MicrosoftProfessional levelAZ-700

AZ-700 exam dumps: 310 free Azure Network Engineer practice questions

Free AZ-700 practice questions for the Designing and Implementing Microsoft Azure Networking Solutions exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 310 by number, or take a timed practice exam.

Question bank last updated May 2025

Start timed practice exam Browse all 310 questions

Free AZ-700 practice questions

Questions 1 to 10 of 310

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

AZ-700 Question 1

Select 2

You are designing a new Azure Virtual Network for a multi-tier application consisting of front-end, business logic, and database subnets. Your on-premises network uses 192.168.0.0/16, and an upcoming project will require site-to-site VPN connectivity between on-premises and Azure. You also plan to deploy domain controllers in the Azure VNet that must have static private IP addresses. Which two design considerations should you implement to avoid address conflicts and ensure optimal IP address management?

A
Use 192.168.0.0/16 for your Azure VNet to match the on-premises address space for easy integration.
B
Choose a non-overlapping address space such as 10.1.0.0/16, and segment it into appropriately sized subnets for each application tier.
C
Use a /24 subnet for each tier and assign static IP addresses to domain controllers from the DHCP dynamic allocation pool for simplicity.
D
Exclude static IP addresses for domain controllers from the dynamic allocation range and configure them within the same subnet.

Show answer and explanation

Correct answers: B, D

Explanation

When designing IP schemes for Azure VNets, you must avoid overlapping address spaces with on-premises networks to enable smooth connectivity via site-to-site VPN. Azure best practices recommend selecting a distinct address block and then subdividing it into subnets sized for your workloads� current and future needs. Additionally, any static IP addresses (for domain controllers or other critical VMs) should be excluded from the subnet� DHCP allocation to prevent potential IP conflicts. For more details, refer to the official Microsoft documentation: https://learn.microsoft.com/azure/virtual-network/virtual-networks-address-spaces-overview.

A. Incorrect.
Option 1 is incorrect. Reusing the on-premises IP range (192.168.0.0/16) for Azure leads to an overlap when you set up site-to-site VPN. This prevents proper routing between on-premises and Azure.
B. Correct.
Option 2 is correct. Selecting a non-overlapping address space (e.g., 10.1.0.0/16) prevents conflict with on-premises networks. Creating multiple subnets provides logical separation and sufficient capacity for future growth.
C. Incorrect.
Option 3 is incorrect. While using /24 subnets is a common approach, assigning static IP addresses from inside the DHCP dynamic range increases the risk of IP conflicts and is not aligned with best practices.
D. Correct.
Option 4 is correct. Reserving static IP addresses outside the subnet� dynamic allocation range ensures there is no conflict between statically assigned IP addresses and automatically allocated addresses.

AZ-700 Question 2

Single answer

You are designing an IP address space for a new multi-tier application hosted in Azure. Your on-premises environment already uses the 10.0.0.0/8 address range. You want to ensure that all Azure resources will be reachable from on-premises without IP conflicts and leave room for future expansions. Which address space should you assign to your new Azure Virtual Network?

A
10.0.0.0/16
B
172.16.0.0/16
C
192.168.0.0/24
D
10.12.0.0/24

Show answer and explanation

Correct answer: B

Explanation

When creating an Azure Virtual Network that must integrate with an on-premises environment, it is critical to select an address range that does not overlap with any existing private ranges on-prem. Since 10.0.0.0/8 is fully utilized on-premises, choosing 172.16.0.0/16 avoids conflicts and provides a sufficiently large IP range for future subnets or workloads. For more details, refer to Microsoft documentation on Azure Virtual Network address space planning (https://learn.microsoft.com/azure/virtual-network/virtual-networks-address-space).

A. Incorrect.
Option A: 10.0.0.0/16. This falls within the existing on-premises range (10.0.0.0/8), so it would cause overlapping address issues.
B. Correct.
Option B: 172.16.0.0/16. This is a private address space that does not overlap with 10.0.0.0/8, offering enough addresses for scalable workloads.
C. Incorrect.
Option C: 192.168.0.0/24. While it is a valid private address space, /24 might be too small if you anticipate many subnets or large workloads.
D. Incorrect.
Option D: 10.12.0.0/24. This also resides within 10.0.0.0/8 and would conflict with the on-premises range.

AZ-700 Question 3

Single answer

You are designing an Azure Virtual Network (VNet) for a multi-tier application. Your on-premises data center currently uses 10.0.0.0/16, but there are plans to expand this to the broader 10.0.0.0/8 range in the future. You need to ensure that your Azure VNet has sufficient IP space to segment front-end, middle-tier, and database subnets while avoiding any overlapping IP addresses with on-premises networks, both now and after the expansion. Which address space should you choose for your Azure VNet?

A
A. 10.0.10.0/16
B
B. 10.10.0.0/16
C
C. 172.16.0.0/12
D
D. 192.168.0.0/16

Show answer and explanation

Correct answer: C

Explanation

When planning Azure VNet address spaces, one of the key considerations is avoiding overlap with existing or future on-premises IP ranges. Although both 172.16.0.0/12 and 192.168.0.0/16 could be used, 172.16.0.0/12 provides a larger non-overlapping range for segmenting multiple tiers (front-end, middle-tier, and database). Microsoft documentation recommends reserving non-overlapping IP spaces especially when future expansion is a concern. Reference: 'Designing IP addressing for Azure VNets' in Microsoft Learn.

A. Incorrect.
A. 10.0.10.0/16 uses the 10.0.x.x space, which is already in use and planned to expand to /8 in the future. This would create overlapping addresses over time, making it an incorrect choice.
B. Incorrect.
B. 10.10.0.0/16 is still part of the 10.x.x.x range. If on-premises expands to 10.0.0.0/8, you would eventually introduce address conflicts, making this option incorrect.
C. Correct.
C. 172.16.0.0/12 falls outside the 10.x.x.x range and provides ample space for multiple subnets. It avoids the overlap problem if on-premises expands its 10.0.0.0/8 network, making this the best choice.
D. Incorrect.
D. 192.168.0.0/16 is also outside the 10.x.x.x range and could work in many scenarios. However, the 172.16.0.0/12 space offers more subnetting flexibility if you need additional segments in the future. While 192.168.0.0/16 wouldn�t overlap, it might be restrictive compared to a /12 range. Option C is still the most optimal.

AZ-700 Question 4

Single answer

Your organization has deployed a three-tier application in Azure within a single virtual network (VNet) using a 10.0.0.0/16 address space. Three subnets are defined for the front-end, mid-tier, and back-end, each sized at /24. Now you need to add several new subnets for additional services and anticipate needing more IP addresses than originally planned. You want to minimize disruption to the current environment. Which action represents the best approach for handling the upcoming expansions?

A
Add new subnets as 10.0.3.0/24, 10.0.4.0/24, etc. until you exhaust the 10.0.0.0/16 space.
B
Double the VNet CIDR to 10.0.0.0/15 by removing the existing CIDR and reassigning a larger one.
C
Remove and recreate the entire VNet with a larger address space, then redeploy all resources.
D
Add a second CIDR block (e.g., 10.1.0.0/16) to the existing VNet to expand available IP space.

Show answer and explanation

Correct answer: D

Explanation

Azure supports multiple address spaces in a single VNet, providing the flexibility to add new CIDR blocks as IP demands increase. This approach avoids significant reconfiguration or redeployment. For more details, see the official Microsoft documentation on virtual network address spaces: https://learn.microsoft.com/azure/virtual-network/virtual-networks-create-vnet-arm#add-additional-address-space-after-creation

A. Incorrect.
Option 1: While adding successive /24 subnets within the existing 10.0.0.0/16 is straightforward, it might be insufficient if you further expand. Once the 10.0.0.0/16 range is filled, you must redesign or add another range, potentially disrupting existing services later.
B. Incorrect.
Option 2: You cannot just 'double' a VNet CIDR by swapping from a /16 to /15 without removing the existing address space. Attempting to modify the current address space in place is not supported if subnets are already in use. This could cause service downtime.
C. Incorrect.
Option 3: Removing and recreating the VNet would be highly disruptive. All dependent resources, such as virtual machines, would need to be redeployed. This is rarely a recommended approach in production environments.
D. Correct.
Option 4: Adding a second CIDR to the existing VNet (for example, 10.1.0.0/16) is the best solution. Azure allows multiple address spaces per VNet, letting you continue using current subnets without disruption while also accommodating future growth.

