AZ-700 Azure Network Engineer Associate Practice Questions with Explanations

Free AZ-700 Azure Network Engineer Associate practice questions with an explanation for every answer. Covers virtual networks, hybrid connectivity, VPN and ExpressRoute, load balancing, Azure DNS, and network security.

148 questions · Cloud Computing · by Study Foxy

Study these questions free

Questions

  1. How many usable IP addresses does a /26 subnet provide in Azure?

    • 59
    • 62
    • 64
    • 58

  2. Which address does Azure reserve at the start of every subnet for the default gateway?

    • The first usable address (x.x.x.1)
    • The last address (x.x.x.255)
    • The middle address of the subnet's address range
    • No address is reserved for it

  3. What must the subnet for a VPN or ExpressRoute gateway be named?

    • GatewaySubnet
    • VpnGatewaySubnet
    • AzureGatewaySubnet
    • RouteServerSubnet

  4. What size does Microsoft recommend for GatewaySubnet to allow future growth and coexistence?

    • /27 or larger
    • /29
    • /30
    • /32

  5. What must the subnet for Azure Firewall be named?

    • AzureFirewallSubnet
    • FirewallSubnet
    • GatewaySubnet
    • AzureBastionSubnet

  6. What size must AzureFirewallSubnet be?

    • /26
    • /29
    • /28
    • /30

  7. Which resources can share a subnet with an Application Gateway v2?

    • Only other Application Gateways
    • Any VMs in the same VNet
    • Azure Firewall instances
    • VMs in the backend pool of the same gateway

  8. What does subnet delegation do?

    • Lets a specific Azure service deploy its resources into the subnet
    • Assigns a subnet to a different Entra tenant
    • Moves a subnet and its resources to another subscription and tenant
    • Copies NSG rules to every subnet in the VNet

  9. Azure SQL Managed Instance is being deployed. What does its subnet require?

    • A dedicated subnet delegated to SQL Managed Instance
    • A shared subnet with web VMs
    • The GatewaySubnet
    • A shared subnet with no route table and no NSG attached

  10. A partner must allow-list your outbound IPs, and you'll add more resources over time. What should you create?

    • A public IP address prefix
    • A Basic SKU public IP per VM
    • A private DNS zone
    • An application security group

  11. A company wants to use its own registered public IP range in Azure to keep existing allow-lists. What should you implement?

    • A custom IP address prefix (BYOIP)
    • A public IP address prefix from Azure
    • A NAT gateway with Azure-assigned IPs
    • A private endpoint for each service

  12. Which statement about Standard SKU public IP addresses is correct?

    • They're static and can be zone-redundant
    • They're always dynamically assigned
    • They allow all inbound traffic by default
    • They can't be used with load balancers

  13. A VNet must connect to an on-premises network that uses 10.0.0.0/16. Which VNet address space avoids problems?

    • 10.1.0.0/16
    • 10.0.0.0/16
    • 10.0.128.0/17
    • 10.0.0.0/8

  14. What is the IP address of the Azure-provided DNS service and platform endpoint?

    • 168.63.129.16
    • 169.254.169.254
    • 10.0.0.1
    • 8.8.8.8

  15. You change a VNet's DNS servers to custom ones. When do existing VMs start using them?

    • After a DHCP lease renewal or VM restart
    • Immediately, with no other action
    • Only after the VNet is recreated
    • Only after the VMs are redeployed to a new subnet

  16. On-premises servers must resolve names in Azure private DNS zones without running DNS VMs in Azure. What should you deploy?

    • An Azure DNS Private Resolver inbound endpoint
    • A public DNS zone in Azure DNS
    • An outbound endpoint only
    • A conditional forwarder to 168.63.129.16 on-prem

  17. Azure VMs must resolve names in an on-premises domain. Which DNS Private Resolver components do you use?

    • An outbound endpoint and a DNS forwarding ruleset
    • An inbound endpoint only
    • A public DNS zone with NS records for the on-premises domain
    • A private endpoint for DNS

  18. What do DNS Private Resolver inbound and outbound endpoints require?

    • Dedicated subnets delegated to the resolver
    • The GatewaySubnet
    • AzureBastionSubnet
    • A shared subnet that also hosts the DNS client VMs

  19. VMs in a VNet should automatically get A records in a private DNS zone when created. What do you configure?

    • A virtual network link with autoregistration enabled
    • A public DNS zone with an alias record set for each VM
    • An NS delegation at the domain registrar
    • A Private Link service for the zone

  20. A team should manage dev.contoso.com while contoso.com stays with central IT in Azure DNS. What do you configure?

    • A child zone, delegated with NS records in the parent
    • A CNAME record pointing dev at the parent zone
    • A second contoso.com zone created in the team's own subscription
    • An alias record on the parent zone's apex

  21. Spoke VNets must route through a VPN gateway in the hub. Which peering settings do you use?

    • Allow gateway transit on the hub, use remote gateways on spokes
    • Use remote gateways on the hub, allow transit on spokes
    • Enable forwarded traffic on the spokes and disable it on the hub
    • Disable VNet access on both sides of the peering

  22. Traffic from a spoke passes through an NVA in the hub to reach another spoke. Which peering setting must allow it on the receiving side?

