Domain 1: Core networking infrastructure
- Azure reserves 5 addresses in every subnet (network, gateway, two for DNS, broadcast), so a /24 yields 251 usable and a /23 yields 507 usable addresses; the exam often asks for the smallest CIDR meeting a host count.
- Standard SKU public IPs are static, support availability zones, and are required for zone-redundant and Standard Load Balancer scenarios; Basic public IPs are retiring.
- Subnet delegation hands a subnet to a specific Azure service (App Service VNet integration, SQL Managed Instance) so the service can inject its resources.
- A user-defined route (UDR) with next hop set to an NVA's private IP forces subnet traffic through the appliance; the NVA must have IP forwarding enabled on its NIC.
- Azure route selection uses longest-prefix match first; when prefix lengths tie, priority is UDR > BGP > system routes. A next hop of None, or an unavailable appliance, drops traffic silently.
- Azure Route Server must sit in a dedicated subnet named exactly RouteServerSubnet (/27 or larger) and uses a fixed ASN of 65515; it exchanges BGP routes between NVAs and the VNet/gateway, reducing static UDRs.
- Disabling BGP route propagation on a route table stops gateway-learned on-premises routes from being added, commonly paired with a 0.0.0.0/0 UDR to force traffic through an NVA.
- Azure DNS hosts public zones; alias record sets point an apex domain directly at Azure resources (Front Door, Traffic Manager, public IP), and NS records delegate a zone to authoritative servers.
- Network Watcher provides IP flow verify (which NSG rule allows/denies a packet), Connection troubleshoot (one-time reachability), Connection monitor (continuous), and packet capture for deep inspection.
- Service tags (Internet, AzureLoadBalancer, VirtualNetwork, and per-service tags) represent groups of IP prefixes and simplify NSG and firewall rules by removing the need to maintain explicit ranges.
Domain 2: Connectivity services
- Azure VPN Gateway SKUs scale by aggregate throughput (VpnGw1 ~650 Mbps, VpnGw2 ~1 Gbps, VpnGw3 ~1.25 Gbps in Generation 1); choose the smallest SKU that meets the requirement, and the gateway needs a subnet named exactly GatewaySubnet plus a public IP.
- Active-active VPN Gateway provisions two instances, each with its own public IP and IPsec tunnel, for redundancy and higher throughput with no failover delay - which is why it requires two public IP addresses.
- ExpressRoute is a dedicated private connection that bypasses the public internet with consistent latency and bandwidth; private and Microsoft peerings are established at the provider edge, and FastPath bypasses the gateway in the data path.
- ExpressRoute Global Reach links two on-premises sites to each other through the Microsoft backbone, and route filters on Microsoft peering select which BGP community prefixes the circuit advertises and consumes.
- The recommended backup pattern is ExpressRoute as primary with a site-to-site VPN Gateway as the failover path; for ExpressRoute resiliency use two circuits in different peering locations.
- VNet peering gives private-IP connectivity and automatically updates both route tables, but it is non-transitive (A-B and B-C does not give A-C); global VNet peering connects VNets across regions.
- For spoke VMs to reach on-premises through a hub gateway, enable 'Allow gateway transit' on the hub peering and 'Use remote gateways' on the spoke peering.
- Azure Virtual WAN Standard hubs support User VPN (P2S), site-to-site VPN, and ExpressRoute; the Basic SKU supports site-to-site VPN only.
- Point-to-Site VPN authenticates with Azure certificate, Microsoft Entra ID, or RADIUS; OpenVPN (TLS over 443) is the cross-platform tunnel type for Windows, macOS, Linux, iOS, and Android.
- BGP sessions between the customer/provider edge and Microsoft carry route advertisements over ExpressRoute; monitor BGP availability to confirm session health.
Domain 3: Application delivery services
- Azure Load Balancer is a layer-4 (TCP/UDP) distributor; the Standard SKU is zone-redundant, uses health probes to detect backend health, and supports outbound rules and HA ports.
- Application Gateway is a layer-7 (HTTP/S) load balancer with URL path-based and multi-site routing, SSL/TLS termination, cookie-based session affinity, and autoscaling on the v2 tier.
- Application Gateway WAF_v2 adds a Web Application Firewall (OWASP rules) in front of your web apps, running in detection or prevention mode.
- Azure Front Door is a global layer-7 entry point with anycast, HTTP/S load balancing, caching, TLS offload, WAF, and near-instant failover between backends.
- Traffic Manager is DNS-based global routing (priority, weighted, performance, geographic, multivalue, subnet) that returns the best endpoint's name; because it is DNS-level, it does not proxy traffic.
- Health probes determine backend availability across Load Balancer, Application Gateway, and Front Door; a failing probe removes an endpoint from rotation.
- Choose by scope: Load Balancer for regional layer-4, Application Gateway for regional layer-7/WAF, Front Door for global layer-7/WAF, and Traffic Manager for DNS-based global distribution.
- Application Gateway backend pools can target VMs, VM scale sets, IP addresses, or App Service; listeners and rules bind a frontend port to a backend pool.
- Session persistence (affinity) keeps a client's requests on the same backend, important for stateful web apps that do not share session state.
- SNAT and outbound rules on a Standard Load Balancer control how backend instances reach the internet and prevent port exhaustion under high connection counts.
Domain 4: Private access to Azure services
- A private endpoint projects a PaaS service into your VNet as a NIC with a private IP, so traffic to services like Azure SQL or Storage stays off the public internet.
