AZ-700 Study Manual
Exam study guide for Azure Network Engineer — all five domains.
📘 AZ-700: Designing and Implementing Microsoft Azure Networking Solutions
Complete Exam Study Guide (2026 Edition)
🎯 Exam Overview
| Aspect | Details |
|---|---|
| ------------ | ------------- |
| Exam Code | AZ-700 |
| Exam Name | Designing and Implementing Microsoft Azure Networking Solutions |
| Duration | 100 minutes |
| Number of Questions | 40-60 questions |
| Passing Score | 700/1000 (70%) |
| Question Types | Multiple choice, multi-select, drag-drop, case studies, hot area |
| Exam Cost | $165 USD |
| Prerequisites | Azure Administrator (AZ-104) knowledge recommended |
| Renewal | Annually via Microsoft Learn |
📊 Exam Domains and Weights
Domain Breakdown (2026 Exam Update)
| Domain | Weight | Topics |
|---|---|---|
| ----------- | ------------ | ------------ |
| 1. Design, Implement, and Manage Hybrid Networking | 25-30% | VPN Gateway, ExpressRoute, Virtual WAN, DNS |
| 2. Design and Implement Core Networking Infrastructure | 20-25% | VNets, Subnets, Peering, IP Addressing |
| 3. Design and Implement Routing | 20-25% | UDRs, System Routes, BGP, Azure Firewall, Route Server |
| 4. Secure and Monitor Networks | 15-20% | NSGs, ASGs, Azure Firewall, Network Watcher, DDoS |
| 5. Design and Implement Private Access to Azure Services | 10-15% | Service Endpoints, Private Link, Private DNS Zones |
📅 30-Day Study Plan
Week 1: Foundations (Core Networking)
Day 1-2: VNets, Subnets, IP Addressing
- [ ] Understand VNet address spaces (CIDR notation)
- [ ] Learn subnet delegation (App Service, Container Instances, etc.)
- [ ] Master reserved IP addresses in subnets (first 3, last 1, broadcast)
- [ ] Practice IP address planning for multi-VNet scenarios
- [ ] Study Azure-provided DNS (168.63.129.16)
Lab 1.1: Create a VNet with multiple subnets
# Create VNet with multiple subnets New-AzVirtualNetwork -Name "VNet-Lab" -ResourceGroupName "RG-Lab" ` -Location "EastUS" -AddressPrefix "10.0.0.0/16" # Add subnets Add-AzVirtualNetworkSubnetConfig -Name "WebSubnet" ` -VirtualNetwork $vnet -AddressPrefix "10.0.1.0/24" Add-AzVirtualNetworkSubnetConfig -Name "AppSubnet" ` -VirtualNetwork $vnet -AddressPrefix "10.0.2.0/24"
Day 3-4: VNet Peering
- [ ] Understand VNet peering (regional vs. global)
- [ ] Learn peering properties (Gateway Transit, Remote Gateway, Forwarded Traffic)
- [ ] Master NON-TRANSITIVE nature of peering
- [ ] Study peering costs (intra-region vs. cross-region)
- [ ] Learn peering requirements (no overlapping IP spaces)
Lab 1.2: Configure VNet peering
# Peer VNet-1 to VNet-2 Add-AzVirtualNetworkPeering -Name "VNet1-to-VNet2" ` -VirtualNetwork $vnet1 -RemoteVirtualNetworkId $vnet2.Id ` -AllowGatewayTransit -AllowForwardedTraffic # Peer VNet-2 to VNet-1 Add-AzVirtualNetworkPeering -Name "VNet2-to-VNet1" ` -VirtualNetwork $vnet2 -RemoteVirtualNetworkId $vnet1.Id ` -UseRemoteGateways -AllowForwardedTraffic
Day 5-6: NSGs and ASGs
- [ ] Learn NSG rule structure (priority, source, destination, port, protocol, action)
- [ ] Understand default NSG rules (cannot be deleted)
- [ ] Master NSG association (subnet vs. NIC level)
- [ ] Study Application Security Groups (ASGs) for logical grouping
- [ ] Practice NSG rule evaluation order
Lab 1.3: Configure NSGs with ASGs
# Create ASG for web servers New-AzApplicationSecurityGroup -Name "ASG-WebServers" ` -ResourceGroupName "RG-Lab" -Location "EastUS" # Create NSG rule using ASG $rule = New-AzNetworkSecurityRuleConfig -Name "Allow-HTTP" ` -Priority 100 -Direction Inbound -Access Allow ` -Protocol TCP -SourcePortRange * -DestinationPortRange 80 ` -SourceAddressPrefix Internet ` -DestinationApplicationSecurityGroup $asgWeb
Day 7: Week 1 Review
- [ ] Complete Microsoft Learn modules for VNets and NSGs
- [ ] Take practice quiz on core networking
- [ ] Review notes and create flashcards
Week 2: Hybrid Connectivity
Day 8-9: VPN Gateway
- [ ] Understand VPN Gateway SKUs (Basic, VpnGw1-5, VpnGw1AZ-5AZ)
- [ ] Learn Site-to-Site (S2S) vs. Point-to-Site (P2S) vs. VNet-to-VNet
- [ ] Master IPsec/IKE parameters and policies
- [ ] Study BGP configuration with VPN Gateway
- [ ] Learn VPN Gateway HA options (Active-Active, Zone-Redundant)
Lab 2.1: Deploy VPN Gateway with S2S tunnel
# Create Gateway Subnet (must be named "GatewaySubnet") Add-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" ` -VirtualNetwork $vnet -AddressPrefix "10.0.255.0/27" # Create VPN Gateway (takes 30-45 minutes) New-AzVirtualNetworkGateway -Name "VPN-Gateway" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -GatewayType Vpn -VpnType RouteBased -GatewaySku VpnGw2 ` -VirtualNetwork $vnet -PublicIpAddress $gwpip # Create Local Network Gateway (on-premises) New-AzLocalNetworkGateway -Name "OnPrem-Gateway" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -GatewayIpAddress "203.0.113.10" ` -AddressPrefix "192.168.0.0/16" # Create VPN Connection New-AzVirtualNetworkGatewayConnection -Name "S2S-Connection" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -VirtualNetworkGateway1 $vpnGw -LocalNetworkGateway2 $localGw ` -ConnectionType IPsec -SharedKey "YourSharedKey123!"
