EnglishDeutschFrançaisEspañolPortuguês

Microsoft · AZ-700 · Associate

Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) — Practice Questions and Mock Exam

The AZ-700 certification validates expertise in designing, implementing, and maintaining Azure networking solutions.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing AZ-700 freeBuy AZ-700 access for $29.99
50Questions per Pass-IT mock exam
100minPass-IT mock exam time limit

Official AZ-700 exam: 700 out of 1000 points to pass.

Checked against Microsoft · August 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a AZ-700 sample question and read the explanation with its source. Right here, with no sign-up.

Design and implement Azure network security services1 / 5

An existing network interface named myNIC in the resource group myResourceGroup currently has no network security group. You must associate the existing network security group myNSG with that network interface by using the Azure CLI, without changing the configuration of the subnet. Which command should you run?

AlexFull explanation from Alex

The two association points for a network security group are the subnet (a property of the subnet object, set with az network vnet subnet update) and the network interface (a property of the network interface object, set with az network nic update). Application security group membership is different again: it is a property of the network interface's IP configuration. Choosing the right object is what determines the blast radius of the rule set.

Sourcelearn.microsoft.com

Design and implement Azure network security services3 / 5

In the Azure portal, you are reviewing Azure Firewall SKUs. Your organization requires TLS inspection and IDPS. Identify the minimum SKU that provides these features.

AlexFull explanation from Alex

Azure Firewall Premium SKU is the minimum tier providing both TLS inspection and IDPS (Intrusion Detection and Prevention System). Standard SKU offers network/application rules, threat intelligence, and DNS proxy but lacks TLS inspection and IDPS. Basic SKU is cost-effective with limited features for lower-throughput scenarios. Premium adds four key capabilities over Standard: (1) TLS inspection for decrypting/inspecting HTTPS traffic, (2) IDPS for signature-based threat detection, (3) URL filtering for granular URL control, and (4) web categories for content filtering. Premium is designed for highly sensitive and regulated environments such as payment and healthcare industries.

Sourcelearn.microsoft.com

Design and implement private access to Azure services4 / 5

Azure Service Endpoints for Azure Storage allow on-premises clients connected via ExpressRoute private peering to access the storage account using the service endpoint. Does this configuration meet the goal?

AlexFull explanation from Alex

Service Endpoints and on-premises access: FALSE. Service endpoints extend VNet identity to Azure services but on-premises clients connected via ExpressRoute private peering CANNOT use service endpoint routes. Service endpoints: only apply to resources within the VNet. On-premises: traffic goes through ExpressRoute but doesn't carry VNet identity. Fix: use Private Endpoints for on-premises access to PaaS services. Exam tip: Service endpoints do NOT extend to on-premises. Only VNet-sourced traffic. Use Private Endpoints for on-prem PaaS access.

Sourcelearn.microsoft.com

How to prepare for AZ-700 with Pass-IT.

Currently 376 practice questions for AZ-700, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · AZ-700

Virtual WAN hub sizing

  1. You

    Why is the proposed /26 hub address space rejected?

  2. Alex · AI tutor

    The virtual hub requires at least a /24 private address space.

    Read the Microsoft documentation ↗
  3. You

    Does a larger prefix number mean more addresses?

  4. Alex · AI tutor

    No. A /26 contains fewer addresses than a /24. The proposed range is too small.

    Read the Microsoft documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

AZ-700 · Question excerpt

Virtual WAN hub sizing

View the full question

You are creating a virtual hub in a Standard virtual WAN and enter 10.20.0.0/26 as the Hub private address space. Validation fails. What is the smallest hub private address space that Azure Virtual WAN accepts when you create a virtual hub?

Understand the correct answer.

/24

Use at least a /24 address space for the virtual hub in this example.

Read the Microsoft documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your AZ-700 mock exam

Questions
50
Minutes
100

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for AZ-700.

Exam topics, relevant practice and sources you can check.

Addressing, routing and network monitoring25–30% of the exam90 QuestionsPass-IT questions

Build Azure networks with suitable addresses, name resolution, routes and diagnostics.

  • Plan address spaces and segmentation, create virtual networks and configure shared, dedicated or delegated subnets for gateways, endpoints, firewalls, integrated services and Azure Bastion.
  • Choose and create public IP prefixes, bring your own IP address ranges, and create and associate public IP addresses with resources.
  • Configure name resolution inside virtual networks, public and private DNS zones and their network links, plus Azure DNS Private Resolver.
  • Connect networks with peering, gateway transit, service chaining and Virtual Network Manager; implement route tables, forced tunneling and Route Server, and troubleshoot routes.
  • Identify when Azure NAT Gateway fits outbound connectivity needs and deploy it.
  • Diagnose networks with Network Watcher and Azure Monitor, activate and monitor DDoS protection, and assess Defender for Cloud Secure Score, attack paths and Cloud Security Explorer findings.
Official Microsoft objectives
VPN, ExpressRoute and Virtual WAN20–25% of the exam83 QuestionsPass-IT questions

Connect users, sites and regions with the right connectivity services.

