AZ-700 Final Exam Attack Plan | NetForge Cloud Learning

AZ-700 — 100 minutes, 40-60 questions, pass mark ~700/1000 (≈70%)

D1 · Core Networking Infrastructure 25–30%

D2 · Connectivity Services 20–25%

D3 · Application Delivery Networks 15–20%

D4 · Private Access to Azure Services 10–15%

D5 · Network Security 15–20%

Battle plan: D1 (Core Networking) is the largest domain. Master subnet math, routing precedence, and DNS Private Resolver before anything else. D2 (Connectivity) covers VPN, ExpressRoute, and Virtual WAN — high-complexity, high-value. D5 (Security) tests NSG evaluation, Firewall rules, and AVNM — high concept density.

Principle 1 — Longest Prefix Match Always Wins First
Before comparing UDR vs BGP vs System, Azure first selects the most specific prefix. A /32 beats a /24 which beats a /16, regardless of route source.

Principle 2 — Same Prefix Length: UDR > BGP > System
When prefix lengths are equal, User-Defined Routes override BGP (ExpressRoute/VPN) routes, which override System routes.

Principle 3 — VNet Peering is Non-Transitive
Spoke-A ↔ Hub ↔ Spoke-B does NOT give Spoke-A → Spoke-B connectivity. You need an NVA or Azure Firewall in the hub with UDRs on both spokes.

Principle 4 — BGP Propagation Disabled = Spokes Can't Bypass Firewall
Disable BGP Route Propagation on spoke route tables to prevent on-premises BGP routes from being programmed directly into the spoke, which would bypass Azure Firewall.

Principle 5 — GatewaySubnet UDRs Are Required for Return Traffic
In hub-spoke with Firewall, a route table on GatewaySubnet is needed for return traffic from on-premises to spokes. Without it, traffic from on-premises reaches spokes but return traffic is dropped.

TRAP: "Route Server creates routes" — FALSE. Route Server propagates BGP routes learned from NVAs to VPN/ExpressRoute gateways and vice versa. It does not generate routes itself.

TRAP: "AllowGatewayTransit on the spoke makes it work" — FALSE. AllowGatewayTransit goes on the HUB peering. UseRemoteGateways goes on the SPOKE peering. They always pair on opposite sides.

MAP

Requirement	Correct Service	Key Reason
On-premises to Azure, internet path, encrypted	VPN Gateway (S2S)	IPsec over public Internet
On-premises to Azure, private dedicated circuit, SLA	ExpressRoute	Private, predictable, not encrypted
Remote workers, client VPN, Entra ID auth	VPN Gateway P2S + OpenVPN	Only OpenVPN supports Entra ID auth
50+ branches, automatic routing, SD-WAN integration	Azure Virtual WAN	Scale, automation, built-in transit
Global access ALL Azure regions via ExpressRoute	ExpressRoute Premium	Standard = same geo only
Encrypted traffic over ExpressRoute (provider circuit)	VPN over ExpressRoute (IPsec)	MACsec = Direct only, not provider circuits
Two on-premises networks communicate via Microsoft backbone	ExpressRoute Global Reach	Connects two ER circuits at Microsoft edge

TRAP: "ExpressRoute encrypts traffic" — FALSE. ExpressRoute is private but NOT encrypted. Solutions: VPN-over-ER (most common) or MACsec (ExpressRoute Direct only).

TRAP: "VPN Gateway Basic SKU supports P2S and BGP" — FALSE. Basic SKU supports neither BGP nor most P2S features.

Decision: Which load balancing service?

Is the app HTTP/HTTPS?
  NO  → DNS-based/Global?  → Traffic Manager (any protocol, DNS only)
      → Layer 4 Regional?  → Azure Load Balancer (Standard)
      → Layer 4 Global?    → Cross-Region Load Balancer
  YES → Is it global?
    YES → Azure Front Door (WAF, caching, Anycast, TLS at edge)
    NO  → Azure Application Gateway (WAF, URL routing, SSL termination, regional)

Quick memory: LB=L4 Regional, AppGW=L7 Regional, FD=L7 Global, TM=DNS Global

Service	Layer	Scope	WAF	Protocols
Azure Load Balancer (Standard)	L4	Regional	❌	TCP/UDP
Azure Application Gateway (v2)	L7	Regional	✅ WAF v2	HTTP/HTTPS
Azure Front Door (Premium)	L7	Global	✅	HTTP/HTTPS
Azure Traffic Manager	DNS	Global	❌	Any (DNS only)
Cross-Region Load Balancer	L4	Global	❌	TCP/UDP
Gateway Load Balancer	L4	Regional	❌	All (NVA insertion)

TRAP: "Traffic Manager routes traffic to backends" — FALSE. Traffic Manager only returns DNS records. It never sees application traffic. This distinction appears frequently in exam questions.

Feature	Service Endpoint	Private Endpoint
Cost	Free	Hourly cost + data processing
Private IP in VNet	❌ Uses public IP	✅ Private IP
On-premises access	❌ VNet only	✅ Via VPN/ER + DNS
Public endpoint disabled	❌ Still exists	✅ Can disable public
DNS requirements	None	Private DNS Zone required
Cross-tenant access	❌	✅ Via Private Link Service
Per-subnet control	✅ Per subnet	✅ Per endpoint

Key Private DNS Zone Names

Service	Private DNS Zone
Azure SQL Database	privatelink.database.windows.net
Azure Blob Storage	privatelink.blob.core.windows.net
Azure Key Vault	privatelink.vaultcore.azure.net
Azure Container Registry	privatelink.azurecr.io
Azure Cosmos DB (SQL)	privatelink.documents.azure.com
Azure App Service	privatelink.azurewebsites.net

TRAP: "Service Endpoints work from on-premises" — FALSE. Service Endpoints only work from the VNet where the endpoint is enabled. Private Endpoints are required for on-premises access.

