Microsoft Certified: Azure Network Engineer Associate — Practice Set 1

Question 1

An Azure network engineer needs to provide internet outbound connectivity for virtual machines in a subnet without assigning public IP addresses directly to each VM. The solution must support up to 64,000 concurrent outbound flows and allow specifying a static outbound IP address. Which Azure service should be used?

Accepted Answer

Azure NAT Gateway provides outbound-only internet connectivity for resources in a subnet without requiring public IP addresses on each VM. It supports up to 64,000 concurrent outbound flows per public IP address and enables a static public IP address prefix for outbound traffic. Azure Load Balancer outbound rules (A) can provide outbound SNAT but are not as scalable or straightforward. Application Gateway (C) is for inbound HTTP/HTTPS, and Azure Bastion (D) is for secure RDP/SSH administrative access, not general outbound connectivity.

Question 2

A company wants to host a web application on Azure and requires a private DNS zone that resolves names for virtual machines within a virtual network. The DNS records must be automatically registered when VMs are deployed. Which configuration achieves this?

Accepted Answer

Creating a private DNS zone and linking it to the VNet with auto-registration enabled causes Azure to automatically create DNS records when VMs are created, updated, or deleted within the linked VNet. A public DNS zone (A) is internet-facing and not appropriate for internal private resolution. Pointing DNS to 8.8.8.8 (C) uses Google's public resolver, which cannot resolve private Azure hostnames. Azure DNS Private Resolver (D) is for resolving DNS between on-premises and Azure, not for auto-registration within a VNet.

Question 3

An organization has two virtual networks, VNet-A (10.1.0.0/16) and VNet-B (10.2.0.0/16), connected by VNet peering. Traffic from VNet-A must pass through a Network Virtual Appliance (NVA) hosted in a hub VNet before reaching VNet-B. The NVA inspects all east-west traffic. Which feature must be configured to route VNet-A traffic through the NVA?

Accepted Answer

User-defined routes (UDRs) override Azure's default system routes and allow you to specify a custom next hop — in this case, the NVA's private IP — so that traffic from VNet-A is steered through the NVA before reaching VNet-B. Service chaining with gateway transit (A) is used to route traffic through a VPN or ExpressRoute gateway in a hub, not through an NVA. IP forwarding (C) must also be enabled on the NVA's NIC, but that alone does not redirect traffic. NSG deny rules (D) block traffic but do not redirect it through an appliance.

Question 4

A network engineer must plan subnets inside a virtual network for several Azure services. Which TWO subnets require dedicated subnet delegation in Azure? Choose 2.

Accepted Answer

Subnet delegation allows Azure platform services to inject service-specific resources into the subnet. Azure App Service VNet Integration and Azure Container Instances both require subnet delegation (Microsoft.Web/serverFarms and Microsoft.ContainerInstance/containerGroups respectively). Azure Bastion (A) requires a subnet named AzureBastionSubnet but does not use delegation. The GatewaySubnet (C) is a reserved name for VPN/ExpressRoute gateways but also does not use delegation. Azure SQL Database (D) uses private endpoints or service endpoints, not delegation.

Question 5

A company needs to manage routing across multiple virtual networks and on-premises sites from a central control plane. The solution must support automated propagation of routes between peered VNets without manually updating route tables. Which Azure service should be deployed?

Accepted Answer

Azure Route Server enables Network Virtual Appliances (NVAs) to exchange routes with Azure's software-defined networking (SDN) using BGP, automatically propagating NVA routes to all peered VNets without manual route table updates. Azure Virtual Network Manager (B) manages connectivity and security policies at scale across VNets but does not perform BGP route exchange. Azure Traffic Manager (C) is a DNS-based global load balancer. Azure Front Door (D) is an application delivery and CDN service — neither routes Layer 3 traffic between VNets.

Question 6

Contoso has 50 spoke VNets peered to a hub VNet. The security team requires that all outbound internet traffic from spoke VNets be inspected and filtered by an Azure Firewall deployed in the hub. The spoke VNets must not have direct internet access. What is the correct combination of configurations to enforce this requirement?

Accepted Answer

To route all spoke internet traffic through the hub Azure Firewall, you must create a UDR in each spoke with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP as the next hop, then associate this UDR with each spoke subnet. Gateway transit alone (without the UDR) does not redirect traffic to the firewall. NSG deny rules (B) block but do not redirect traffic through an inspection device. Forced tunneling via VPN (C) is for on-premises scenarios and adds unnecessary complexity. IP flow verification (D) is a diagnostic tool, not a traffic control mechanism.

Question 7

A network engineer needs to monitor and capture network traffic flows at the subnet level in a virtual network to analyze traffic patterns and detect anomalies. Which Azure Network Watcher feature should be used?

Accepted Answer

Virtual network flow logs (VNet flow logs) capture information about IP traffic flowing through a virtual network at the subnet and NIC level, stored in Azure Storage for analysis. IP Flow Verify (A) tests whether a specific packet is allowed or denied by the current NSG rules — it does not log traffic flows. Connection Monitor (B) tests reachability between endpoints. Packet Capture (D) captures raw packets at the VM level, which is more granular but not suited for broad subnet-level flow analysis.

Question 8

An organization wants to implement centralized management of virtual networks across multiple subscriptions, including enforcing consistent NSG rules and connectivity topology across all spoke VNets. Which service should be used?

Accepted Answer

Azure Virtual Network Manager (AVNM) provides centralized management of virtual networks at scale across subscriptions and regions. It supports network groups, connectivity configurations (hub-and-spoke or mesh), and security admin rules that enforce NSG-like policies across all member VNets. Azure Policy with DeployIfNotExists (A) can enforce compliance but does not offer the connectivity topology management that AVNM provides. Azure Blueprints (C) manages deployment artifacts, not ongoing network configuration. Azure Route Server (D) is for BGP route exchange with NVAs.

Question 9

An enterprise needs to establish a dedicated private connection from its on-premises data center to Azure that offers consistent throughput, lower latency, and higher security than a VPN. The connection must not traverse the public internet. Which connectivity option should be selected?

Accepted Answer

Azure ExpressRoute provides a dedicated private connection between on-premises infrastructure and Azure through a connectivity provider, bypassing the public internet. This delivers consistent throughput, lower latency, and higher security than internet-based VPN connections. Site-to-site VPN (A) and Point-to-site VPN (C) both travel over the public internet using IPsec encryption. Azure Virtual WAN with VPN (D) also routes over the internet. ExpressRoute is the only option that avoids the public internet entirely.

Question 10

A company has an ExpressRoute circuit and wants to enable traffic between two on-premises sites connected to the same ExpressRoute circuit through the Microsoft backbone. The on-premises sites are in different geographic regions. Which ExpressRoute feature should be enabled?

Accepted Answer

ExpressRoute Global Reach allows two on-premises networks, each connected to Azure via separate ExpressRoute circuits, to communicate with each other through the Microsoft backbone network — effectively creating a private WAN link between on-premises sites. ExpressRoute FastPath (A) improves data path performance by bypassing the gateway for data flows. ExpressRoute Direct (C) provides direct connectivity to Microsoft's peering locations at 10 or 100 Gbps. BFD (D) is a failure detection protocol used to speed up link failure detection on ExpressRoute peerings.

Question 11

Fabrikam is designing a site-to-site VPN connection for high availability. The requirement is that failover between VPN tunnels must be automatic and support active-active gateway configuration. The connection must also handle BGP route advertisement. Which Virtual Network Gateway configuration meets all requirements?

Accepted Answer

An active-active VPN gateway configuration with BGP enabled provides automatic failover because both gateway instances maintain active tunnels simultaneously. The VpnGw2 SKU (and above) supports active-active mode and BGP route-based VPNs. Two local network gateways (or a single one with two tunnel endpoints) are required to configure dual tunnels for the active-active setup. The Basic SKU (A) does not support BGP or active-active. Active-standby with policy-based VPN (C) does not support BGP and has slower failover. ExpressRoute gateways (D) are not VPN gateways and cannot be used as a primary VPN connection.

Question 12

A remote user needs to connect securely to Azure resources from a personal laptop without requiring a site-to-site VPN infrastructure. Authentication must use Microsoft Entra ID. Which point-to-site VPN tunnel type supports Microsoft Entra ID authentication?

Accepted Answer

OpenVPN (SSL/TLS-based) is the only point-to-site tunnel type that supports Microsoft Entra ID (formerly Azure Active Directory) authentication for Azure VPN Gateway. IKEv2 (A) supports certificate-based authentication but not Entra ID. SSTP (B) only supports certificate-based authentication. L2TP/IPsec (D) is not a supported P2S tunnel type for Azure VPN Gateway at all.

Question 13

A network team is designing an Azure Virtual WAN deployment to connect 30 branch offices and three Azure regions. They need per-branch security policies enforced by a third-party NVA running inside the virtual hub. Which Virtual WAN SKU and feature supports this?

Accepted Answer

Azure Virtual WAN Standard SKU supports integrating third-party Network Virtual Appliances (NVAs) directly inside the virtual hub through the Managed Applications marketplace (e.g., Barracuda, Check Point, Fortinet). This enables per-branch traffic inspection within the hub. Basic SKU Virtual WAN (A, D) does not support NVA integration inside the hub and has limited capabilities. Option C uses Azure Firewall Manager with Azure Firewall, not a third-party NVA, which is a different scenario.

Question 14

An engineer is configuring ExpressRoute Microsoft peering. Which TWO actions are required to configure Microsoft peering correctly? Choose 2.

Accepted Answer

Microsoft peering is used to access Microsoft public services (Microsoft 365, Dynamics 365, Azure public services) over ExpressRoute. It requires the customer to own a public IP address range and a registered public or private ASN to advertise routes. A route filter must also be applied to the circuit to select which BGP communities (services) are routed over the Microsoft peering. Private peering (B) uses RFC 1918 addresses and is for Azure virtual network connectivity, not Microsoft peering. Global Reach (D) connects two on-premises networks through Microsoft backbone and is unrelated to Microsoft peering setup. An ExpressRoute gateway (E) is needed only for private peering to connect to a VNet.

Question 15

A company needs a Layer 7 load balancer that can route HTTP/HTTPS requests to different backend pools based on the URL path. For example, requests to /images/* go to one backend pool and requests to /api/* go to another. Which Azure service provides this functionality?

Accepted Answer

Azure Application Gateway is a Layer 7 load balancer that supports path-based routing, allowing different URL paths to be routed to different backend pools. Azure Load Balancer (A) operates at Layer 4 (TCP/UDP) and cannot inspect or route based on URL paths. Azure Traffic Manager (B) is a DNS-based load balancer for global distribution across regions — it does not perform URL-path routing. Azure Front Door (D) also supports path-based routing globally, but Application Gateway is the regional Layer 7 solution specifically designed for this scenario.

Question 16

Northwind Traders runs a global e-commerce site serving users in North America, Europe, and Asia. They need a solution that accelerates dynamic content delivery, performs TLS offloading at the edge, routes users to the closest healthy backend, and supports WAF protection — all within a single Azure service. Which service should be deployed?

Accepted Answer

Azure Front Door is a global application delivery service that provides anycast routing to the closest healthy backend, TLS termination at the edge (PoP), WAF policy integration, caching for static content, and traffic acceleration for dynamic content — all from a single service. Running separate Application Gateways per region (A) does not provide global routing or edge TLS termination. Traffic Manager with Load Balancer (C) provides DNS-based global routing but no TLS offloading or WAF at the edge. Azure CDN (D) handles caching but lacks health-based routing and WAF.

Question 17

An organization is deploying Azure Load Balancer to distribute traffic to VMs. VMs are being decommissioned and new ones are being added regularly. The health probe must automatically remove unhealthy VMs from the rotation. Which health probe protocol should be used if the backend application exposes a dedicated /health HTTP endpoint?

Accepted Answer

Azure Load Balancer supports HTTP and HTTPS health probes that make HTTP GET requests to a specified path. Using an HTTP probe targeting /health provides application-level health checking — the backend is removed from rotation if the HTTP response is not 200 OK. A TCP probe (A) only verifies that the port is open; it does not check application health logic returned by the /health endpoint. HTTPS (C) requires a valid TLS certificate on the backend, which adds complexity unnecessarily if the endpoint is HTTP. UDP probes (D) are not supported by Azure Load Balancer.

Question 18

An Azure engineer is configuring Azure Front Door to protect the origin servers. Which TWO configurations should be applied to ensure that only Azure Front Door can access the origin backend? Choose 2.

Accepted Answer

To restrict origin access to Azure Front Door only, two complementary approaches are: (1) Enable Azure Private Link on the origin, which routes Front Door traffic through the Microsoft backbone without exposing the origin publicly, and (2) Configure NSG rules to allow inbound traffic only from the AzureFrontDoor.Backend service tag, which contains the IP ranges of Front Door PoPs. DDoS Protection Standard (C) protects against volumetric attacks but does not restrict who can reach the origin. The X-Azure-FDID header approach (D) is a validation technique at the application level but is not a network-level restriction. Azure Bastion (E) is for administrative RDP/SSH access, not application traffic.

Question 19

A developer needs to connect an Azure Storage account to a virtual network so that VMs in the VNet can access the storage without the traffic leaving the Microsoft network. The storage account should also remain accessible from the public internet for authorized external clients. Which feature enables VNet-to-storage connectivity without exposing VNet traffic to the internet?

Accepted Answer

Service endpoints extend the VNet's private address space and identity to Azure PaaS services like Azure Storage over the Microsoft backbone network, preventing storage traffic from traversing the internet from the VNet. The storage account can simultaneously be accessible from the internet for authorized external clients. Azure Private Endpoint (A) creates a private IP for the storage account in the VNet and can fully privatize the storage account, but the question specifies that internet access should remain available — service endpoints are simpler for this requirement. VNet peering (C) connects VNets, not VNets to PaaS services. NAT Gateway (D) manages outbound internet connectivity.

Question 20

Contoso has deployed a Private Link service in front of their internal web application running on Azure Load Balancer. A partner company (Fabrikam) in a different Azure tenant needs to consume this service privately. Fabrikam should not be able to see or access any other Contoso resources. What must Contoso and Fabrikam each configure?

Accepted Answer

Azure Private Link service allows a service provider (Contoso) to expose their internal Load Balancer-fronted service as a Private Link service with an alias. The consumer (Fabrikam) creates a private endpoint in their own VNet referencing Contoso's Private Link service alias. This creates a one-way private connection across tenants — Fabrikam can only reach the specific service, not any other Contoso resources. The provider must approve the connection request, maintaining control over who can connect. VNet peering (C) would expose all resources in both VNets to each other, which violates the isolation requirement. Options B and D are not Private Link patterns.

Question 21

After deploying a private endpoint for an Azure SQL Database, on-premises clients connected via ExpressRoute cannot resolve the SQL server's FQDN to the private IP address in the VNet. The public DNS resolution still returns the public IP. What must be configured to fix this?

Accepted Answer

When using private endpoints, the FQDN must resolve to the private IP, not the public IP. This requires a private DNS zone (privatelink.database.windows.net) linked to the VNet with an A record mapping the SQL FQDN to the private endpoint IP. For on-premises clients to resolve this, DNS queries must be forwarded from on-premises DNS servers to the Azure DNS Private Resolver (or a DNS forwarder VM in the VNet), which can return the private IP. Adding an A record to the public DNS zone (A) would expose the private IP publicly and break public access. NAT at the firewall (C) is a workaround that does not address DNS resolution correctly. Enabling public access (D) defeats the purpose of using a private endpoint.

Question 22

A network security engineer needs to group multiple virtual machines that run the same application tier and apply consistent NSG rules to all of them, even as VM membership changes. Which Azure feature allows rules to reference a logical group of VMs by name rather than by IP address?

Accepted Answer

Application Security Groups (ASGs) allow you to group VM network interfaces logically and reference the group in NSG rules rather than individual IP addresses. As VMs are added or removed from the ASG, the NSG rules automatically apply or stop applying without any rule changes. IP-based NSG rules (A) require manual updates when VM IPs change. Azure Firewall application rules (C) filter based on FQDNs and are a different security control. DDoS Protection (D) protects against volumetric DDoS attacks, not lateral traffic control.

Question 23

An organization needs to filter outbound HTTP/HTTPS traffic from Azure VMs to the internet based on fully qualified domain names (FQDNs), blocking access to all sites except a specific allowlist. NSGs cannot filter by FQDN. Which Azure service provides FQDN-based outbound filtering?

Accepted Answer

Azure Firewall application rules support FQDN-based filtering for outbound HTTP/HTTPS and SQL traffic. You can create an allowlist of FQDNs, and Azure Firewall will deny all other outbound traffic to unlisted domains. NSGs with service tags (A) filter by IP ranges associated with Azure services, not arbitrary FQDNs. WAF on Application Gateway (B) inspects inbound traffic to your application, not outbound internet traffic from VMs. DDoS Protection Standard (D) mitigates DDoS attacks; it does not filter outbound traffic.

Question 24

A security architect is designing a WAF deployment to protect a public-facing web application hosted on Azure Application Gateway. Which TWO WAF rule set configurations must be done to protect against OWASP Top 10 threats while avoiding false positives for a known legitimate scanner? Choose 2.

Accepted Answer

To protect against OWASP Top 10 threats, the WAF policy should use the OWASP CRS in prevention mode (A), which actively blocks matched requests. To prevent false positives from a known legitimate scanner, a WAF exclusion (B) can be configured to skip specific rules or rule groups for requests matching the scanner's IP or specific headers, allowing the scanner's traffic to pass without triggering blocks. Detection mode (C) only logs — it does not block threats. Disabling all CRS rules (D) removes OWASP protection entirely. DDoS Protection (E) complements WAF but does not prevent application-layer attacks covered by OWASP CRS.

Question 25

An organization wants to deploy Azure Firewall to inspect all traffic between Azure spoke VNets and the on-premises network. They want centralized management of firewall policies across multiple Azure regions, including the ability to inherit base policies from a parent policy. Which Azure Firewall feature enables this?

Accepted Answer

Azure Firewall Manager provides centralized management of Azure Firewall policies across multiple regions and deployments. It supports hierarchical policies where a parent policy can define baseline rules that are inherited by child policies, enabling consistent security governance while allowing regional customization. Managing rules directly on each firewall instance (A) lacks centralized control and policy inheritance. Azure Front Door WAF policies (C) protect web applications at the edge, not east-west or hybrid network traffic. NSG flow logs with Azure Monitor (D) provide visibility but no traffic inspection or filtering capability.

AZ-700 — Azure Network Engineer Associate