Microsoft · AZ-700 · Associate

Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Prepare for AZ-700 with original practice questions and clear answer explanations. Ask Alex, your AI tutor, when you need more detail, use your results to identify topics to review, and practice your pacing with timed mock exams.

Start practicing AZ-700 free Buy AZ-700 access for $29.99

Buy AZ-700 access for $29.99 Start practicing AZ-700 free

50Mock exam questions

100minTime limit

700/ 1000Passing score

Checked against Microsoft · August 2026 · Current exam version

Overview

About the exam

The AZ-700 certification validates expertise in designing, implementing, and maintaining Azure networking solutions. It covers virtual networks, hybrid networking, routing, load balancing, application delivery, private access to Azure services, and network security. Candidates must demonstrate proficiency with VNet peering, VPN gateways, ExpressRoute, Azure Front Door, Azure Firewall, and DNS configuration.

This certification is designed for network engineers who specialize in Azure networking infrastructure. Candidates should have significant experience with on-premises networking concepts and hands-on Azure networking skills, including configuring and troubleshooting complex hybrid connectivity and network security architectures.

Try the practice preview

Try five AZ-700 questions

Try five practice questions from the app’s current Designing and Implementing Microsoft Azure Networking Solutions question bank, with answers and explanations.

Design and implement Azure network security services1 / 5

An existing network interface named myNIC in the resource group myResourceGroup currently has no network security group. You must associate the existing network security group myNSG with that network interface by using the Azure CLI, without changing the configuration of the subnet. Which command should you run?

AlexFull explanation from Alex

The two association points for a network security group are the subnet (a property of the subnet object, set with az network vnet subnet update) and the network interface (a property of the network interface object, set with az network nic update). Application security group membership is different again: it is a property of the network interface's IP configuration. Choosing the right object is what determines the blast radius of the rule set.

Sourcelearn.microsoft.com

Design and implement Azure network security services4 / 5

In the Azure portal, you are reviewing Azure Firewall SKUs. Your organization requires TLS inspection and IDPS. Identify the minimum SKU that provides these features.

AlexFull explanation from Alex

Azure Firewall Premium SKU is the minimum tier providing both TLS inspection and IDPS (Intrusion Detection and Prevention System). Standard SKU offers network/application rules, threat intelligence, and DNS proxy but lacks TLS inspection and IDPS. Basic SKU is cost-effective with limited features for lower-throughput scenarios. Premium adds four key capabilities over Standard: (1) TLS inspection for decrypting/inspecting HTTPS traffic, (2) IDPS for signature-based threat detection, (3) URL filtering for granular URL control, and (4) web categories for content filtering. Premium is designed for highly sensitive and regulated environments such as payment and healthcare industries.

Sourcelearn.microsoft.com

Design and implement private access to Azure services5 / 5

Azure Service Endpoints for Azure Storage allow on-premises clients connected via ExpressRoute private peering to access the storage account using the service endpoint. Does this configuration meet the goal?

AlexFull explanation from Alex

Service Endpoints and on-premises access: FALSE. Service endpoints extend VNet identity to Azure services but on-premises clients connected via ExpressRoute private peering CANNOT use service endpoint routes. Service endpoints: only apply to resources within the VNet. On-premises: traffic goes through ExpressRoute but doesn't carry VNet identity. Fix: use Private Endpoints for on-premises access to PaaS services. Exam tip: Service endpoints do NOT extend to on-premises. Only VNet-sourced traffic. Use Private Endpoints for on-prem PaaS access.

Sourcelearn.microsoft.com

Create a free account

Question pool

380 practice questions

The Pass-IT question pool gives you material to practice for AZ-700. A Pass-IT mock exam uses 50 questions and a 100-minute time limit; these are practice settings.

Pool details: AZ-700

Exam details checked against MicrosoftAugust 28, 2026

date of the last check against the official Microsoft source

Passing score700 / 1,000

as published by Microsoft

Objectives in the guide152 objectives listed in the official guide

across 5 domains in the official exam guide

Pool size380 questions

= The pool size is equivalent to 7 sets of 50 questions; this does not mean that each mock exam uses a separate set.

