AZ-700 Tests Routing, DNS and Service Selection — Not Memorising Gateway SKU Tables
Aimed at network engineers designing hybrid and hub-and-spoke Azure networks. Most questions hinge on which path a packet takes and where a name resolves, so trace traffic and DNS before choosing a service.
Check Your Readiness →Most candidates understand Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Scenarios describe a topology and a requirement such as spoke-to-spoke traffic, on-premises name resolution or TLS offload, then offer several real Azure services. Distractors work at the wrong layer or scope: regional instead of global, layer 4 instead of layer 7, Azure-only instead of reachable from on-premises.
Add hosts file entries on each spoke VM
Create an outbound endpoint with a forwarding ruleset for the on-premises domain and link the ruleset to every spoke VNet, or point spoke DNS at the hub. A ruleset only applies to VNets linked to it.
Put Traffic Manager in front of the regional endpoints
Traffic Manager only answers DNS, so it never sees TLS and cannot cache. Front Door provides global layer 7 routing, caching and TLS termination; choose Premium if origins must stay private behind Private Link.
ExpressRoute is a private circuit, so it is already encrypted
ExpressRoute is private but unencrypted by default. Use MACsec on ExpressRoute Direct ports or an IPsec VPN over private peering. FastPath and Global Reach change data paths, not confidentiality, and appear as distractors.
The UDR should win because UDRs beat BGP routes
Longest prefix match is evaluated first, so the more specific /16 BGP route wins. Add a /16 UDR to the firewall; UDR over BGP over system applies only at equal prefix length. Confirm with Network Watcher next hop.
Enable a Microsoft.Storage service endpoint on the gateway subnet
Service endpoints only carry traffic from Azure subnets, and the service keeps its public endpoint. On-premises clients need a private endpoint per sub-resource, blob and file separately, plus DNS forwarding that returns the private IP.
Peering links only the two VNets in the pair. Spoke-to-spoke traffic needs a hub NVA or Azure Firewall with UDRs, direct peering, or a Virtual Network Manager mesh. Gateway transit is separate: Allow gateway transit on the hub, Use remote gateways on each spoke.
Azure reserves the network address, default gateway, two DNS-mapped addresses and broadcast in every subnet, so a /29 leaves three usable hosts, not six. GatewaySubnet should be /27 or larger, especially when VPN and ExpressRoute gateways coexist.
Clients keep resolving the public address until a zone such as privatelink.database.windows.net is linked to every resolving VNet. On-premises forwarders should target a DNS Private Resolver inbound endpoint, because 168.63.129.16 answers only from inside Azure.
Standard adds threat intelligence and FQDN filtering; only Premium performs TLS inspection and signature-based IDPS, and Basic targets small businesses. Rules process DNAT, then network, then application, and a network rule match ends evaluation before application rules run.
Entra ID authentication, which brings Conditional Access and MFA, requires the OpenVPN tunnel type over TLS on port 443. Policy-based gateways support no point-to-site and only one site-to-site tunnel, so remote users plus several sites always means route-based.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
Trace routes, DNS answers and layer choices under AZ-700 conditions before booking the exam.