    • Allow forwarded traffic
    • Use remote gateways
    • Allow gateway transit
    • Disable virtual network access

  23. You manage 80 VNets and want hub-and-spoke peering created and kept in sync automatically. What should you use?

    • Azure Virtual Network Manager connectivity configurations
    • Manual peering in the portal for each VNet
    • A Traffic Manager profile per region with nested endpoints
    • Application security groups

  24. How can Azure Virtual Network Manager add VNets to a network group automatically?

    • Dynamic membership using Azure Policy conditions
    • Tags read by Traffic Manager
    • Peering requests that each VNet owner sends to the network manager
    • DNS records in a private zone

  25. Which route source wins when a UDR, a BGP route, and a system route all have the same prefix?

    • The user-defined route
    • The BGP route
    • The system route
    • The most recently added route

  26. All internet-bound traffic from Azure must go back to the on-premises network for inspection. What is this called?

    • Forced tunneling
    • Split tunneling
    • Gateway transit
    • Service chaining

  27. How can you implement forced tunneling over a site-to-site VPN?

    • Advertise or route 0.0.0.0/0 to the VPN gateway
    • Add an NSG rule that denies Internet outbound on every subnet
    • Remove the public IP from the VPN gateway
    • Enable allow forwarded traffic on peering

  28. NVAs should exchange routes with a VNet using BGP instead of manually maintained UDRs. What should you deploy?

    • Azure Route Server
    • Azure DNS Private Resolver
    • A NAT gateway
    • Azure Virtual Network Manager

  29. What must the subnet for Azure Route Server be named?

    • RouteServerSubnet
    • GatewaySubnet
    • AzureRouteSubnet
    • BgpSubnet

  30. Private VMs need outbound internet access through a fixed set of IPs, and existing load balancer outbound rules are running out of SNAT ports. What should you implement?

    • A NAT gateway on the subnet
    • An inbound NAT rule
    • A private endpoint
    • An application security group

  31. A subnet has a NAT gateway and its VMs also sit behind a load balancer with outbound rules. Which handles outbound internet traffic?

    • The NAT gateway
    • The load balancer outbound rules
    • Whichever was created first
    • Neither; outbound is blocked

  32. About how many SNAT ports does each public IP on a NAT gateway provide?

    • 64,512
    • 1,024
    • 8,000
    • 256

  33. Which direction of traffic does Azure NAT Gateway handle?

    • Outbound connections only
    • Inbound connections only
    • Both inbound and outbound
    • Only traffic between VNets

  34. Which Network Watcher tool checks connectivity from a VM to an endpoint and reports where the path breaks?

    • Connection troubleshoot
    • Topology
    • Packet capture
    • Traffic analytics

  35. A VM can't reach an on-premises subnet. Which view shows all routes applied to its NIC, including BGP and UDRs?

    • Effective routes
    • Effective security rules
    • IP flow verify
    • Activity log

  36. Which flow logging type is the current recommendation, replacing NSG flow logs?

    • Virtual network flow logs
    • Activity log diagnostics
    • Storage analytics logs
    • Boot diagnostics logs

  37. Which feature turns flow log data into maps and charts of traffic hot spots and threats?

    • Traffic analytics
    • Azure Advisor
    • Connection troubleshoot
    • Effective routes

  38. Which Azure Monitor experience gives a single view of health and metrics across network resources?

    • Network Insights
    • Application Insights
    • VM insights
    • Storage insights

  39. Which DDoS Protection SKU protects all public IPs in VNets linked to a plan?

    • DDoS Network Protection
    • DDoS IP Protection
    • Azure Firewall Basic
    • WAF Prevention mode

  40. Which metric shows whether a public IP is currently under a DDoS attack?

    • Under DDoS attack or not
    • SNAT port usage
    • Data path availability
    • Health probe status

  41. Which Defender for Cloud feature shows how an attacker could chain exposures, such as an internet-exposed VM, to reach critical resources?

    • Attack path analysis
    • Secure Score history
    • Azure Advisor
    • Effective routes

  42. Which Defender for Cloud tool lets you query for resources such as VMs exposed to the internet on port 22?

    • Cloud Security Explorer
    • Network Watcher topology
    • Traffic Manager
    • Azure Resource Mover

  43. You need point-to-site VPN, BGP, and several site-to-site tunnels on one gateway. Which VPN type must you choose?

    • Route-based
    • Policy-based
    • Static-based
    • Peering-based

  44. When is a policy-based VPN gateway appropriate?

    • A legacy on-prem device supports only policy-based IPsec
    • You need point-to-site VPN for remote users
    • You need BGP routing with multiple on-premises sites and failover
    • You need VNet-to-VNet connections

  45. In a site-to-site VPN, what does the local network gateway resource represent?

    • The on-premises VPN device and its address ranges
    • The Azure VPN gateway's public IP and its BGP peer settings
    • The GatewaySubnet route table
    • The Azure VNet's DNS settings

  46. A site-to-site VPN must survive the failure of one Azure gateway instance with minimal interruption. What should you configure?

    • An active-active VPN gateway
    • A policy-based VPN gateway
    • A second local network gateway only
    • A Basic SKU VPN gateway

  47. Which VPN gateway SKUs are designed to be deployed across availability zones?

    • SKUs ending in AZ, such as VpnGw2AZ
    • The Basic SKU only
    • SKUs ending in v1
    • Any SKU in a Basic VNet

  48. Security requires specific encryption and integrity algorithms for a VPN tunnel. What do you configure?

    • A custom IPsec/IKE policy on the connection
    • A WAF policy on the gateway
    • A custom DNS server on the VNet that resolves the on-prem device
    • A route table on the GatewaySubnet

  49. A new site-to-site connection shows Not connected. On-prem says the tunnel fails at authentication. What is the most likely cause?

    • Mismatched shared key (PSK)
    • Too many VMs in the VNet
    • A missing private DNS zone
    • An expired TLS certificate on a web app

  50. Which Network Watcher feature diagnoses VPN gateway and connection problems and collects logs?

    • VPN troubleshoot
    • IP flow verify
    • Traffic analytics
    • Next hop

Showing 50 of 148. Open the quiz to study them all.