High-Value AZ-700 Questions to Dominate Azure Networking: 67+ Free Practice Questions (2025 Update)

Azure Bastion is a fully managed PaaS service that you provision inside your virtual network. It provides secure and seamless RDP/SSH connectivity to your VMs directly from the Azure portal over TLS.

An Azure VNet can support up to 3,000 subnets, allowing for significant segmentation and organization of resources.

The MultiValue routing method allows you to have multiple healthy endpoints returned in a single DNS query response, allowing the client to have multiple options.

Using private, non-internet routable address spaces as defined in RFC 1918 (e.g., 10.0.0.0/8) is highly recommended to avoid IP address conflicts.

vWAN simplifies network connectivity by abstracting the complexity of the hub network, removing the need for customers to manage routing, gateways, and other hub components.

A service endpoint provides a secure and direct connection to Azure services over the Azure backbone, securing the service to a specific VNet and subnet.

The `AzureLoadBalancer` service tag represents the well-known Azure IP address (168.63.129.16) used for health probes. This rule is necessary for the load balancer to determine the health of backend VMs.

When both are present, custom rules are evaluated first. This allows you to create exceptions or specific blocking rules that take precedence over the broader managed rules.

NVAs are virtual appliances from vendors like Palo Alto Networks, Cisco, and Check Point that offer specialized network and security functions beyond Azure’s native capabilities.

This is the address block set aside by the IETF for Unique Local Addresses, which are the IPv6 equivalent of IPv4 private addresses from RFC 1918.

OpenVPN is an SSL-based protocol that operates over TCP port 443, the same port used for HTTPS traffic, making it highly likely to be allowed through firewalls.

Azure NSGs use a longest prefix match algorithm. The rule with the more specific address prefix will be evaluated first if priorities are the same.

The domain validation process requires you to prove ownership by creating a specific TXT record in your DNS zone. Azure then checks for this record to complete the validation.

Due to platform limitations, NSG flow logging does not work properly and is not supported for Application Gateway v2 subnets. This limitation does not affect v1 SKUs.

Since both East US and West US are in the North America geopolitical region, a Standard SKU circuit is sufficient to connect VNets in both locations.

These two settings work together to allow the Spoke VNet to use the VPN gateway in the Hub VNet, enabling transitive connectivity to on-premises networks.

If VNet A is peered with VNet B, and VNet B is peered with VNet C, VNet A and VNet C cannot communicate with each other by default. A direct peering between A and C is required.

A backend setting (formerly known as an HTTP setting) configures the port, protocol, and other parameters like cookie-based affinity for traffic being sent from the gateway to the backend targets.

NSG Flow Logs is the feature specifically designed to record information about IP traffic flowing through an associated NSG, including source/destination IPs, ports, and the rule decision.

The listener is the component that checks for incoming requests on a specified frontend IP, port, protocol, and hostname, and is where SSL/TLS termination is configured.

The Basic SKU is a legacy option that has feature limitations, such as a lack of support for point-to-site connections and lower performance, and should be avoided if possible.

Session affinity uses a cookie to ensure that for stateful applications, a user’s session is maintained on a single backend server (origin).

The Standard SKU is required for Availability Zone support, allowing for the creation of zone-redundant or zonal frontends.

This is the fundamental distinction; Load Balancer distributes traffic based on IP address and port, whereas Application Gateway can make routing decisions based on HTTP attributes like URL path or host headers.

A well-defined, enforced naming convention is a best practice that improves manageability, clarity, and consistency across the Azure environment.

This setting is crucial for backends that host multiple websites on a single IP (multi-tenant). It allows Front Door to modify the incoming host header to the one expected by the specific backend application.

The Premium SKU offers more accurate categorization by looking at the entire URL path and query string, whereas the Standard SKU only considers the Fully Qualified Domain Name (FQDN).

For the v1 tiers (Standard or WAF), you are responsible for capacity planning and must specify both the instance count (up to 32) and the size (Small, Medium, or Large).

Route Server establishes BGP peering with NVAs. The NVAs advertise their network routes to the Route Server, which then propagates them to the VMs in the VNet.

RADIUS authentication allows the VPN gateway to forward authentication requests to a RADIUS server, which can be integrated with on-premises Active Directory or other identity systems, enabling a wide variety of authentication options including MFA.

A VPN gateway connection uses a secure IPsec/IKE tunnel to encrypt traffic between the VNets, which may be required for specific security or compliance use cases.

For FQDN filtering in network rules (Layer 3/4), the firewall must act as a DNS proxy to intercept and resolve the FQDN to an IP address, which it can then use to filter traffic.

A WAF is specifically designed to protect web applications by inspecting inbound web traffic and filtering out malicious requests based on rule sets like the OWASP Core Rule Set.

