AZ-700 Study Material
Flashcards
Click any card to reveal the answer. Work through all 20 flashcards, review the 4 mnemonic anchors, then check the domain summary cards. Test yourself until every card is instant recall.
20 Flashcards — Click to Flip
D1 · Core Networking
What is the routing priority order when prefix lengths are the same?
Click to reveal answer
D1 · Core Networking
UDR > BGP > System routes
Longest prefix match applies first — a /32 beats /24 regardless of source. Only when lengths match does source priority apply.
D1 · Core Networking
How many usable IPs are in a /26 subnet? What are the 5 reserved addresses?
Click to reveal answer
D1 · Core Networking
59 usable (64 − 5 reserved)
Reserved: network (.0), Azure gateway (.1), Azure DNS (.2 & .3), broadcast (.255)
D1 · Core Networking
Which Network Watcher tool tells you if an NSG is blocking a specific flow?
Click to reveal answer
D1 · Core Networking
IP Flow Verify
It simulates a flow (5-tuple) and reports which NSG rule allows or blocks it. Next Hop = routing check. Connection Monitor = continuous 24/7.
D1 · Core Networking
DNS Private Resolver — inbound vs outbound endpoint: which direction for each?
Click to reveal answer
D1 · Core Networking
Inbound: On-premises → Azure (on-prem DNS forwards to inbound endpoint IP)
Outbound: Azure → On-premises (forwarding ruleset sends Azure queries to on-prem DNS)
D2 · Connectivity
VNet peering: which peering gets AllowGatewayTransit and which gets UseRemoteGateways?
Click to reveal answer
D2 · Connectivity
AllowGatewayTransit → HUB (the VNet that owns the gateway)
UseRemoteGateways → SPOKE (the VNet without a gateway)
They always pair on opposite sides of the peering.
D2 · Connectivity
Does ExpressRoute encrypt data in transit? How do you add encryption?
Click to reveal answer
D2 · Connectivity
NO encryption.
Add encryption via: VPN over ExpressRoute (IPsec tunnel) for provider circuits, or MACsec for ExpressRoute Direct connections only.
D2 · Connectivity
When do you need ExpressRoute Premium? And ExpressRoute Local?
Click to reveal answer
D2 · Connectivity
Premium: Access to ALL Azure regions globally + 10,000 routes
Local: Same metro area, egress transfer included free in the port cost
D2 · Connectivity
Which VPN tunnel type is required for Microsoft Entra ID authentication on P2S?
Click to reveal answer
D2 · Connectivity
OpenVPN
Only OpenVPN supports Entra ID (Azure AD) authentication. SSTP and IKEv2 do not support Entra ID auth.
D2 · Connectivity
What is the correct migration sequence to Azure Virtual WAN?
Click to reveal answer
D2 · Connectivity
1. Create VWAN + hubs
2. Delete existing VNet peerings
3. Connect spokes to VWAN hub
4. Update UDRs and routing tables
D3 · App Delivery
Scenario: global HTTP(S) app, need WAF, CDN, Anycast edge delivery. Which service?
Click to reveal answer
D3 · App Delivery
Azure Front Door (Standard/Premium)
L7 global, Anycast PoPs, WAF (Premium), caching/CDN, SSL termination at edge. Not App Gateway (regional only). Not Traffic Manager (DNS only).
D3 · App Delivery
Where does the Azure Load Balancer health probe originate? Why does this matter?
Click to reveal answer
D3 · App Delivery
From 168.63.129.16 — Azure's virtual IP.
NSG rules using 10.x.x.x source IPs won't match probe traffic. Must allow AzureLoadBalancer service tag (or 168.63.129.16/32) in the backend subnet NSG.
D3 · App Delivery
Does Standard Azure Load Balancer provide default outbound Internet access?
Click to reveal answer
D3 · App Delivery
NO. Standard LB is secure by default — no implicit outbound SNAT.
Solutions: NAT Gateway (overrides all other methods), or explicit outbound rules on the LB, or assign instance-level public IPs.
D4 · Private Access
Three key differences between Service Endpoints and Private Endpoints?
Click to reveal answer
D4 · Private Access
1. SE = free, PE = costs money
2. SE = public IP used, PE = private IP in VNet
3. SE = VNet only, PE = accessible from on-prem via VPN/ER + DNS
D4 · Private Access
What is the DNS resolution chain for a Private Endpoint to Azure SQL?
