Microsoft AZ-700: Azure Network Engineer Associate Practice Exam
Cover all five AZ-700 skill areas — core networking infrastructure, connectivity services, application delivery, network security, and private access — with design-and-implement scenario questions, immediate feedback in Learn mode, and full timed simulation in Exam mode.
Start 24-hour free trial →AZ-700 exam at a glance
- Vendor
- Microsoft (Azure)
- Exam code
- AZ-700 (Designing and Implementing Microsoft Azure Networking Solutions)
- Certification
- Microsoft Certified: Azure Network Engineer Associate
- Level
- Associate (role-based; networking specialization)
- Blueprint
- Skills measured as of July 27, 2026 (current edition)
- Format
- Typically 40–60 questions; multiple choice, multiple response, drag-and-drop, and case studies
- Duration
- About 100 minutes
- Passing score
- 700 of 1000 (scaled, not a raw percentage)
- Delivery
- Pearson VUE test center or online proctored
- Recommended experience
- Experience creating and managing Azure compute, storage, and networking resources, plus networking fundamentals (name resolution, protocols, address management); AZ-104-level background is the usual on-ramp
- Cost (USD)
- $165 USD list price (associate tier; varies by region)
- Validity
- Valid one year; renewed free via an online assessment on Microsoft Learn
Source: Microsoft Learn — AZ-700 study guide (skills measured) and the Azure Network Engineer Associate certification page. Verify current details with Microsoft before scheduling.
About the Microsoft Certified: Azure Network Engineer Associate certification
AZ-700 validates that you can design and implement Azure networking solutions — core virtual-network infrastructure, hybrid connectivity, load balancing and application delivery, private access to Azure services, and network security. It is a specialization exam for network professionals: expect deep, scenario-based questions on VNets and subnetting, DNS, routing and NAT, VPN and ExpressRoute, Virtual WAN, Load Balancer, Application Gateway and Front Door, Private Link, and Azure Firewall. The single exam earns the Azure Network Engineer Associate certification.
AZ-700 is an active exam (current edition dated July 27, 2026, with only minor changes from the prior version). It is not an entry point: Microsoft expects hands-on Azure experience and solid networking fundamentals, and the usual on-ramp is the AZ-104 Azure Administrator route. If you are brand new to Azure, start with AZ-900 Azure Fundamentals first. AZ-700 also pairs naturally with the AZ-305 Solutions Architect Expert exam, deepening the networking design that AZ-305 touches at a higher level.
Every PowerKram practice question maps to one of the five AZ-700 skill areas and links to the specific Microsoft Learn page it was derived from, so your weak spots become a focused reading list rather than a guess.
AZ-700 skill areas and weights
Five skill areas, with core networking infrastructure the single heaviest at 25–30%. Microsoft published each area as a weighting range rather than an exact percentage; the ranges below are reproduced as Microsoft stated them in the current edition.
IP addressing and segmentation (VNets, subnets, subnet delegation, public IP prefixes); name resolution (Azure DNS public and private zones, DNS Private Resolver); VNet connectivity and routing (peering, user-defined routes, Route Server, NAT Gateway, Virtual Network Manager); and network monitoring with Network Watcher and Azure Monitor.
Site-to-site VPN (gateway SKUs, policy- versus route-based, IPsec/IKE); point-to-site VPN (tunnel types, authentication including Microsoft Entra ID and RADIUS); Azure ExpressRoute (connectivity models, peering, Global Reach, FastPath, Direct); and Azure Virtual WAN architecture with virtual hubs.
Azure Load Balancer (public versus internal, regional versus cross-region, SKUs, rules, SNAT) and Traffic Manager; Azure Application Gateway (backend pools, health probes, listeners, routing rules, TLS); and Azure Front Door (routing, origins, TLS, caching, rules, Private Link origins).
Network security groups and application security groups (rules, flow logs, IP flow verify); Azure Firewall and Firewall Manager (SKUs, rules, policies, secure hub in Virtual WAN); and Web Application Firewall (detection versus prevention, rule sets on Front Door and Application Gateway).
Azure Private Link service and private endpoints (planning, creation, access, DNS integration, on-premises client access); and service endpoints (when to use them, service endpoint policies, and configuring access).
Source: Microsoft Learn — AZ-700 study guide (skills measured, as of July 27, 2026). Microsoft published weightings as ranges; core networking infrastructure is the heaviest area.
