Microsoft · AZ-700
Validates expertise in designing, implementing, and maintaining Azure networking solutions including hybrid connectivity, application delivery services, private access to Azure services, and network security.
Practice Questions
554
≈ 11 practice exams
Duration
120 minutes
Passing Score
700/1000
Difficulty
AssociateLast Updated
Jan 2026
Use this AZ-700 practice exam to prepare for Microsoft Certified: Azure Network Engineer Associate (AZ-700) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 554 questions for Microsoft AZ-700, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Core Networking Infrastructure, Routing, Azure ExpressRoute, Network Security, and Private Access to Azure Services. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
The Microsoft Certified: Azure Network Engineer Associate (AZ-700) validates subject matter expertise in designing, implementing, and managing Azure networking solutions. The certification covers five core domains: core network infrastructure (virtual networks, IP addressing, DNS, routing, and NAT), hybrid connectivity (site-to-site VPN, point-to-site VPN, Azure ExpressRoute, and Azure Virtual WAN), application delivery services (Azure Load Balancer, Traffic Manager, Application Gateway, and Azure Front Door), private access to Azure services (Private Link, private endpoints, and service endpoints), and network security (NSGs, Azure Firewall, Firewall Manager, and Web Application Firewall). The exam was last updated on January 21, 2026, reflecting the latest Azure networking capabilities.
Earning this certification demonstrates that a professional can optimize performance, resiliency, scale, and security across Azure networking environments, proactively monitor network health, diagnose routing and connectivity issues, and collaborate effectively with solution architects, cloud administrators, security engineers, and application developers. It is recognized across the industry as a benchmark for Azure network engineering proficiency at the associate level.
This certification targets network engineers and cloud infrastructure professionals who plan, implement, and manage Azure networking solutions as part of their day-to-day responsibilities. Ideal candidates typically hold roles such as Azure Network Engineer, Cloud Network Architect, Infrastructure Engineer, or Network Administrator working in organizations that operate workloads in Azure or are migrating from on-premises environments.
Candidates should have hands-on experience creating and managing compute, storage, and networking resources in Azure, along with a solid understanding of networking fundamentals including name resolution, network protocols (TCP/IP, BGP, IPsec/IKE), and network address management (CIDR, subnetting). Those who regularly work with Azure VNets, ExpressRoute circuits, Application Gateway, Azure Firewall, or hybrid connectivity scenarios will find the exam content closely aligned with their practical experience.
There are no formal prerequisite certifications required to sit for the AZ-700 exam. However, Microsoft recommends that candidates possess practical experience creating and managing compute, storage, and networking resources in Azure before attempting the exam. A working knowledge of Azure fundamentals—such as the concepts covered in the AZ-900 (Azure Fundamentals) certification—provides a useful foundation, though it is not mandatory.
Candidates should be proficient in core networking concepts including IP addressing and subnetting, DNS, routing protocols (including BGP for ExpressRoute scenarios), VPN technologies (IPsec/IKE, SSL/TLS), and network security principles. Familiarity with Azure-specific services such as Virtual Networks, Azure Portal, Azure CLI, and Azure PowerShell is strongly recommended. Prior experience with on-premises networking technologies and hybrid connectivity scenarios involving site-to-site VPNs or MPLS/ExpressRoute circuits will be advantageous.
Exam AZ-700 is a proctored assessment delivered through Pearson VUE, available in both online proctored and in-person test center formats. Candidates are given 100 minutes to complete the exam. The exam may include interactive components such as labs or case studies in addition to standard question types like multiple choice, multiple select, drag-and-drop, and scenario-based questions.
The passing score is 700 out of 1000 on Microsoft's scaled scoring system, which uses a compensatory model—meaning candidates do not need to achieve a minimum score in each individual domain, only an overall scaled score of 700 or above. The exam is available in English, German, Spanish, French, Italian, Japanese, Korean, Portuguese (Brazil), Chinese (Simplified), and Chinese (Traditional). The exam fee is $165 USD (pricing varies by country/region). Certification earned is valid for 12 months and can be renewed at no cost by passing an online renewal assessment on Microsoft Learn.
The Azure Network Engineer Associate certification opens doors to roles such as Azure Network Engineer, Cloud Infrastructure Engineer, Network Architect, and Cloud Solutions Architect at organizations across virtually every industry undertaking Azure adoption or hybrid cloud migrations. As of early 2026, Azure Network Engineers in the United States earn average annual salaries of approximately $109,000–$145,000, with top earners in high-cost markets such as California, Massachusetts, and Washington D.C. commanding $155,000–$165,000 or more depending on experience and seniority.