Click to reveal answer
D4 · Private Access
FQDN → CNAME to privatelink.database.windows.net → A record in Private DNS Zone → Private IP of endpoint
Without VNet link → resolves to public IP instead
D4 · Private Access
How do you apply NSG rules to traffic flowing TO a Private Endpoint?
Click to reveal answer
D4 · Private Access
Enable privateEndpointNetworkPolicies on the subnet:az network vnet subnet update ... --private-endpoint-network-policies Enabled
NSG rules are NOT applied to Private Endpoint NICs by default.
D5 · Security
NSG evaluation order: which NSG is checked FIRST for inbound traffic? And outbound?
Click to reveal answer
D5 · Security
Inbound: Subnet NSG first → NIC NSG second (both must allow)
Outbound: NIC NSG first → Subnet NSG second (both must allow)
D5 · Security
What is the Azure Firewall rule processing order?
Click to reveal answer
D5 · Security
1. DNAT (inbound NAT rules)
2. Network (IP/port/protocol)
3. Application (FQDN/URL/category)
4. Default Deny (implicit)
D5 · Security
Which Azure Firewall SKU is required for IDPS and TLS inspection?
Click to reveal answer
D5 · Security
Premium SKU only
Standard = threat intelligence + FQDN application rules + URL filtering (SNI only)
Premium = Standard + IDPS signatures + TLS inspection + full URL filtering
D5 · Security
AVNM Security Admin Rules: AlwaysAllow vs NSG Deny — what is the outcome?
Click to reveal answer
D5 · Security
AlwaysAllow wins — NSG Deny is completely bypassed.
Evaluation order: Security Admin Rules evaluated FIRST. AlwaysAllow = NSG skipped. Regular Allow = NSG then evaluated after.
D5 · Security
DDoS Protection: does it prevent HTTP application-layer attacks?
Click to reveal answer
D5 · Security
NO — L3/L4 only.
HTTP floods (L7 application layer) require WAF on Azure Application Gateway or Azure Front Door Premium. DDoS Protection and WAF complement each other — use both.
4 Mnemonic Anchors
Routing Precedence
UBS
Firewall Rule Order
DNAD
Load Balancing Quick Pick
LAFTCG
NSG Evaluation
SN → NS
5 Domain Summary Cards
Domain 1
Core Networking Infrastructure
25–30% of exam
- Subnet math: /29=3, /28=11, /27=27, /26=59, /24=251
- Routing: UDR > BGP > System (longest prefix first)
- DNS Private Resolver: inbound=on-prem→Azure, outbound=Azure→on-prem
- Network Watcher: IP Flow Verify, Next Hop, Connection Monitor
- GatewaySubnet: /27 min; AzureFirewallSubnet: /26 min
Domain 2
Connectivity Services
20–25% of exam
- VPN: peering non-transitive, gateway transit hub/spoke settings
- ExpressRoute: private not encrypted, Premium=all regions, Local=metro
- P2S: OpenVPN required for Entra ID auth
- VWAN migration: create → delete peerings → connect spokes → update UDRs
- ER Global Reach: two on-prem sites via Microsoft backbone
Domain 3
Application Delivery Networks
15–20% of exam
- LB=L4 Regional; AppGW=L7 Regional; Front Door=L7 Global; TM=DNS Global
- LB probes from 168.63.129.16 — allow AzureLoadBalancer service tag
- Standard LB: no default outbound — add NAT Gateway or outbound rules
- Traffic Manager = DNS only, never touches app traffic
- NAT Gateway overrides LB outbound SNAT on the subnet
Domain 4
Private Access to Azure Services
10–15% of exam
- SE=free, public IP, VNet only. PE=costs, private IP, on-prem access possible
- PE DNS: FQDN → CNAME → A record in Private DNS Zone → private IP
- Every VNet needs its own Private DNS Zone VNet link
- NSG on PE NICs requires privateEndpointNetworkPolicies=Enabled
- Private Link Service: expose your service across tenants via Standard ILB
Domain 5
Network Security
15–20% of exam
- NSG inbound: Subnet→NIC. Outbound: NIC→Subnet. Both must allow.
- Firewall rules: DNAT → Network → Application → Deny
- Firewall Premium: IDPS + TLS inspection (Standard does not have these)
- AVNM Security Admin: evaluated before NSG; AlwaysAllow bypasses NSG
- DDoS = L3/L4 only; HTTP floods need WAF on AppGW or Front Door