Microsoft AZ-700 Practice Test 1

Question 1

A CDN-enabled app serves outdated pricing pages for hours after prices change in the origin database. What should the Azure network engineer do?

Adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses.
Deploy an appropriate Azure Front Door profile with routes, origin groups, endpoints, and health probes.
Configure Front Door rules sets and route options to apply the approved redirects and URL rewrites.
Configure Front Door origin groups and routes with appropriate priority and latency-based traffic distribution.

Explanation

Correct Answer

Edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data.

Incorrect Answers

For this question, edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data.

For this finding, edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data.

Here, edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data.

Question 2

A peered VNet retains a default address range that duplicates an on-premises production prefix, and routing fails after VPN connection. Which response best addresses this Azure networking scenario?

Use supported service tags where appropriate and review service scope instead of freezing changing platform address lists.
Resolve the address overlap before deploying peering and hybrid route advertisements into the same connectivity topology.
Investigate subnet IP assignments and available CIDR capacity independently from DNS resolver configuration.
Check supported global or cross-region load-balancing constructs and separate regional address identities where required.

Explanation

Correct Answer

Overlapping advertised prefixes undermine deterministic routing regardless of gateway health.

Incorrect Answers

Here, overlapping advertised prefixes undermine deterministic routing regardless of gateway health.

For this finding, overlapping advertised prefixes undermine deterministic routing regardless of gateway health.

For this question, overlapping advertised prefixes undermine deterministic routing regardless of gateway health.

Question 3

A company seeks lower latency by reducing gateway data-path processing for eligible ExpressRoute workloads. Which response best addresses this Azure networking scenario?

Add diverse eligible circuits and routing failover options across independent connectivity locations.
Evaluate ExpressRoute Direct with supported locations, port capacity, and operational requirements.
Evaluate ExpressRoute FastPath prerequisites and verify which traffic paths the selected gateway and routes support.
Evaluate ExpressRoute Global Reach between eligible circuits and validate location and provider support.

Explanation

Correct Answer

FastPath can bypass parts of a supported gateway data path but is not automatically available for all circuit configurations.

Incorrect Answers

Adding diverse eligible circuits and routing failover options across independent connectivity locations would not meet the need for ExpressRoute FastPath gateway bypass.

Here, fastPath can bypass parts of a supported gateway data path but is not automatically available for all circuit configurations.

Evaluating ExpressRoute Global Reach between eligible circuits and validating location and provider support would not meet the need for ExpressRoute FastPath gateway bypass.

Question 4

An organization acquires a partner whose 10.20.0.0/16 network overlaps a planned Azure hub, making peering routes ambiguous. An operator tries to place an Azure VPN gateway in an ordinary shared application subnet named AppServers. What is the most appropriate plan for this situation?

Redesign the Azure address plan using nonoverlapping prefixes and coordinate any required network translation before connecting the environments; provision a dedicated GatewaySubnet with the required size and attach the virtual network gateway to that supported subnet.
Provision a dedicated GatewaySubnet with the required size and attach the virtual network gateway to that supported subnet; do not Redesign the Azure address plan using nonoverlapping prefixes and coordinate any required network translation before connecting the environments.
Configure the service's supported subnet delegation and check whether other intended resources can share that subnet; provision a dedicated GatewaySubnet with the required size and attach the virtual network gateway to that supported subnet.
Redesign the Azure address plan using nonoverlapping prefixes and coordinate any required network translation before connecting the environments; Expand or redesign the VNet address space and reserve appropriately sized nonoverlapping subnets before deploying new services.

Explanation

Correct Answer

Peering and VPN routing cannot disambiguate overlapping private destinations without a deliberate addressing or translation plan. Azure virtual network gateways rely on the specially named GatewaySubnet, not an arbitrary application segment. Both actions are needed.

Incorrect Answers

This plan leaves out a required action: Redesign the Azure address plan using nonoverlapping prefixes and coordinate any required network translation before connecting the environments. The remaining action alone does not satisfy the situation.