Who AZ-700 is for
Azure Network Engineer Associate is aimed at professionals who plan, implement, and manage Azure networking:
- Network engineers and administrators specializing in Azure networking — connectivity, routing, DNS, and security.
- Cloud engineers and infrastructure staff who own hybrid connectivity, VPN and ExpressRoute, and virtual-network design.
- Solutions architects who need deep networking implementation skill beneath their design work.
- Security and DevOps engineers responsible for network segmentation, firewalls, and private access to Azure services.
AZ-700 is not an entry point. Microsoft expects hands-on Azure experience and networking fundamentals (name resolution, protocols, address management); the standard on-ramp is the AZ-104 Azure Administrator route, and newcomers should take AZ-900 Azure Fundamentals first. For the roles this credential supports — with skills, tools, and salary ranges — see the Network Engineer career path.
What this AZ-700 practice exam delivers
Learn mode
Get the correct answer, the reasoning, and a direct link to the exact Microsoft Learn page each question was derived from — immediately after each question. Built for the service-selection and configuration scenarios AZ-700 tests across VPN, ExpressRoute, load balancing, and private access.
Exam mode
A timed run in the AZ-700 shape — roughly 40 to 60 questions in about 100 minutes, including case studies — so you build pacing for the exam’s scenario-heavy networking format.
Source-linked explanations
Every answer cites the exact Microsoft Learn documentation page it was built from — so you can verify networking service behavior and configuration, not just memorize.
Score by skill area
Results break down by the five AZ-700 areas — core infrastructure, connectivity, application delivery, network security, and private access — so practice tells you exactly which area to revisit.
Sample AZ-700 practice questions
Ten free questions across the five AZ-700 skill areas, with full explanations and source links to the Microsoft Learn pages each is derived from. The complete bank is available with the 24-hour trial.
Two virtual networks in the same Azure region must communicate privately over the Microsoft backbone with low latency, without a VPN gateway or public internet.
Which Azure networking feature should you implement?
- VNet peering
- A site-to-site VPN
- An ExpressRoute circuit
- A public load balancer
Show answer & explanation
Correct: A — VNet peering. VNet peering connects two virtual networks privately over the Microsoft backbone with low latency and no gateway or public internet — exactly the requirement. Regional peering covers same-region VNets; global peering covers cross-region.
Why not the others: a site-to-site VPN (B) connects Azure to on-premises over IPsec, not VNet-to-VNet on the backbone; ExpressRoute (C) is private on-premises connectivity; a public load balancer (D) distributes inbound traffic, not VNet interconnect.
Source: Microsoft Learn — Azure Virtual Network → Further reading: PowerKram — AZ-104 Azure Administrator →Resources in a virtual network must resolve custom internal hostnames that are not published to the public internet, with records managed inside Azure.
Which solution should you implement?
- An Azure public DNS zone
- A user-defined route
- A network security group rule
- An Azure private DNS zone linked to the VNet
Show answer & explanation
Correct: D — an Azure private DNS zone linked to the VNet. A private DNS zone provides name resolution for internal hostnames within one or more linked VNets, without exposing records publicly — exactly the requirement.
Why not the others: a public DNS zone (A) publishes records to the internet; a user-defined route (B) controls traffic paths, not name resolution; an NSG rule (C) filters traffic, not DNS.
Source: Microsoft Learn — Azure DNS zones and records →You must force all outbound internet traffic from a subnet through a network virtual appliance for inspection, overriding Azure’s default system routes.
Which mechanism should you use?
- A service endpoint
- VNet peering
- A user-defined route (UDR)
- A private endpoint
Show answer & explanation
Correct: C — a user-defined route (UDR). UDRs override Azure’s default system routes to send subnet traffic to a next hop such as a network virtual appliance for inspection — exactly the forced-tunneling scenario described.
Why not the others: a service endpoint (A) and a private endpoint (D) control private access to Azure PaaS services, not traffic routing through an NVA; VNet peering (B) connects VNets but does not redirect outbound traffic.
Source: Microsoft Learn — User-defined routes → Further reading: PowerKram — AZ-305 Solutions Architect Expert →An enterprise needs a private, high-bandwidth, low-latency connection between its on-premises datacenter and Azure that does not traverse the public internet.
Which connectivity solution should you recommend?