DNS Chain (know this cold): FQDN → CNAME to privatelink.service.azure.com → A record in Private DNS Zone → Private IP of endpoint. Without the Private DNS Zone VNet link, VMs get the public IP.

NSG Inbound Evaluation Order:
  1. Subnet NSG → 2. NIC NSG → Both must ALLOW

NSG Outbound Evaluation Order:
  1. NIC NSG → 2. Subnet NSG → Both must ALLOW

Azure Firewall Rule Processing:
  1. DNAT Rules (inbound NAT)
  2. Network Rules (L3/L4 — IP, port, protocol)
  3. Application Rules (L7 — FQDN, URL, web category)
  4. Default Deny (implicit)

AVNM Security Admin Rules vs NSG:
  AVNM rules evaluated FIRST (higher precedence)
  AlwaysAllow → bypasses NSG entirely
  Allow → NSG still evaluates after
  Deny → NSG cannot override

Firewall SKU	Threat Intel	IDPS	TLS Inspection	URL Filtering
Basic	❌	❌	❌	❌
Standard	✅	❌	❌	✅ (by SNI)
Premium	✅	✅	✅	✅ (full)

TRAP: "AzureFirewallSubnet should have a route table" — FALSE in 95% of scenarios. Do NOT attach a route table to AzureFirewallSubnet (except forced tunnelling).

TRAP: "A Network rule allow on port 443 will still let Application rules evaluate FQDNs" — FALSE. Once a Network rule matches, processing stops. Application rules never evaluate. Put FQDN-based rules ONLY in Application rules and remove catch-all network rules for that port.

7 Days Before

Complete all three mock exams — scoring 80%+ consistently before proceeding
Review every incorrect answer — understand the WHY, not just the answer
Focus on your weakest domain (run domain-targeted practice)
Read through the Troubleshooting Scenarios case studies

1 Day Before

Read the Quick Reference Cheat Sheet end-to-end (one pass)
Review all 20 rapid-recall cards below
Review the Flashcards for any domain you feel uncertain about
Light study only — do NOT cram new material
Prepare your exam environment (quiet room, strong Internet, valid ID ready)
Get 8+ hours of sleep

Exam Morning

Eat a proper meal — brain needs fuel for 100 minutes of concentration
Log in to the exam platform 15 minutes early
Take the exam tutorial to settle nerves and check your UI setup
Recall the 5 routing principles and the load-balancing decision tree

During the Exam

Read every question TWICE before selecting — one pass to understand, one to answer
Flag uncertain questions and return at the end — never leave blanks
At question 25, check clock — you should be around 50 minutes remaining
Watch for qualifier words: "minimum cost", "minimum effort", "maximum availability"
Use ALL 100 minutes — review all flagged questions before submitting

Read the question. Think. Check the answer.

Subnet Math

How many usable IPs in a /24?

251 (256 − 5 Azure reserved)

Routing

Same prefix length: what order?

UDR > BGP > System routes

Peering

Can Spoke-A reach Spoke-B through hub?

NO — peering is non-transitive

Gateway Transit

Which peering gets AllowGatewayTransit?

HUB peering (the VNet with the gateway)

ER Encryption

Does ExpressRoute encrypt traffic?

NO — use VPN-over-ER or MACsec (Direct only)

ER Premium

When do you need ExpressRoute Premium?

Access to ALL Azure regions globally

P2S Auth

Which tunnel type for Entra ID auth?

OpenVPN — only supported tunnel for Entra ID

Firewall Order

Azure Firewall rule processing sequence?

DNAT → Network → Application → Deny

Firewall Subnet

Should AzureFirewallSubnet have a route table?

NO — never (except forced tunnelling)

NSG Inbound

Which NSG is checked first for inbound traffic?

Subnet NSG first, then NIC NSG

NSG Outbound

Which NSG is checked first for outbound traffic?

NIC NSG first, then subnet NSG

Load Balancer

Health probe origin IP for Azure Load Balancer?

168.63.129.16 — use AzureLoadBalancer service tag

Standard LB

Does Standard LB provide outbound connectivity?

NO — explicit outbound rules or NAT Gateway required

Traffic Manager

Does Traffic Manager route application traffic?

NO — DNS only, never sees app traffic

DNS Resolver

Inbound endpoint: what direction?

On-premises → Azure (on-prem queries Azure DNS)

DNS Resolver

Outbound endpoint: what direction?

Azure → On-premises (Azure VMs forward to on-prem)

Private Endpoint

Do NSG rules apply to Private Endpoints by default?

NO — must enable privateEndpointNetworkPolicies on subnet

Service Endpoint

Can Service Endpoints be used from on-premises?

NO — VNet only. Use Private Endpoint for on-prem access.

NAT Gateway

NAT Gateway vs Load Balancer for outbound — which wins?

NAT Gateway always overrides LB outbound rules

AVNM

AVNM Security Admin AlwaysAllow vs NSG Deny — result?

AlwaysAllow wins — NSG is bypassed entirely