Key Concepts:
- GatewaySubnet minimum size: /29 (recommended /27 for future growth)
- Max S2S tunnels: Basic = 10, VpnGw1 = 30, VpnGw2+ = 30
- BGP ASN: Can be customized (default 65515)
- Active-Active: Requires 2 public IPs, doubles throughput
Day 10-11: ExpressRoute
- [ ] Understand ExpressRoute circuit architecture (Provider → Microsoft Edge → Azure)
- [ ] Learn peering types (Private, Microsoft, Public - deprecated)
- [ ] Master ExpressRoute SKUs (Local, Standard, Premium)
- [ ] Study ExpressRoute Global Reach
- [ ] Learn FastPath for high-throughput scenarios
Lab 2.2: Configure ExpressRoute circuit (requires provider)
# Create ExpressRoute Circuit (requires provider provisioning) New-AzExpressRouteCircuit -Name "ER-Circuit" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -SkuTier Premium -SkuFamily MeteredData ` -ServiceProviderName "Equinix" -PeeringLocation "Silicon Valley" ` -BandwidthInMbps 1000 # Configure Private Peering Add-AzExpressRouteCircuitPeeringConfig -Name "AzurePrivatePeering" ` -ExpressRouteCircuit $circuit -PeeringType AzurePrivatePeering ` -PeerASN 65001 -PrimaryPeerAddressPrefix "192.168.1.0/30" ` -SecondaryPeerAddressPrefix "192.168.1.4/30" -VlanId 100 # Link ExpressRoute to VNet Gateway New-AzVirtualNetworkGatewayConnection -Name "ER-Connection" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -VirtualNetworkGateway1 $erGw -PeerId $circuit.Id ` -ConnectionType ExpressRoute
ExpressRoute vs. VPN Quick Reference:
| Criteria | ExpressRoute | VPN Gateway |
|---|---|---|
| -------------- | ------------------ | ----------------- |
| Connection | Private circuit | Public Internet |
| Bandwidth | 50 Mbps - 100 Gbps | Up to 10 Gbps |
| Latency | Predictable, low | Variable |
| Encryption | Not by default | IPsec/IKE |
| Setup Time | Weeks/months | Minutes |
| Cost | High | Low |
| Use Case | Production, mission-critical | Dev/test, DR, small offices |
Day 12-13: Virtual WAN
- [ ] Understand Virtual WAN architecture (Standard vs. Basic)
- [ ] Learn Virtual Hub creation and management
- [ ] Master hub-to-hub connectivity (Any-to-Any)
- [ ] Study Secured Virtual Hub (requires Azure Firewall)
- [ ] Learn Routing Intent (NEW 2025/2026 feature)
Lab 2.3: Deploy Virtual WAN
# Create Virtual WAN New-AzVirtualWan -Name "VWAN-Global" ` -ResourceGroupName "RG-Lab" -Location "EastUS" -Type Standard # Create Virtual Hub New-AzVirtualHub -Name "Hub-EastUS" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -VirtualWan $vwan -AddressPrefix "10.200.0.0/16" # Connect VNet to Virtual Hub New-AzVirtualHubVnetConnection -Name "Spoke1-Connection" ` -ResourceGroupName "RG-Lab" -ParentResourceName "Hub-EastUS" ` -RemoteVirtualNetwork $spokeVnet
Virtual WAN Migration Checklist:
- 1. ✅ Create Virtual WAN and Virtual Hub
- 2. ✅ DELETE existing VNet peerings (critical step!)
- 3. ✅ Connect Spoke VNets to Virtual Hub
- 4. ✅ Update route tables (remove old UDRs)
- 5. ✅ Deploy Azure Firewall for Secured Virtual Hub (optional)
Day 14: Week 2 Review
- [ ] Complete Microsoft Learn modules for Hybrid Networking
- [ ] Practice VPN vs. ExpressRoute decision matrix
- [ ] Review Virtual WAN migration sequence
Week 3: Routing and Security
Day 15-16: Routing (UDRs, System Routes, BGP)
- [ ] Understand System Routes (VNet local, peering, Internet, etc.)
