Exam AZ-720: Troubleshooting Microsoft Azure Connectivity Practice Test
AZ-720 practice addresses diagnosing connectivity between Azure resources, virtual networks, on-premises environments, and public or private endpoints. The question bank’s scenarios use networking tasks such as investigating outbound access, validating DNS resolution, checking subnet and NIC behavior, and monitoring connections. These exercises help build the troubleshooting habits needed to trace a connectivity failure from the affected workload to the relevant network service or configuration.
Exam overview
About the Exam AZ-720: Troubleshooting Microsoft Azure Connectivity Exam
Effective Azure connectivity troubleshooting starts with identifying where traffic should travel and what could prevent it. Practice scenarios can involve selecting a user-initiated VPN connection versus network-to-network connectivity, evaluating predictable outbound internet access, or checking whether a private endpoint hostname resolves to its private address. Other tasks include reviewing virtual network links for private DNS zones, determining whether service endpoints or storage network rules fit a service-access requirement, and checking load-balancer rules and VM reachability. Network Watcher connection monitoring can help reveal whether a remote endpoint remains reachable over time. When investigating suspected packet loss, administrators should gather relevant performance and network evidence rather than assume a bandwidth limit is the cause. These decisions connect routing, name resolution, access controls, and endpoint behavior to a structured fault-isolation process.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
An organization needs encrypted private connectivity between a remote user's computer and Azure resources, with access initiated by the user rather than by an entire on-premises network. Which connectivity option best matches this need?
Show answer
Correct answer: APoint-to-site VPN provides a VPN connection from an individual client device to an Azure virtual network. Site-to-site VPN connects networks, peering connects Azure virtual networks, and service endpoints provide subnet-based access to supported Azure services.
A virtual machine in an Azure virtual network cannot reach a public website by IPv4. The subnet has no public IPs, but the organization wants predictable outbound internet connectivity shared by the subnet. Which Azure service best fits this requirement?
Show answer
Correct answer: AAzure NAT Gateway provides outbound internet connectivity for resources in a subnet and uses its associated public IP addresses for outbound traffic. It does not provide inbound connectivity to the virtual machines.
A private DNS zone is linked to an Azure virtual network, but virtual machines in that network still cannot resolve records in the zone. What should an administrator verify about the virtual network link?
Show answer
Correct answer: APrivate DNS zone resolution depends on linking the zone to the relevant virtual network. Verify the link exists and is in a usable state, and check its configuration for the intended resolution and registration behavior.
A network administrator suspects that Azure is dropping packets because a VM's NIC has exceeded a configured bandwidth limit. Which evidence is most useful to investigate first?
Show answer
Correct answer: AAzure Monitor metrics for the VM and network interface can help identify throughput saturation or packet-related issues. Correlating these measurements with the time of reported failures helps distinguish capacity problems from configuration or application faults.
An Azure virtual machine is assigned an IP address from a subnet, but a newly deployed appliance on that subnet does not respond to ARP requests from neighboring systems. What should be checked first?
Show answer
Correct answer: AARP operates on the local network segment and does not depend on DNS or a remote gateway. Confirm that the appliance interface is up and that its IP configuration matches the subnet and intended address.
A workload must reach an Azure service through a private endpoint. The administrator wants to confirm that the service hostname resolves to the private endpoint address from a VM. What should be checked first?
Show answer
Correct answer: APrivate endpoint connectivity commonly depends on DNS resolving the service hostname to the private endpoint's IP address. Verify the private DNS zone, its record, and the relevant virtual network link or DNS forwarding path before diagnosing subsequent connectivity controls.
A team needs to allow a subnet to access an Azure service over the service's public endpoint while keeping the traffic on Microsoft's network where supported. Which virtual network feature can provide this type of service-specific connectivity?
Show answer
Correct answer: AA service endpoint extends a virtual network's identity to supported Azure services and can help keep traffic to those services on the Azure backbone. It does not assign the service a private IP in the virtual network; that is a different connectivity model.
How to use this practice test
The free AZ-720 practice session draws up to 20 random questions from the available 50-question bank. Use each scenario to identify the failing network path, then compare your reasoning with the results shown after the session. Revisit missed concepts by tracing the expected DNS, routing, access-control, or monitoring behavior.
Preparation tips
- For each connectivity scenario, sketch the path from source to destination and mark where routing, DNS, or access controls could interrupt it.
- Distinguish point-to-site VPN access for an individual user from site-to-site connectivity between networks; identify who initiates the connection and which endpoints need access.
- Practice verifying private endpoint name resolution from a VM, including whether the relevant private DNS zone is linked to the virtual network.
- Compare outbound access options and service-specific controls, including NAT Gateway, service endpoints, and storage network restrictions.
- When a load-balanced service or remote connection fails, separate VM reachability, load-balancer configuration, and ongoing connection monitoring into distinct checks.