Question bank
Microsoft Certified: Azure Network Engineer Associate
42 Microsoft Certified: Azure Network Engineer Associate questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Design and implement Azure network security services
8 questions in this domain
- Question 1Single Choice
What is the function of an Azure CDN profile?
- AManagement container for endpointsCorrect answer
- BClient-facing URL for content
- CCaching rule for expiry
- DSource of truth for content
Why this is the answer
An Azure CDN profile is a management container for one or more endpoints. Endpoints are the client-facing URLs, while the origin is the source of content.
- Question 2Multiple Select
Which options are valid origin types for an Azure CDN? Select all that apply.
- AAzure Storage accountCorrect answer
- BA Web AppCorrect answer
- CCustom HTTP serverCorrect answer
- DAzure SQL Database
Why this is the answer
Azure CDN origins can be an Azure Storage account, a Web App, or a custom HTTP server. A SQL database is not a valid origin for static or dynamic web content delivery.
- Question 3Interactive
Based on the Traffic Manager configuration shown, which statement about traffic distribution is correct?
- AEndpoint2 gets 75%, Endpoint1 gets 25%Correct answer
- BBoth endpoints get 50% equally
- CEndpoint1 gets 75%, Endpoint2 gets 25%
- DEndpoint2 receives all traffic until it fails
Why this is the answer
With weighted routing and weights 1 and 3, Endpoint2 receives 75% of traffic and Endpoint1 receives 25%. Higher weight receives proportionally more traffic.
- Question 4Single Choice
Which Azure service uses Anycast and the Microsoft global network to accomplish Layer 7 global load balancing?
- AAzure Front DoorCorrect answer
- BAzure Traffic Manager
- CAzure Application Gateway
- DAzure Load Balancer
Why this is the answer
Azure Front Door is a global Layer 7 service that uses Anycast and integrates with WAF. Traffic Manager is DNS-based, while Application Gateway and Load Balancer are regional.
- Question 5Multiple Select
Which statements accurately describe Azure Front Door? Select all that apply.
- AUses Anycast protocolCorrect answer
- BProvides Layer 7 load balancingCorrect answer
- CIntegrates with Web Application FirewallCorrect answer
- DOperates only at the DNS level
Why this is the answer
Azure Front Door uses Anycast, performs Layer 7 load balancing, and includes WAF integration. DNS-level operation is a characteristic of Azure Traffic Manager.
- Question 6Interactive
A load balancer health probe is configured as shown. What occurs after two consecutive probe failures?
- ABackend instance is removed from rotationCorrect answer
- BBackend virtual machine is restarted
- CDNS record is switched to another region
- DClient session cookie is reset
Why this is the answer
Health probes determine backend availability. After the unhealthy threshold is reached, the load balancer removes the instance from rotation until it responds successfully again.
- Question 7Single Choice
What is the main purpose of session affinity in Azure Application Gateway?
- AEnsures client requests go to the same backend serverCorrect answer
- BBalances traffic by CPU utilization
- COffloads SSL encryption and decryption
- DFilters traffic based on WAF rules
Why this is the answer
Session affinity, also known as sticky sessions, routes a client's requests to the same backend server for the duration of a session. This is important for stateful applications.
- Question 8Multiple Select
Which methods are available for Azure Traffic Manager routing? Select all that apply.
- APerformanceCorrect answer
- BWeightedCorrect answer
- CGeographicCorrect answer
- DURL Path
Why this is the answer
Traffic Manager routing methods include Performance, Priority, Weighted, and Geographic. URL Path routing is performed by Application Gateway, not Traffic Manager.
Design and implement application delivery services
8 questions in this domain
- Question 9Single Choice
In the Azure CDN resource hierarchy, what is the primary purpose of a CDN profile?
- AA management container for one or more endpoints.Correct answer
- BA URL that serves cached content to clients.
- CThe origin server storing the original content.
- DA DNS-based routing service for global traffic.
Why this is the answer
A profile is a management container for one or more endpoints. Endpoints are the actual URLs clients use to access content.
- Question 10Multiple Select
Which of the following can be configured as an origin type for an Azure CDN endpoint? Select all that apply.
- AAzure Storage accountCorrect answer
- BAzure Web AppCorrect answer
- CCustom HTTP serverCorrect answer
- DAzure SQL Database
Why this is the answer
Azure CDN supports Azure Storage, Web Apps, and custom HTTP servers as origins. SQL Database is not a valid origin for CDN content.