- [ ] Learn User-Defined Routes (UDRs) and next hop types
- [ ] Master route selection logic (LPM → UDR → BGP → System)
- [ ] Study BGP route propagation (enable/disable per route table)
- [ ] Learn Azure Route Server (for NVA route advertisement)
Lab 3.1: Configure UDRs for Hub-and-Spoke
# Create Route Table New-AzRouteTable -Name "RT-Spoke" ` -ResourceGroupName "RG-Lab" -Location "EastUS" # Add route to force traffic through Firewall Add-AzRouteConfig -Name "Route-to-Hub" ` -RouteTable $routeTable -AddressPrefix "10.0.0.0/8" ` -NextHopType VirtualAppliance -NextHopIpAddress "10.1.0.4" # Add default route to Firewall Add-AzRouteConfig -Name "Default-Route" ` -RouteTable $routeTable -AddressPrefix "0.0.0.0/0" ` -NextHopType VirtualAppliance -NextHopIpAddress "10.1.0.4" # Disable BGP propagation (prevents on-prem routes from bypassing firewall) $routeTable.DisableBgpRoutePropagation = $true # Associate route table with subnet Set-AzVirtualNetworkSubnetConfig -Name "Spoke-Subnet" ` -VirtualNetwork $spokeVnet -AddressPrefix "10.2.1.0/24" ` -RouteTable $routeTable
Routing Precedence Mnemonics:
- "LPM Before All" - Longest Prefix Match wins first
- "UDR Beats BGP Beats System" - When prefix length is same
- "User Before Dynamic Before Default" - Another way to remember
Day 17-18: Azure Firewall
- [ ] Understand Azure Firewall SKUs (Basic, Standard, Premium)
- [ ] Learn rule types (NAT, Network, Application)
- [ ] Master rule collection groups and priority
- [ ] Study Firewall policies vs. classic rules
- [ ] Learn IDPS (Intrusion Detection/Prevention) in Premium
Lab 3.2: Deploy Azure Firewall in Hub VNet
# Create AzureFirewallSubnet (must be named exactly this) Add-AzVirtualNetworkSubnetConfig -Name "AzureFirewallSubnet" ` -VirtualNetwork $hubVnet -AddressPrefix "10.1.0.0/26" # Create Firewall Public IP New-AzPublicIpAddress -Name "FW-PIP" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -AllocationMethod Static -Sku Standard # Create Azure Firewall New-AzFirewall -Name "AzFW-Hub" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -VirtualNetwork $hubVnet -PublicIpAddress $fwPip # Create Network Rule Collection $netRule = New-AzFirewallNetworkRule -Name "Allow-RDP" ` -Protocol TCP -SourceAddress "10.2.0.0/16" ` -DestinationAddress "10.3.0.0/16" -DestinationPort 3389 $netRuleCollection = New-AzFirewallNetworkRuleCollection ` -Name "RDP-Rules" -Priority 100 -Rule $netRule -ActionType Allow Set-AzFirewall -AzureFirewall $firewall
Azure Firewall Rule Processing Order:
- 1. DNAT Rules (Destination NAT - inbound)
- 2. Network Rules (Layer 3/4 filtering)
- 3. Application Rules (Layer 7 / FQDN filtering)
- 4. Default Action (Deny if no match)
Day 19-20: Network Watcher
- [ ] Learn IP Flow Verify (NSG rule testing)
- [ ] Master Next Hop (routing troubleshooting)
- [ ] Study Connection Monitor (continuous monitoring)
- [ ] Understand NSG Flow Logs + Traffic Analytics
- [ ] Learn Packet Capture (deep packet inspection)
Lab 3.3: Use Network Watcher for troubleshooting
# Enable Network Watcher (per region) New-AzNetworkWatcher -Name "NW-EastUS" ` -ResourceGroupName "NetworkWatcherRG" -Location "EastUS" # IP Flow Verify (test if traffic is allowed/denied by NSG) Test-AzNetworkWatcherIPFlow -NetworkWatcher $nw ` -TargetVirtualMachineId $vm.Id -Direction Outbound ` -Protocol TCP -LocalIPAddress "10.0.1.4" -LocalPort 50000 ` -RemoteIPAddress "10.0.2.4" -RemotePort 443 # Next Hop (check routing) Get-AzNetworkWatcherNextHop -NetworkWatcher $nw ` -TargetVirtualMachineId $vm.Id ` -SourceIPAddress "10.0.1.4" -DestinationIPAddress "8.8.8.8" # Enable NSG Flow Logs Set-AzNetworkWatcherFlowLog -NetworkWatcher $nw ` -TargetResourceId $nsg.Id -StorageId $storageAccount.Id ` -Enabled $true -RetentionInDays 90
Network Watcher Tools Quick Reference:
| Tool | Purpose | Use Case |
|---|---|---|
| ---------- | ------------- | -------------- |
| IP Flow Verify | Test NSG rules | "Is my NSG blocking this traffic?" |
| Next Hop | Check routing decision | "Where is this packet going?" |
| Connection Monitor | 24/7 connectivity monitoring | "Is my app always reachable?" |
| NSG Flow Logs | Traffic metadata logging | "Who accessed my VM?" |
| Packet Capture | Deep packet inspection | "What's in the actual packet?" |
| Topology | Visual network diagram | "Show me my network layout" |
| VPN Troubleshoot | VPN Gateway diagnostics | "Why is my VPN down?" |
Day 21: Week 3 Review
- [ ] Complete Microsoft Learn modules for Routing and Security
- [ ] Practice routing precedence scenarios
- [ ] Review Azure Firewall rule types
Week 4: Private Access, Load Balancing, and Advanced Topics
Day 22-23: Private Link and Service Endpoints
