Exam AZ-700: Designing and Implementing Microsoft Azure Networking Solutions earns the Microsoft Certified: Azure Network Engineer Associate credential. It covers VNets and IP planning, DNS and Private Resolver, routing, VPN, ExpressRoute and Virtual WAN, load balancing with Load Balancer, Application Gateway and Front Door, Private Link, and network security with NSGs, Azure Firewall and WAF. The skills measured were last updated on 27 July 2026.
This guide follows the official study guide: five skill areas with weights, the services to tell apart, a 7-week plan and 15 original scenario questions.
Quick facts (Microsoft Learn, November 2026)
| Item | Detail |
|---|---|
| Certification | Microsoft Certified: Azure Network Engineer Associate (Intermediate) |
| Time | 100 minutes; proctored; may include interactive components |
| Passing score | 700 |
| Languages | English, German, Spanish, French, Italian, Japanese, Korean, Portuguese (Brazil), Chinese (Simplified), Chinese (Traditional) |
| Price | Based on the country where you take the exam (Pearson VUE) |
| Renewal | Every 12 months, with a free online assessment |
| Skills measured | As of 27 July 2026 (minor changes to IP addressing, monitoring and NSGs) |
Read the official certification page and AZ-700 study guide before booking.
Who should take AZ-700?
- Network engineers (CCNA or CCNP) moving into Azure.
- Azure administrators who passed AZ-104 and handle VNets, VPNs and firewalls.
- Architects preparing for AZ-305 who need deeper networking.
Skills measured and weights
| Skill area | Weight |
|---|---|
| Design and implement core networking infrastructure | 25–30% |
| Design, implement and manage connectivity services | 20–25% |
| Design and implement application delivery services | 15–20% |
| Design and implement private access to Azure services | 10–15% |
| Design and implement Azure network security services | 15–20% |
1. Core networking infrastructure (25–30%)
- IP addressing: segmentation and address spaces; subnets for gateways, private endpoints, firewalls, Application Gateway and Bastion; subnet delegation; public IP prefixes and BYOIP (custom IP prefix).
- Name resolution: DNS settings for a VNet; public and private DNS zones; linking private zones; Azure DNS Private Resolver.
- Connectivity and routing: gateway transit and service chaining; VNet peering; Azure Virtual Network Manager; user-defined routes and forced tunnelling; Azure Route Server; NAT Gateway.
- Monitoring: Network Watcher; Azure Monitor for Networks; DDoS Protection; Defender for Cloud Secure Score, attack path analysis and Cloud Security Explorer.
2. Connectivity services (20–25%)
- Site-to-site VPN: high availability; gateway SKUs; policy-based vs route-based; local network gateways; IPsec/IKE policies; troubleshooting; Azure Extended Network.
- Point-to-site VPN: tunnel types; authentication with certificates, RADIUS or Microsoft Entra ID; client configuration; Always On VPN.
- ExpressRoute: connectivity models; SKUs and tiers; redundancy and DR; Global Reach, FastPath and ExpressRoute Direct; private vs Microsoft peering; gateways; encryption; BFD; troubleshooting.
- Virtual WAN: SKUs; virtual hubs; gateway scale units; hub routing; third-party NVAs.
| Need | Usual choice |
|---|---|
| Encrypted link over the internet to an office | Site-to-site VPN |
| Laptops connecting from home | Point-to-site VPN with Entra ID authentication |
| Private, high-bandwidth link to a data centre | ExpressRoute |
| Connect two on-premises sites through Microsoft's backbone | ExpressRoute Global Reach |
| Many branches and VNets in a global transit network | Virtual WAN |
3. Application delivery (15–20%)
- Load Balancer and Traffic Manager: SKUs; public vs internal; regional vs cross-region; rules; inbound NAT; outbound rules and SNAT; Gateway Load Balancer; DNS-based Traffic Manager.
- Application Gateway: autoscale; backend pools; probes; listeners; routing rules; HTTP settings; TLS; rewrite rules.
- Front Door: tiers; routes, origins and endpoints; end-to-end TLS; caching; acceleration; rules and redirects; securing origins with Private Link.
| Service | Layer | Scope | Use it for |
|---|---|---|---|
| Azure Load Balancer | 4 (TCP/UDP) | Regional (cross-region option) | VMs, non-HTTP traffic |
| Application Gateway | 7 (HTTP) | Regional | Path routing, TLS, WAF inside a region |
| Front Door | 7 (HTTP) | Global | Global websites, caching, WAF at the edge |
| Traffic Manager | DNS | Global | DNS-based failover or geographic routing |
4. Private access (10–15%)
- Private endpoints and Private Link service: planning, creating and DNS integration; access from on-premises clients.
