Microsoft Azure Network Engineer (AZ-700) Exam Prep

What's inside

1. Level 1: How AZ-700 Works and How to Use This CourseFree
   [Exam craft] Learn how Exam AZ-700 (Designing and Implementing Microsoft Azure Networking Solutions) is set up. Microsoft's study guide, with skills measured as of July 27, 2026, is free on Microsoft Learn and is not reproduced here. Microsoft's exam page gives you 100 minutes, and you need a score of 700 or greater to pass. This course is independent of Microsoft and does not promise a pass.
2. Level 2: Network Segmentation, Address Spaces and Creating a VNetFree
   [Design and implement core networking infrastructure – IP addressing] Plan network segmentation and non-overlapping address spaces, then create a virtual network (VNet) in the portal, Azure CLI and Bicep.
3. Level 3: Subnetting for Services, Delegation and Shared Subnets
   [Design and implement core networking infrastructure – IP addressing] Size and name subnets for virtual network gateways, private endpoints, service endpoints, firewalls, application gateways, VNet-integrated platform services and Azure Bastion. Plan and configure subnet delegation, and choose between shared and dedicated subnets.
4. Level 4: Public IPs, Public IP Prefixes and Custom IP Prefixes
   [Design and implement core networking infrastructure – IP addressing] Create public IP addresses and associate them with resources, create a Public IP Prefix and decide when to use one, and plan a Custom IP address prefix (bring your own IP).
5. Level 5: VNet Name Resolution and Public DNS Zones
   [Design and implement core networking infrastructure – name resolution] Design name resolution inside a VNet, configure DNS settings for a VNet, and design and configure public DNS zones in Azure DNS.
6. Level 6: Private DNS Zones and Azure DNS Private Resolver
   [Design and implement core networking infrastructure – name resolution] Design and configure private DNS zones, link them to VNets with or without autoregistration, and design and implement Azure DNS Private Resolver for hybrid name resolution.
7. Level 7: VNet Peering, Service Chaining and Gateway Transit
   [Design and implement core networking infrastructure – VNet connectivity and routing] Implement regional and global VNet peering, and design service chaining, including gateway transit and use remote gateways in a hub-and-spoke network.
8. Level 8: Connectivity with Azure Virtual Network Manager
   [Design and implement core networking infrastructure – VNet connectivity and routing] Implement and manage virtual network connectivity with Azure Virtual Network Manager, using network groups, connectivity configurations and deployments.
9. Level 9: User-Defined Routes and Forced Tunneling
   [Design and implement core networking infrastructure – VNet connectivity and routing] Design and implement user-defined routes (UDRs), associate a route table with a subnet, configure forced tunneling, and diagnose and resolve routing issues.
10. Level 10: Azure Route Server and Azure NAT Gateway
    [Design and implement core networking infrastructure – VNet connectivity and routing] Design and implement Azure Route Server for BGP route exchange with NVAs. Identify the right use cases for Azure NAT Gateway and implement it for outbound connectivity.
11. Level 11: Network Watcher and Azure Monitor for Networks
    [Design and implement core networking infrastructure – monitor networks] Configure monitoring, network diagnostics and logs in Azure Network Watcher. Monitor and troubleshoot network health with Network Watcher and with Azure Monitor for Networks.
12. Level 12: DDoS Protection and Defender for Cloud Network Insights
    [Design and implement core networking infrastructure – monitor networks] Activate and monitor distributed denial-of-service (DDoS) protection. Evaluate network security recommendations from Microsoft Defender for Cloud Secure Score and attack path analysis, and identify network resources with Cloud Security Explorer.
13. Level 13: Designing Site-to-Site VPN and Choosing Gateway SKUs
    [Design, implement, and manage connectivity services – site-to-site VPN] Design a site-to-site VPN connection, including for high availability. Decide when to use a policy-based or route-based VPN, and select a virtual network gateway SKU that meets the requirements.
14. Level 14: Building a Site-to-Site VPN with IPsec/IKE Policies
    [Design, implement, and manage connectivity services – site-to-site VPN] Create and configure a virtual network gateway and a local network gateway, implement the site-to-site connection, and create a custom IPsec/Internet Key Exchange (IKE) policy.
15. Level 15: VPN Gateway Troubleshooting and Azure Extended Network
    [Design, implement, and manage connectivity services – site-to-site VPN] Diagnose and resolve virtual network gateway connectivity issues, and implement Azure Extended Network to stretch an on-premises subnet into Azure.