Blueprint domains5 domains in the exam blueprint

Design and implement core networking infrastructure 91 · Design, implement, and manage connectivity services 85 · Design and implement application delivery services 85 · Design and implement private access to Azure services 42 · Design and implement Azure network security services 77

Recorded as checked against sources380 of 380

questions recorded as having their answer, options, and explanation checked against official Microsoft documentation

How questions are made →

Exam domains

What's on the exam

Core networking infrastructure carries the most weight at 25–30%: IP addressing, name resolution, VNet connectivity and routing, and network monitoring form the foundation everything else builds on. Connectivity services (site-to-site and point-to-site VPN, ExpressRoute, Virtual WAN) follow at 20–25%, and network security (NSGs, Azure Firewall, WAF) takes 15–20%. Application delivery (Load Balancer, Application Gateway, Front Door) sits at 15–20% and private access to Azure services closes the blueprint at 10–15%.

The weighting favors the plumbing over the edge cases: get VNet design, DNS, and routing right and the remaining domains build directly on that foundation.

Exam blueprint: AZ-700

Design and implement core networking infrastructure25–30%

Design and implement IP addressing (network segmentation, VNets, subnets, subnet delegation, public IP prefixes), name resolution (DNS settings, public/private DNS zones, Azure DNS Private Resolver), VNet connectivity and routing (service chaining, VNet peering, UDRs, forced tunneling, Route Server, NAT Gateway), and monitor networks (Network Watcher, Azure Monitor, DDoS protection, Defender for Cloud)

≈ 14 h

Design, implement, and manage connectivity services20–25%

Design and manage site-to-site VPN connections (high availability, gateway SKUs, IPsec/IKE policies, local network gateways), point-to-site VPN (tunnel types, authentication including RADIUS and Entra ID, Always On VPN), Azure ExpressRoute (connectivity models, SKUs, Global Reach, FastPath, Direct, peering), and Azure Virtual WAN architecture (hub routing, NVA integration)

≈ 12 h

Design and implement application delivery services15–20%

Design and implement Azure Load Balancer and Traffic Manager (SKU selection, regional/cross-region, Gateway Load Balancer, NAT rules, outbound rules), Azure Application Gateway (autoscale, backend pools, health probes, listeners, routing rules, TLS, rewrite rules), and Azure Front Door (routing, origins, endpoints, TLS, caching, traffic acceleration, URL rewrite/redirect, Private Link)

≈ 9 h

Design and implement private access to Azure services10–15%

Design and implement Azure Private Link service and private endpoints (planning, configuration, DNS integration, on-premises client integration) and design and implement service endpoints (endpoint policies, access configuration)

≈ 6 h

Design and implement Azure network security services15–20%

Implement and manage NSGs (ASGs, security rules, VNet flow logs, IP flow verification, Azure Bastion, Virtual Network Manager), design and implement Azure Firewall and Firewall Manager (SKU selection, deployment, rules, policies, secured hubs), and design and implement WAF (detection/prevention mode, rule sets for Front Door and Application Gateway)

≈ 10 h

Format

Exam format and question types

AZ-700 draws 40–60 questions from a mix of multiple-choice, multiple-select, drag-and-drop, ordering, and dropdown-selection formats inside a 100-minute window. Items lean heavily on topology: a network diagram or routing scenario is described, and you pick the VNet peering, UDR, load-balancer tier, or firewall rule that resolves it — precise IP addressing and routing-table knowledge matters more than general Azure familiarity.

Question types: AZ-700

Multiple Choice41%

Select the single answer that best meets the question’s requirements.

Drag & Drop17%

Move items into the slots, groups, or sequence specified by the task.

Ordering11%

Arrange the steps in the sequence needed to complete the process.

Multiple Response11%

Select multiple answers. Follow the question’s instructions on how many to choose.

Dropdown11%

Choose options from dropdown menus to complete a statement or configuration.

True / False9%

Decide whether a statement is true or false, paying attention to its conditions and wording.

See Microsoft for official question-format information. The shares shown describe the Pass-IT practice pool; they do not establish the proportions on the official exam.

Planning

Preparing for AZ-700

AZ-700 runs through Pearson VUE, either online with a remote proctor or at an authorized testing center, and is offered in English, German, Spanish, French, Italian, Japanese, Korean, Portuguese (Brazil), Chinese (Simplified), and Chinese (Traditional). Certification holds for one year, and Microsoft opens a free renewal assessment on Learn starting six months before it expires.

Preparation and logistics: AZ-700

Preparation

Illustrative study time30–75 h

illustrative planning range: 30 h with relevant experience to 75 h when starting out; your needs may fall outside this range

LevelAssociate

Taking and maintaining the certification

DeliveryPearson VUE online proctored or at authorized testing centers worldwide

Retake policy24-hour wait after the first attempt, 14 days between subsequent attempts, maximum 5 attempts per exam within a 12-month period

Certification validity1 year

Free renewal assessment on Microsoft Learn, available starting 6 months before expiration. Must be completed before the certification expires.

Official guideView on provider site

Study notes

Common pitfalls

Topics to review: AZ-700

01Routing Precedence
Not understanding Azure route evaluation order including system routes, UDRs, and BGP routes and their precedence.
02Load Balancer SKUs
Confusing Standard vs Basic Load Balancer capabilities and when to use Azure Load Balancer vs Application Gateway vs Front Door.
03ExpressRoute Circuits
Struggling with ExpressRoute peering types (Private, Microsoft), circuit redundancy, and Global Reach configurations.
04DNS Resolution
Overlooking Azure Private DNS zone configurations, DNS forwarding, and hybrid DNS resolution for private endpoints.
05Network Segmentation
Not designing proper subnet segmentation with NSGs, ASGs, and Azure Firewall for defense-in-depth network security.

Practice with questions and explanations in Pass-IT →

Questions

Frequently asked questions

How long is the Designing and Implementing Microsoft Azure Networking Solutions exam?

The AZ-700 exam has 50 questions and a 100-minute time limit.

What is the passing score for Designing and Implementing Microsoft Azure Networking Solutions?

The passing score for the AZ-700 exam is 700 / 1000.

Which pitfalls should I review when preparing for Designing and Implementing Microsoft Azure Networking Solutions?

Topics to review include Routing Precedence, Load Balancer SKUs, ExpressRoute Circuits, DNS Resolution, Network Segmentation. Work through examples to check that you understand the distinctions and can explain your answer.

Which Azure certification is best for a network engineer?

AZ-700 is the one written for the role: core networking infrastructure is 28% of it, connectivity services 23% and network security 20%. AZ-104 covers virtual networking as one section among five, so it is the broader administrator exam rather than a networking one. If your job is hub-and-spoke design, ExpressRoute and private access, AZ-700 is the closer match.

How is AZ-700 weighted?

Core networking infrastructure leads at 28%, with connectivity services at 23% and network security services at 20%. Application delivery takes 17% and private access to Azure services 12%. Half the exam sits in the first two areas, which are also the ones that need a lab rather than reading.

Do you need AZ-104 before AZ-700?

No, Microsoft records no prerequisite for AZ-700. The exam assumes Azure fundamentals such as resource groups, subscriptions and role assignments, which is AZ-104 ground. The catalog budget is around 50 hours and does not include learning Azure itself from scratch.

How long is AZ-700 valid?

One year. Microsoft renews it with a free assessment on Microsoft Learn that opens six months before expiry, so it never means sitting the full exam again. The renewal has to land before the date, because there is no retrospective route.

How soon can you retake AZ-700?

After 24 hours for the second attempt, and 14 days between attempts from the third onwards. The cap is five attempts on the same exam in 12 months.

One certification, 12 months

Practice for AZ-700

Focus your practice on one certification, or choose Pro to practice across all certifications.

Buy AZ-700 access for $29.99

Start a free practice sessionTry the first 20 questions without a card to see whether the practice suits you.

For eligible purchases: money-back guarantee if you fail your exam.

View guarantee terms →