- A point-to-site VPN
- VNet peering
- Azure ExpressRoute
- Azure Front Door
Show answer & explanation
Correct: C — Azure ExpressRoute. ExpressRoute provides a private, high-bandwidth, low-latency connection from on-premises to Azure through a connectivity provider, bypassing the public internet — exactly the requirement.
Why not the others: a point-to-site VPN (A) connects individual client devices over the internet; VNet peering (B) connects Azure VNets; Front Door (D) is a global web-application entry point, not private hybrid connectivity.
Source: Microsoft Learn — Azure ExpressRoute → Further reading: PowerKram — AZ-305 Solutions Architect Expert →A global enterprise wants a unified hub-and-spoke architecture that centralizes VPN, ExpressRoute, and inter-hub transit across many regions, managed by Microsoft.
Which Azure solution should you recommend?
- Azure Virtual WAN
- A single large VNet
- Azure Bastion
- Azure DNS Private Resolver
Show answer & explanation
Correct: A — Azure Virtual WAN. Virtual WAN provides a Microsoft-managed hub-and-spoke backbone that unifies site-to-site and point-to-site VPN, ExpressRoute, and inter-hub transit across regions — exactly the global topology described.
Why not the others: a single large VNet (B) does not scale across regions or unify hybrid links; Azure Bastion (C) provides secure VM access; DNS Private Resolver (D) handles hybrid name resolution, not WAN transit.
Source: Microsoft Learn — Azure Virtual WAN →A web application needs layer-7 load balancing within a region with URL path-based routing, SSL termination, and an integrated web application firewall.
Which Azure service should you recommend?
- Azure Load Balancer
- Azure Application Gateway
- Azure Traffic Manager
- Azure NAT Gateway
Show answer & explanation
Correct: B — Azure Application Gateway. Application Gateway is the regional layer-7 (HTTP/S) load balancer with URL path-based routing, SSL/TLS termination, and an optional integrated WAF — exactly the requirement.
Why not the others: Azure Load Balancer (A) is layer-4 (TCP/UDP) with no URL routing or WAF; Traffic Manager (C) is DNS-based global routing; NAT Gateway (D) handles outbound SNAT, not inbound web load balancing.
Source: Microsoft Learn — Azure Load Balancer → Further reading: PowerKram — AZ-500 Azure Security Engineer →A global web application needs a single entry point that provides edge caching, TLS termination close to users, and fast global routing to the nearest healthy backend.
Which Azure service should you recommend?
- An internal load balancer
- A network security group
- A private endpoint
- Azure Front Door
Show answer & explanation
Correct: D — Azure Front Door. Front Door is the global entry point providing edge caching, TLS termination near users, traffic acceleration, and routing to the nearest healthy origin — exactly the global web-delivery requirement.
Why not the others: an internal load balancer (A) is regional and private; an NSG (B) filters traffic; a private endpoint (C) provides private access to a PaaS service, not global web delivery.
Source: Microsoft Learn — Azure Front Door →You need a centralized, managed, stateful firewall with FQDN filtering and threat intelligence to control traffic across many virtual networks from one policy.
Which Azure service should you recommend?
- Network security groups alone
- Azure Firewall
- Azure Private Link
- A user-defined route
Show answer & explanation
Correct: B — Azure Firewall. Azure Firewall is the centralized, managed, stateful network firewall with application (FQDN) and network rules, threat intelligence, and centralized policy across VNets — exactly the requirement. NSGs handle basic subnet filtering beneath it.
Why not the others: NSGs alone (A) offer only basic per-rule allow/deny without FQDN filtering or threat intelligence; Private Link (C) provides private service access; a UDR (D) routes traffic but does not inspect or filter it.
Source: Microsoft Learn — Azure Firewall → Further reading: PowerKram — AZ-500 Azure Security Engineer →A team must protect a public web application from common exploits such as SQL injection and cross-site scripting at the application layer.
Which Azure capability should you recommend?
- A network security group
- Azure Bastion
- A Web Application Firewall (WAF)
- A service endpoint
Show answer & explanation
Correct: C — a Web Application Firewall (WAF). A WAF, deployed on Application Gateway or Front Door, protects web applications from common layer-7 exploits such as SQL injection and cross-site scripting using managed rule sets — exactly the requirement.
Why not the others: an NSG (A) filters by IP, port, and protocol, not application-layer attacks; Azure Bastion (B) provides secure VM access; a service endpoint (D) provides private access to Azure services.