AZ-700 Question 5

Single answer

Your company� on-premises network uses the 10.0.0.0/16 IP range. You are tasked with creating a new Azure Virtual Network (VNet) for the engineering department. The VNet must not overlap with the on-premises range, and it should allow for future expansion of subnets. Which address space is the most appropriate for this new Azure VNet?

A
10.0.0.0/16
B
10.0.1.0/24
C
10.1.0.0/16
D
192.168.0.0/16

Show answer and explanation

Correct answer: C

Explanation

When creating a new VNet in Azure that will eventually connect to on-premises resources, it is crucial to avoid IP address overlap. Overlapping IP address spaces can prevent successful site-to-site or VPN connections and complicate routing. Azure best practices recommend planning your address space thoroughly to allow for subnet expansion and avoid future collisions. For more information, refer to the official Microsoft documentation on designing and implementing Azure VNets: https://learn.microsoft.com/azure/virtual-network/virtual-networks-overview.

A. Incorrect.
Option A (10.0.0.0/16) directly overlaps with the on-premises network, so it cannot be used if you plan to connect the VNet to the on-premises environment.
B. Incorrect.
Option B (10.0.1.0/24) also falls within the 10.0.0.0/16 range used on-premises, making it unsuitable for the same reason�overlapping IP spaces.
C. Correct.
Option C (10.1.0.0/16) is correct because it does not overlap with the on-premises 10.0.0.0/16 network and provides a sufficiently large block of addresses for future subnet expansion.
D. Incorrect.
Option D (192.168.0.0/16) does not overlap with 10.0.0.0/16, but it may conflict with other commonly used private ranges and might impose additional routing complexities. In most cases, staying within the same 10.x range but a different subnet is simpler to manage.

AZ-700 Question 6

Single answer

You need to deploy a new three-tier application in Azure. The design requires a single virtual network (VNet) named AppVNet with the address space 10.0.0.0/16. You plan to create two subnets: a FrontEnd subnet (10.0.0.0/24) for web servers that must accept inbound HTTP traffic from the Internet and a BackEnd subnet (10.0.1.0/24) restricted to internal communication. Which of the following actions is essential to ensure the planned network configuration is valid and will allow both subnets to be created successfully?

A
Use subnet address prefixes that do not overlap with each other and fall within the VNet address space
B
Assign each subnet an address space that spans the entire 10.0.0.0/16 range
C
Enable IP forwarding on the virtual network before adding any subnets
D
Configure a service endpoint in the FrontEnd subnet to allow HTTP inbound traffic

Show answer and explanation

Correct answer: A

Explanation

When creating a virtual network in Azure, each subnet� address range must be a non-overlapping subset of the VNet� address space. The VNet (10.0.0.0/16) is subdivided into 10.0.0.0/24 and 10.0.1.0/24 for FrontEnd and BackEnd, ensuring no address conflicts. Refer to Microsoft Azure Virtual Network Subnet Planning guidelines at https://learn.microsoft.com/azure/virtual-network/virtual-networks-overview for more details.

A. Correct.
Correct. Subnet address ranges must be non-overlapping and must lie entirely within the VNet address space (10.0.0.0/16). Overlapping subsets or addresses outside the VNet range prevent successful subnet creation.
B. Incorrect.
Incorrect. Each subnet should have a unique sub-range within the 10.0.0.0/16 space; assigning the entire address block to each subnet would overlap and fail creation.
C. Incorrect.
Incorrect. IP forwarding is an optional feature usually enabled for network virtual appliances, not a requirement for creating valid subnets.
D. Incorrect.
Incorrect. Service endpoints are for secure Azure service access, not for basic inbound HTTP. A Network Security Group (NSG) rule can open HTTP inbound, but it does not affect subnet creation validity.