16. Level 16: Point-to-Site VPN: SKUs, Tunnels and Authentication
    [Design, implement, and manage connectivity services – point-to-site VPN] Select a gateway SKU for point-to-site requirements, select and configure a tunnel type, choose an authentication method, and configure RADIUS and Microsoft Entra ID authentication.
17. Level 17: P2S Clients, Always On VPN and Azure Network Adapter
    [Design, implement, and manage connectivity services – point-to-site VPN] Implement a VPN client configuration file, diagnose and resolve client-side and authentication issues, and specify what Azure needs for Always On VPN and Azure Network Adapter.
18. Level 18: ExpressRoute Models, SKUs and Peering
    [Design, implement, and manage connectivity services – ExpressRoute] Select an ExpressRoute connectivity model and an SKU and tier, choose between Azure private peering, Microsoft peering or both, configure each peering, and recommend a route advertisement configuration.
19. Level 19: ExpressRoute Gateways, Resilience, Global Reach, FastPath
    [Design, implement, and manage connectivity services – ExpressRoute] Create and configure an ExpressRoute gateway and connect a VNet to a circuit. Design for cross-region connectivity, redundancy and disaster recovery, and implement Global Reach, FastPath and ExpressRoute Direct.
20. Level 20: ExpressRoute Encryption, BFD and Troubleshooting
    [Design, implement, and manage connectivity services – ExpressRoute] Configure encryption over ExpressRoute, implement Bidirectional Forwarding Detection, and diagnose and resolve ExpressRoute connection issues.
21. Level 21: Virtual WAN: SKUs, Hubs, Gateways and Hub Routing
    [Design, implement, and manage connectivity services] Covers the whole 'Design and implement an Azure Virtual WAN architecture' skill: choosing a Basic or Standard Virtual WAN SKU, designing the architecture and its connection types, creating a virtual hub, picking scale units for each gateway type, deploying gateways into a hub, configuring hub route tables, associations and propagation, and integrating a third-party NVA in the hub.
22. Level 22: Azure Load Balancer: SKU, Tier and Design Choices
    [Design and implement application delivery services] Serves the first Load Balancer bullets: matching requirements to Azure Load Balancer features and use cases, choosing a SKU (Standard or Gateway, now that Basic is retired) and a tier (regional or global), and choosing between public and internal and between regional and cross-region load balancers.
23. Level 23: Building Load Balancer: Rules, NAT Rules, Outbound SNAT
    [Design and implement application delivery services] Covers creating and configuring an Azure Load Balancer: frontend IP configurations, backend pools, health probes, load balancing rules, inbound NAT rules (single VM and backend pool versions), and explicit outbound rules that control source network address translation (SNAT) and port allocation.
24. Level 24: Gateway Load Balancer and Azure Traffic Manager
    [Design and implement application delivery services] Covers the 'Implement Gateway Load Balancer' and 'Implement Azure Traffic Manager' bullets: putting NVAs inline with Gateway Load Balancer by chaining it to a frontend, and DNS-based global routing with Traffic Manager profiles, routing methods, endpoints, nested profiles and endpoint monitoring.
25. Level 25: Application Gateway: Pools, Probes, Listeners, Rules
    [Design and implement application delivery services] Covers the core Azure Application Gateway bullets: matching requirements and use cases to its layer-7 features, choosing manual or autoscale capacity on the v2 SKU, its dedicated subnet, and configuring backend pools, health probes, listeners (basic and multi-site), routing rules (basic and path-based), and HTTP settings (called backend settings in the portal).
26. Level 26: Application Gateway TLS and Rewrite Rule Sets
    [Design and implement application delivery services] Covers 'Configure Transport Layer Security (TLS)' and 'Configure rewrite rule sets' for Application Gateway: TLS termination versus end-to-end TLS, TLS policies, Key Vault certificates through a managed identity, HTTP-to-HTTPS redirection, and rewriting headers and URLs with conditions.
27. Level 27: Azure Front Door: Tiers, Routes, Origins, TLS, Caching
    [Design and implement application delivery services] Covers the main Azure Front Door bullets: matching requirements and use cases, choosing Standard or Premium tier, configuring endpoints, routes, origin groups and origins, TLS termination with managed or customer certificates and end-to-end TLS, caching (query string behaviour, compression, purge), and traffic acceleration over Microsoft's global edge network.
28. Level 28: Front Door Rules, Private Link Origins, Picking a Service
    [Design and implement application delivery services] Finishes the Front Door bullets ('Implement rules, URL rewrite, and URL redirect' and 'Secure an origin by using Azure Private Link in Azure Front Door') and practises exam-style choices between Load Balancer, Application Gateway, Front Door and Traffic Manager.
