AZ-700: Designing and Implementing Microsoft Azure Networking Solutions

AZ-700 exam objectives and study guide

The skills measured on the AZ-700 exam, by objective domain. Percentages are the share of the exam each domain carries.

AZ-700 practice questions and answers

10 free sample questions from the AZ-700 bank, with the correct answer and a full explanation for each. These are original questions written to the Microsoft objective domains — not real exam content.

1. Question 1Design and implement application delivery services

   Coho Vineyard needs per-request troubleshooting data for an Azure Front Door Standard profile. Operations must send every Front Door request and failed health probe details to a Log Analytics workspace. Which two diagnostic log categories should they enable?

   • AFrontDoorAccessLog
   • BFrontDoorHealthProbeLog
   • CNSGFlowEvent
   • DBuilt-in Azure Front Door reports only
   • ETraffic Manager endpoint monitor logs

   Show answer and explanation

   Correct answers

   • FrontDoorAccessLog
   • FrontDoorHealthProbeLog

   Explanation

   Enable the FrontDoorAccessLog and FrontDoorHealthProbeLog diagnostic log categories. Azure Front Door can log each request and failed health probes, and diagnostic settings can send these logs to destinations such as Log Analytics.

   NSG flow logs and Traffic Analytics report network flow data for virtual networks, not Azure Front Door edge requests. Built-in Azure Front Door reports are useful for analysis but do not replace per-request diagnostic logs in Log Analytics. Traffic Manager endpoint monitoring is for Traffic Manager profiles, not Azure Front Door health probe logs.

   References:

   • Configure Azure Front Door Logs
   • Monitor Azure Front Door
   • Azure Front Door Overview
2. Question 2Design and implement Azure network security services

   A regional landing zone uses Azure Virtual Network Manager to publish a security admin configuration to development and production VNets. The platform team wants to document how these rules interact with workload NSGs before delegating NSG management to application teams. Which statements are correct? Select all that apply.

   • AA Deny security admin rule blocks matching traffic before NSG rules are evaluated, so a workload NSG Allow rule cannot permit the same flow.
   • BAn Always allow security admin rule permits matching traffic and prevents later NSG rules from blocking the same flow.
   • CAn Allow security admin rule permits matching traffic to continue to NSG evaluation, where an NSG Deny rule can still block it.
   • DSecurity admin rules are stored as high-priority security rules inside each NSG associated with the targeted subnets.
   • EDeploying a security admin configuration to one Azure region applies it to every Azure region in the network manager scope.
   • FA connectivity configuration must be deployed for the same network group before any security admin rules can be evaluated.

   Show answer and explanation

   Correct answers

   • A Deny security admin rule blocks matching traffic before NSG rules are evaluated, so a workload NSG Allow rule cannot permit the same flow.
   • An Always allow security admin rule permits matching traffic and prevents later NSG rules from blocking the same flow.
   • An Allow security admin rule permits matching traffic to continue to NSG evaluation, where an NSG Deny rule can still block it.

   Explanation

   Security admin rules are evaluated before NSG rules. The action determines whether NSG evaluation can still affect the traffic.

   • Deny blocks matching traffic before NSG evaluation, so an NSG allow cannot override it.
   • Always allow allows matching traffic and bypasses NSG evaluation, so an NSG deny cannot block it.
   • Allow permits matching traffic to continue to NSG evaluation, where NSG rules can still allow or deny the flow.
   • Security admin rules are not stored as high-priority rules inside NSGs; they are Azure Virtual Network Manager configuration objects.
   • Deployments are targeted to selected regions, not automatically to every region in scope.
   • Connectivity configurations are independent of security admin configurations; peering isn't required for security admin rules to be evaluated on a managed VNet.

   References:

   • Security admin rules in Azure Virtual Network Manager
   • Manage Configuration Deployments in Azure Virtual Network Manager
   • Azure network security groups overview
3. Question 3Design and implement Azure network security services

   Fabrikam tags production virtual networks with Environment=Production across several subscriptions. Future production VNets that are inside the Azure Virtual Network Manager scope must be brought under the same central security admin baseline with minimal manual membership maintenance. Which approach should you implement?

