Networking practice round

{{ summaryValue }}

{{ summaryLine }}

Build an AZ-700 practice round

Unofficial preparation for Designing and Implementing Microsoft Azure Networking Solutions (AZ-700). Skills measured from July 27, 2026 · verified September 11, 2026. Independently authored; not affiliated with or endorsed by Microsoft.

35 curated English scenarios span the five skill areas. Uniform sampling without replacement; no blueprint weighting. Fixed scenario difficulty is uncalibrated. This untimed, single-answer practice covers selected objectives, not the full blueprint or hands-on tasks. The official proctored exam allows 100 minutes and may include interactive components.

Official dated study guide · Exam details and eligibility guidance

Expected background: experience managing Azure compute, storage and networking, plus DNS, protocols and address management. No prerequisite credential is listed on the exam page; verify booking requirements with Microsoft. This practice issues no credential. The associated certification renews annually.

Blueprint ranges: core networking 25–30%; connectivity 20–25%; application delivery 15–20%; private access 10–15%; network security 15–20%. These define exam scope, not this round’s sampling or score. Practise real Azure deployments alongside these conceptual scenarios.

Optional. Blank uses a stable default; a custom seed changes question and option order. Long seeds are bounded at complete Unicode characters. The active round keeps its own seed.

{{ seedNotice }}

{{ examSetupValidation }}

{{ answeredCount }} of {{ questionCount }} answered · {{ Math.round(progressPercent) }}%

{{ progressStatusLine }}

Question {{ examCursor + 1 }} of {{ questionCount }}

{{ currentQuestion.stem }}

{{ currentQuestion.accessible_clue }}

Answer recorded. Corrections appear when you view results.

Review this practice round

{{ resultLead }}

AZ-700 · skills 2026-07-27 · original bank 2026.09.11. This score describes only these practice items; it is not an official scaled score, a pass prediction or evidence of certification. Microsoft and Azure names identify the exam and technologies; no endorsement is implied.

Active replay seed: {{ examSession.seed }}

This untimed, single-answer conceptual practice does not reproduce the official exam format or assess hands-on networking skills. The official exam may include interactive components. Practise deploying and troubleshooting Azure networks, and use Microsoft’s exam sandbox to explore the official interface and question formats.

{{ readinessReviewTitle }}

{{ readinessReviewLine }}

{{ card.label }}
{{ card.value }}
{{ card.note }}

Missed answer review

  1. {{ item.prompt }}

    Your answer: {{ item.selected_answer_label }}

    Correct answer: {{ item.correct_answer_label }}

    {{ item.explanation }}

    {{ item.source.label.split(' — ')[0] }} · {{ item.source.version }}

Domain performance

The chart shows correct and missed counts only for sampled domains. The study list covers all five official areas; an unsampled domain is unknown, not a zero score. Blueprint ranges do not weight these counts.

  • {{ domain.code }} · {{ domain.label }} ({{ domain.weight }})

    {{ domain.answerLine }}. {{ domain.study }}

Loading domain-performance chart…

{{ examChartStatus }}

{{ examChartExportStatus }}

Answer ledger

Question ID Prompt Topic Your answer Correct answer Outcome Explanation Source Copy
{{ row.question_id }} {{ row.prompt }} {{ row.category_label }}{{ row.category_id }} {{ row.selected_answer_label }}{{ row.selected_answer_id }} {{ row.correct_answer_label }}{{ row.correct_answer_id }} {{ row.outcome_label }} {{ row.explanation }} {{ row.source ? `${row.source.label.split(' — ')[0]} · ${row.source.version}` : 'Official guide' }}{{ sourceUrl(row.question_id) }}

{{ examLedgerExportStatus }}

Microsoft Azure Administrator Exam Prep Practise AZ-104 with 30 original Azure administration questions, documented explanations and repeatable rounds to focus your study.
IPv4 Subnetting Quiz Practice IPv4 subnetting from /0 to /32 with explained answers and repeatable rounds that let you retry only the questions you missed.
Internet Protocol version 4 (IPv4) Subnet Calculator Calculate an IPv4 subnet boundary from CIDR or a dotted mask, then check usable hosts, special-purpose ranges and reserve-adjusted capacity.
Static Route Commands Generator Generate reviewed static-route commands across host and network CLIs with CIDR normalization plus priority checks and rollback-ready delete output.

An Azure application can have a working route and still be unreachable because its hostname resolves to the wrong address, a security rule rejects the connection, or an application gateway considers its backend unhealthy. Azure network engineering involves following that whole journey. The design needs a path to the destination and back, suitable access controls, and a way to detect failures before they affect more users.

