AZ-700 Azure Network Engineer Study Guide: Domains, Topics and Study Plan

By Macdara Ó Murchú · Founder, AzurePrep·Last reviewed ·12 min read·2,585 words

AZ-700 is the Azure certification for professionals who work on network infrastructure. It tests whether you can design, implement and manage networking across Azure and hybrid environments. This AZ-700 study guide covers the exam format, the domains and their weights, the networking topics that come up most, and a week-by-week study plan.

The AZ-700 Exam

What Is AZ-700?

The Azure Network Engineer Associate certification (AZ-700) tests your ability to design and implement Azure networking. It is an associate-level exam that applies standard networking concepts to Azure. Candidates need hands-on experience with virtual networking, routing protocols, security configuration and hybrid connectivity.

The passing score is 700 out of 1000. The exam typically has 40-60 questions in several formats, including multiple choice, drag-and-drop and scenario-based questions. You have 100 minutes of exam time.

Who Should Take the AZ-700?

The exam is aimed at these roles:

If you already manage on-premises networks and want to move into Azure, AZ-700 gives that move a structure. It pairs with the AZ-104 Azure Administrator certification and often comes before more specialised networking credentials.

Prerequisites

Before starting on AZ-700, you should have:

Azure certifications build on each other. Most candidates pass AZ-104 first and then take a networking specialty such as AZ-700, so the Azure fundamentals are in place before the harder networking material.

5Exam domainsNetworking skill areas tested
$165Exam cost (USD)Same as all Associate level exams
700Passing scoreOut of 1000, the standard Microsoft bar

AZ-700 Exam Domains and Weighted Distribution

The AZ-700 exam covers five domains. Their weights tell you where to spend study time.

Domain Weight Focus Areas
Design and implement core networking infrastructure 25-30% IP addressing, name resolution, VNet connectivity and routing, network monitoring
Design, implement, and manage connectivity services 20-25% Site-to-site and point-to-site VPN, ExpressRoute, Virtual WAN
Design and implement application delivery services 15-20% Load Balancer, Traffic Manager, Application Gateway, Front Door
Design and implement private access to Azure services 10-15% Private Link, Private Endpoints, service endpoints
Design and implement Azure network security services 15-20% Network security groups, Azure Firewall, Web Application Firewall

Core networking infrastructure is the largest domain at 25-30%, and connectivity services is next at 20-25%. Split your study time in roughly the same proportions.

Core Networking Topics

Azure Virtual Networks and Subnetting

Everything else in Azure networking sits on Virtual Networks (VNets). You need to know:

Plan address space carefully. Azure reserves the first four IP addresses and the last address in every subnet, which matters most in small subnets. A /24 subnet (256 addresses) leaves 251 for resources.

VNet peering connects virtual networks directly, without crossing the public internet. It works within a region and across regions; global VNet peering lets networks in different Azure regions talk directly at low latency.

Virtual Network Peering and Connectivity

VNet peering comes in two models:

In a hub-and-spoke design, enabling "Allow forwarded traffic" routes traffic through the hub, which keeps management and security controls in one place. "Allow gateway transit" lets spoke VNets use the hub's VPN gateway.

Peering bandwidth is unlimited, but traffic across a peering connection is billed as data transfer, charged at both ends of the connection and at a higher rate for global (cross-region) peering. Peered VNets are still separate networks, though: resources only communicate across a peering when routing and Network Security Group (NSG) rules allow it.

VPN Gateway Types and Configuration

Azure supports two VPN gateway types:

Route-based VPNs use routing table entries to direct traffic to IPsec tunnels. They support:
- Multiple connections to different sites
- Dynamic routing with BGP
- More flexible connection scenarios
- Required for all new deployments

Policy-based VPNs (classic deployments) select traffic using policies. They:
- Support only static routing
- Work with specific IP ranges
- Represent legacy configurations
- Aren't recommended for new implementations

Route-based is the current standard, and for the exam, assume Azure's current VPN features are built around route-based gateways.