   • ACreate a dynamic membership condition on an Azure Virtual Network Manager network group that matches the production tag, associate the group with the security admin rule collection, and deploy the configuration to the target regions.
   • BCreate a static Azure Virtual Network Manager network group and add each production VNet resource ID whenever a new workload is deployed.
   • CAssign an Azure Policy initiative that audits production VNets for missing NSG rules and sends noncompliant resources to Microsoft Defender for Cloud.
   • DCreate a mesh connectivity configuration for all VNets that have the production tag so that the VNets inherit the same peering state.

   Show answer and explanation

   Correct answer

   • Create a dynamic membership condition on an Azure Virtual Network Manager network group that matches the production tag, associate the group with the security admin rule collection, and deploy the configuration to the target regions.

   Explanation

   Azure Virtual Network Manager network groups can use dynamic membership conditions, such as tag-based conditions, to group VNets for configurations. Associating that network group with a security admin rule collection lets the central baseline target production VNets without manually listing each VNet.

   • Dynamic network group membership based on the production tag is the correct approach.
   • Static membership works but requires manual updates for every future VNet.
   • An Azure Policy initiative that audits NSG rules doesn't deploy Azure Virtual Network Manager security admin rules.
   • A connectivity mesh configuration manages peering between VNets and doesn't create the security baseline.

   References:

   • What is a network group in Azure Virtual Network Manager?
   • Security admin rules in Azure Virtual Network Manager
   • Manage Configuration Deployments in Azure Virtual Network Manager
4. Question 4Design and implement Azure network security services

   A regional landing zone must keep Azure Firewall egress controls consistent across 12 hub virtual networks in three subscriptions. The security team owns mandatory deny rules, while application teams need a supported way to add approved allow rules for their own workloads without editing the mandatory baseline. Which design should you implement?

   • ACreate a parent Azure Firewall Policy for the mandatory rule collection groups and create child firewall policies for team-specific rules; associate the child policies with the regional firewalls.
   • BConfigure classic rule collections directly on each Azure Firewall and allow application teams to update only the rule collections that contain their workloads.
   • CCreate one standalone Azure Firewall Policy per subscription and use Azure Policy to audit that each policy contains the required rule collection names.
   • DAssociate the same editable Azure Firewall Policy with all firewalls and allow application teams to add their own rule collection groups to that policy.

   Show answer and explanation

   Correct answer

   • Create a parent Azure Firewall Policy for the mandatory rule collection groups and create child firewall policies for team-specific rules; associate the child policies with the regional firewalls.

   Explanation

   Use Azure Firewall Manager with a parent Azure Firewall Policy for the mandatory baseline and child firewall policies for regional or workload-specific rule collections. This provides centralized management and lets child policies add rules without changing the parent baseline.

   • Direct classic rules on each firewall do not provide central inheritance and increase configuration drift.
   • Auditing standalone policies with Azure Policy does not enforce rule processing or inheritance.
   • A single shared editable policy allows workload teams to affect the same policy that contains the baseline.
   • Parent and child firewall policies are the supported hierarchy for combining central and delegated rules.

   References:

   • What is Azure Firewall Manager?
   • Azure Firewall Manager policy overview
   • Azure Firewall rule processing logic
5. Question 5Design and implement Azure network security services

   Trey Research operates hub virtual networks and Azure Virtual WAN hubs in separate subscriptions. The network team wants a central service that can apply common Azure Firewall rule collections to both deployment models. Which service should the team use?

   • AAzure Firewall Manager
   • BAzure Virtual Network Manager
   • CAzure Policy
   • DAzure Network Watcher

   Show answer and explanation

   Correct answer

   • Azure Firewall Manager

   Explanation

   Azure Firewall Manager provides centralized management for Azure Firewalls across multiple subscriptions and supports firewalls deployed in both hub virtual networks and Virtual WAN secured virtual hubs.

   • Azure Virtual Network Manager centralizes connectivity and security admin rules for virtual networks, but it does not manage Azure Firewall rule collections.
   • Azure Policy can audit or deploy configurations, but it is not the operational management plane for Azure Firewall policies and secured virtual hubs.
   • Network Watcher is used for network monitoring, diagnostics, and troubleshooting, not for centralized Azure Firewall policy management.