Committing to a one or three-year RI is risky if your workloads are not stable, as you might lock in resources that do not align with your long-term needs.

IP flow verify is a diagnostic tool designed specifically to check whether a packet with a given 5-tuple (source/destination IP, source/destination port, protocol) is allowed or denied to or from a VM.

This specific range of ASNs is reserved by Microsoft for internal use and cannot be assigned to an NVA peering with Azure Route Server.

The WAF engine assigns an anomaly score of 5 for each rule matched with a ‘Critical’ severity.

When configuring a WAF policy for Front Door, it can only be associated at the frontend domain level, applying the policy to one or more domains in the profile.

When multiple origins share the same priority, the ‘Weight’ (1-1000) is used to distribute traffic between them. An origin with a weight of 200 will receive twice as much traffic as one with a weight of 100.

The home region is for deployment and management, but the static frontend IP is advertised from multiple participating regions. An outage in the home region does not affect traffic routing through other regions.

Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic to your public-facing applications across the global Azure regions.

A WAF policy for Application Gateway is a regional resource and can only be associated with an Application Gateway instance that resides in the same Azure region.

Azure Route Server is a fully managed service that uses BGP to dynamically exchange routes between your NVA and Azure VNet, simplifying routing configuration.

Azure Front Door is a global Layer 7 load balancing service that directs client requests to the fastest and most available backend, which can be in any Azure region or even outside of Azure.

The documentation specifies minimum subnet sizes for gateway subnets to accommodate gateway instances; /29 is the minimum for active-passive, and /28 for active-active configurations.

Azure Traffic Manager is a global, DNS-based service that is not pinned to a specific region and is designed to route traffic across regions.

IP flow verify is specifically designed to quickly diagnose connectivity issues by checking if a packet is allowed or denied based on 5-tuple information for a given VM.

UDRs are used to override Azure’s default system routes, allowing administrators to specify a next-hop address, such as an NVA, for traffic.

Permanent redirection sends an HTTP 301 response, informing clients and search engines that the resource has been permanently moved to the new URL.

Enabling the service endpoint on the subnet is the network-side operation. You must then perform the resource-side operation by adding a VNet rule to the storage account’s firewall to grant access to that specific subnet.

A default system route with the address prefix 0.0.0.0/0 and a next hop type of ‘Internet’ ensures that any traffic not destined for the VNet is routed to the public internet.

A Virtual Hub is a Microsoft-managed virtual network that serves as the core of a vWAN deployment in a region, simplifying connectivity between various endpoints.

Azure reserves the first four IP addresses (network address, default gateway, DNS mapping) and the last IP address (broadcast address) within each subnet.

The Premium SKU is designed for highly sensitive environments and includes advanced features such as TLS inspection and a signature-based IDPS.

An Availability Zone is a physical location concept for high availability and cannot be specified as a next hop in a route table.

The peering location, such as ‘Seattle’ or ‘London’, is the physical datacenter or meet-me location where your ExpressRoute provider connects to the Microsoft global network.

Azure DDoS Protection safeguards against Layer 3 and 4 attacks. To protect against Layer 7 attacks like Slowloris or HTTP floods, a Web Application Firewall (WAF) is required.

Availability Zones are physically separate locations within a single Azure region, each with independent power, cooling, and networking, designed to protect applications from datacenter-level failures.

Microsoft has partnered with simulation testing services. You must create an account with a service like BreakingPoint Cloud and explicitly authorize it to perform tests against your public IP addresses.

Azure vWAN is designed to simplify large-scale connectivity by providing a managed hub-and-spoke architecture that supports transitive routing and any-to-any connectivity out of the box.

A direct connection increases security by avoiding the public internet and offers more predictable, reliable, and lower-latency performance.

A Private Endpoint gives the app a private IP on your VNet for secure inbound connections. VNet Integration enables the app to access resources within your VNet (or peered VNets) via their private IPs.

The Local Network Gateway is an object in Azure that represents your on-premises site. It contains properties such as the public IP address of the on-premises VPN device and the on-premises network address spaces.

The firewall must be deployed in a dedicated subnet named exactly ‘AzureFirewallSubnet’ with a minimum size of /26 to accommodate scaling.

All these modern operating systems come pre-installed with native clients that support the IKEv2 protocol, simplifying client configuration.

The holdtime is the maximum time a BGP router will wait for a keep-alive message from its peer. If this time is exceeded, the router declares the session down and initiates failover.

This is the highly recommended method. It reserves the IP address for the resource within Azure’s fabric, preventing conflicts and ensuring the assignment persists.

The Standard SKU limits connectivity to regions within the same geopolitical area. The Premium SKU is required to extend connectivity to all Azure regions globally.

The Unlimited option provides all outbound data transfer for a fixed monthly fee, making it ideal for organizations with high or inconsistent outbound data transfer needs.