Peering and VPN routing cannot disambiguate overlapping private destinations without a deliberate addressing or translation plan.

Azure virtual network gateways rely on the specially named GatewaySubnet, not an arbitrary application segment.

Question 5

A backend pool is configured for HTTP/2-only application traffic while the gateway's supported backend mode differs from the client-side protocol expectation. A regional Application Gateway deployment includes several separate backends but fails requests after a subnet routing change inserts an unsupported forced tunnel. Which course of action addresses the stated issues?

Verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration; validate Application Gateway subnet and routing restrictions and repair the effective required control-plane and backend paths.
Validate Application Gateway subnet and routing restrictions and repair the effective required control-plane and backend paths; do not verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration.
Verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration; use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname.
Configure supported cookie-based affinity where suitable and redesign session state for failover resilience; validate Application Gateway subnet and routing restrictions and repair the effective required control-plane and backend paths.

Explanation

Correct Answer

A gateway's client-facing protocol does not automatically imply identical protocol negotiation toward the backend. An Application Gateway still depends on documented networking prerequisites, including compatible routing through its subnet. Both actions are needed.

Incorrect Answers

This plan leaves out a required action: Verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration. The remaining action alone does not satisfy the situation.

An Application Gateway still depends on documented networking prerequisites, including compatible routing through its subnet.

A gateway's client-facing protocol does not automatically imply identical protocol negotiation toward the backend.

Question 6

A gateway terminates TLS from public clients, but the security policy requires HTTPS encryption to remain on the backend hop. A gateway must add an X-Forwarded custom header for upstream application diagnostics without changing application binaries. Which response best addresses these needs?

Configure HTTPS backend settings with appropriate certificate trust and end-to-end TLS validation; configure a supported Application Gateway rewrite rule set and verify the forwarded request headers.
Review listener and rule priorities and verify path-match precedence before committing the correction; configure a supported Application Gateway rewrite rule set and verify the forwarded request headers.
Configure HTTPS backend settings with appropriate certificate trust and end-to-end TLS validation; correct backend hostname and trusted certificate settings and retest the Application Gateway health probe.
Configure a supported Application Gateway rewrite rule set and verify the forwarded request headers; do not configure HTTPS backend settings with appropriate certificate trust and end-to-end TLS validation.

Explanation

Correct Answer

Frontend TLS termination alone does not guarantee that the gateway-to-origin hop is encrypted. Gateway rewrite rules modify eligible HTTP metadata without requiring changes to every backend service. Both actions are needed.

Incorrect Answers

Frontend TLS termination alone does not guarantee that the gateway-to-origin hop is encrypted.

Gateway rewrite rules modify eligible HTTP metadata without requiring changes to every backend service.

This plan leaves out a required action: Configure HTTPS backend settings with appropriate certificate trust and end-to-end TLS validation. The remaining action alone does not satisfy the situation.

Question 7

A financial services company requires private dedicated connectivity to Azure with predictable provider interconnection instead of an internet VPN. A circuit's provider reports ready, but BGP sessions do not establish because the configured peer ASN and VLAN values disagree. What is the most appropriate plan for this situation?

Align the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration; do not design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration.
Configure Azure private peering and the applicable VNet gateway or direct connectivity model; align the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration.
Design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration; create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit.
Design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration; align the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration.

Explanation

Correct Answer

ExpressRoute uses private connectivity arrangements distinct from encrypted internet VPN tunnels. ExpressRoute service provisioning and route exchange are separate milestones with strict peering parameters. Both actions are needed.

Incorrect Answers

This plan leaves out a required action: Design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration. The remaining action alone does not satisfy the situation.

ExpressRoute uses private connectivity arrangements distinct from encrypted internet VPN tunnels.

ExpressRoute service provisioning and route exchange are separate milestones with strict peering parameters.

Question 8

Multiple Azure Firewalls should share a baseline threat and network rule policy while allowing one region's justified exceptions. A team requires advanced threat protection, URL filtering and supported TLS inspection but selects Azure Firewall Basic for the production design. An organization creates a secured Virtual WAN hub but assumes adding an ordinary VNet firewall appliance automatically integrates with hub routing intent. Which course of action addresses the stated issues?

