Microsoft Azure Network Engineer AssociateStudy guide
The associate certification for designing, implementing, and operating Azure networking (AZ-700).
About Microsoft Azure Network Engineer Associate (AZ-700)
Microsoft Azure Network Engineer Associate (AZ-700) is a Associate-level certification from Microsoft. This page organizes the exam scope into a 5-chapter, 13-section study guide and lets you check your understanding with exam-style practice questions. A good flow is to read the chapters below in order, then test yourself via "Practice questions."
Exam domains (approximate weighting)
- Design and implement core networking infrastructure (incl. routing)~24%
- Design, implement, and manage connectivity services~24%
- Design and implement application delivery services~23%
- Secure and monitor networks~19%
- Design and implement private access to Azure services~10%
Weights are approximate guidance for the live exam. Each domain is covered in detail in the chapters and sections below.
Official exam information: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-700
1Design and Implement Core Networking Infrastructure
- 1.1Virtual Networks (VNet) and Subnets
Understand the virtual network (VNet) as the foundation of Azure networking, plus subnets, address space (CIDR), and VNet peering. The starting point for "core networking infrastructure" in AZ-700.
- 1.2Name Resolution in Azure (DNS)
Understand public DNS (hosting public domains), private DNS zones (name resolution inside a VNet), and Azure-provided default resolution. Resolving names to addresses is fundamental to networking.
- 1.3Load Balancing (Load Balancer, App Gateway, Front Door)
Understand how to choose among Azure load balancing services that distribute traffic to backends: Azure Load Balancer (L4), Application Gateway (L7, regional), Front Door (L7, global), and Traffic Manager (DNS-based).
2Design, Implement, and Manage Hybrid Networking
- 2.1Site-to-Site and P2S with VPN Gateway
Understand VPN Gateway that connects on-premises or individual clients to Azure over an encrypted tunnel. Site-to-site (S2S), point-to-site (P2S), and VNet-to-VNet are the basis of AZ-700 hybrid networking.
- 2.2Private Connectivity with ExpressRoute
Understand ExpressRoute, which connects on-prem and Azure over a dedicated, private connection that bypasses the internet. Choose it over VPN for enterprise connectivity needing high bandwidth, low latency, and stability.
- 2.3Large-Scale Networking with Virtual WAN
Understand Azure Virtual WAN, which unifies many sites, VNets, and remote users over the Microsoft backbone for centralized management—a managed service for operating hub-and-spoke at scale.
3Design and Implement Routing
- 3.1System Routes and User-Defined Routes (UDR)
Understand the system routes Azure provides automatically, user-defined routes (UDR) that override them, and the route table that bundles them. Controlling the "next hop" of traffic is the basis of routing.
- 3.2NVAs, Service Chaining, and Forced Tunneling
Understand service chaining that routes through network virtual appliances (NVA) like firewalls, forced tunneling that forces outbound traffic through on-prem, and gateway sharing in hub-and-spoke. These are practical traffic controls built on UDRs.
- 3.3BGP and Route Propagation
Understand BGP for dynamically exchanging routes between on-prem and Azure, route propagation over VPN/ExpressRoute, and route-selection precedence. Dynamic routing reduces manual route configuration.
4Secure and Monitor Networks
- 4.1Securing Networks (NSG, Firewall, WAF, DDoS)
From a network engineer’s view, understand combining NSG/ASG (L3/L4 filtering), Azure Firewall (centralized stateful), WAF (L7 defense), and DDoS Protection (volumetric mitigation) in a layered design.
- 4.2Network Monitoring with Network Watcher
Understand Azure Network Watcher for network visibility and diagnostics. Troubleshoot using tools like Connection Monitor, NSG diagnostics (flow logs), IP flow verify, and next hop.
5Design and Implement Private Access to Azure Services
- 5.1Private Link and Private Endpoints
Understand Azure Private Link and private endpoints that bring PaaS (Storage, SQL, etc.) connectivity onto a private IP inside the VNet, plus the private DNS zone that backs name resolution. The goal is to reach PaaS without using the public path.
- 5.2Choosing Between Service Endpoints and Private Endpoints
Understand the difference and selection between service endpoints (optimize PaaS access via the VNet) and private endpoints (assign a private IP), and touch on Private Link Service for offering your own service via Private Link.