A VPN gateway needs a dedicated subnet named "GatewaySubnet", which can't host other resources. The gateway size sets throughput: Basic (100 Mbps, for dev-test only), and the zone-redundant VpnGw1AZ through VpnGw5AZ, which range from 650 Mbps up to 10 Gbps aggregate throughput. Microsoft says the non-AZ VpnGw1 to VpnGw5 SKUs should not be used to create new VPN gateways.

Azure ExpressRoute for Private Connectivity

ExpressRoute is a dedicated, private connection to Azure that never crosses the public internet. That is the main difference from a VPN.

ExpressRoute offerings include:

ExpressRoute uses BGP for dynamic routing. Private peering reaches Azure resources, and Microsoft peering reaches Microsoft 365 and Dynamics 365.

For hybrid connectivity, ExpressRoute gives you:
- Consistent network performance
- Private connectivity (no internet exposure)
- Higher bandwidth capacity
- SLA guarantees on availability and latency

ExpressRoute needs a connectivity provider. Setup means ordering a circuit, getting authorisation keys and configuring BGP sessions. A VPN gateway, by contrast, is configured entirely inside Azure.

Load Balancing: Azure Front Door vs Application Gateway vs Load Balancer

Choosing between the three load balancing options is a common exam trap. Each has a different job:

Azure Load Balancer (Layer 4 / Transport)
- Distributes traffic across VMs in availability sets
- Supports TCP/UDP protocols
- Operates within Azure regions
- Use for internal or external load balancing of backend pools
- No content-based routing

Application Gateway (Layer 7 / Application)
- Routes based on URL paths, hostnames, or HTTP headers
- Supports SSL/TLS termination
- Includes Web Application Firewall (WAF) capabilities
- Regional deployment
- Suits microservices architectures that need content-based routing

Azure Front Door (Global Layer 7)
- Global content delivery with split-TCP
- Routes across Azure regions and external endpoints
- Provides DDoS protection and WAF
- Supports global load balancing
- Best for worldwide traffic distribution

Scenario questions about which load balancer to pick come up often. Worldwide users point to Front Door. Routing on URL paths within a region points to Application Gateway. Simple Layer 4 load balancing within a VNet points to Load Balancer.

Azure Firewall vs Network Security Groups

Both filter traffic, at different network layers:

Network Security Groups (NSGs)
- Filter traffic at the NIC or subnet level
- Support allow/deny rules with priorities
- Stateful filtering
- Applied directly to NICs or subnets
- Lower latency and cost
- Limited logging and monitoring

Azure Firewall
- Fully managed firewall service
- Operates at the network level
- Supports Layer 7 filtering (FQDN filtering)
- Centralised management
- High availability built-in
- Premium and Standard SKUs available

Use NSGs for basic segmentation and per-resource rules. Use Azure Firewall when you need threat protection, FQDN-based filtering or one security policy across several VNets.

Private Link and Private Endpoints

Private Link gives private connectivity to Azure services without exposing them to the public internet.

Private Endpoints are network interfaces in your VNet that connect to an Azure service (Azure Storage, SQL Database, Key Vault and others). Traffic never crosses the public internet.

Private Link Service lets you offer your own services over private connectivity.

Configuration involves:

  1. Creating a private endpoint resource
  2. Selecting the target Azure service and resource
  3. Associating it with a subnet in your VNet
  4. Configuring private DNS zones to resolve service hostnames to private IPs

With a private endpoint in place, DNS queries return the private IP address instead of the public one, so traffic stays on the Azure backbone.

Service endpoints work differently. They still use the service's public endpoint but route traffic over the Azure backbone. Private endpoints are real network interfaces in your VNet, which allows finer access control.

DNS Resolution: Azure DNS and Private DNS Zones

Azure DNS hosts your DNS domains on Azure's infrastructure. At your domain registrar, you set the nameserver records to Azure's authoritative DNS servers.

Private DNS Zones resolve hostnames within your VNet to private IP addresses. Resources outside the VNet cannot query private DNS zones.

Setting one up means:

Private DNS zones work directly with private endpoints. Creating a private endpoint for Azure Storage adds the DNS records to your private DNS zone automatically, so clients resolve the private address without extra configuration.