AZ-700 Question 7

Single answer

You are designing a new virtual network in Azure to host an ExpressRoute gateway, an Azure Bastion host, private endpoints (for Azure SQL Database and storage accounts), and an Application Gateway. You also plan to add Azure Firewall in the near future. You want to adhere to subnet naming requirements, avoid IP conflicts, and provide the required isolation for these services. Which approach should you use when creating subnets to meet these requirements?

A
Place all services in a single /16 subnet and manage access using one network security group.
B
Allocate a larger /22 subnet for the GatewaySubnet, then host the remaining services in a single /24 subnet.
C
Create distinct subnets for each service: one named GatewaySubnet for the ExpressRoute gateway, one named AzureBastionSubnet for Bastion, one for private endpoints, one for the Application Gateway, and plan a separate AzureFirewallSubnet for the firewall.
D
Deploy private endpoints, Application Gateway, and Azure Bastion together in a /25 subnet while using a /27 for the GatewaySubnet.

Show answer and explanation

Correct answer: C

Explanation

Azure guidelines and best practices specify using a dedicated 'GatewaySubnet' for the ExpressRoute or VPN gateway, 'AzureBastionSubnet' for Azure Bastion, 'AzureFirewallSubnet' for Azure Firewall, and consistently sized subnets for private endpoints and Application Gateway. This design minimizes IP conflicts, enforces logical separation, and supports future scalability. Refer to the Microsoft documentation on implementing Azure networking best practices for subnet planning and naming requirements.

A. Incorrect.
Incorrect. Placing all services in a single subnet makes it difficult to isolate traffic and does not follow the required subnet naming conventions for Azure Bastion (AzureBastionSubnet) and gateways (GatewaySubnet).
B. Incorrect.
Incorrect. Although setting a larger subnet for your gateway might be acceptable in some contexts, merging all remaining services into a single subnet introduces future scalability issues and goes against the recommended approach of isolating each service in its own subnet. You also need specific naming for Azure Bastion and Azure Firewall subnets.
C. Correct.
Correct. Azure best practices state that each service (ExpressRoute gateway, Bastion, Application Gateway, Azure Firewall, and private endpoints) should have a dedicated subnet with adequate IP addresses. The gateway subnet must be named 'GatewaySubnet,' and the Bastion subnet must be named 'AzureBastionSubnet.' Azure Firewall also requires its own dedicated subnet, 'AzureFirewallSubnet.'
D. Incorrect.
Incorrect. Consolidating multiple services (private endpoints, Application Gateway, and Azure Bastion) into a single small subnet does not follow Microsoft� recommended design. Private endpoints also often require multiple IP addresses, so a /25 might become too small as your environment grows.

AZ-700 Question 8

Select 2

You are designing a single virtual network for your organization to host several Azure services: a site-to-site VPN gateway, an Azure Bastion instance for secure VM access, an Azure Firewall for traffic inspection, and a private endpoint for Azure SQL Database. The design should follow Microsoft� best practices while minimizing the number of subnets. Which two subnet configurations should you implement?

A
1. Create a single subnet named 'ManagementSubnet' with a /24 prefix and deploy the VPN gateway, Bastion, Firewall, and the private endpoint in that subnet.
B
1. Deploy a dedicated 'GatewaySubnet' for the site-to-site VPN gateway and a dedicated 'AzureBastionSubnet' for Azure Bastion, but place Azure Firewall and the private endpoint in the same new subnet named 'FirewallPrivateSubnet'.
C
1. Deploy a dedicated 'GatewaySubnet' for the VPN gateway, a dedicated 'AzureBastionSubnet' for Azure Bastion, a dedicated 'AzureFirewallSubnet' for the Firewall, and place the private endpoint in an existing application subnet.
D
1. Deploy a dedicated 'GatewaySubnet' for the VPN gateway, a dedicated 'AzureBastionSubnet' for Azure Bastion, a dedicated 'AzureFirewallSubnet' for the Firewall, and a new subnet specifically for the private endpoint.

