60+ Free Azure AZ-700 Practice Test Questions to Master Azure Networking in 2025

This next hop type is specifically for routing traffic to an NVA. You must also provide the private IP address of the NVA as the ‘Next hop address’.

This configuration allows spoke VNets to use the gateway in the hub VNet to reach remote networks, centralizing the gateway and reducing costs.

This command correctly specifies the ‘group delete’ action with the resource group’s name. The ‘–yes’ flag confirms the deletion without prompting.

Application Gateway is a regional web traffic load balancer that enables you to manage traffic to your web applications, offering features like SSL termination and URL-based routing.

The Basic SKU has limited capabilities, no availability zone support, limited monitoring, and no SLA, making it unsuitable for production environments.

NVAs are third-party virtual appliances (e.g., from Palo Alto Networks, Cisco, Check Point) that customers can deploy into their VNets to add advanced network capabilities.

The V2 tiers offer autoscaling, allowing the gateway to scale its compute instances up or down based on traffic load, which eliminates the need for manual capacity planning required by the V1 tiers.

The OWASP CRS is a widely used open-source rule set available for Azure WAF, but its implementation in Azure is specific to the regional WAF on Application Gateway and is not supported on Front Door.

Almost all Azure services, including VNet, are created in a specific regional location, which must be specified at creation time.

By configuring the storage account firewall to allow access from specific virtual networks (via service endpoints) and disabling access from all other networks, you achieve this goal.

By enabling DNS Proxy, you can configure clients to use the firewall as their DNS server. This allows the firewall to intercept and process FQDNs used in network and application rules.

The documentation specifies a limit of 200 custom route tables per region per subscription.

The global (cross-region) load balancer has a static public IP advertised via Anycast, allowing it to distribute traffic to regional load balancers in its backend pool, providing cross-region resiliency.

A Health Probe is a separate component used to monitor the health of backend targets. While a backend setting can specify a custom probe, the probe itself is not a direct component of the routing rule.

The Basic SKU is a legacy option and lacks many modern features, including P2S connectivity, making it unsuitable for many use cases.

Due to platform limitations, NSG flow logging is explicitly not supported for the Application Gateway v2 subnet. This limitation does not apply to the v1 SKU.

BGP uses keep-alive messages to confirm the link is active. If a router doesn’t receive a keep-alive within the configured holdtime, it considers the link down and initiates failover.

After enabling the service endpoint on the subnet (network side), you must go to the storage account (resource side) and add a rule to its firewall allowing traffic from that specific subnet.

A permanent redirection uses the HTTP 301 response code, which causes clients and search engines to update their records to the new location.

ExpressRoute uses a connectivity provider to establish a private, high-bandwidth, and low-latency connection directly to the Microsoft network.

NSG flow logs capture information about IP traffic that is allowed or denied by an NSG, which is invaluable for compliance, security forensics, and understanding network patterns.

The Basic SKU is highly discouraged for new deployments because it lacks support for features like point-to-site connections and has significant performance constraints.

The dedicated subnet for an Azure Firewall deployment must be named exactly ‘AzureFirewallSubnet’ and have a minimum size of /26 to accommodate scaling.

Azure vWAN provides a managed service for large-scale network connectivity, creating a hub that automatically handles routing between spokes (VNets, branches, users) without complex manual configuration.

This provides a seamless way to deploy a template from a repository by automatically passing the template to the Azure portal’s deployment service.

The holdtime is the failure detection timer. On Microsoft edge routers, it is set to 180 seconds, meaning a link failure could take up to 3 minutes to be detected.

Azure’s default system route for 0.0.0.0/0 has a next hop type of ‘Internet’, which directs all non-VNet traffic to the internet.

A service endpoint extends your VNet’s private address space and identity to the Azure service, routing traffic over the Azure backbone network instead of the internet.

Anomaly scoring provides more flexible and intelligent threat detection by aggregating scores from all matched rules before deciding on an action based on a predefined threshold.

Routing is handled by Azure Route Tables and UDRs, not by rules within the Firewall Policy itself. The firewall acts on traffic that is routed to it.

Route Server allows an NVA to exchange BGP routes with the Azure SDN, so you don’t need to manually configure and maintain route tables for the NVA.

This service is specifically designed to defend against network-level (Layer 3 and 4) attacks such as volumetric and protocol attacks by absorbing and scrubbing malicious traffic.

WAF is designed to protect against Layer 7 attacks by analyzing application traffic and identifying malicious patterns, which is necessary to defend against HTTP-based exploits.

IP flow verify is a diagnostic tool designed specifically to check whether a packet with 5-tuple information is permitted or blocked by NSG rules applied to a VM.

P2S VPNs are designed to provide secure access to Azure resources for individual remote users, not entire networks.

VNet peering connects VNets within or across regions, leveraging the low-latency, high-bandwidth Microsoft backbone without routing traffic over the public internet.

OpenVPN, like SSTP, uses TCP port 443, the standard port for HTTPS traffic, which is almost always allowed through firewalls.

The ‘Deny’ effect is used to enforce standards by rejecting any deployment or modification that would result in a non-compliant resource.

For the Azure VPN gateway to forward authentication messages to an on-premises RADIUS server, there must be a network path. An S2S VPN provides this required reachability.

A Private Endpoint creates a network interface in your VNet for a specific resource (e.g., one storage account), whereas a Service Endpoint secures the connection at the subnet level to the entire service (e.g., all of Azure Storage in a region).

The source material states that Android, Linux, iOS, macOS, Windows 10 (and above), and Windows Server 2016 (and above) devices all have pre-installed native clients that support IKEv2.

Azure provides a unique TXT record that must be added to the domain’s DNS zone. Front Door then queries this record to prove ownership of the domain before it can serve traffic for it.

This service allows you to host a private DNS zone (e.g., internal.contoso.com) and link it to one or more VNets, enabling name resolution for custom domains without needing to deploy custom DNS servers.

The Standard SKU provides access to all Azure regions within a single geopolitical area, making it the ideal choice for a geographically-focused deployment strategy.

This is a well-known virtual public IP address used by Azure for platform communication, including health probes from the load balancer. Traffic from this IP must be allowed in NSGs.

The Metered option is cheaper for low or inconsistent egress, while the Unlimited option provides predictable costs for high-volume egress data.

Session persistence, also known as source IP affinity or sticky sessions, is a setting on a load-balancing rule that directs all requests from the same client IP to the same backend VM.

Inbound NAT rules are designed to map a specific external port on the load balancer to an internal IP address and port on a single backend resource, often used for RDP or SSH access.

Specifying ‘None’ as the next hop type effectively creates a black hole for the traffic matching the address prefix, causing it to be dropped.

This specific range of Autonomous System Numbers (ASNs) is reserved by Microsoft and cannot be used for BGP peering with Azure services.

When multiple origins share the same priority, Front Door uses the assigned weights (1-1000) to distribute traffic among them, allowing for scenarios like a 70/30 split.

This command correctly uses the ‘create’ action with the required parameters for name, resource group, IP version, and SKU to provision a standard public IP.

The Priority method allows you to rank endpoints. Traffic Manager sends all traffic to the highest-priority (lowest number) endpoint that is healthy. Lower-priority endpoints are used only as backups.

This setting on an origin allows you to modify the hostname in the incoming HTTP request to match what the backend server expects to receive.

The 0.0.0.0/0 route is the default route. A next hop of ‘Internet’ means that any traffic not matching a more specific route in the table will be routed out through Azure’s internet infrastructure.

The newer topology tool within Network Insights offers more comprehensive visualization capabilities, including cross-subscription and multi-location views.

RFC 1918 specifies private, non-internet routable address spaces (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) which are the standard for internal networks.

The hub-and-spoke model provides a scalable and cost-effective design by centralizing services like gateways and firewalls in the hub, while isolating workloads in the spokes.

The Premium SKU is specifically designed to provide connectivity to all Azure regions globally, overcoming the geopolitical boundary limitations of the Standard SKU.

When connecting to an SSH host for the first time, typing ‘yes’ confirms that you trust the host’s public key and adds it to your known_hosts file, allowing the connection to continue.

When configuring WAF for Front Door, the policy is associated with one or more of the frontend domains (custom domains or the default endpoint) defined in the profile.

This feature allows administrators to control outbound web access by defining policies based on predefined content categories rather than individual URLs.

Traffic Manager is a DNS-based traffic load balancer. When a client requests a DNS name, Traffic Manager returns the CNAME of an endpoint based on rules like performance, geographic location, or priority.

The ExpressRoute gateway is a type of virtual network gateway that acts as the bridge, enabling traffic to flow between the VNet and the connected ExpressRoute circuit.

The listener is the frontend component that checks for incoming client requests and, based on its configuration, passes them to the appropriate rule for processing.

RADIUS authentication forwards authentication requests from the VPN gateway to a RADIUS server, which can then integrate with identity systems like Active Directory and support various advanced authentication methods.

BGP uses ASNs to identify networks and enforce routing policies. Both the Azure gateway and the on-premises device must have unique ASNs to establish a peering session and exchange routes dynamically.

Azure reserves five IPs: the network address (first), default gateway (second), two for Azure DNS mapping (third and fourth), and the broadcast address (last).

A route table contains a set of rules, called routes, that determine where network traffic is sent. By associating a route table with a subnet, you can override Azure’s default routing.