- [ ] Understand Service Endpoints (VNet-scoped, public IP remains)
- [ ] Learn Private Endpoints (private IP, Private Link)
- [ ] Master Private DNS Zones for Private Endpoints
- [ ] Study Private Link Service (expose your service)
- [ ] Learn cross-tenant Private Link scenarios
Lab 4.1: Configure Private Endpoint for Storage
# Create Private Endpoint for Storage Account $plsConnection = New-AzPrivateLinkServiceConnection ` -Name "PE-Storage-Connection" ` -PrivateLinkServiceId $storageAccount.Id ` -GroupId "blob" New-AzPrivateEndpoint -Name "PE-Storage" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -Subnet $subnet -PrivateLinkServiceConnection $plsConnection # Create Private DNS Zone New-AzPrivateDnsZone -Name "privatelink.blob.core.windows.net" ` -ResourceGroupName "RG-Lab" # Link Private DNS Zone to VNet New-AzPrivateDnsVirtualNetworkLink -Name "VNet-Link" ` -ResourceGroupName "RG-Lab" -ZoneName "privatelink.blob.core.windows.net" ` -VirtualNetworkId $vnet.Id -EnableRegistration # Create DNS A record for Private Endpoint New-AzPrivateDnsRecordSet -Name $storageAccount.Name ` -RecordType A -ZoneName "privatelink.blob.core.windows.net" ` -ResourceGroupName "RG-Lab" -Ttl 3600 ` -PrivateDnsRecords (New-AzPrivateDnsRecordConfig -IPv4Address "10.0.1.5")
Private Link vs. Service Endpoints Decision Tree:
Need access from on-premises? ├─ YES → Private Endpoints (Service Endpoints VNet-only) └─ NO → Continue Need cross-tenant access? ├─ YES → Private Endpoints (Service Endpoints same-tenant only) └─ NO → Continue Zero public IP requirement? ├─ YES → Private Endpoints (Service Endpoints use public IP) └─ NO → Continue Budget-conscious? ├─ YES → Service Endpoints (free) └─ NO → Private Endpoints (best security)
Day 24: DNS Private Resolver
- [ ] Understand Inbound endpoints (on-prem → Azure)
- [ ] Learn Outbound endpoints (Azure → on-prem)
- [ ] Master DNS Forwarding Rulesets
- [ ] Study subnet requirements (/28 minimum, delegated)
- [ ] Practice hybrid DNS resolution scenarios
Lab 4.2: Deploy DNS Private Resolver
# Create DNS Private Resolver
New-AzDnsResolver -Name "DNS-Resolver" `
-ResourceGroupName "RG-Lab" -Location "EastUS" `
-VirtualNetworkId $hubVnet.Id
# Create Inbound Endpoint (on-prem queries Azure)
$inboundSubnet = Get-AzVirtualNetworkSubnetConfig `
-Name "DNSResolverInboundSubnet" -VirtualNetwork $hubVnet
New-AzDnsResolverInboundEndpoint -Name "Inbound-Endpoint" `
-DnsResolverName "DNS-Resolver" -ResourceGroupName "RG-Lab" `
-Location "EastUS" -IpConfiguration @{SubnetId=$inboundSubnet.Id}
# Create Outbound Endpoint (Azure queries on-prem)
$outboundSubnet = Get-AzVirtualNetworkSubnetConfig `
-Name "DNSResolverOutboundSubnet" -VirtualNetwork $hubVnet
New-AzDnsResolverOutboundEndpoint -Name "Outbound-Endpoint" `
-DnsResolverName "DNS-Resolver" -ResourceGroupName "RG-Lab" `
-Location "EastUS" -SubnetId $outboundSubnet.Id
# Create DNS Forwarding Ruleset
New-AzDnsForwardingRuleset -Name "OnPrem-Forwarding" `
-ResourceGroupName "RG-Lab" -Location "EastUS" `
-OutboundEndpoint @{Id=$outboundEndpoint.Id}
# Add forwarding rule for on-premises domain
New-AzDnsForwardingRule -Name "Contoso-Rule" `
-DnsForwardingRulesetName "OnPrem-Forwarding" `
-ResourceGroupName "RG-Lab" -DomainName "contoso.local" `
-TargetDnsServer @{IpAddress="192.168.1.10"; Port=53}
# Link ruleset to Spoke VNets
New-AzDnsForwardingRulesetVirtualNetworkLink -Name "Spoke1-Link" `
-DnsForwardingRulesetName "OnPrem-Forwarding" `
-ResourceGroupName "RG-Lab" -VirtualNetworkId $spoke1Vnet.Id
Day 25-26: Load Balancing Services
- [ ] Understand Azure Load Balancer (Layer 4, regional)
- [ ] Learn Application Gateway (Layer 7, regional, WAF)
- [ ] Master Azure Front Door (Layer 7, global)
- [ ] Study Traffic Manager (DNS-based, global)
- [ ] Learn when to use each service
Load Balancer Comparison Table:
| Service | Layer | Scope | Protocol | Use Case |
|---|---|---|---|---|
| ------------- | ----------- | ----------- | -------------- | -------------- |
| Load Balancer | Layer 4 | Regional | TCP/UDP | Internal apps, VMs, high-throughput |
| Application Gateway | Layer 7 | Regional | HTTP/HTTPS | Web apps, WAF, SSL termination |
| Front Door | Layer 7 | Global | HTTP/HTTPS | Global web apps, CDN, WAF |
| Traffic Manager | DNS | Global | Any | DR, geographic routing, non-HTTP |
Lab 4.3: Deploy Application Gateway with WAF