  • Design highly available site-to-site VPNs, choose gateway SKUs and policy- or route-based connections, configure gateways and IPsec/IKE policies, troubleshoot connectivity and implement Azure Extended Network.
  • Configure point-to-site gateway SKUs, tunnels, RADIUS or Entra authentication and client files; resolve client and sign-in issues and specify Azure requirements for Always On VPN and Azure Network Adapter.
  • Choose an ExpressRoute connectivity model, SKU and tier; design cross-region connections, redundancy and recovery with Global Reach, FastPath and ExpressRoute Direct where appropriate.
  • Configure Azure private or Microsoft peering, gateways and circuit connections, route advertisements, encryption and Bidirectional Forwarding Detection; diagnose ExpressRoute faults.
  • Design Virtual WAN types, services and SKUs; create hubs, size and deploy gateways, configure hub routing and integrate third-party network virtual appliances for cloud connectivity.
Official Microsoft objectives
Load balancing and application delivery15–20% of the exam85 QuestionsPass-IT questions

Route application traffic through Load Balancer, Traffic Manager, Application Gateway and Front Door.

  • Match Load Balancer capabilities, SKUs and tiers to requirements; choose public or internal and regional or cross-region designs, and implement Load Balancer, Traffic Manager and Gateway Load Balancer.
  • Configure load-balancing rules, inbound network address translation rules and explicit outbound rules with source NAT.
  • Choose Application Gateway features and manual or automatic scaling; configure backend pools, probes, listeners, routing, HTTP settings, TLS and rewrite rules.
  • Choose a Front Door tier for the application, configure origins, endpoints and routing, and set up TLS termination or end-to-end TLS encryption.
  • Configure Front Door caching, traffic acceleration, rules, URL rewriting and redirects, and protect origins with Private Link.
Official Microsoft objectives
Private access to Azure services10–15% of the exam42 QuestionsPass-IT questions

Configure private endpoints, Private Link services and service endpoints.

  • Plan and create private endpoints and control access to them.
  • Create a Private Link service, integrate private access with DNS and connect on-premises clients.
  • Decide when service endpoints are appropriate, create them and configure access and endpoint policies.
Official Microsoft objectives
Network and web application security15–20% of the exam76 QuestionsPass-IT questions

Control network traffic and protect applications with security groups and firewalls.

  • Create network and application security groups, associate them with supported subnets or interfaces, set inbound and outbound rules, secure remote administration with Bastion and manage security with Virtual Network Manager.
  • Enable and interpret virtual network flow logs and use IP flow verification to investigate traffic.
  • Select an Azure Firewall SKU, design and deploy the firewall, configure rules and Firewall Manager policies, and secure a Virtual WAN hub with Azure Firewall.
  • Design a web application firewall deployment, choose detection or prevention mode, and create and associate WAF policies and rule sets for Front Door and Application Gateway.
Official Microsoft objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
True / False
Decide whether statements are true or false.
Drag & Drop
Match items to the appropriate targets.
Ordering
Put steps in the correct order.
Dropdown
Choose the appropriate entry from a dropdown list.

These are Pass-IT practice formats. Check the Microsoft certification page for the official exam information.

The ranges describe the weighting of exam topics. See Official Microsoft objectives for the current exam objectives.

Frequently asked questions

Your preparation

How much study time should I plan for AZ-700?

For planning, Pass-IT estimates roughly 30–75 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Microsoft or a promise that you will be exam-ready within that time.

Do you need AZ-104 before AZ-700?

No, Microsoft records no prerequisite for AZ-700. The exam assumes Azure fundamentals such as resource groups, subscriptions and role assignments, which is AZ-104 ground. The catalog budget is around 50 hours and does not include learning Azure itself from scratch.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Microsoft for the languages available for the official exam.

How long does my AZ-700 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the AZ-700 exam

Where can I take the AZ-700 exam?

Pearson VUE online proctored or at authorized testing centers worldwide.

How long is the Designing and Implementing Microsoft Azure Networking Solutions exam?

The AZ-700 exam has 50 questions and a 100-minute time limit.

Which Azure certification is best for a network engineer?

AZ-700 is the one written for the role: core networking infrastructure is 28% of it, connectivity services 23% and network security 20%. AZ-104 covers virtual networking as one section among five, so it is the broader administrator exam rather than a networking one. If your job is hub-and-spoke design, ExpressRoute and private access, AZ-700 is the closer match.

How long is AZ-700 valid?

One year. Microsoft renews it with a free assessment on Microsoft Learn that opens six months before expiry, so it never means sitting the full exam again. The renewal has to land before the date, because there is no retrospective route.

How soon can you retake AZ-700?

After 24 hours for the second attempt, and 14 days between attempts from the third onwards. The cap is five attempts on the same exam in 12 months.

Your preparation for AZ-700

$29.99one-time

12 months of access for AZ-700 · No automatic renewal

Buy AZ-700 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

Administering Information Security in Microsoft 365Administering Microsoft Azure SQL SolutionsAdministering Windows ServerCollaboration Communications Systems EngineerAll Microsoft certifications →