- Service endpoints: when to use them; service endpoint policies.
5. Network security (15–20%)
- NSGs and ASGs: rules; association to subnets and NICs; virtual network flow logs; IP flow verify; Bastion; security admin rules with Virtual Network Manager.
- Azure Firewall: SKUs; design; rules; Firewall Manager policies; secured virtual hubs.
- WAF: detection vs prevention; rule sets on Front Door and Application Gateway; WAF policies.
# Hub firewall: route spoke traffic to Azure Firewall with a UDR
az network route-table create -g rg-net -n rt-spoke
az network route-table route create -g rg-net --route-table-name rt-spoke \
-n default-to-fw --address-prefix 0.0.0.0/0 \
--next-hop-type VirtualAppliance --next-hop-ip-address 10.0.1.4
az network vnet subnet update -g rg-net --vnet-name vnet-spoke1 -n app \
--route-table rt-spoke7-week study plan
| Week | Focus | Lab |
|---|---|---|
| 1 | VNets, subnets, public IPs, DNS zones, Private Resolver | Hub-and-spoke VNets with a private DNS zone |
| 2 | Peering, gateway transit, UDRs, Route Server, NAT Gateway, Virtual Network Manager | Force spoke traffic through the hub |
| 3 | Site-to-site and point-to-site VPN, Entra ID authentication | VPN between two VNets; P2S from your laptop |
| 4 | ExpressRoute models, peering, Global Reach, FastPath, Virtual WAN | Design an ExpressRoute plus VPN failover on paper |
| 5 | Load Balancer, Application Gateway, Front Door, Traffic Manager | Front Door in front of two regional App Gateways |
| 6 | Private endpoints, Private Link, service endpoints, DNS integration | Storage account reachable only through a private endpoint |
| 7 | NSGs, ASGs, flow logs, Azure Firewall, WAF, Network Watcher; Practice Assessment | Firewall policy plus WAF in prevention mode; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. On-premises servers must resolve Azure private DNS zones without running DNS VMs. What do you deploy?
Azure DNS Private Resolver with an inbound endpoint.
2. Spokes must use the hub's VPN gateway to reach on-premises. What do you enable on the peering?
Gateway transit (and "use remote gateways" on the spokes).
3. All internet-bound traffic from a subnet must go through a firewall. What do you create?
A user-defined route 0.0.0.0/0 with the firewall as the next hop.
4. VMs without public IPs need reliable outbound internet with fixed IPs. What do you use?
Azure NAT Gateway.
5. Employees connect from home and must sign in with their company account. Which VPN and authentication?
Point-to-site VPN with Microsoft Entra ID authentication.
6. You need a private 10 Gbps connection that doesn't use the public internet. What do you use?
ExpressRoute.
7. Two offices both connect to Azure via ExpressRoute and must talk to each other through Microsoft's network. What do you enable?
ExpressRoute Global Reach.
8. Fifty branches and twenty VNets need a managed global transit network. What do you use?
Azure Virtual WAN.
9. A global website needs caching, edge TLS and WAF. Which service?
Azure Front Door (Premium for Private Link origins and managed rule sets).
10. A regional web app needs path-based routing (/api and /images) and WAF. Which service?
Azure Application Gateway with WAF.
11. SQL database traffic must stay on a private IP inside your VNet. What do you create?
A private endpoint, integrated with a private DNS zone.
12. Web servers should be grouped in NSG rules by role, not by IP address. What do you use?
Application security groups.
13. You need to know whether an NSG rule is blocking a specific packet. Which tool?
IP flow verify in Network Watcher.
14. Firewall rules must be managed centrally across many hubs and regions. What do you use?
Azure Firewall Manager with firewall policies.
15. You want to see attacks without blocking traffic while you tune rules. Which WAF mode?
Detection mode, then switch to prevention.
After AZ-700
- Go further with AZ-305 or security with SC-500.
- Compare with Google Cloud Network Engineer and practise AWS VPC and Azure networking interview questions.
- See live cloud and network jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches Azure, AWS and Google Cloud networking, security and DevOps with real-time projects. See the APEX program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
What certification does AZ-700 earn?
Microsoft Certified: Azure Network Engineer Associate.
How long is the AZ-700 exam?
100 minutes. It is proctored and may include interactive components.
What is the passing score for AZ-700?
700.
Which AZ-700 skill area has the most weight?
Design and implement core networking infrastructure, at 25–30%.
When were the AZ-700 skills last updated?
The current skills measured apply as of 27 July 2026, with minor changes to IP addressing, monitoring and network security groups.
How often must AZ-700 be renewed?
Every 12 months, with a free online renewal assessment on Microsoft Learn.