- Question 11Interactive
Review the JSON configuration below. What type of origin is defined for this Azure CDN endpoint?
- AAzure Storage account
- BAzure Web AppCorrect answer
- CCustom HTTP server
- DApache web server
Why this is the answer
The host myapp.azurewebsites.net indicates an Azure Web App origin because it uses the azurewebsites.net domain.
- Question 12Single Choice
Which Azure service uses the Anycast protocol and the Microsoft global network to provide Layer 7 load balancing with integrated WAF?
- AAzure Traffic Manager
- BAzure Front DoorCorrect answer
- CAzure Load Balancer
- DAzure Application Gateway
Why this is the answer
Azure Front Door uses Anycast and Microsoft's global network to provide Layer 7 load balancing, SSL offloading, and WAF integration.
- Question 13Multiple Select
Which of the following are valid routing methods for Azure Traffic Manager? Select all that apply.
- APerformanceCorrect answer
- BPriorityCorrect answer
- CWeightedCorrect answer
- DLatency
Why this is the answer
Traffic Manager supports Performance, Priority, Weighted, and Geographic routing methods. Latency is not a distinct routing method.
- Question 14Interactive
Examine the JSON configuration below. Which routing method is configured for this Azure Traffic Manager profile?
- APriority
- BWeighted
- CPerformanceCorrect answer
- DGeographic
Why this is the answer
The routing method is set to Performance, causing Traffic Manager to direct users to the endpoint with the lowest latency.
- Question 15Single Choice
What is the primary purpose of a health probe in an Azure load balancing solution?
- ATo encrypt traffic between clients and backends
- BTo determine the viability of backend instancesCorrect answer
- CTo route traffic based on client geolocation
- DTo manage SSL certificate rotation
Why this is the answer
Health probes check whether backend instances are healthy. If a probe fails, the load balancer removes that instance from rotation.
- Question 16Multiple Select
Which Azure services operate as Layer 7 load balancers and inspect application-level traffic? Select all that apply.
- AAzure Application GatewayCorrect answer
- BAzure Front DoorCorrect answer
- CAzure Load Balancer
- DAzure Firewall
Why this is the answer
Application Gateway and Front Door inspect HTTP/HTTPS payloads for Layer 7 routing. Azure Load Balancer works at Layer 4; Azure Firewall is a network security service.
Design and implement core networking infrastructure
9 questions in this domain
- Question 17Single Choice
In Azure CDN, what is the main purpose of a CDN profile in the resource hierarchy?
- AIt acts as a management container for endpointsCorrect answer
- BIt stores cached content at edge locations
- CIt is the client-facing URL used to access content
- DIt defines the origin server authentication method
Why this is the answer
A profile is a management container for one or more endpoints, while endpoints are the client-facing URLs.
- Question 18Multiple Select
Which of the following can be configured as an Azure CDN origin? Select all that apply.
- AAzure Storage accountCorrect answer
- BAzure SQL Database
- CAzure Web AppCorrect answer
- DCustom HTTP serverCorrect answer
Why this is the answer
Azure CDN origins include storage accounts, web apps, and custom HTTP servers; SQL Database is not a CDN origin.
- Question 19Interactive
Review the Azure CLI command shown in the code block. What Azure resource does it create?
- ACDN endpoint
- BCDN profileCorrect answer
- CFront Door profile
- DStorage account
Why this is the answer
The az cdn profile create command creates an Azure CDN profile, the management container for endpoints.
- Question 20Single Choice
In Azure CDN caching, what does the TTL setting determine?
- AThe maximum size of files cached at the edge
- BHow long cached content remains valid before being refreshedCorrect answer
- CThe number of purge requests allowed per day
- DThe number of edge nodes that store the content
Why this is the answer
TTL defines how long edge nodes keep cached content before considering it stale, balancing cache hits and freshness.
- Question 21Multiple Select
Which Azure services perform Layer 7 load balancing? Select all that apply.
- AAzure Application GatewayCorrect answer
- BAzure Load Balancer
- CAzure Front DoorCorrect answer
- DAzure Traffic Manager
Why this is the answer
Application Gateway and Front Door inspect HTTP/HTTPS data; Load Balancer is Layer 4 and Traffic Manager is DNS-based.