Show answer and explanation

Correct answers: C, D

Explanation

Both VPN gateways and Azure Bastion require dedicated subnets named 'GatewaySubnet' and 'AzureBastionSubnet' respectively. Azure Firewall also requires its own dedicated 'AzureFirewallSubnet'. Private endpoints can be placed in an existing subnet, provided that network policies such as service endpoints or network security group rules are correctly configured. In some scenarios, security or governance requirements may justify an entirely dedicated subnet for private endpoints, while other scenarios may place them in existing subnets to minimize IP overhead. Refer to Microsoft documentation on Azure VNet service constraints (https://learn.microsoft.com/azure/virtual-network/virtual-network-manage-subnet#subnet-constraints) for details on subnet requirements for each resource.

A. Incorrect.
Option 1: Incorrect. Azure Bastion, Azure Firewall, and the VPN gateway each require their own dedicated subnet. Placing all services in a single subnet violates Azure� requirement for dedicated subnets, particularly for Bastion and Firewall.
B. Incorrect.
Option 2: Incorrect. While creating separate subnets for the gateway and Bastion is correct, Azure Firewall also requires its own subnet named 'AzureFirewallSubnet'. Combining the Firewall and the private endpoint in a single subnet is not a recommended practice.
C. Correct.
Option 3: Correct. Each service (VPN gateway, Bastion, Firewall) is placed in its dedicated subnet according to Azure requirements. Private endpoints can reside in an existing application subnet if it is properly configured, minimizing the creation of additional subnets.
D. Correct.
Option 4: Correct. This option follows all best practices by providing dedicated subnets for the VPN gateway, Bastion, and Firewall, plus a segregated subnet for the private endpoint if further isolation is desired.

AZ-700 Question 9

Select 3

You are designing a virtual network for a new Azure NetApp Files deployment. You need to create a dedicated subnet for your NetApp volumes. Before creating the volumes, you must ensure the subnet is properly delegated and meets all requirements. Which three actions must you perform to successfully create a new Azure NetApp Files volume in the subnet?

A
Remove any existing resources referencing the subnet so that the subnet is empty.
B
Enable the Microsoft.Storage service endpoint on the subnet.
C
Assign the 'Microsoft.NetApp/volumes' delegation to the subnet.
D
Configure the subnet to have a /28 or larger address space (e.g., /27).
E
Add a service endpoint for Microsoft.Sql to the subnet.

Show answer and explanation

Correct answers: A, C, D

Explanation

Azure NetApp Files requires a dedicated, delegated subnet that is empty (no existing resources) and has an address space of at least /28. You configure the delegation by selecting 'Microsoft.NetApp/volumes' in the subnet settings. Refer to the Azure NetApp Files documentation (https://learn.microsoft.com/azure/azure-netapp-files/azure-netapp-files-create-volumes) for specifics on subnet requirements, delegation, and best practices.

A. Correct.
Correct. Azure NetApp Files requires a dedicated, empty subnet with no other resources or dependencies. Existing resources (e.g., VM NICs, other services) must be removed before delegation.
B. Incorrect.
Incorrect. Azure NetApp Files does not require, nor recommend, enabling the Microsoft.Storage service endpoint on the delegated subnet. Doing so can cause conflicts.
C. Correct.
Correct. You must assign the 'Microsoft.NetApp/volumes' delegation so that Azure NetApp Files can properly manage and deploy volumes in this subnet.
D. Correct.
Correct. Azure NetApp Files requires a minimum subnet size of /28 or larger (meaning /27, /26, etc.) to provide sufficient IP addresses for management and volume operations.
E. Incorrect.
Incorrect. There's no requirement for enabling a Microsoft.Sql service endpoint for Azure NetApp Files, and adding irrelevant service endpoints can cause confusion and potential conflicts.