A virtual network (VNet) provides an address space for Azure resources, divided into smaller ranges called subnets. The Domain Name System (DNS) translates application names into addresses. Routes determine where traffic goes next, while a network security group (NSG) permits or denies matching network flows. These functions solve different problems. Changing a route does not repair a missing DNS record, and allowing a port does not make the application listening on that port healthy.

Connecting an office to Azure introduces another choice. A site-to-site virtual private network (VPN) connects networks through an encrypted tunnel over the internet. Point-to-site VPN connects individual remote clients. ExpressRoute provides private connectivity through a provider without using the public internet, but the private connection does not itself provide end-to-end encryption. Connectivity, encryption and redundancy each need to satisfy the stated requirements.

Application delivery depends on what must be distributed. Transmission Control Protocol (TCP) connections can be balanced using network addresses and ports. Hypertext Transfer Protocol (HTTP) requests can also be routed using application information such as a URL path. A global web entry point and a private frontend for an internal service are therefore different design requirements.

Requirement Suitable capability Important distinction
Private frontend for a raw TCP application Standard Azure Load Balancer with an internal frontend Distributes connections without using HTTP URL paths.
Regional web routing to different backend pools Application Gateway HTTP path-based routing The path rule applies to web requests, not arbitrary TCP data.
Global web delivery with caching and acceleration Azure Front Door Receives application traffic and routes it to an origin, the backend service.
Global endpoint selection through DNS Azure Traffic Manager The client connects to the selected endpoint; Traffic Manager is not the traffic proxy.

Private access to a managed service such as Azure Storage also requires precise terminology. A private endpoint provides a private network interface and address for a supported resource through Azure Private Link. A service endpoint instead identifies traffic from a configured Azure subnet while the service continues to use its public endpoint. Enabling either feature is not a substitute for configuring the service's access restrictions. In particular, creating a private endpoint does not automatically disable public access.

Operational checks matter as much as service selection. An approved private endpoint still needs correct name resolution. A redundant circuit needs working connections on both paths. After an NSG change, an existing connection can continue even though a new connection would be denied. Recognizing these distinctions prevents a successful but incomplete test from being mistaken for proof that a design meets its requirements.

AZ-700, Designing and Implementing Microsoft Azure Networking Solutions, is the exam associated with Microsoft Certified: Azure Network Engineer Associate. Its subject is planning, implementing and managing Azure networks, rather than simply recognizing cloud service names. The expected background includes experience with Azure compute, storage and networking resources, plus name resolution, protocols and address management. Question practice can expose gaps in that reasoning, but it cannot demonstrate that someone can deploy, troubleshoot or safely operate an Azure network. Practical deployments and failure investigations remain essential preparation.

How to Use This Tool:

The default is an untimed, five-question round from all domains with feedback after each answer. The available questions are 35 independently authored English scenarios, not official Microsoft examination questions. This practice is not affiliated with or endorsed by Microsoft.

  1. Choose a Domain / practice focus and Question count. All domains offers 5, 10, 20 or 35 questions. Core networking and connectivity each offer 5 or 8; application delivery and network security each offer 5 or 7; private access offers 5. Changing focus resets an incompatible count to 5.
    If Start exam practice is unavailable, choose an offered focus, feedback mode and question count.
  2. Choose Feedback timing. Learn — feedback after each answer reveals the correction and explanation immediately. Review — feedback at completion records the answer without showing whether it is correct until results. Both modes use the same scoring rule.
  3. Enter an optional Replay seed under Advanced when you need a repeatable round. Leaving it blank uses a stable default, not a newly randomized selection each time. Leading and trailing spaces are removed. Long seeds are shortened at complete Unicode characters to fit 128 UTF-16 code units, so some characters consume more than one unit. The active round keeps the seed it started with. To reproduce a round, keep its seed, settings and question-bank version unchanged.
  4. Select Start exam practice, read the scenario's requirements and choose one of the four answers. Selecting an answer records and locks it immediately. There is no separate submission step or opportunity to revise that recorded choice.
  5. Use Next question after answering, then View results after the last answer. Questions cannot be skipped to produce a completed result.
    End round discards the active answers and removes the saved attempt from the current URL. It returns to setup rather than grading an unfinished round.
  6. Review Missed answer review and the full Answer ledger. Read the explanation and its linked technical reference before choosing Retry missed. A Practise this domain action starts a five-question round for the chosen area.

Interpreting Results:

During a round, the headline counts answers recorded. In the final review, it changes to correct answers out of all questions. The progress percentage therefore describes completion, not accuracy. A fully answered round reaches 100% progress even when some answers are wrong.

