AZ-700 series. This study guide follows the official Microsoft skills measured as of April 24, 2026 and is organized as a focused path for Azure network engineers.
Overview
The AZ-700 exam targets Azure network engineers who design and implement production networking on Azure. This is not a beginner networking exam. It assumes you can reason about IP addressing, DNS resolution, routing, hybrid connectivity, load balancing, private access, and network security controls. The exam then asks you to apply those fundamentals with Azure services such as Virtual Network, VPN Gateway, ExpressRoute, Virtual WAN, Application Gateway, Azure Front Door, Private Link, Azure Firewall, and Network Watcher.
The most important study habit is to follow the packet. When a VM calls a private endpoint, which DNS answer does it receive? Which route wins? Which NSG rule applies? Does traffic hit Azure Firewall? Does the application gateway probe use the right hostname? AZ-700 rewards that kind of operational thinking.
Exam Details
Attribute
Details
Exam
AZ-700
Certification
Microsoft Certified: Azure Network Engineer Associate
Level
Associate
Role
Plan, implement, manage, monitor, secure, and troubleshoot Azure networking solutions
Monitor and troubleshoot with Network Watcher, Azure Monitor for Networks, DDoS Protection, Defender for Cloud recommendations, attack paths, and Security Explorer.
Design, Implement, and Manage Connectivity Services (20-25%)
Design and implement site-to-site VPN, point-to-site VPN, active-active gateways, local network gateways, and IPsec/IKE policy.
Configure client VPN authentication with certificates, Microsoft Entra ID, and RADIUS.
Design and implement ExpressRoute circuits, private peering, Microsoft peering, gateways, route advertisement, encryption, BFD, and troubleshooting.
Design Azure Virtual WAN architecture with virtual hubs, gateway scale units, hub routing, and third-party NVA integration.
Design and Implement Application Delivery Services (15-20%)
Choose and configure Azure Load Balancer, Traffic Manager, Gateway Load Balancer, inbound NAT rules, outbound rules, and health probes.
Configure Application Gateway with listeners, backend pools, probes, routing rules, HTTP settings, TLS, and rewrite rules.
Configure Azure Front Door with endpoints, origins, origin groups, routes, TLS, caching, acceleration, rules, URL rewrite, URL redirect, and Private Link origin access.
Design and Implement Private Access to Azure Services (10-15%)
Plan and create private endpoints, Private Link services, and private endpoint access controls.
Integrate Private Link and private endpoints with DNS for Azure and hybrid clients.
Choose when to use service endpoints, configure service endpoint policies, and compare them with private endpoints.
Design and Implement Azure Network Security Services (15-20%)
Implement NSGs, ASGs, inbound and outbound security rules, virtual network flow logs, IP flow verify, and Bastion-friendly remote administration.
Design Azure Firewall deployments, choose SKUs, configure rules, use Firewall Manager policies, and deploy secured Virtual WAN hubs.
Design WAF policies for Application Gateway and Azure Front Door using managed rules, custom rules, detection mode, prevention mode, and exclusions.
Azure Networking Map - What You Need to Know
Think of AZ-700 as five connected layers. The exam often gives you a scenario that crosses multiple layers, so practice joining them together rather than studying one service at a time.
Layer
Azure features
What to understand
Foundation
VNet, subnet, public IP, public IP prefix
Address planning, service subnets, delegation, overlap avoidance, BYOIP, subnet sizing
Name resolution
Azure DNS, Private DNS, DNS Private Resolver
Public vs private zones, VNet links, forwarding rulesets, hybrid private endpoint DNS
AZ-700 questions often combine two or three services. A question about Private Link may really be a DNS question. A question about Application Gateway may really be a probe or certificate question. A question about ExpressRoute may really be a route advertisement question. Read for the constraint that makes one answer better than the others.
Question clue
What Microsoft is probably testing
"Name resolves to public IP"
Private DNS zone link or DNS forwarding problem.
"Tunnel is connected but traffic fails"
Routing, NSG, firewall, or return path problem.
"Backend is unhealthy"
Probe, host header, certificate, port, or backend HTTP settings problem.
"All outbound traffic must be inspected"
UDR to Azure Firewall or NVA, plus firewall rules and DNS behavior.
"Global web app with WAF and acceleration"
Azure Front Door, not Traffic Manager.
"Private access from on-premises to PaaS"
Private Endpoint plus VPN/ExpressRoute routing plus hybrid DNS.
Packet Walk Method
Resolve the name. Is it public DNS, private DNS, custom DNS, or forwarded DNS?
Find the selected route. Is it system, UDR, BGP, peering, gateway, firewall, or NAT?
Check security enforcement. Which NSG, ASG, firewall rule, or WAF policy applies?
Check service health. Does the probe succeed? Is the backend selected? Is the origin healthy?
Check return traffic. Does the response know how to get back, and is it allowed?