AZ-700 Question 10

Select 2

You plan to deploy multiple container groups using Azure Container Instances (ACI) in a virtual network for an internal application. The container groups must communicate with a backend database service running in the same virtual network. You decide to create a delegated subnet for ACI. Which two actions are required to ensure the subnet is correctly delegated for Azure Container Instances? (Choose two.)

A
Specify 'Microsoft.ContainerInstance/containerGroups' as the delegated service for the subnet.
B
Enable a Microsoft.ContainerRegistry service endpoint on the delegated subnet.
C
Place the delegated subnet in the same region and subscription as the container group deployment.
D
Attach a network security group that blocks all inbound and outbound traffic.

Show answer and explanation

Correct answers: A, C

Explanation

For Azure Container Instances to run in a virtual network, you need to delegate a subnet by specifying 'Microsoft.ContainerInstance/containerGroups' as the service. Additionally, the subnet must be in the same region and subscription as the container group to avoid deployment errors. Blocking all traffic with a network security group would prevent any necessary communications, and enabling a Microsoft.ContainerRegistry service endpoint is unrelated to the delegation requirement. For more details, refer to Microsoft� official documentation on Azure Container Instances and subnet delegation: https://learn.microsoft.com/azure/container-instances/container-instances-vnet#subnet-delegation.

A. Correct.
Correct. When configuring subnet delegation for Azure Container Instances, you must set the delegated service to 'Microsoft.ContainerInstance/containerGroups.' This ensures that the subnet is specifically reserved for ACI usage.
B. Incorrect.
Incorrect. Enabling a service endpoint for Azure Container Registry on the subnet is not a requirement for subnet delegation to ACI. Service endpoints are used for controlling traffic to specific Azure services, but this is not mandatory for basic ACI network connectivity.
C. Correct.
Correct. The subnet used for ACI must reside in the same region and subscription as the container group deployment. A mismatch in region or subscription can cause deployment failures.
D. Incorrect.
Incorrect. While you can use network security groups with ACI, blocking all inbound and outbound traffic would prevent the container group from communicating with the internal backend database or any external service. This does not fulfill the requirement of allowing traffic within the virtual network.

Timed practice exam

Take a AZ-700 practice test under exam conditions

70 questions in 100 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the AZ-700 exam covers

Official Designing and Implementing Microsoft Azure Networking Solutions exam domains and weightings.

Design and Implement Core Networking Infrastructure
25% of exam
Design and Implement Routing
25% of exam
Secure and Monitor Networks
15% of exam
Design and Implement Private Access to Azure Services
20% of exam

AZ-700 practice questions 1 to 100 of 310

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 4 pages of up to 100 questions.

AZ-700 exam dumps FAQ

Are these AZ-700 dumps real exam questions?

No. These are original practice questions written to the Designing and Implementing Microsoft Azure Networking Solutions exam objectives, not questions copied from a live exam. Memorising leaked questions violates Microsoft's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many AZ-700 practice questions are there?

310 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the AZ-700 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed AZ-700 practice test?

Sign in and start the Designing and Implementing Microsoft Azure Networking Solutions exam on HydraNode. A session gives you 70 questions drawn from this bank in 100 minutes, then a score report with a per-question review.

What topics does the AZ-700 exam cover?

The official exam domains are: Design and Implement Core Networking Infrastructure; Design and Implement Routing; Secure and Monitor Networks; Design and Implement Private Access to Azure Services.

More Microsoft exam dumps

All Microsoft exams

AZ-305243 questions

Azure Solutions Architect exam dumps

Designing Microsoft Azure Infrastructure Solutions

AZ-400306 questions

Azure DevOps Engineer exam dumps

Designing and Implementing Microsoft DevOps Solutions

AI-102492 questions

Azure AI Engineer exam dumps

Designing and Implementing a Microsoft Azure AI Solution

AI-900285 questions

Azure AI Fundamentals exam dumps

Microsoft Azure AI Fundamentals

AZ-500273 questions

Azure Security Engineer exam dumps

Microsoft Azure Security Technologies

AZ-104288 questions

Azure Administrator exam dumps

Microsoft Certified: Azure Administrator Associate