- Question 22Interactive
A load balancer is configured with the probe shown in the code block. What is the purpose of this probe?
- ATo assign traffic weights to backend instances
- BTo check whether backend instances are healthyCorrect answer
- CTo cache static content for faster delivery
- DTo terminate TLS connections at the load balancer
Why this is the answer
Health probes send periodic requests to a specified port and path; if the probe fails, the instance is removed from rotation.
- Question 23Single Choice
Which Azure Traffic Manager routing method selects the endpoint with the lowest latency?
- APriority
- BWeighted
- CPerformanceCorrect answer
- DGeographic
Why this is the answer
Performance routing sends traffic to the endpoint with the lowest measured latency. Priority focuses on failover, Weighted on capacity.
- Question 24Multiple Select
Which statements about Azure Traffic Manager are correct? Select all that apply.
- AIt uses DNS to route traffic to endpointsCorrect answer
- BIt inspects HTTP headers to make routing decisions
- CIt can include both Azure and non-Azure endpointsCorrect answer
- DIt uses Anycast to provide fast failover
Why this is the answer
Traffic Manager is a DNS-based balancer that can target Azure or non-Azure endpoints; it cannot inspect HTTP headers and does not use Anycast.
- Question 25Interactive
An Application Gateway template includes the property in the code block. What feature does this setting enable?
- ASession affinityCorrect answer
- BHealth probes
- CSSL policy
- DURL path-based routing
Why this is the answer
Cookie-based affinity enables sticky sessions, ensuring a client is routed to the same backend server for the session.
Design and implement private access to Azure services
8 questions in this domain
- Question 26Single Choice
In Azure Content Delivery Network (CDN), what is the primary role of a CDN profile?
- AA management container for one or more endpointsCorrect answer
- BA DNS record used to resolve custom domains
- CA firewall policy protecting origin servers
- DA storage solution for static content
Why this is the answer
An Azure CDN profile is a management container that groups one or more endpoints. It provides configuration, billing, and policy settings for all endpoints within it.
- Question 27Multiple Select
Which of the following are valid Azure CDN origin types? (Choose all that apply.)
- AAzure Storage accountCorrect answer
- BAzure Web AppCorrect answer
- CCustom HTTP serverCorrect answer
- DAzure SQL Database
Why this is the answer
Azure CDN supports Azure Storage, Azure Web Apps, and custom HTTP servers as origins. Azure SQL Database is a relational database platform, not a content origin.
- Question 28Interactive
A network engineer is reviewing a configuration file for an Azure traffic distribution service. The settings in the code block include HTTP protocol, regional deployment, URL path routing, WAF enablement, and cookie-based affinity. Which Azure service does this configuration represent?
- AAzure Application GatewayCorrect answer
- BAzure Load Balancer
- CAzure Traffic Manager
- DAzure Front Door
Why this is the answer
The regional scope, URL path-based routing, WAF protection, and cookie-based affinity are all characteristics of Azure Application Gateway.
- Question 29Single Choice
What is the purpose of health probes in Azure load balancing?
- AThey check the availability and health of backend instancesCorrect answer
- BThey cache static content at edge locations
- CThey select the backend based on client IP address
- DThey encrypt traffic between clients and the backend
Why this is the answer
Health probes monitor specific endpoints on backend instances to determine whether they are healthy and should continue receiving traffic.
- Question 30Multiple Select
Which routing methods are available with Azure Traffic Manager? (Select all that apply.)
- APerformanceCorrect answer
- BPriorityCorrect answer
- CWeightedCorrect answer
- DGeographicCorrect answer
Why this is the answer
Azure Traffic Manager supports Performance, Priority, Weighted, and Geographic routing methods for controlling traffic distribution.
- Question 31Interactive
An architect is configuring Azure Traffic Manager with the properties shown in the code block. Based on that configuration, which two statements are true? (Choose all that apply.)
- AThe service supports URL path-based routing
- BTraffic is distributed according to lowest latencyCorrect answer
- CEndpoint availability is verified with health probesCorrect answer
- DTLS inspection is performed at the edge
Why this is the answer
Traffic Manager is DNS-level and uses the Performance routing method for lowest-latency distribution, while health probes monitor endpoint availability. It does not support URL path routing or TLS edge inspection.
- Question 32Single Choice
Which Azure service uses Anycast and integrates WAF for global web application acceleration?