   References:

   • What is Azure Firewall Manager?
   • What is Azure Firewall?
6. Question 6Design and implement Azure network security services

   Aisha, a platform security engineer, notices that traffic is denied even though a workload team added a child Firewall Policy rule collection that allows TCP 443 to a partner subnet. The parent Firewall Policy contains a network rule collection that denies traffic to the partner address range. Why is the traffic denied?

   • AThe parent Firewall Policy is evaluated before the child Firewall Policy, so the parent deny rule is applied first.
   • BThe child rule collection priority must be numerically higher than the parent rule collection priority to allow the traffic.
   • CApplication rule collections are evaluated before network rule collections, so the child network rule is skipped.
   • DAzure Firewall Manager evaluates associated policies in alphabetical order by policy name.

   Show answer and explanation

   Correct answer

   • The parent Firewall Policy is evaluated before the child Firewall Policy, so the parent deny rule is applied first.

   Explanation

   In Azure Firewall Policy inheritance, parent policy rules are processed before child policy rules. A child policy allow rule cannot override a matching deny rule that has already been applied by the parent policy.

   • A lower numeric priority in the child policy does not make the child policy run before the parent policy.
   • Network rules are processed before application rules, but the decisive behavior here is parent policy precedence.
   • Firewall Policy processing is based on policy inheritance, rule collection group priority, rule collection priority, and rule type processing, not alphabetical policy names.

   References:

   • Azure Firewall rule processing logic
   • What is Azure Firewall Manager?
7. Question 7Design and implement Azure network security services

   During a design review, you are asked which subnet must exist in a hub virtual network before an Azure Firewall instance can be deployed to that virtual network. Which subnet name should be used?

   • A`AzureFirewallSubnet`
   • B`GatewaySubnet`
   • C`AzureBastionSubnet`
   • D`AzureFirewallManagementSubnet`

   Show answer and explanation

   Correct answer

   • `AzureFirewallSubnet`

   Explanation

   Azure Firewall deployed to a virtual network requires a dedicated subnet named AzureFirewallSubnet.

   • GatewaySubnet is used by Azure VPN Gateway and ExpressRoute gateway.
   • AzureBastionSubnet is used by Azure Bastion.
   • AzureFirewallManagementSubnet is used for the separate management path in forced tunneling deployments, not as the primary firewall subnet.

   References:

   • Deploy and configure Azure Firewall using Azure CLI
   • Azure Firewall forced tunneling
   • What is Azure Firewall?
8. Question 8Design and implement Azure network security services

   Soo-min, a network automation engineer, must create a Firewall Policy for a regional egress firewall. The policy must support TLS inspection and IDPS, and traffic that matches Microsoft threat intelligence must be blocked. Complete the PowerShell command.

   New-AzFirewallPolicy `
     -Name "pol-egress" `
     -ResourceGroupName "rg-network" `
     -Location "eastus" `
     -SkuTier 1 `
     -ThreatIntelMode 2

   Blank 1

   • APremium
   • BStandard
   • CBasic

   Blank 2

   • ADeny
   • BAlert
   • COff

   Show answer and explanation

   Correct answers

   • Blank 1: Premium
   • Blank 2: Deny

   Explanation

   -SkuTier Premium creates a policy tier that supports advanced Azure Firewall capabilities such as TLS inspection and IDPS. -ThreatIntelMode Deny configures the policy to block traffic that matches Microsoft threat intelligence.

   For blank 1, Standard and Basic are real Azure Firewall tiers, but they do not satisfy the TLS inspection and IDPS requirement. For blank 2, Alert logs threat intelligence matches without blocking them, and Off disables threat intelligence filtering.

   References:

   • New-AzFirewallPolicy (Az.Network)
   • Azure Firewall features by SKU
   • Azure Firewall Premium features implementation guide
9. Question 9Design and implement Azure network security services

   Nadia, a network operations lead, is defining where Azure Firewall Manager can apply Firewall Policy to manage Azure Firewall rule collections. Which deployment types are supported? Select all that apply.