Domain performance shows correct and missed counts for the domains sampled. A longer bar can simply mean that more questions came from that domain. The study list includes all five areas, and Not sampled in this round means no evidence was collected for that area, not that its score was zero. Use the missed explanations to identify a specific concept to revisit, and use an unsampled area's practice action to fill a coverage gap.

Replay same seed repeats the questions and option order of that attempt. Try a new seed changes the selection or ordering within the eligible questions, but can repeat previously seen items. A round containing an entire pool must reuse those questions. Retry missed scores a separate, smaller round rather than correcting the earlier score. Compare attempts with their question counts, focus and feedback mode in mind.

A Perfect round means every question in that round was answered correctly. It is not a readiness assessment or a pass prediction, especially after seeing the corrections. The scenarios have fixed, uncalibrated difficulty. Microsoft's technical exams use a scaled score from 1 to 1,000 with a passing score of 700 or greater; 700 is not equivalent to 70% correct. No conversion from this practice score to that official scale is provided.

Technical Details:

A routing answer may depend on the most specific destination prefix, while a security answer may depend on the first matching rule for a new connection. Those networking rules determine the correct choice. Practice scoring then gives each selected scenario equal value, regardless of its domain or apparent difficulty.

Points, accuracy and completion

Each correct answer earns one point. An incorrect answer earns zero, with no partial credit or negative marking. The total score equals the correct count, while accuracy and progress use different numerators.

S = C A = 100×CN P = 100×RN

S is the score in points, C is the correct-answer count, N is every question in the round, and R is the recorded-answer count. A is raw accuracy in percent and P is progress in percent. Possible points equal N, so the score ranges from 0 to N. An unanswered question remains in that denominator without being counted as incorrect.

The headline result uses exact integer counts. Raw accuracy and progress are unrounded. The visible progress percentage rounds to the nearest whole percent, with half-percent ties upward; this does not change the recorded answers or completion requirement. These conditions determine whether the final review is available and which review message appears; they do not define levels of exam readiness.

Condition Practice outcome Meaning
R < N Progress without a final review More answers are required before the final review.
R = N and C < N Start with the missed answers At least one recorded answer needs review.
R = N and C = N Perfect round There are no missed answers in this attempt.

Official objectives and the selected practice bank

The target is the English AZ-700 skills edition effective July 27, 2026. The question bank is dated September 11, 2026. The official percentage ranges describe examination emphasis, whereas the counts below describe the available original practice questions.

Skill area Official share Practice questions Selected subjects represented
Core networking infrastructure 25–30% 8 Addressing, routes, peering, DNS, outbound translation and diagnostics
Connectivity services 20–25% 8 VPN connections, route exchange, ExpressRoute redundancy and Virtual WAN
Application delivery services 15–20% 7 Load balancing, web routing, health probes, encryption and private origins
Private access to Azure services 10–15% 5 Private endpoints, DNS, service endpoints and publishing a Private Link service
Azure network security services 15–20% 7 NSGs, application security groups, Azure Firewall, web application firewall modes and Bastion

Selection is uniform without replacement within the chosen pool. No question repeats inside one round, but there are no official domain quotas, blueprint score weights or difficulty adjustments. Even all 35 questions cover only selected objectives. For example, there are no dedicated scenarios for Azure Route Server, Azure Virtual Network Manager or service endpoint policies, although those subjects appear in the official objectives.

The official exam is proctored, allows 100 minutes and may include interactive components. This practice is untimed and single-answer, with no deployment labs. Microsoft's exam sandbox provides a separate way to explore the official interface and question formats. The associated certification has a 12-month renewal frequency; completing this practice does not issue or renew a credential. Localized exam updates can follow a different schedule from the English edition.

Azure IPv4 subnet reservations

For an ordinary Azure Internet Protocol version 4 (IPv4) subnet, five addresses are reserved: the first four and the last. The maximum assignable address count before any resource allocations is the size of the address block minus those reservations.

H=232−p−5

p is an integer prefix length from 2 through 29, inclusive, for an ordinary supported Azure IPv4 subnet. H is the assignable address count before other allocations. The scenario 10.20.0.0/27 contains 32 addresses and leaves 27, from 10.20.0.4 through 10.20.0.30. Choosing 30 would subtract only two addresses and miss Azure's additional reservations. Existing allocations and service-specific subnet requirements need separate checking.

Route choice and security-rule order

A user-defined route (UDR) deliberately chooses a next hop. Border Gateway Protocol (BGP) exchanges reachable network prefixes between peers. For the ordinary usable routes and NSG-only situations described here, the deciding rules are as follows.