Route Tables and User-Defined Routes

Azure creates system routes automatically for VNet traffic, peered networks and virtual gateways. User-defined routes override them.

Common use cases for custom routes:

Azure picks a route in this order:

  1. Most specific route (longest prefix match)
  2. User-defined routes
  3. BGP routes
  4. System routes

The default route, 0.0.0.0/0, has the lowest priority. A more specific route such as 10.1.0.0/24 wins over it.

Network Engineer Path
AZ-900Azure FundamentalsFUND
AZ-104Administrator AssociateASSOC
AZ-700Network Engineer Assoc.ASSOC
AZ-305Solutions ArchitectEXPERT

Security and Monitoring Strategies

Network Security Configuration

Other security controls besides NSGs:

Monitoring and Diagnostics

The monitoring tools to know:

The exam asks which tool fits a situation. Network Watcher is for troubleshooting connectivity, flow logs show security policy violations, and diagnostic logs record gateway and firewall operations.

Common Exam Traps

Trap 1: Confusing Service Endpoints with Private Endpoints

Service endpoints route traffic over Azure's backbone but still use public IPs. Private endpoints use private IPs and are real network interfaces. Both restrict access to an Azure service, by different mechanisms.

Trap 2: VPN vs ExpressRoute Selection

A VPN runs encrypted over the public internet. ExpressRoute uses a dedicated circuit with guaranteed bandwidth. Exam scenarios often hinge on whether private connectivity or guaranteed performance is a requirement.

Trap 3: Peering Limitations

VNet peering doesn't allow transitive routing through non-peered networks. If VNet A peers with B, and B peers with C, traffic cannot flow from A to C through B. You need either direct peering or a routing appliance in the hub.

Trap 4: Load Balancer Selection Complexity

Telling Load Balancer, Application Gateway and Front Door apart comes up often. Load Balancer is Layer 4, Application Gateway is Layer 7 within a region, and Front Door is global Layer 7.

Trap 5: Gateway Subnet Requirements

VPN and ExpressRoute gateways need a dedicated subnet. Nothing else can be deployed in the GatewaySubnet, which is a /27 or /28 used only by the gateway.

AZ-700 Study Plan

Recommended Timeline: 8-10 Weeks

Weeks 1-2: Foundational Review
- Review TCP/IP, routing, and DNS fundamentals
- Understand Azure subscription and resource group structures
- Complete Azure Virtual Networks overview

Weeks 3-4: Core Networking Infrastructure
- Master VNets, subnets, and IP addressing
- Explore VNet peering configurations
- Hands-on: Create and peer multiple VNets
- Study NSG rules and application

Weeks 5-6: Hybrid Connectivity
- Study VPN Gateway types and configurations in detail
- Study ExpressRoute concepts and peering
- Understand site-to-site and point-to-site VPNs
- Hands-on: Configure VPN gateways and test connectivity

Weeks 7-8: Routing and Load Balancing
- Master route tables and user-defined routes
- Study Azure Route Server and BGP
- Compare all load balancing options
- Hands-on: Create route tables with complex topologies
- Practice scenarios for load balancer selection

Weeks 9-10: Security, Private Access, and Practice
- Master Private Link and Private Endpoints
- Study Azure Firewall and WAF
- Review monitoring and diagnostics tools
- Work through AZ-700 practice questions
- Complete full-length practice exams
- Review weak areas identified in practice tests

Hands-On Practice Requirements

Reading is not enough for this exam. In the Azure portal:

After doing these tasks yourself, you can picture the Azure screens and configuration steps that a scenario question describes.

Practice Questions on azureprep.com

Practice questions under exam conditions are part of any AZ-700 preparation. AzurePrep has Azure practice questions for every live certification. AZ-700 has a free preview, and one All-Access subscription (monthly or annual) unlocks full access.

How to use them:

Practice questions show your knowledge gaps, build speed and get you used to the question formats before the real exam.

Exam Day Tips

Before Exam Day

During the Exam

After the Exam

Next Steps

AZ-700 certifies specialised cloud networking knowledge. To pass, you need a working grasp of virtual networks, VPN connectivity, routing, security and private access to Azure services.