What AZ-700 Tests
AZ-700 tests whether you can design, implement, manage, secure, monitor, and troubleshoot Azure networking solutions. Microsoft expects Azure network engineers to work with solution architects, cloud administrators, security engineers, application developers, and DevOps engineers. The exam is scenario-heavy: you are usually given requirements, constraints, and symptoms, then asked to choose the service or configuration that satisfies them.
Skills Measured
| Domain | Weight | Study priority |
|---|---|---|
| Core networking infrastructure | 25-30% | Highest. Addressing, DNS, routing, and monitoring appear everywhere. |
| Connectivity services | 20-25% | High. VPN, ExpressRoute, and Virtual WAN are major design topics. |
| Application delivery services | 15-20% | High. Know service selection and health-probe behavior. |
| Private access to Azure services | 10-15% | Medium, but DNS details are critical. |
| Azure network security services | 15-20% | High. NSG, Firewall, Firewall Manager, and WAF are common scenario answers. |
Foundational Knowledge
- IPv4 CIDR notation, subnet sizing, overlapping address spaces, and route specificity.
- TCP, UDP, HTTP, HTTPS, TLS, DNS, SNAT, DNAT, BGP, IPsec, and IKE basics.
- Azure resource hierarchy, regions, availability zones, resource groups, managed identities, and RBAC.
- How Azure platform services reserve subnets and expose private endpoints.
- How effective routes and effective security rules determine real packet behavior.
Exam Mindset
Do not memorize only product names. Memorize decision boundaries. For example, if the requirement says global HTTP acceleration with WAF and private origin access, think Azure Front Door Premium. If it says regional path-based routing to VM backends, think Application Gateway. If it says private PaaS access with a private IP in your VNet, think Private Endpoint plus Private DNS.
Minimum Lab Environment
- One hub VNet and two spoke VNets.
- One VM per VNet for testing connectivity.
- Azure Bastion or a locked-down jump host.
- Azure Firewall or a simple NVA path for forced tunneling.
- One storage account with private endpoint and private DNS.
- One Application Gateway or Front Door lab for HTTP delivery.
Official Resources
How To Think Like An Azure Network Engineer
Most AZ-700 questions can be solved by separating control plane, data plane, and name resolution. Control plane is the Azure resource configuration. Data plane is the actual traffic path. Name resolution is how the client finds the destination. A design can look correct in the portal and still fail if DNS resolves to the wrong address or a route sends traffic to the wrong next hop.
The Four Questions
- What name or IP is the client trying to reach?
- What route does Azure select from the source subnet?
- Which security controls allow or deny the flow?
- Which service health probe or backend setting decides whether traffic is sent?
Core Design Patterns
| Pattern | Used for | Services involved |
|---|---|---|
| Hub-spoke | Centralized shared services and inspection | VNet peering, Azure Firewall, VPN/ExpressRoute gateways, UDRs |
| Virtual WAN | Managed large-scale branch and hub connectivity | Virtual WAN, virtual hubs, VPN, ExpressRoute, secured hub |
| Private PaaS | Remove public access to Azure services | Private Endpoint, Private DNS, DNS Private Resolver |
| Global web app | Global HTTP routing and protection | Azure Front Door, WAF, origin groups, Private Link origin |
| Regional web app | Regional layer 7 routing | Application Gateway, WAF, backend pools, probes |
What To Memorize
- Special subnet names: GatewaySubnet, AzureFirewallSubnet, AzureBastionSubnet.
- Private endpoint DNS behavior and zone-link requirements.
- Route precedence and longest prefix match.
- Load Balancer vs Application Gateway vs Front Door vs Traffic Manager.
- VPN vs ExpressRoute vs Virtual WAN decision boundaries.
- NSG, Azure Firewall, and WAF responsibilities.