You create an Azure subnet with the address range 10.10.20.0/24. How many IP addresses are available for Azure resources in that subnet?
Azure Az700 Core Networking
Question · Easy
FREE AZ-700 Exam Guide 2026: 5 Domains, $165, Pass Score 700/1000
Master Microsoft AZ-700 Azure Network Engineer first try: 100 minutes, 700/1000 passing, $165. FREE 2026 study plan with hub-spoke vs Virtual WAN, Private Link, and ExpressRoute SKU decisions.
Blog
You are designing multiple Azure VNets that will later be peered to each other and connected to on-premises networks. Which address planning approach should you use?
Introduction & AZ-700 Exam Overview
0.1 About the AZ-700 Exam: Format, Scoring & Skills Measured
Study guide
Your security team wants a reserved block of contiguous public IP addresses so that external partners can allowlist a predictable range before you deploy Azure Firewall instances. Which Azure resource should you create?
Question · Medium
Tech Exam Prep Podcast
Listen on Spotify
Podcast
You change a virtual network to use custom DNS servers, but existing VMs continue using the old DNS settings. What should you do next?
You want VM records in a VNet to be created and removed automatically in an Azure Private DNS zone. Which type of link should you configure?
On-premises DNS servers must resolve records from Azure Private DNS zones without deploying DNS forwarder VMs in Azure. Which Azure DNS Private Resolver component should receive those forwarded queries?
Chapter 1: Azure Virtual Networks, Addressing & Subnet Architecture
1.1 VNet Planning, IP Addressing & Subnet Design
SpokeA is peered with a hub VNet, and SpokeB is also peered with the same hub. What is true about connectivity between SpokeA and SpokeB if no other configuration is added?
You need low-latency connectivity between two Azure VNets in different regions without deploying VPN gateways. Which option should you choose?
You must force all internet-bound traffic from a subnet through an NVA that has the IP address 10.0.0.4. Which user-defined route should you create?
A subnet has the default system route 0.0.0.0/0 to Internet and a user-defined route 10.20.0.0/16 to a virtual appliance. Where will traffic to 10.20.5.8 be sent?
1.2 Virtual Network Peering & Global Peering
You want an NVA in a hub VNet to exchange BGP routes with Azure so that routes update dynamically instead of being maintained in many route tables. Which Azure service should you deploy?
On April 1, 2026, you deploy a new VNet using current defaults and place VMs in a new subnet. The VMs must reach package repositories on the internet by using a stable outbound IP without allowing inbound access. Which resource is the best fit?
For new VNets created with API versions released after March 31, 2026, what does Azure's private-subnet-by-default behavior mean?
A VM cannot connect to another VM on TCP port 3389, and you need to confirm quickly whether an NSG is allowing or denying that flow. Which Network Watcher feature should you use?
1.3 Azure NAT Gateway & Outbound Connectivity
You need a consolidated Azure-native view of network topology, health, and metrics for gateways and other networking resources. Which service should you use?
An organization wants one DDoS protection plan to protect virtual networks in multiple subscriptions under the same Microsoft Entra tenant. Is this supported?
Your security team wants Azure recommendations that highlight exposed network paths, risky internet exposure, and hardening actions across subscriptions. Which service should they use?
A hub VNet contains an Azure DNS Private Resolver inbound endpoint at 10.10.0.4. You create a forwarding rule for contoso.internal that sends queries to 10.10.0.4 and then link that same ruleset to the hub VNet. What is the main risk?
Question · Hard
1.4 Azure Virtual Network Manager (AVNM) & Network Groups
You must standardize hub-and-spoke connectivity across hundreds of VNets in multiple subscriptions with centralized deployment and governance. Which Azure service is designed for that scenario?
In Azure Virtual Network Manager, you create a hub-and-spoke configuration with two spoke network groups named Production and Test. Direct connectivity is enabled only for the Production group. What should you expect?
Your outbound design uses a NAT Gateway, and the security team wants future scale-out to stay within a preapproved contiguous public range. Which approach best supports that requirement?
Which statement about Azure Route Server traffic flow is correct?
1.5 Public IP Addresses, Public IP Prefixes & Custom IP Prefixes (BYOIP)
You need continuous connectivity tests between an Azure VM and an on-premises endpoint, including performance measurements and alerting. Which Network Watcher capability should you use?
A team asks to attach an Azure DDoS Network Protection plan directly to an Azure Virtual WAN hub. How should you respond?
On April 15, 2026, you create a new VM in an existing VNet whose subnet was never changed to private. What happens to default outbound access by default?
You added a NAT Gateway to a subnet, but compliance still reports default outbound IPs associated with the VMs. What should you do to fully remove those default outbound IP assignments?
Chapter 2: Azure Name Resolution & Core Routing
2.1 Azure DNS & Private DNS Zones
A spoke VNet already uses remote gateways from Hub1. Can that same spoke also enable Use remote gateways on a peering to Hub2?
You want spoke VNets to resolve on-premises DNS namespaces without deploying custom DNS forwarder VMs in every spoke. Which Azure DNS Private Resolver design should you use?
Two application subnets need a shared Azure-managed outbound internet service that applies at subnet scope and provides a consistent public egress address. Which service best fits?
You need Azure-managed name resolution for many spoke VNets in the same region, even though those spokes are not peered with the hub VNet that hosts Azure DNS Private Resolver. Which design will work?
2.2 Azure Private DNS Resolver & Hybrid Name Resolution
You are creating a site-to-site VPN connection and need to define the remote VPN device public IP address and the on-premises address prefixes. Which Azure resource represents that remote site?
Azure Az700 Connectivity Services
A branch office adds new subnets frequently, and you do not want to update Azure VPN routes manually each time. Which configuration best supports dynamic route exchange?
You are configuring point-to-site VPN with Microsoft Entra ID authentication for Windows users. Which tunnel type is required?
Which gateway type is required for Azure point-to-site VPN connections?
2.3 System Routes & User-Defined Routes (UDR)
You need a Microsoft-managed service that can connect branch offices, remote users, and Azure VNets through central hubs. Which service should you deploy?
A hub VNet contains a VPN gateway, and a spoke VNet must use that gateway for on-premises connectivity through VNet peering. Which peering settings are required?
What is true about Azure VPN Gateway when you deploy it in active-active mode?
Loading more…