- AAzure Front DoorCorrect answer
- BAzure Traffic Manager
- CAzure Load Balancer
- DAzure CDN Classic
Why this is the answer
Azure Front Door is a global Layer 7 service that uses Anycast, integrates with WAF, and provides secure web application acceleration.
- Question 33Multiple Select
Which of the following are valid cache control strategies in Azure CDN? (Select all that apply.)
- ASetting TTL expiration rulesCorrect answer
- BManually purging cached contentCorrect answer
- CIncreasing TTL when content is updated frequently
- DDisabling HTTPS to improve cache performance
Why this is the answer
TTL expiration and manual purging are the main CDN cache control mechanisms. A high TTL with frequent updates causes stale content, and disabling HTTPS harms security.
Design, implement, and manage connectivity services
9 questions in this domain
- Question 34Single Choice
In Azure CDN, which component serves as the management container for one or more endpoints?
- ACDN profileCorrect answer
- BCDN endpoint
- COrigin server
- DPoint of presence
Why this is the answer
A CDN profile is the management container that groups endpoints. Endpoints are client-facing URLs, and origins provide the actual content.
- Question 35Multiple Select
Which of the following can be configured as an origin in Azure CDN? Select all that apply.
- AAzure Storage accountCorrect answer
- BAzure Web AppCorrect answer
- CCustom HTTP serverCorrect answer
- DAzure SQL Database
Why this is the answer
Azure CDN origins can be Azure Storage accounts, Azure Web Apps, or custom HTTP servers. Azure SQL Database is not a supported content origin.
- Question 36Interactive
Review the Azure CLI command in the code block. What does the origin option define for the CDN endpoint?
- AThe source server that provides the contentCorrect answer
- BThe client-facing CDN endpoint URL
- CThe CDN profile management container
- DThe point-of-presence cache location
Why this is the answer
The origin parameter specifies the origin server, which is the source of truth for content that the CDN will cache and deliver.
- Question 37Single Choice
When a client requests content that is valid and stored at an Azure CDN point of presence, what does the CDN do?
- AServes the cached copy directly from the point of presenceCorrect answer
- BForwards the request to the origin server
- CPurges the cached content and refetches it
- DReturns an error to the client
Why this is the answer
The CDN serves content from the edge cache when a valid copy exists, avoiding a round-trip to the origin and reducing latency.
- Question 38Multiple Select
From the options listed, which Azure services are designed for global traffic distribution? Select all that apply.
- AAzure Front DoorCorrect answer
- BAzure Traffic ManagerCorrect answer
- CAzure Application Gateway
- DAzure Load Balancer
Why this is the answer
Azure Front Door and Traffic Manager are global services. Application Gateway and Load Balancer handle traffic within a single region.
- Question 39Interactive
Review the Azure CLI command in the code block. Which Traffic Manager routing method is being configured?
- APerformanceCorrect answer
- BPriority
- CWeighted
- DGeographic
Why this is the answer
The command sets the routing method to Performance, which directs traffic to the endpoint with the lowest latency.
- Question 40Single Choice
At which layer of the network stack does Azure Traffic Manager make traffic routing decisions?
- ADNSCorrect answer
- BTransport (Layer 4)
- CApplication (Layer 7)
- DData link (Layer 2)
Why this is the answer
Traffic Manager is a DNS-based balancer that returns a healthy endpoint IP address and cannot inspect packets or application headers.
- Question 41Multiple Select
Which statements about Azure Application Gateway are correct from the list below? Select all that apply.
- AIt provides Layer 7 load balancingCorrect answer
- BIt supports URL path-based routingCorrect answer
- CIt supports cookie-based session affinityCorrect answer
- DIt can load balance generic TCP traffic
Why this is the answer
Application Gateway works at Layer 7 for HTTP/HTTPS, supports path-based routing and cookie-based affinity, but not raw TCP or SQL traffic.
- Question 42Interactive
Review the Azure CLI command in the code block. What does the path parameter determine for the health probe?
- AThe endpoint on the backend used to verify healthCorrect answer
- BThe backend port that receives HTTP traffic
- CThe load balancer public IP address
- DThe local path for cached CDN content
Why this is the answer
The path parameter defines the URI that a health probe requests from a backend instance to confirm the service is responding.
Frequently asked questions
Everything about the Microsoft Certified: Azure Network Engineer Associate question bank and how to use it.