Free Microsoft AZ-700 Practice Test | Azure Networking

Microsoft AZ-700 Practice Test

Preparing for the Microsoft AZ-700 practice test becomes much easier when you understand how Azure networking services work together instead of memorizing isolated definitions. AZ-700, Designing and Implementing Microsoft Azure Networking Solutions, supports the Microsoft Certified: Azure Network Engineer Associate credential. Candidates are expected to plan, implement, manage, secure, monitor, and troubleshoot Azure networking solutions. You can Discover your next certification practice test while using Microsoft Learn as your main source for the current skills measured. A well-designed AZ-700 practice test helps you apply networking knowledge to realistic Azure scenarios, compare services, identify configuration requirements, and improve your decision-making before the real assessment.

This guide follows Microsoft’s official AZ-700 study guide and its skills measured as of July 27, 2026. Microsoft describes the intended candidate as an Azure network engineer with experience in core network infrastructure, hybrid connectivity, application delivery, private access to Azure services, and network security. The role also involves optimizing performance, resiliency, scale, and security while monitoring environments and resolving connectivity issues.

What Does the AZ-700 Practice Test Cover?

An AZ-700 practice test checks whether you can select, configure, and troubleshoot the right Azure networking service for a business requirement. It should include direct technical questions as well as scenarios involving multiple services.

For example, a question might describe two Azure virtual networks that need private communication, an on-premises network that must connect to Azure, a globally distributed application that requires fast delivery, or a storage account that must not be exposed through a public endpoint. Your task is to identify the correct design and understand why it fits the stated requirements.

Good preparation should help you:

• design address spaces and subnet structures;
• configure virtual networks, peering, routes, and DNS;
• compare site-to-site VPN, point-to-site VPN, ExpressRoute, and Virtual WAN;
• select the appropriate Azure load-balancing or application-delivery service;
• use Private Link, private endpoints, and service endpoints correctly;
• apply network security groups, Azure Firewall, and Web Application Firewall;
• monitor network health and diagnose connectivity failures;
• recognize service limitations, dependencies, and high-availability options.

The emphasis is on making correct design and implementation choices. Simply knowing that a service exists is not enough. You need to understand where it operates, what problem it solves, how it is configured, and how it differs from similar services.

Official Microsoft AZ-700 Domains and Weightings

Microsoft lists five skills-measured domains for AZ-700. These ranges show the approximate share of questions associated with each area, although Microsoft notes that related topics can also appear.

These percentages show why core infrastructure and connectivity deserve significant study time. However, the lower-weighted private-access domain should not be ignored. It includes concepts such as private endpoints and DNS integration that are often connected to broader security and hybrid-networking scenarios.

Domain 1: Design and Implement Core Networking Infrastructure — 25–30%

This is the largest domain and forms the foundation for the rest of the exam. It covers IP addressing, name resolution, VNet connectivity, routing, and network monitoring.

IP addressing for Azure resources

You should know how to plan network segmentation and non-overlapping address spaces. Practice creating virtual networks and selecting subnet sizes that allow room for expected growth. Some Azure services require dedicated subnets, while others use subnet delegation or can share a subnet under supported conditions.

Microsoft specifically expects candidates to plan subnets for services such as virtual network gateways, private endpoints, service endpoints, Azure Firewall, Application Gateway, Azure Bastion, and VNet-integrated platform services. Practice questions may test which service needs a dedicated subnet, how large that subnet should be, or why a proposed design creates an address conflict.

Also review public IP addresses, public IP prefixes, and custom IP prefixes. Understand when a predictable group of public addresses is useful and how bring-your-own-IP planning differs from creating a standard public IP resource.

Azure name resolution

DNS is central to many AZ-700 scenarios. You should understand Azure-provided name resolution, custom DNS servers, public Azure DNS zones, and private DNS zones.

Be able to explain how a private DNS zone is linked to a VNet and how records can resolve across connected networks. Study Azure DNS Private Resolver, including inbound and outbound endpoints and forwarding rulesets. A private endpoint question can also become a DNS question because the client must resolve the service name to its private IP address.

VNet connectivity and routing

Review local and global VNet peering, peering settings, gateway transit, and service chaining. Learn how system routes differ from user-defined routes and how route selection works. You should understand when forced tunneling is required and how a route table is associated with a subnet.

Microsoft’s current outline also includes Azure Virtual Network Manager for managing connectivity at scale, Azure Route Server for dynamic route exchange, and Azure NAT Gateway for controlled outbound connectivity. Focus on the business requirement behind each service rather than treating them as interchangeable.

Routing questions often provide several routes and ask where traffic will go. Practice reading address prefixes, next-hop types, and route priorities. When troubleshooting, verify effective routes, peering status, appliance forwarding, and return paths.

Monitoring and troubleshooting networks

The monitoring section includes Azure Network Watcher, Azure Monitor for Networks, diagnostics, logs, DDoS protection monitoring, and selected Microsoft Defender for Cloud recommendations.

Learn when to use tools such as connection troubleshoot, IP flow verify, next hop, packet capture, topology, and flow logs. Microsoft’s July 2026 objectives also reference Defender for Cloud Secure Score, attack path analysis, and Cloud Security Explorer for identifying network resources and security recommendations.

In practice questions, first identify whether the problem concerns DNS, routing, security rules, gateway connectivity, or service health. Then choose the diagnostic tool that directly examines that layer.

Domain 2: Design, Implement, and Manage Connectivity Services — 20–25%

This domain covers hybrid and remote connectivity through site-to-site VPN, point-to-site VPN, ExpressRoute, Azure Virtual WAN, and related services.

Site-to-site VPN

A site-to-site VPN connects networks over encrypted IPsec/IKE tunnels. Study virtual network gateways, local network gateways, gateway SKUs, active-active configurations, high availability, and custom IPsec/IKE policies.

You should understand route-based and policy-based VPNs and know why route-based VPNs support more flexible scenarios. Practice identifying the Azure object that represents the on-premises VPN device and address prefixes. Also review Azure Extended Network as listed in Microsoft’s current skills outline.

Troubleshooting questions may involve mismatched shared keys, incompatible IPsec parameters, incorrect address prefixes, gateway provisioning, Border Gateway Protocol settings, or problems with the on-premises device.

Point-to-site VPN

Point-to-site VPN provides individual clients with secure access to an Azure VNet. Learn gateway SKU requirements, tunnel types, client configuration, and authentication choices.

Microsoft expects candidates to work with certificate authentication, RADIUS, and Microsoft Entra ID where supported. You should be able to choose a method based on central identity requirements and client compatibility. Review common client-side, certificate, and authentication problems, as well as the Azure requirements for Always On VPN and Azure Network Adapter.

Azure ExpressRoute

ExpressRoute provides private connectivity between an organization and Microsoft cloud services through a connectivity provider. It does not simply mean an encrypted VPN over the public internet.

Study connectivity models, SKUs, tiers, circuit provisioning, private peering, Microsoft peering, route advertisements, gateways, and circuit-to-VNet connections. Understand ExpressRoute Direct, FastPath, Global Reach, encryption options, Bidirectional Forwarding Detection, redundancy, cross-region connectivity, and disaster-recovery considerations.

Scenario questions often require a choice between VPN and ExpressRoute. Look for clues involving private connectivity, predictable performance, bandwidth, resiliency, cost, encryption, and speed of deployment.

Azure Virtual WAN

Azure Virtual WAN provides a managed networking service for branch, remote-user, and VNet connectivity through virtual hubs. Review Standard and Basic capabilities, hub routing, gateway deployment, scale units, secure hubs, and third-party network virtual appliance integration.

Learn how Virtual WAN simplifies large connectivity designs compared with manually building many individual hub-and-spoke relationships. A question may test whether the requirement is centralized global transit, branch connectivity, remote users, or integrated security.

After completing the connectivity topics, you can Browse Microsoft practice tests by certification track to continue building skills for other Microsoft credentials.

Domain 3: Design and Implement Application Delivery Services — 15–20%

This domain examines how Azure distributes traffic and delivers applications. The main services are Azure Load Balancer, Traffic Manager, Application Gateway, and Azure Front Door.

Azure Load Balancer and Traffic Manager

Azure Load Balancer operates at Layer 4 and distributes TCP or UDP traffic. Understand public and internal load balancers, regional and cross-region designs, health probes, backend pools, load-balancing rules, inbound NAT rules, outbound rules, SNAT behavior, SKUs, tiers, and Gateway Load Balancer.

Traffic Manager is a DNS-based global traffic-distribution service. Because it works through DNS responses, it does not proxy application traffic in the same way as Azure Front Door. Learn its routing methods and the importance of endpoint health.

When comparing services, identify the traffic type, processing layer, scope, and required features. A global web application needing HTTP acceleration and Web Application Firewall protection has different needs from a regional TCP workload.

Azure Application Gateway

Application Gateway is a regional Layer 7 web traffic load balancer. Study listeners, backend pools, health probes, routing rules, HTTP settings, TLS termination, end-to-end TLS, autoscaling, and rewrite rule sets.

You should be able to identify when path-based or host-based routing is useful. Also understand the relationship between Application Gateway and Web Application Firewall. Practice interpreting a design in which multiple sites or application paths share one gateway.

Azure Front Door

Azure Front Door is a global application-delivery service for HTTP and HTTPS workloads. Review profiles, tiers, endpoints, origins, origin groups, routing, caching, acceleration, health probes, TLS, rule sets, URL rewrite, URL redirect, and origin security.

Microsoft specifically includes securing an origin with Azure Private Link. Understand how this reduces direct public exposure while allowing Front Door to reach the origin privately.

For comparison questions, remember the main scopes: Application Gateway is regional, Front Door is global, Load Balancer provides Layer 4 distribution, and Traffic Manager makes DNS-based routing decisions.

Domain 4: Design and Implement Private Access to Azure Services — 10–15%

This domain focuses on accessing platform services without relying on unrestricted public connectivity.

Private Link services and private endpoints

A private endpoint places a network interface with a private IP address in a VNet to provide private access to a supported Azure service. The service can be Microsoft-managed, customer-owned, or partner-provided.

Study how to plan and create private endpoints, configure access, integrate them with DNS, and support on-premises clients. DNS is especially important: the service name must resolve to the private endpoint address for private traffic to work as intended.

Azure Private Link service allows a provider to expose a service privately to consumers. Understand the provider and consumer sides of the design, approval workflows, network address translation considerations, and integration with a Standard Load Balancer.

Service endpoints

Service endpoints extend the identity of a VNet subnet to supported Azure services. They do not place the service itself inside the VNet. Learn how to enable an endpoint, restrict access through service firewall rules, and apply service endpoint policies.

Practice comparing service endpoints with private endpoints. A service endpoint still reaches the service’s public endpoint over the Azure backbone, whereas a private endpoint gives the service a private IP presence within the VNet. Requirements involving on-premises access, private DNS, data-exfiltration controls, cost, or simple subnet-based restriction can influence the choice.

Domain 5: Design and Implement Azure Network Security Services — 15–20%

This domain covers controls that filter, inspect, and protect network traffic.

Network security groups and application security groups

Network security groups contain inbound and outbound rules that can be associated with subnets or network interfaces. Learn priorities, source and destination fields, protocols, ports, default rules, stateful behavior, and effective security rules.

Application security groups let you group virtual machine network interfaces by application role and use those groups in NSG rules. This can make policy easier to understand than maintaining individual IP addresses.

The current outline includes virtual network flow logs, flow-log interpretation, IP flow verification, remote administration with Azure Bastion, and network security management through Azure Virtual Network Manager. Practice questions may ask why traffic is allowed or denied when multiple NSGs apply.

Azure Firewall and Firewall Manager

Azure Firewall is a managed, stateful network security service. Study Firewall SKUs, deployment architectures, network rules, application rules, destination network address translation rules, threat intelligence, policy hierarchy, forced tunneling, and DNS-related behavior.

Azure Firewall Manager provides centralized security policy and routing management. Understand secured virtual hubs and how Azure Firewall can be deployed in a Virtual WAN hub. When a scenario includes multiple regions, hubs, or firewalls, centralized policy may be an important clue.

Web Application Firewall

Web Application Firewall protects HTTP and HTTPS applications from common web attacks. For AZ-700, focus on WAF with Application Gateway and Azure Front Door.

Know the difference between detection and prevention modes, managed rule sets, custom rules, exclusions, policies, and policy association. A WAF is designed for web-layer threats; it does not replace an NSG or Azure Firewall for every network-security requirement.

How to Use AZ-700 Practice Questions Effectively

Start with a mixed diagnostic assessment. Do not worry about the first score. Use it to discover which domains require the most attention. Record every incorrect answer and every correct answer that involved guessing.

For each missed question, write down:

1. the Microsoft objective being tested;
2. the requirement or clue you overlooked;
3. why the correct service or configuration fits;
4. why your selected option does not fit;
5. one related task to perform in an Azure lab.

This process converts a mistake into a study action. If you miss a question about private endpoint name resolution, for example, review the private DNS design and then build a small lab that links a private DNS zone to a VNet.

Avoid repeating the same question set until you memorize its wording. After reviewing a topic, use a fresh scenario or change the design requirements yourself. Real understanding means you can solve the problem even when the resources, regions, protocols, or constraints change.

A Six-Week AZ-700 Study Structure

Week 1: Core network foundations

Review VNets, subnets, IP planning, public IP resources, peering, user-defined routes, and NAT Gateway. Build a small multi-VNet environment and inspect effective routes.

Week 2: DNS and monitoring

Work with public and private DNS zones, VNet links, DNS Private Resolver concepts, Network Watcher, and Azure Monitor for Networks. Practise selecting the correct diagnostic tool for different failures.

Week 3: Hybrid and remote connectivity

Study site-to-site and point-to-site VPNs, gateway SKUs, authentication, ExpressRoute, routing, and Virtual WAN. Create comparison notes based on requirements rather than product descriptions.

Week 4: Application delivery

Compare Load Balancer, Traffic Manager, Application Gateway, and Front Door. Practise mapping regional versus global, Layer 4 versus Layer 7, and proxy versus DNS-based requirements.

Week 5: Private access and security

Review private endpoints, Private Link service, service endpoints, NSGs, ASGs, Azure Firewall, Firewall Manager, WAF, DDoS protection, and Bastion.

Week 6: Mixed practice and targeted review

Complete timed practice sets, score results by domain, revisit weak objectives, and repeat selected labs. Review Microsoft’s current study guide again to ensure no objective has been missed.

Learning Advantages Included in Your Preparation

This student-focused heading replaces the repeated “What you get when you prepare with us” wording while keeping its intended meaning.

Structured AZ-700 preparation provides more than a collection of questions. It gives you a way to connect networking requirements with Azure services and to measure progress by objective. Useful benefits include:

• coverage aligned with Microsoft’s current five exam domains;
• scenario-based practice that develops design judgment;
• explanations that clarify why similar Azure services differ;
• targeted revision based on domain-level performance;
• practice with routing, DNS, connectivity, security, and troubleshooting decisions;
• improved speed when identifying the important clue in a long scenario;
• better confidence through repeated application and hands-on validation.

A quality practice resource should explain each answer in direct language and avoid unsupported claims about real exam content. You can Discover practice resources for ambitious learners in the middle of your preparation journey while continuing to rely on Microsoft Learn and hands-on Azure experience for authoritative technical understanding.

Common AZ-700 Mistakes to Avoid

One common mistake is choosing a service because its name sounds related to the scenario without checking its scope or network layer. For example, Azure Load Balancer, Traffic Manager, Application Gateway, and Front Door all distribute traffic, but they do so differently.

Another mistake is overlooking DNS. Private endpoints, hybrid networks, and multi-VNet designs often fail when names resolve to the wrong address. Similarly, a correct forward route does not guarantee connectivity if the return route is missing.

Students also confuse service endpoints with private endpoints, assume NSGs inspect application content, or use WAF as a general network firewall. Review the purpose and boundaries of each control.

Finally, do not study only through reading. AZ-700 requires practical familiarity with configuration and troubleshooting. Even small labs can make routing, peering, health probes, security rules, and private access much easier to understand.

Frequently Asked Questions

What is the full name of AZ-700?

The official title is Exam AZ-700: Designing and Implementing Microsoft Azure Networking Solutions. Passing it supports the Microsoft Certified: Azure Network Engineer Associate certification.

Which AZ-700 domain has the highest weighting?

Design and implement core networking infrastructure has the highest published range at 25–30%. It includes IP addressing, DNS, VNet connectivity, routing, and monitoring.

Are the AZ-700 domains current?

The domains in this guide follow Microsoft’s official skills measured as of July 27, 2026. Microsoft can update exams, so candidates should check the official study guide before scheduling and again shortly before taking the assessment.

Does AZ-700 require hands-on Azure experience?

Microsoft recommends training and hands-on experience. Candidates should already have experience creating and managing Azure compute, storage, and networking resources and should understand networking fundamentals such as protocols, name resolution, and address management.

How should I compare similar Azure networking services?

Compare them by traffic type, layer, scope, routing method, security features, resiliency, integration options, and cost. Then choose the service that meets every stated requirement with the least unnecessary complexity.

Can practice tests replace Microsoft Learn?

No. Practice tests are useful for checking knowledge and identifying gaps, but Microsoft Learn, official Azure documentation, and hands-on labs should remain central to preparation.

How can I measure readiness?

Track your scores separately for all five domains. You should also be able to explain your service choice, reject plausible alternatives, and complete common networking tasks without depending entirely on step-by-step notes.