- Service endpoints keep traffic on the Azure backbone and present the subnet/VNet identity to the service firewall, but the service is still reached over its public endpoint - unlike private endpoints, which assign a private IP.
- Creating a private endpoint does not disable the service's public endpoint; you must explicitly disable public network access on the resource to block public access.
- For a service's public FQDN to resolve to the private endpoint IP, create the matching privatelink Private DNS zone (e.g. privatelink.database.windows.net), link it to the VNet, and integrate the private endpoint with it.
- Private endpoints are reachable from peered and globally peered VNets and from on-premises over VPN or ExpressRoute.
- Azure Private Link service publishes your own service privately: place VMs behind a Standard Load Balancer, then create a Private Link service bound to that load balancer's frontend for consumers to connect via private endpoints.
- Azure DNS Private Resolver uses an inbound endpoint (in a delegated subnet) to receive on-premises queries and an outbound endpoint with forwarding rules to send queries to on-premises DNS, enabling bidirectional hybrid name resolution.
- Private DNS zones need a virtual network link to each VNet that must resolve their records; auto-registration creates A (and PTR) records for VMs in the linked VNet automatically.
- Subnet service-endpoint policies restrict which specific resources (e.g. particular storage accounts) can be reached over service endpoints, preventing data exfiltration to rogue accounts.
- App Service VNet integration gives an app a NIC in a delegated subnet for outbound VNet access; enable VNET_ROUTE_ALL to route all outbound traffic through the VNet.
Domain 5: Secure network connectivity to Azure resources
- NSGs are applied at the subnet or NIC level and evaluated by priority (lowest number first); the first matching rule wins, and service tags like Internet or VirtualNetwork simplify rules.
- Azure Firewall must sit in a dedicated subnet named exactly AzureFirewallSubnet (/26 minimum for autoscale); rule processing order is DNAT, then network rules, then application rules.
- Azure Firewall application rules filter outbound traffic by target FQDN, network rules handle layer-4 IP/port, and NAT rules provide inbound DNAT; Premium adds TLS inspection and IDPS.
- To force internet egress through Azure Firewall, associate a route table with a 0.0.0.0/0 route whose next hop is the firewall's private IP.
- Azure Firewall Manager centrally manages firewall policies across hubs and Virtual WAN secured hubs.
- DDoS Network Protection adds adaptive tuning, attack analytics, per-resource telemetry, alerting, and cost protection with a financial SLA on top of the always-on platform protection.
- Application security groups (ASGs) let you group VM NICs by workload and reference the group in NSG rules instead of maintaining IP lists.
- Azure Bastion requires a dedicated subnet named exactly AzureBastionSubnet (/26 minimum) and lets you RDP/SSH to VMs over their private IP with no public IP on the VM.
- NSG flow logs need a storage account, and traffic analytics additionally needs a Log Analytics workspace to visualize and analyze the flows.
- Web Application Firewall (on Application Gateway or Front Door) protects web apps at layer 7 against OWASP threats such as SQL injection and cross-site scripting.
AZ-700 exam tips
- Study by the five skills-measured areas: core networking infrastructure, connectivity services, application delivery services, private access, and secure connectivity - the domains map directly.
- Memorize the dedicated subnet names and minimum sizes: GatewaySubnet, RouteServerSubnet (/27, ASN 65515), AzureFirewallSubnet (/26), AzureBastionSubnet (/26).
- For routing questions, apply the rule order every time: longest-prefix match first, then source priority UDR > BGP > system route.
- Distinguish service endpoints (subnet identity, public endpoint, backbone route) from private endpoints (private IP NIC, privatelink DNS zone needed) - it drives many Private Link answers.
- Match the delivery service to scope: Load Balancer (regional L4), Application Gateway (regional L7/WAF), Front Door (global L7/WAF), Traffic Manager (DNS global).
Study guide FAQ
How many questions are on the AZ-700 and what score do I need to pass?
The exam typically presents 40-60 questions and you must score 700 out of 1000 to pass. You have 100 minutes, which includes time for case studies and multi-part scenario items.
What is the difference between a service endpoint and a private endpoint?
A service endpoint keeps traffic on the Azure backbone and presents your subnet's identity to the PaaS service firewall, but you still reach the service via its public endpoint. A private endpoint projects the service into your VNet as a NIC with a private IP, requiring a privatelink Private DNS zone, and lets you fully disable public access.
When should I choose ExpressRoute over a VPN Gateway?
Choose ExpressRoute for a dedicated, private connection that bypasses the public internet with consistent latency and bandwidth and an SLA. Use a site-to-site VPN Gateway for lower-cost, internet-based connectivity, or as a failover path behind ExpressRoute. Global Reach links on-premises sites to each other over the Microsoft backbone.
How does Azure decide which route wins when multiple routes match?
Azure selects the route with the longest prefix match (most specific) first. If prefix lengths are equal, it falls back to source priority: user-defined routes beat BGP-learned routes, which beat default system routes. A UDR next hop of None, or one pointing to an unavailable appliance, drops traffic silently.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Microsoft Learn - Exam AZ-700 study guideBlueprint revised July 27, 2026 · link and content verified 8 September 2026Five skills areas: core networking infrastructure 25-30%, connectivity services 20-25%, application delivery services 15-20%, private access to Azure services 10-15%, Azure network security services 15-20%.