29. Level 29: Planning Private Endpoints
    [Design and implement private access to Azure services] Covers 'Plan private endpoints': which resources and target sub-resources support them, subnet placement and IP planning, private endpoint network policies for NSGs and UDRs, cross-region and cross-tenant use, and how a private endpoint differs from a service endpoint.
30. Level 30: Creating Private Endpoints and Controlling Access
    [Design and implement private access to Azure services] Covers 'Create private endpoints' and 'Configure access to private endpoints': deploying with automatic or manual approval, managing connection states, turning off public network access on the target resource, and filtering private endpoint traffic with NSGs and UDRs.
31. Level 31: DNS Integration for Private Endpoints
    [Design and implement private access to Azure services] Covers 'Integrate Private Link and Private Endpoint with DNS': privatelink private DNS zones, private DNS zone groups, VNet links in hub-and-spoke designs, and resolving private endpoints from on-premises with Azure DNS Private Resolver and conditional forwarders.
32. Level 32: Building a Private Link Service for Consumers
    [Design and implement private access to Azure services] Covers 'Create a Private Link service' and 'Integrate a Private Link service with on-premises clients': putting your own service behind a Standard internal load balancer, NAT IP configuration, visibility and auto-approval, TCP Proxy v2, and reaching it from on-premises over VPN or ExpressRoute.
33. Level 33: Service Endpoints and Service Endpoint Policies
    [Design and implement private access to Azure services] Covers every service endpoint bullet: when to use a service endpoint rather than a private endpoint, enabling one on a subnet, restricting access with resource firewall rules for VNets, and limiting egress to particular Azure Storage accounts with service endpoint policies.
34. Level 34: NSGs and ASGs: Create, Associate, Write Rules
    [Design and implement Azure network security services] Covers the first NSG bullets: creating a network security group, associating it with a subnet or network interface, creating application security groups and adding NICs to them, and writing inbound and outbound security rules with priorities, service tags, augmented rules and ASGs.
35. Level 35: Virtual Network Flow Logs and IP Flow Verify
    [Design and implement Azure network security services] Covers 'Implement virtual network flow logs', 'Interpret virtual network flow logs' and 'Verify IP flow': enabling flow logs on a VNet, subnet or NIC to a storage account with traffic analytics, reading flow records, and using Network Watcher IP flow verify to find the rule that allows or denies traffic.
36. Level 36: Bastion Access and Virtual Network Manager Security
    [Design and implement Azure network security services] Covers 'Configure an NSG for remote server administration, including Azure Bastion' and 'Implement and manage virtual network security by using Azure Virtual Network Manager': the NSG rules AzureBastionSubnet needs, locking down RDP/SSH on target VMs, and security admin rules that override NSGs across network groups.
37. Level 37: Azure Firewall: SKUs, Design and Deployment
    [Design and implement Azure network security services] Covers 'Map requirements to features and capabilities of Azure Firewall', 'Select an appropriate Azure Firewall SKU', 'Design an Azure Firewall deployment', 'Create and implement an Azure Firewall deployment' and 'Create a secure hub by deploying Azure Firewall inside an Azure Virtual WAN hub'.
38. Level 38: Azure Firewall Rules and Firewall Manager Policies
    [Design and implement Azure network security services] Covers 'Configure Azure Firewall rules' and 'Create and implement Azure Firewall Manager policies': DNAT, network and application rules, rule collection groups and processing order, FQDN tags and service tags, and parent/child firewall policies managed centrally in Azure Firewall Manager.
39. Level 39: WAF Design, Modes, and Policy Association
    [Design and implement Azure network security services] Covers 'Map requirements to features and capabilities of WAF', 'Design a WAF deployment', 'Configure detection or prevention mode', 'Implement a WAF policy' and 'Associate a WAF policy' on Azure Front Door and Application Gateway.
40. Level 40: WAF Rule Sets on Front Door and Application Gateway
    [Design and implement Azure network security services] Covers 'Configure rule sets for WAF on Azure Front Door' and 'Configure rule sets for WAF on Application Gateway': managed Default Rule Set and OWASP rule sets, bot manager rules, custom rules (match, geo-filter, rate limit), exclusions, and tuning false positives.
41. Level 41: Timed Mock Exam: AZ-700 Full Practice Test Timed mock
    [All sections: core networking infrastructure; connectivity services; application delivery services; private access to Azure services; Azure network security services] This timed mock exam has 50 original scenario questions to answer in 100 minutes, weighted like the July 27, 2026 skills measured, and a 70% pass mark that mirrors the real exam's 700 score.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →