Microsoft AZ-700: Designing and Implementing Microsoft Azure Networking Solutions

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Network security and monitoring

   A security team wants to block traffic to a set of Azure service endpoints from a specific subnet unless the traffic comes from approved sources. Which control is most appropriate?

   1. ANetwork security group rules with service tags and a firewall policy on the subnet
   2. BNo controls are needed because Azure services are secured by default
   3. CRemoving every routing entry from the subnet route table and its next hops
   4. DDisabling DNS resolution for the subnet by turning off the Azure-provided DNS
   Show answer and explanationHide answer

   Correct answer: A

   NSG rules with service tags and firewall policies control traffic to Azure services from a subnet. The other options do not provide targeted filtering and some break connectivity.

2. Question 2Connectivity services

   A company connects its on-premises network to Azure with a site-to-site VPN and needs high availability for the gateway. Which configuration should be chosen?

   1. AA public IP on each on-premises server that connects directly to the Azure VPN gateway
   2. BAn active-active VPN gateway with two public IP addresses and redundant tunnels
   3. CNo VPN gateway is deployed, and traffic relies on a single internet connection over one router
   4. DA single VPN gateway with a basic SKU that provides one active instance and one public IP
   Show answer and explanationHide answer

   Correct answer: B

   An active-active gateway with two public IPs and redundant tunnels provides high availability for site-to-site connectivity. A basic single gateway and no gateway do not provide that resilience.

3. Question 3Core networking infrastructure

   A team creates a virtual network with address space 10.1.0.0/16 and needs a subnet for 500 virtual machines. Which subnet size is the smallest that meets the requirement, considering Azure reserves five addresses per subnet?

   1. A10.1.0.0/22
   2. B10.1.0.0/24
   3. C10.1.0.0/23
   4. D10.1.0.0/25
   Show answer and explanationHide answer

   Correct answer: C

   A /23 provides 512 addresses, leaving 507 usable after the five reserved addresses, which covers 500 VMs. A /24 gives only 251 usable addresses, and a /25 is smaller still.

4. Question 4Application delivery and private access

   A web application running on VMs in two regions must route users to the nearest healthy region with TLS termination and WAF protection. Which service should be used?

   1. AAn internal Standard load balancer with a private frontend IP in a region
   2. BAzure Load Balancer Standard in a single region with health probes
   3. CAzure Front Door with a WAF policy and health probes to origins
   4. DA public IP on each VM with its own NSG-protected inbound rules for HTTPS
   Show answer and explanationHide answer

   Correct answer: C

   Front Door provides global HTTP routing, health probing, TLS termination and WAF integration across regions. A regional load balancer does not provide global routing, and internal balancers are not reachable from the internet.

5. Question 5Network security and monitoring

   A network engineer needs to verify whether an NSG is blocking traffic between two VMs during an incident. Which tool gives the most direct answer?

   1. AAzure Policy compliance dashboard
   2. BAzure Cost Management
   3. CAzure Advisor recommendations
   4. DNetwork Watcher IP flow verify
   Show answer and explanationHide answer

   Correct answer: D

   IP flow verify tests whether a specific packet is allowed or denied and names the NSG rule. Advisor, cost tools and policy dashboards do not test traffic paths.