Use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities; update and associate approved route tables or secured hub routing intent and confirm packets traverse the firewall; and deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections.
Use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities; select an appropriate Azure Firewall Premium tier after validating required advanced security features; and deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections.
Use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities; select an appropriate Azure Firewall Premium tier after validating required advanced security features; and update and associate approved route tables or secured hub routing intent and confirm packets traverse the firewall.
Update and associate approved route tables or secured hub routing intent and confirm packets traverse the firewall; select an appropriate Azure Firewall Premium tier after validating required advanced security features; and deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections.

Explanation

Correct Answer

Central policy inheritance can standardize controls without copying every rule by hand into each firewall. Azure Firewall SKUs differ in supported advanced inspection and security capabilities. A secured virtual hub has supported managed integration steps distinct from placing any VM in a peered subnet. Each decision addresses a separate requirement.

Incorrect Answers

Two actions meet their requirements, but action 2 misses this need: azure Firewall SKUs differ in supported advanced inspection and security capabilities.

Two actions meet their requirements, but action 3 misses this need: a secured virtual hub has supported managed integration steps distinct from placing any VM in a peered subnet.

Two actions meet their requirements, but action 1 misses this need: central policy inheritance can standardize controls without copying every rule by hand into each firewall.

Question 9

A VM database subnet must accept TCP 1433 only from the approved application subnet, but an NSG rule allows every source prefix. Which response most directly resolves the issue?

Use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules.
Check effective NSG rules across subnet and NIC scopes before changing unrelated Azure Firewall policies.
Reorder or narrow the higher-priority matching NSG rule and validate the effective security evaluation.
Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority.

Explanation

Correct Answer

NSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted.

Incorrect Answers

For this finding, nSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted.

For this question, nSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted.

Here, nSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted.

Question 10

A backend API needs a nonstandard HTTP port and the gateway reports connection failures though client port 443 is healthy. An application routes by hostname but uses a generic probe that targets the wrong virtual host and marks every endpoint down. What is the most appropriate plan for this situation?

Configure probes with the intended host header and path and validate the origin's virtual host behavior; do not Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener.
Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; configure probes with the intended host header and path and validate the origin's virtual host behavior.
Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; update backend pool membership and probe configuration and verify traffic distribution from client requests.
Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; configure probes with the intended host header and path and validate the origin's virtual host behavior.

Explanation

Correct Answer

Frontend and backend ports are independent settings in an application-layer proxy. HTTP virtual hosting can return different health responses depending on the Host header sent by the probe. Both actions are needed.

Incorrect Answers

This plan leaves out a required action: Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener. The remaining action alone does not satisfy the situation.

HTTP virtual hosting can return different health responses depending on the Host header sent by the probe.

Frontend and backend ports are independent settings in an application-layer proxy.

Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests

Microsoft AZ-700 Practice Test 1 - 10 Questions (Last Reviewed 09-Nov-2026)
Microsoft AZ-700 Practice Test 2 - 10 Questions (Last Reviewed 08-Nov-2026)
Microsoft AZ-700 Practice Test 3 - 10 Questions (Last Reviewed 07-Nov-2026)

Pass Your Microsoft AZ-700 Exam Easy!

Question 1

Explanation

Correct Answer

Incorrect Answers

Question 2

Explanation

Correct Answer

Incorrect Answers

Question 3

Explanation

Correct Answer

Incorrect Answers

Question 4

Explanation

Correct Answer

Incorrect Answers

Question 5

Explanation

Correct Answer

Incorrect Answers

Question 6

Explanation

Correct Answer

Incorrect Answers

Question 7

Explanation

Correct Answer

Incorrect Answers

Question 8

Explanation

Correct Answer

Incorrect Answers

Question 9

Explanation

Correct Answer

Incorrect Answers

Question 10

Explanation

Correct Answer

Incorrect Answers

Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests