Microsoft · AZ-700
Validates expertise in designing, implementing, and maintaining Azure networking solutions including hybrid connectivity, application delivery services, private access to Azure services, and network security.
Practice Questions
554
≈ 11 practice exams
Duration
120 minutes
Passing Score
700/1000
Difficulty
AssociateLast Updated
Jan 2026
Use this AZ-700 practice exam to prepare for Microsoft Certified: Azure Network Engineer Associate (AZ-700) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 554 questions for Microsoft AZ-700, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Core Networking Infrastructure, Routing, Azure ExpressRoute, Network Security, and Private Access to Azure Services. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
The Microsoft Certified: Azure Network Engineer Associate (AZ-700) validates subject matter expertise in designing, implementing, and managing Azure networking solutions. The certification covers five core domains: core network infrastructure (virtual networks, IP addressing, DNS, routing, and NAT), hybrid connectivity (site-to-site VPN, point-to-site VPN, Azure ExpressRoute, and Azure Virtual WAN), application delivery services (Azure Load Balancer, Traffic Manager, Application Gateway, and Azure Front Door), private access to Azure services (Private Link, private endpoints, and service endpoints), and network security (NSGs, Azure Firewall, Firewall Manager, and Web Application Firewall). The exam was last updated on January 21, 2026, reflecting the latest Azure networking capabilities.
Earning this certification demonstrates that a professional can optimize performance, resiliency, scale, and security across Azure networking environments, proactively monitor network health, diagnose routing and connectivity issues, and collaborate effectively with solution architects, cloud administrators, security engineers, and application developers. It is recognized across the industry as a benchmark for Azure network engineering proficiency at the associate level.
This certification targets network engineers and cloud infrastructure professionals who plan, implement, and manage Azure networking solutions as part of their day-to-day responsibilities. Ideal candidates typically hold roles such as Azure Network Engineer, Cloud Network Architect, Infrastructure Engineer, or Network Administrator working in organizations that operate workloads in Azure or are migrating from on-premises environments.
Candidates should have hands-on experience creating and managing compute, storage, and networking resources in Azure, along with a solid understanding of networking fundamentals including name resolution, network protocols (TCP/IP, BGP, IPsec/IKE), and network address management (CIDR, subnetting). Those who regularly work with Azure VNets, ExpressRoute circuits, Application Gateway, Azure Firewall, or hybrid connectivity scenarios will find the exam content closely aligned with their practical experience.
There are no formal prerequisite certifications required to sit for the AZ-700 exam. However, Microsoft recommends that candidates possess practical experience creating and managing compute, storage, and networking resources in Azure before attempting the exam. A working knowledge of Azure fundamentals—such as the concepts covered in the AZ-900 (Azure Fundamentals) certification—provides a useful foundation, though it is not mandatory.
Candidates should be proficient in core networking concepts including IP addressing and subnetting, DNS, routing protocols (including BGP for ExpressRoute scenarios), VPN technologies (IPsec/IKE, SSL/TLS), and network security principles. Familiarity with Azure-specific services such as Virtual Networks, Azure Portal, Azure CLI, and Azure PowerShell is strongly recommended. Prior experience with on-premises networking technologies and hybrid connectivity scenarios involving site-to-site VPNs or MPLS/ExpressRoute circuits will be advantageous.
Exam AZ-700 is a proctored assessment delivered through Pearson VUE, available in both online proctored and in-person test center formats. Candidates are given 100 minutes to complete the exam. The exam may include interactive components such as labs or case studies in addition to standard question types like multiple choice, multiple select, drag-and-drop, and scenario-based questions.
The passing score is 700 out of 1000 on Microsoft's scaled scoring system, which uses a compensatory model—meaning candidates do not need to achieve a minimum score in each individual domain, only an overall scaled score of 700 or above. The exam is available in English, German, Spanish, French, Italian, Japanese, Korean, Portuguese (Brazil), Chinese (Simplified), and Chinese (Traditional). The exam fee is $165 USD (pricing varies by country/region). Certification earned is valid for 12 months and can be renewed at no cost by passing an online renewal assessment on Microsoft Learn.
The Azure Network Engineer Associate certification opens doors to roles such as Azure Network Engineer, Cloud Infrastructure Engineer, Network Architect, and Cloud Solutions Architect at organizations across virtually every industry undertaking Azure adoption or hybrid cloud migrations. As of early 2026, Azure Network Engineers in the United States earn average annual salaries of approximately $109,000–$145,000, with top earners in high-cost markets such as California, Massachusetts, and Washington D.C. commanding $155,000–$165,000 or more depending on experience and seniority.
Demand for certified Azure networking professionals continues to grow as enterprises expand hybrid connectivity using ExpressRoute and Virtual WAN, adopt Zero Trust network security models, and migrate application delivery infrastructure to Azure-native services like Front Door and Application Gateway. Compared to general cloud associate certifications, the AZ-700's specialization in networking positions holders for higher-compensation, more technically complex roles. The certification also serves as a natural stepping stone toward expert-level credentials such as the Azure Solutions Architect Expert (AZ-305) or specialized security certifications, making it a strategically valuable milestone in a cloud networking career path.
5 sample questions with answers and explanations. The full bank has 554 questions, enough for 11 full-length practice exams.
Preview — answers shown1. Proseware Inc has Azure Front Door Premium with Web Application Firewall protecting their global application. They need to implement rate limiting to block attackers while allowing legitimate users during high-traffic events. The solution must differentiate between normal users and automated attacks based on behavior patterns. What should you configure?
Explanation
For sophisticated rate limiting that differentiates between legitimate users and attacks, combining bot protection with adaptive rate limiting provides the best approach. Bot protection helps identify automated traffic patterns, while adaptive rate limiting can adjust thresholds based on behavior. Geo-filtering can help block traffic from suspicious regions. This multi-layered approach provides more intelligent protection than simple IP-based rate limiting.
2. A global news agency runs its primary web application, 'WebApp1', from endpoints in several Azure regions. They use an Azure Traffic Manager profile, 'NewsTrMgr', to manage traffic distribution. The primary goal is to minimize page load times for users by directing their requests to the Azure region that will provide the lowest network latency. Which routing method should be configured on 'NewsTrMgr'?
Explanation
The Performance routing method is the correct choice to meet this requirement. It operates by directing traffic to the 'closest' endpoint in terms of network latency. Traffic Manager maintains an internet latency table and uses it to determine which endpoint will provide the best performance for the end-user based on the source IP of their DNS query. Geographic routing directs traffic based on the geographical location where the DNS query originates, which is different from latency. Priority routing is used for failover scenarios, and Weighted routing distributes traffic based on assigned percentages, not performance.
3. A financial services company, 'FinSecure', maintains an Azure subscription with a virtual network named 'VNet-PROD'. This VNet is segmented into four subnets: SubnetA (10.1.0.0/25) hosting 10 virtual machines, SubnetB (10.2.0.0/26), SubnetC (10.3.0.0/27), and SubnetD (10.4.0.0/27). SubnetD is specifically delegated for Azure NetApp Files to handle high-performance workloads. FinSecure needs to establish a private endpoint for a storage account called 'storage_audit_logs'. From which subnets can this private endpoint be configured?
Explanation
Private endpoints are implemented as a network interface within a virtual network, so they do not require an entirely dedicated subnet. This flexibility allows them to be placed in subnets that already contain other resources, such as virtual machines, making SubnetA, SubnetB, and SubnetC all valid choices. However, SubnetD cannot be used. When a subnet is delegated to a specific Azure service, like Azure NetApp Files, Azure places a lock on that subnet, restricting it from hosting any other type of resource. This delegation ensures the service has all the necessary IP addresses and network configurations to function correctly, but it means a network interface for a private endpoint cannot be created there.
4. Fabrikam Logistics operates multiple datacenters connected via ExpressRoute circuits and wants to enable direct communication between their locations using the Microsoft backbone network instead of their private WAN. They need a solution that leverages their existing ExpressRoute infrastructure. Which ExpressRoute feature enables site-to-site connectivity over the Microsoft network?
Explanation
ExpressRoute Global Reach enables you to connect your on-premises networks to each other through Microsoft's global network by linking ExpressRoute circuits together. This allows traffic to flow between your different locations using Microsoft's backbone instead of your own WAN infrastructure, providing potentially better performance and redundancy.
5. Litware Inc has 85 public IP resources across their Azure subscription and needs to implement DDoS protection while minimizing costs. Which DDoS protection plan and application method should you recommend?
Explanation
Azure DDoS Network Protection costs $2,944 monthly and protects up to 100 public IP resources, making it cost-effective for 85 IPs. Azure DDoS IP Protection costs $199 per IP monthly, totaling $16,915 for 85 IPs. Network Protection is applied at the virtual network level and automatically protects all public IP resources within that network, providing better cost efficiency and centralized management.
Microsoft Certified: Azure for SAP Workloads Specialty (AZ-120)
AZ-120 · 582 questions
Microsoft Certified: Azure Fundamentals (AZ-900)
AZ-900 · 382 questions
Microsoft Certified: Azure Solutions Architect Expert (AZ-305)
AZ-305 · 530 questions
Microsoft Certified: Azure Security Engineer Associate (AZ-500)
AZ-500 · 469 questions
Microsoft Certified: AI Business Professional (AB-730)
AB-730 · 699 questions
Microsoft Certified: AI Transformation Leader (AB-731)
AB-731 · 700 questions
$17.99
One-time access to this exam