# Create Application Gateway Subnet Add-AzVirtualNetworkSubnetConfig -Name "AppGwSubnet" ` -VirtualNetwork $vnet -AddressPrefix "10.0.10.0/24" # Create Public IP for Application Gateway New-AzPublicIpAddress -Name "AppGw-PIP" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -AllocationMethod Static -Sku Standard # Create Application Gateway with WAF $appGw = New-AzApplicationGateway -Name "AppGw-WAF" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -Sku WAF_v2 -Tier WAF_v2 -Capacity 2 ` -BackendAddressPool $backendPool ` -BackendHttpSettings $httpSettings ` -FrontendIpConfiguration $fipConfig ` -GatewayIpConfiguration $gwIpConfig ` -HttpListener $listener ` -RequestRoutingRule $rule ` -WebApplicationFirewallConfiguration $wafConfig
Day 27: Advanced Topics
- [ ] Azure Bastion (secure RDP/SSH without public IPs)
- [ ] Azure Route Server (for NVA BGP integration)
- [ ] NAT Gateway (outbound Internet connectivity)
- [ ] DDoS Protection Standard vs. Basic
- [ ] Azure Virtual Network Manager (preview/new)
Lab 4.4: Deploy Azure Bastion
# Create AzureBastionSubnet (must be named exactly this, minimum /26) Add-AzVirtualNetworkSubnetConfig -Name "AzureBastionSubnet" ` -VirtualNetwork $vnet -AddressPrefix "10.0.254.0/26" # Create Public IP for Bastion New-AzPublicIpAddress -Name "Bastion-PIP" ` -ResourceGroupName "RG-Lab" -Location "EastUS" ` -AllocationMethod Static -Sku Standard # Create Azure Bastion New-AzBastion -Name "Bastion-Hub" ` -ResourceGroupName "RG-Lab" -VirtualNetwork $vnet ` -PublicIpAddress $bastionPip -Sku Standard
Day 28: Final Review Day
- [ ] Review all week 1-4 notes
- [ ] Retake all quizzes (aim for 90%+)
- [ ] Review flashcards (routing, services, comparisons)
Day 29: Practice Exams
- [ ] Take full-length practice exam #1 (timed, 120 minutes)
- [ ] Review incorrect answers and understand why
- [ ] Create summary notes on weak areas
Day 30: Exam Readiness
- [ ] Take full-length practice exam #2 (timed, 120 minutes)
- [ ] Final review of high-yield topics (see below)
- [ ] Get good sleep before exam day
🎯 High-Yield Topics (Study These Extra)
Top 10 Exam Topics (Weighted by Frequency)
- 1. Hub-and-Spoke with Azure Firewall (30% of exam)
- UDR configuration on Spoke subnets
- UDR on GatewaySubnet for return traffic
- Why AzureFirewallSubnet should NOT have route table
- Disabling BGP propagation on Spoke route tables
- 2. Virtual WAN Migration (10-15% of exam)
- Migration sequence: Create VWAN → Delete Peerings → Connect Spokes → Update UDRs
- Secured Virtual Hub (requires Azure Firewall)
- Routing Intent (Internet + Private Traffic policies)
- BGP route propagation in Virtual WAN
- 3. Service Endpoints vs. Private Endpoints (10-15% of exam)
- Service Endpoints: VNet-only, public IP remains, free
- Private Endpoints: On-prem access, private IP, DNS integration, paid
- When to use each (on-prem access = Private Endpoints)
- 4. DNS Private Resolver (5-10% of exam - NEW)
- Inbound endpoint: On-prem → Azure (queries Azure Private DNS Zones)
- Outbound endpoint: Azure → On-prem (with Forwarding Rulesets)
- Subnet requirements: /28 minimum, delegated to Microsoft.Network/dnsResolvers
- 5. Routing Precedence (5-10% of exam)
- Longest Prefix Match (LPM) wins first
- If same prefix: UDR > BGP > System Routes
- How to check: Effective routes on VM NIC
- 6. VNet Peering Non-Transitivity (5-10% of exam)
- Spoke-to-Spoke communication requires Hub routing (firewall/NVA + UDRs)
- Or use Virtual WAN (Any-to-Any by default)
- Gateway Transit ≠ Spoke-to-Spoke transit
- 7. ExpressRoute Features (5-10% of exam)
- No encryption by default (need VPN over ER or MACsec)
- Private Peering (Azure VNets), Microsoft Peering (M365, Azure PaaS)
- Global Reach (connect on-prem sites via Microsoft backbone)
- FastPath (bypass VNet Gateway for high throughput)
- 8. Network Watcher Tools (5-10% of exam)
- IP Flow Verify: NSG testing
- Next Hop: Routing testing
- Connection Monitor: Continuous monitoring
- NSG Flow Logs + Traffic Analytics: Traffic analysis
- 9. Azure Firewall Rules (5-10% of exam)
- Processing order: DNAT → Network → Application → Default Deny
- DNAT is inbound only (need Network rules for outbound)
- Application rules for FQDN filtering
- 10. Load Balancing Decision Matrix (5-10% of exam)
- Layer 4 regional = Load Balancer
- Layer 7 regional + WAF = Application Gateway
- Layer 7 global + WAF = Front Door
- DNS-based global = Traffic Manager
🧠 Memory Aids and Mnemonics
Routing Precedence
"Longest Prefix Married Ursula Before Brigitte's Sister"
- Longest Prefix - Longest Prefix Match (LPM)
- Married - Wins (gets priority)
- Ursula - User-Defined Routes (UDR)
- Before - Beats
- Brigitte - BGP routes
- Sister - System routes
VPN Gateway SKUs
"Basic VPN Gets 1-5 Zones Automatically"
- Basic - Basic SKU (legacy, avoid for production)
- VPN - VPN Gateway
- Gets - Gateway
- 1-5 - VpnGw1, VpnGw2, VpnGw3, VpnGw4, VpnGw5
- Zones - Zone-redundant variants (VpnGw1AZ, etc.)
- Automatically - Active-Active support (VpnGw1+)
Azure Firewall Rule Order
"DNAT Needs Application Defaults"
- DNAT - DNAT rules (first)
- Needs - Network rules (second)
- Application - Application rules (third)
- Defaults - Default action: Deny (last)
Service Endpoints vs. Private Endpoints
"Service Endpoints are Selfish - VNet Only, Public IP Stays"
"Private Endpoints are Polite - Everywhere works, Private IP given"
Virtual WAN Migration
"Create, Delete, Connect, Update"
- Create - Virtual WAN and Virtual Hub
- Delete - Existing VNet peerings
- Connect - Spoke VNets to Virtual Hub
- Update - Route tables (remove old UDRs)
DNS Private Resolver
"Inbound = INTO Azure, Outbound = OUT of Azure"
- Inbound Endpoint - On-prem queries Azure (on-prem → Azure)
- Outbound Endpoint - Azure queries on-prem (Azure → on-prem)
ExpressRoute Peering Types
"Private for VNets, Microsoft for Services"
- Private Peering - Access Azure VNets (private IPs)
- Microsoft Peering - Access M365, Azure PaaS (public IPs)
NSG Default Rules (Outbound)
"VNet first, Internet second, Deny the rest"
- Priority 65000 - AllowVnetOutbound
- Priority 65001 - AllowInternetOutbound
- Priority 65500 - DenyAllOutbound
🔧 Must-Do Labs
Lab Priority: Critical → Important → Nice-to-Have
🔴 CRITICAL (Must Complete)
- 1. Hub-and-Spoke with Azure Firewall
- Deploy Hub VNet with AzureFirewallSubnet, GatewaySubnet, Shared Services
- Deploy 2 Spoke VNets with VNet peering to Hub
- Deploy Azure Firewall in Hub
- Configure UDRs on Spoke subnets (0.0.0.0/0 → Firewall)
- Configure UDR on GatewaySubnet (Spoke prefixes → Firewall)
- Test Spoke-to-Spoke traffic (should go through firewall)
- Why Critical: 30% of exam scenarios involve this topology
- 2. Private Endpoints with Private DNS Zones
- Deploy Storage Account with public access disabled
- Create Private Endpoint for Storage (blob)
- Create Private DNS Zone (privatelink.blob.core.windows.net)
- Link Private DNS Zone to VNet
- Test DNS resolution from VM (should resolve to private IP)
- Why Critical: Private Link is heavily tested (10-15% of exam)
- 3. VNet Peering and Routing
- Create 3 VNets (Hub, Spoke-1, Spoke-2)
- Peer Hub ↔ Spoke-1, Hub ↔ Spoke-2
- Test Spoke-1 → Spoke-2 (should fail - non-transitive)
- Add UDRs to enable Spoke-to-Spoke via Hub NVA/Firewall
- Check effective routes on VM NICs
- Why Critical: VNet peering non-transitivity is a guaranteed question
🟡 IMPORTANT (Strongly Recommended)
- 4. VPN Gateway with Site-to-Site
- Deploy VPN Gateway in Hub VNet
- Configure Local Network Gateway (simulate on-prem)
- Create S2S VPN connection
- Test connectivity (requires real on-prem or simulated with another Azure VNet)
- 5. DNS Private Resolver
- Deploy DNS Private Resolver in Hub VNet
- Create Inbound and Outbound endpoints
- Configure DNS Forwarding Ruleset (forward contoso.local to 192.168.1.10)
- Link ruleset to Spoke VNets
- Test DNS resolution from Spoke VM
- 6. Network Watcher Diagnostics
- Use IP Flow Verify to test NSG rules (allow/deny scenarios)
- Use Next Hop to trace routing decisions
- Configure NSG Flow Logs + Traffic Analytics
- Create Connection Monitor for continuous testing
🟢 NICE-TO-HAVE (If Time Permits)
- 7. Virtual WAN Deployment
- Create Virtual WAN (Standard)
- Create Virtual Hub in 2 regions (East US, West US)
- Connect Spoke VNets to hubs
- Test hub-to-hub connectivity (Any-to-Any)
- 8. Application Gateway with WAF
- Deploy Application Gateway (WAF v2 SKU)
- Configure backend pool with 2-3 VMs
- Configure health probes, HTTP settings, listeners, rules
- Test WAF blocking (SQL injection, XSS)
- 9. Azure Bastion
- Deploy Azure Bastion in Hub VNet
- Test RDP/SSH to VMs without public IPs
- Verify traffic stays within Azure backbone
📚 Recommended Resources
Official Microsoft Resources
- 1. Microsoft Learn Paths (FREE):
- [Design and implement hybrid networking](https://learn.microsoft.com/training/paths/design-implement-hybrid-networking/)
- [Design and implement core networking infrastructure](https://learn.microsoft.com/training/paths/design-implement-core-networking-infrastructure/)
- [Design and implement routing](https://learn.microsoft.com/training/paths/design-implement-routing/)
- [Secure and monitor networks](https://learn.microsoft.com/training/paths/secure-monitor-networks/)
- [Design and implement private access to Azure Services](https://learn.microsoft.com/training/paths/design-implement-private-access-azure-services/)
- 2. Microsoft Documentation:
- [Azure Networking Documentation](https://learn.microsoft.com/azure/networking/)
- [Azure Firewall Documentation](https://learn.microsoft.com/azure/firewall/)
- [ExpressRoute Documentation](https://learn.microsoft.com/azure/expressroute/)
- [Virtual WAN Documentation](https://learn.microsoft.com/azure/virtual-wan/)
- 3. Exam Preparation:
- [AZ-700 Exam Page](https://learn.microsoft.com/certifications/exams/az-700)
- [AZ-700 Study Guide](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4PaHw)
- [Microsoft Learning GitHub Repo](https://github.com/MicrosoftLearning/AZ-700-Designing-and-Implementing-Microsoft-Azure-Networking-Solutions)
Practice Exams
- 1. MeasureUp (Official Microsoft Partner) - $99
- Most realistic practice exams
- Detailed explanations
- Performance tracking
- 2. Whizlabs - $19.95
- Good quality questions
- Affordable
- Multiple practice tests
- 3. Tutorials Dojo - $14.99
- Highly rated
- Timed mode + Review mode
- Performance reports
Video Courses
- 1. John Savill's Azure Master Class (FREE on YouTube)
- [AZ-700 Study Cram](https://www.youtube.com/watch?v=nVZYDhB_M64)
- Comprehensive, deep-dive content
- Whiteboard explanations
- 2. Pluralsight - Subscription required
- "Designing and Implementing Microsoft Azure Networking Solutions" by Tim Warner
- 3. LinkedIn Learning - Subscription required
- Multiple AZ-700 focused courses
Community Resources
- 1. Reddit:
- r/AzureCertification
- r/Azure
- 2. Discord:
- Azure Community Discord
- 3. Study Groups:
- Microsoft Tech Community
📝 Quick Reference Sheets
Reserved Subnet Names
| Subnet Name | Service | Minimum Size |
|---|---|---|
| ----------------- | ------------- | ------------------ |
| GatewaySubnet | VPN/ER Gateway | /29 (recommend /27) |
| AzureFirewallSubnet | Azure Firewall | /26 |
| AzureBastionSubnet | Azure Bastion | /26 |
| RouteServerSubnet | Azure Route Server | /27 |
IMPORTANT: These names are case-sensitive and cannot be renamed.
Azure Reserved IP Addresses (Per Subnet)
Every subnet reserves 5 IP addresses:
- x.x.x.0 - Network address
- x.x.x.1 - Azure Gateway (default gateway)
- x.x.x.2 - Azure DNS mapping
- x.x.x.3 - Azure DNS mapping
- x.x.x.255 - Broadcast address
Example: Subnet 10.0.1.0/24 (256 IPs)
- Reserved: 5 IPs
- Usable: 251 IPs
VPN Gateway Throughput by SKU
| SKU | Max Throughput | Max Tunnels | BGP | Zone-Redundant |
|---|---|---|---|---|
| --------- | ------------------- | ----------------- | --------- | ------------------- |
| Basic | 100 Mbps | 10 | ❌ | ❌ |
| VpnGw1 | 650 Mbps | 30 | ✅ | ❌ |
| VpnGw2 | 1 Gbps | 30 | ✅ | ❌ |
| VpnGw3 | 1.25 Gbps | 30 | ✅ | ❌ |
| VpnGw4 | 5 Gbps | 100 | ✅ | ❌ |
| VpnGw5 | 10 Gbps | 100 | ✅ | ❌ |
| VpnGw1AZ | 650 Mbps | 30 | ✅ | ✅ |
| VpnGw2AZ | 1 Gbps | 30 | ✅ | ✅ |
| VpnGw3AZ | 1.25 Gbps | 30 | ✅ | ✅ |
| VpnGw4AZ | 5 Gbps | 100 | ✅ | ✅ |
| VpnGw5AZ | 10 Gbps | 100 | ✅ | ✅ |
ExpressRoute Bandwidth Options
Local SKU: 50 Mbps, 100 Mbps, 200 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps
Standard/Premium SKU: 50 Mbps, 100 Mbps, 200 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, 100 Gbps
Standard vs. Premium:
- Standard: Regional connectivity only
- Premium: Global connectivity, increased route limits (10,000 vs 4,000)
NSG Default Inbound Rules
| Priority | Name | Source | Destination | Port | Action |
|---|---|---|---|---|---|
| -------------- | ---------- | ------------ | ----------------- | ---------- | ----------- |
| 65000 | AllowVnetInBound | VirtualNetwork | VirtualNetwork | Any | Allow |
| 65001 | AllowAzureLoadBalancerInBound | AzureLoadBalancer | Any | Any | Allow |
| 65500 | DenyAllInBound | Any | Any | Any | Deny |
NSG Default Outbound Rules
| Priority | Name | Source | Destination | Port | Action |
|---|---|---|---|---|---|
| -------------- | ---------- | ------------ | ----------------- | ---------- | ----------- |
| 65000 | AllowVnetOutBound | VirtualNetwork | VirtualNetwork | Any | Allow |
| 65001 | AllowInternetOutBound | Any | Internet | Any | Allow |
| 65500 | DenyAllOutBound | Any | Any | Any | Deny |
Azure Firewall SKU Comparison
| Feature | Basic | Standard | Premium |
|---|---|---|---|
| ------------- | ----------- | -------------- | ------------- |
| Throughput | 250 Mbps | 30 Gbps | 30 Gbps |
| Network Rules | ✅ | ✅ | ✅ |
| Application Rules | ✅ | ✅ | ✅ |
| DNAT Rules | ✅ | ✅ | ✅ |
| Threat Intelligence | ❌ | ✅ | ✅ |
| IDPS | ❌ | ❌ | ✅ |
| TLS Inspection | ❌ | ❌ | ✅ |
| URL Filtering | ❌ | ❌ | ✅ |
| Web Categories | ❌ | ❌ | ✅ |
| Use Case | Small/dev | Production | High-security |
⚠️ Common Exam Traps and Mistakes
Trap #1: "Service Endpoints work from on-premises"
❌ WRONG: Service Endpoints are VNet-scoped only. On-prem access via VPN/ER won't work.
✅ CORRECT: Use Private Endpoints for on-prem access to Azure PaaS.
Trap #2: "VNet peering is transitive"
❌ WRONG: Spoke-to-Spoke communication doesn't work automatically in Hub-and-Spoke.
✅ CORRECT: Need routing via Hub (firewall/NVA + UDRs) or use Virtual WAN.
Trap #3: "ExpressRoute encrypts traffic"
❌ WRONG: ExpressRoute is private but NOT encrypted by default.
✅ CORRECT: Use VPN over ExpressRoute or MACsec (for ER Direct) for encryption.
Trap #4: "Connect VNets to Virtual WAN before deleting peerings"
❌ WRONG: Azure won't allow dual-homed VNets (peered + VWAN connected).
✅ CORRECT: Delete existing peerings BEFORE connecting to Virtual WAN hub.
Trap #5: "DNAT rules are bidirectional"
❌ WRONG: DNAT only handles inbound traffic (external → internal).
✅ CORRECT: Add Network rules for outbound traffic (internal → external).
Trap #6: "AzureFirewallSubnet needs a route table"
❌ WRONG: Adding route table to AzureFirewallSubnet breaks firewall management.
✅ CORRECT: AzureFirewallSubnet should NOT have a route table (except forced tunneling).
Trap #7: "Enable BGP propagation on Spoke route tables in Hub-Spoke"
❌ WRONG: This allows on-prem routes to bypass the firewall.
✅ CORRECT: DISABLE BGP propagation on Spoke route tables when using firewall.
Trap #8: "Private Endpoints work without DNS configuration"
❌ WRONG: Without Private DNS Zone, VMs resolve to public IP.
✅ CORRECT: Create and link Private DNS Zone for private IP resolution.
Trap #9: "Front Door can route to private backends directly"
❌ WRONG: Front Door requires public IPs or Private Link Service for private backends.
✅ CORRECT: Use Private Link Service to connect Front Door to internal Load Balancer.
Trap #10: "Next Hop: None means no route exists"
❌ WRONG: "None" is an explicit black hole (intentional drop).
✅ CORRECT: Someone configured a UDR with Next Hop Type = None to drop traffic.
🎯 Exam Day Strategy
Before the Exam
- [ ] Arrive 15 minutes early (online or test center)
- [ ] Have government-issued ID ready
- [ ] Clear desk (online exam) - remove all materials
- [ ] Test webcam, microphone (online exam)
- [ ] Use bathroom before starting
- [ ] Have water available
During the Exam
- 1. Read questions TWICE - Look for "EXCEPT", "NOT", "LEAST"
- 2. Time management:
- 40-60 questions in 120 minutes = 2-3 minutes per question
- Don't spend >3 minutes on any question
- Mark difficult questions for review
- 3. Eliminate wrong answers first
- Usually can eliminate 2 obviously wrong answers
- Choose between remaining 2
- 4. For scenario questions:
- Draw topology on whiteboard (if provided) or scratch paper
- Identify requirements vs. constraints
- Check all requirements are met by your answer
- 5. Case study sections:
- Read overview first
- Skim technical details
- Go to questions
- Refer back to technical details as needed
- 6. Flag for review:
- Use flagging feature liberally
- Review all flagged questions before submitting
Question Types
Multiple Choice (Single Answer)
- Only one correct answer
- Eliminate obviously wrong answers
- Look for keywords (most, least, minimum, maximum)
Multiple Select (Multiple Answers)
- Question states "Select all that apply" or "Select TWO answers"
- Must select ALL correct answers (partial credit = 0)
- Be methodical - check each option
Drag and Drop (Sequence/Ordering)
- Often tests migration steps or configuration sequence
- Virtual WAN migration is a common drag-and-drop
- Get the ORDER right - all items must be in correct sequence
Case Studies
- 3-5 questions per case study
- Read scenario once, refer back for details
- Watch time - case studies can eat up 15-20 minutes
- All questions in case study are independent
Hot Area (Click/Select in Image)
- Click on diagram to select answer
- Often tests Network Watcher results or topology
- Read the result text carefully
After the Exam
- Results are provided immediately (pass/fail)
- Score report shows domain performance
- Official certificate available in ~24 hours on Microsoft Learn
- Add certification to LinkedIn, resume
✅ Final Pre-Exam Checklist
One Day Before:
- [ ] Review high-yield topics list
- [ ] Review mnemonics and memory aids
- [ ] Review quick reference sheets
- [ ] Review common exam traps
- [ ] Get 8+ hours of sleep
Morning of Exam:
- [ ] Eat a good breakfast
- [ ] Review flashcards (30 minutes)
- [ ] Do NOT cram new material
- [ ] Stay hydrated
Key Concepts to Recall:
- [ ] Routing precedence: LPM → UDR → BGP → System
- [ ] VNet peering is non-transitive
- [ ] Service Endpoints: VNet-only, public IP
- [ ] Private Endpoints: On-prem access, private IP
- [ ] Virtual WAN migration: Create → Delete Peerings → Connect → Update
- [ ] DNS Private Resolver: Inbound (on-prem→Azure), Outbound (Azure→on-prem)
- [ ] ExpressRoute: No encryption by default
- [ ] Azure Firewall rules: DNAT → Network → Application → Deny
- [ ] AzureFirewallSubnet: NO route table
- [ ] GatewaySubnet: NEEDS route table for Spoke return traffic
- [ ] NSG default rules priorities: 65000, 65001, 65500
🎓 You're Ready!
Remember:
- Confidence: You've put in the work
- Time Management: Don't rush, don't linger
- Read Carefully: Watch for "NOT", "EXCEPT", "LEAST"
- Elimination: Narrow down to 2 choices, then decide
- Trust Your Knowledge: Don't second-guess too much
This exam tests real-world networking knowledge. If you've done the labs and studied the concepts, you WILL pass.
Good luck on your AZ-700 exam! 🚀
After you pass, don't forget to:
- Update LinkedIn with certification
- Share your success (Reddit, Twitter, etc.)
- Consider next steps: AZ-305 (Azure Solutions Architect Expert)
Last Updated: February 3, 2026
Exam Version: AZ-700 (2026 Edition)
Study Time Estimate: 60-80 hours total (30-day plan)
Pass Rate: ~60-70% (with proper preparation)
📞 Need Help?
Questions or Feedback:
- Post in r/AzureCertification
- Join Azure Community Discord
- Microsoft Learn Q&A forums
Good luck! You've got this! 💪