   • AAzure Firewall deployed in a hub virtual network
   • BAzure Firewall deployed in an Azure Virtual WAN secured virtual hub
   • CApplication Gateway WAF_v2 associated with a listener-level WAF policy
   • DNetwork security groups associated with workload subnets
   • EAzure Bastion deployed in a virtual network

   Show answer and explanation

   Correct answers

   • Azure Firewall deployed in a hub virtual network
   • Azure Firewall deployed in an Azure Virtual WAN secured virtual hub

   Explanation

   Azure Firewall Manager supports Azure Firewall deployments in both hub virtual networks and Azure Virtual WAN secured virtual hubs. Firewall Policy is the policy object used to apply common Azure Firewall configurations and rule collections to those firewalls.

   • Application Gateway WAF_v2 uses WAF policies, not Azure Firewall Policy for Azure Firewall rule collections.
   • Network security groups are managed separately and do not become Azure Firewall deployments.
   • Azure Bastion provides secure administrative connectivity and is not an Azure Firewall deployment target.

   References:

   • What is Azure Firewall Manager?
   • What is Azure Firewall?
   • What Is Azure Web Application Firewall on Azure Application Gateway?
10. Question 10Design and implement private access to Azure services

    Nadia, a network operations lead, observes that branch office clients connected by ExpressRoute private peering still resolve a storage account blob endpoint to a public IP address. A private endpoint for the storage account's blob subresource is already approved in a spoke virtual network, and public network access to the storage account will be blocked. What should Nadia configure so branch clients use the private endpoint?

    • AConfigure conditional DNS forwarding for the Private Link storage zone to a resolver that can resolve the private DNS zone linked to the spoke virtual network.
    • BEnable ExpressRoute Microsoft peering and advertise the Azure Storage public prefixes to the branch routers.
    • CEnable a Microsoft.Storage service endpoint on the subnet that contains the storage account private endpoint.
    • DAssociate a NAT gateway with the private endpoint subnet so the storage account receives traffic from a private source address.
    • EAdd a route for the storage account public IP range with the ExpressRoute gateway as the next hop.

    Show answer and explanation

    Correct answer

    • Configure conditional DNS forwarding for the Private Link storage zone to a resolver that can resolve the private DNS zone linked to the spoke virtual network.

    Explanation

    Private endpoints require name resolution that returns the private endpoint IP address. For Azure Storage blob endpoints, that commonly means using the privatelink.blob.core.windows.net private DNS zone linked to the virtual network and configuring on-premises conditional forwarding, such as to DNS servers or Azure DNS Private Resolver, so branch clients can resolve the storage FQDN to the private IP. Private Link can be used from on-premises over ExpressRoute private peering; ExpressRoute Microsoft peering is not required.

    • ExpressRoute Microsoft peering would reach Microsoft public endpoints, not cause the storage account name to resolve to the private endpoint IP.
    • A Microsoft.Storage service endpoint changes the source identity of traffic from an Azure subnet to supported PaaS services; it does not solve on-premises DNS resolution for an existing private endpoint.
    • A NAT gateway provides outbound internet SNAT for a subnet and does not change private endpoint DNS or cause traffic to use the endpoint.
    • Adding a route for the storage account public IP range would continue to target public service addresses instead of the private endpoint IP.

    References:

    • Azure Private Endpoint private DNS zone values
    • What is Azure Private Link?
    • What is a private endpoint?

Membership includes 166 questions and explanations aligned to the AZ-700 curriculum, including 7 case studies.

Other Microsoft certifications

Every one of these is included with the same membership as AZ-700.

AB-900Microsoft

Microsoft 365 Copilot and Agent Administration Fundamentals

This exam is intended for candidates who are familiar with Microsoft 365, including core services, security, identity and access, data…

161 practice questionsView

AI-900Microsoft

Microsoft Azure AI Fundamentals

This exam measures knowledge of machine learning and AI concepts and related Microsoft Azure services. It is intended for candidates…

193 practice questionsView

AZ-900Microsoft

Microsoft Azure Fundamentals

This exam is intended for technology professionals who want to demonstrate foundational knowledge of cloud concepts and Microsoft Azure.…

170 practice questionsView

AZ-700 exam FAQ