Demand for certified Azure networking professionals continues to grow as enterprises expand hybrid connectivity using ExpressRoute and Virtual WAN, adopt Zero Trust network security models, and migrate application delivery infrastructure to Azure-native services like Front Door and Application Gateway. Compared to general cloud associate certifications, the AZ-700's specialization in networking positions holders for higher-compensation, more technically complex roles. The certification also serves as a natural stepping stone toward expert-level credentials such as the Azure Solutions Architect Expert (AZ-305) or specialized security certifications, making it a strategically valuable milestone in a cloud networking career path.
5 sample questions with answers and explanations. The full bank has 554 questions, enough for 11 full-length practice exams.
Preview — answers shown1. An online shopper at 'The Digital Bazaar' is proceeding to checkout. When they enter their credit card information, the connection to the website needs to be secure to prevent eavesdroppers from stealing the data. The URL in the browser's address bar changes to indicate a secure, encrypted connection. Which protocol is being used for this secure communication?
Explanation
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP. [10, 22, 28] It uses encryption protocols like SSL/TLS to secure the communication between a web browser and a website, ensuring that data like passwords and credit card numbers are protected during transit. [33, 37] HTTP transmits data in plain text, while FTP is for file transfer and Telnet for remote terminal access, both of which are typically insecure.
2. Wingtip Toys implements Azure Virtual Network Manager security admin configuration with multiple rule collections. They create Always Allow rules for management traffic from specific subnets but discover that some management connections are still being blocked by Network Security Groups. What is the expected behavior of Always Allow rules?
Explanation
Azure Virtual Network Manager security admin rules with Always Allow action completely bypass Network Security Group evaluation for matching traffic. This ensures that critical management traffic is never blocked by NSG configurations, regardless of NSG rule priorities or deny rules. Always Allow provides the highest level of access assurance and is specifically designed to override any conflicting NSG rules for essential connectivity requirements.
3. An administrator is configuring an internal Standard Load Balancer. They want the load balancer to be resilient to the failure of a single availability zone within a region. What is the key characteristic of the load balancer's frontend IP configuration that enables this?
Explanation
For a Standard Load Balancer (both public and internal) to be resilient to a zone failure, its frontend IP configuration must be set to 'Zone-redundant'. This creates a single, logical IP address that is active in all zones simultaneously. If one zone fails, the frontend remains available in the healthy zones, and the load balancer continues to distribute traffic to the healthy backend VMs in those zones.
4. Blue Yonder Airlines has a network security group assigned to a subnet containing three virtual machines: FlightVM1, FlightVM2, and FlightVM3. FlightVM1 and FlightVM2 receive traffic correctly, but FlightVM3 doesn't receive traffic on the same ports. You suspect traffic blocking and need to use Azure Network Watcher to determine if traffic to FlightVM3 is blocked. What should you use for diagnosis?
Explanation
Effective security rules analysis in Azure Network Watcher shows all NSG rules that apply to a specific virtual machine, including rules from both subnet-level and network interface-level NSGs. This tool displays the combined effect of all security rules in the traffic flow path, making it the ideal choice for diagnosing why FlightVM3 might be blocked while other VMs in the same subnet receive traffic normally.
5. A healthcare organization has an Azure setup in the West US region. It includes two virtual networks, 'VNet-Clinical' and 'VNet-Admin'. They also have three private DNS zones: 'clinical.records.com' is linked to VNet-Clinical, 'admin.billing.com' is linked to VNet-Admin, and 'internal.hr.com' has no virtual network links. A plan is in place to deploy an Azure Private DNS Resolver named 'CentralResolver' in the West US region. The resolver will be associated with 'VNet-Admin' and its inbound endpoint will be placed on a subnet within 'VNet-Admin'. Which of the private DNS zones will this resolver be able to resolve queries for?
Explanation
An Azure Private DNS Resolver's inbound endpoint can only resolve names for private DNS zones that are explicitly linked to the virtual network where the resolver itself is deployed.[15][16][17][18] In this scenario, the resolver 'CentralResolver' and its inbound endpoint are located in 'VNet-Admin'. Since only the 'admin.billing.com' zone has a virtual network link to 'VNet-Admin', the resolver can only process queries for that specific zone. It cannot resolve names in 'clinical.records.com' because it is not linked to VNet-Admin, and it cannot resolve 'internal.hr.com' because it is not linked to any VNet.
Microsoft Certified: Azure for SAP Workloads Specialty (AZ-120)
AZ-120 · 582 questions
Microsoft Certified: Azure Fundamentals (AZ-900)
AZ-900 · 382 questions
Microsoft Certified: Azure Solutions Architect Expert (AZ-305)
AZ-305 · 530 questions
Microsoft Certified: Azure Security Engineer Associate (AZ-500)
AZ-500 · 469 questions
Microsoft Certified: AI Business Professional (AB-730)
AB-730 · 699 questions
Microsoft Certified: AI Transformation Leader (AB-731)
AB-731 · 700 questions
$17.99
One-time access to this exam