Source: Microsoft Learn — Web Application Firewall →You must let resources in a VNet reach an Azure Storage account over a private IP inside the VNet, with no exposure to the public internet.
Which solution should you implement?
- A public IP address on the storage account
- An Azure private endpoint (Azure Private Link)
- A user-defined route to the internet
- Azure Traffic Manager
Show answer & explanation
Correct: B — an Azure private endpoint (Azure Private Link). A private endpoint assigns a private IP inside the VNet that connects to the Azure PaaS service (such as Storage) over the Microsoft backbone, with no public exposure — exactly the private-access requirement.
Why not the others: a public IP (A) does the opposite by exposing the service; a UDR to the internet (C) routes traffic publicly; Traffic Manager (D) is DNS-based routing, not private access.
Source: Microsoft Learn — Azure Private Link →Keep going: study & career resources
AZ-700 is the networking specialization on the Azure role-based track. Below it, the administrator route builds the base; alongside it, the architect and security exams connect to its design and security areas — and the network-engineer career track shows where these skills lead.
Deep dive: AZ-700 format, the five areas, renewal, and study path
Exam format and scoring
AZ-700 delivers roughly 40 to 60 questions in about 100 minutes, with a passing score of 700 out of 1000 (scaled). It includes multiple choice, multiple response, drag-and-drop, and one or more case studies. It is a hands-on networking exam: expect scenarios about choosing and configuring the right connectivity, routing, load-balancing, or security service for a stated requirement. There is no penalty for wrong answers. See the AZ-305 Solutions Architect path →
The five skill areas
Core networking infrastructure is the heaviest area (VNets, IP addressing, DNS, routing, NAT, and monitoring). Connectivity services covers hybrid links: site-to-site and point-to-site VPN, ExpressRoute, and Virtual WAN. Application delivery covers Load Balancer, Traffic Manager, Application Gateway, and Front Door. Network security covers NSGs, Azure Firewall, and WAF. Private access covers Private Link, private endpoints, and service endpoints. Knowing which service fits a requirement — and how to configure it — is the core AZ-700 skill. See the AZ-500 Azure Security path →
VPN, ExpressRoute, and Virtual WAN
The connectivity area is where many candidates lose points, because the choices are close. Site-to-site VPN connects whole networks over IPsec; point-to-site connects individual clients; ExpressRoute provides private, high-bandwidth links that bypass the internet; and Virtual WAN unifies all of these into a managed global hub-and-spoke backbone. AZ-700 tests when each is appropriate and how to configure gateways, SKUs, peering, and routing. See the AZ-104 Administrator path →
Realistic study path
Most candidates come to AZ-700 with Azure administration experience (often AZ-104) and need four to eight weeks of networking-focused study. Work through the official Microsoft Learn AZ-700 learning path with an Azure free account, build labs for each area (VNet peering, a VPN gateway, an Application Gateway with WAF, a private endpoint), then drill scenario questions in PowerKram’s Learn mode and finish with timed Exam-mode runs. Spend the most time on core infrastructure and connectivity, since together they are roughly half the exam. See the AZ-900 Azure Fundamentals path →
Cost, renewal, and scheduling
List price is $165 USD (associate tier; regional pricing varies). The Azure Network Engineer Associate certification is valid for one year and is renewed free through an online assessment on Microsoft Learn during the six months before it expires. The exam is delivered through Pearson VUE at a test center or online with a proctor. Microsoft sometimes offers discounted or free vouchers through Virtual Training Day events. Azure Network Engineer Associate certification page →
Career outlook and next steps
AZ-700 validates specialized Azure networking skills that map to cloud network engineer and connectivity specialist roles. It pairs naturally with AZ-305 (Solutions Architect Expert) for architects who need networking depth, and with AZ-500 (Azure Security Engineer) for the network-security overlap. For network professionals moving to the cloud, it is a strong specialization credential. Career Hub — Network Engineer →
Microsoft AZ-700 (Azure Network Engineer Associate) exam FAQ
What are the AZ-700 skill areas and weights?
Is AZ-700 still active?
Does AZ-700 have prerequisites?
What is the AZ-700 passing score and format?
Does the certification expire?
Start your free 24-hour AZ-700 practice trial
Full access to the question bank, both study modes, source-linked explanations, and score-by-skill-area. No credit card required.
Start free trial →