Situation Deciding rule Consequence
Usable BGP and user-defined routes both match a destination Choose the longest matching prefix first. A BGP 10.40.8.0/24 route beats a UDR 10.40.0.0/16 route for 10.40.8.10.
Ordinary routes have the same destination prefix Prefer UDR, then BGP, then system route. Route-source preference resolves an equal-prefix choice, not every overlapping-prefix choice.
Two rules in one NSG match a new flow Process lower priority numbers first and stop at the first match. A matching deny at priority 100 wins over a matching allow at 200.
Subnet and network-interface NSGs both apply to a new inbound flow Evaluate the subnet NSG, then the interface NSG; both must permit the flow. A subnet allow does not override an interface deny.
An allow rule is removed after a TCP connection was established NSGs retain state for established flows. The old connection can continue. Validate the changed policy using a new connection.

System routes for virtual networks, peering and service endpoints are preferred even over more-specific BGP routes. Service-endpoint routes cannot be overridden by a route table. Effective routes and the return path need checking when steering traffic through an appliance. Peering is also nontransitive: A–B and B–C peering alone do not create A–C connectivity.

Network Watcher's IP flow verify evaluates a specified virtual machine flow against applicable security rules and identifies the allowing or denying rule. That result checks filtering; it does not by itself establish that DNS, routing and the destination application work.

Private DNS and encrypted application paths

Private endpoint connectivity needs an approved connection, a usable network path and DNS that resolves the service name to its private address. For Azure public-cloud Blob Storage, the relevant private zone is privatelink.blob.core.windows.net, with the appropriate record and VNet link when using Azure-provided DNS. Other Azure clouds use different suffixes. Peering does not automatically create private-zone links.

For an on-premises DNS server resolving an Azure private zone over working private connectivity, a conditional forwarder targets the Azure DNS Private Resolver inbound endpoint. The private zone must be linked to the resolver's VNet. Outbound endpoints and forwarding rulesets serve the reverse requirement of forwarding Azure queries to other DNS servers. A working VPN does not, by itself, supply either DNS configuration or an Azure subnet's service-endpoint identity to an on-premises client.

Transport Layer Security (TLS) encrypts a connection. With Application Gateway end-to-end TLS, the client-to-gateway and gateway-to-backend connections are separate encrypted connections. An HTTPS listener alone does not encrypt the backend connection. Backend HTTPS settings, a valid certificate, appropriate trust and hostname validation are also needed.

Front Door Private Link has a different boundary. It connects Front Door Premium to a supported origin, not a client privately to Front Door. The origin connection needs approval and appropriate public-access restrictions. The origin type, service tier and supported deployment region still need checking rather than assuming that every Azure service supports the same arrangement.

Saved Attempts and Privacy:

Answers are scored in your browser, but attempt restoration uses information encoded in the page URL. That information is not encrypted and includes enough detail to restore the round, seed, recorded responses and position. Someone receiving the link can recover those responses. The URL can remain in browser history and reach the site when loaded, so a saved-attempt link should not be treated as a private record. Avoid secrets or personal information in replay seeds.

A saved link depends on a compatible question bank and attempt format. If Saved attempt unavailable appears, start a clean round from setup rather than treating the old link as a valid result. If a warning says the round could not be saved in the URL, it remains usable in the current page, but reloading would lose it. Finish the round and export its answer ledger, or end it and use a simpler seed.

Page resources, optional chart and document features, and opened references can use the network. Browser scoring is not a promise of fully offline operation or that nothing leaves the device. Exported answer ledgers include your responses. If the domain chart fails to load, the written domain counts and answer ledger remain the useful review records; Retry chart can try loading the visualization again.

Worked Examples:

Four correct answers with two untested domains

With the September 11, 2026 bank, choose All domains, 5 questions, Learn and the replay seed reference-az700. This selection contains three connectivity questions, one network-security question and one core-networking question. If four answers are correct, the final headline is 4/5, corresponding to 80% raw accuracy. Application delivery and private access were not sampled. Their absence is a reason to practise those areas, not evidence that the four correct answers establish broad coverage.

A healthy application with a failing probe

In an application-delivery round, a scenario describes a backend that responds successfully only to Host: api.example.com at /health, while network access is already allowed. Choose the answer that associates a custom health probe with that host and path. It earns one point, and the explanation identifies why changing DNS timing or allowing a URL in an NSG would not fix the probe request. In Review mode, the choice is recorded immediately but that correction appears only at completion. The corresponding hands-on check is the backend's response to the configured probe, not merely whether its port accepts a connection.

References: