AZ-700: Azure Network Engineer Associate Study Guide

I recently passed the AZ-700 network exam and wanted to share my study guide and notes. Hopefully, this will also help you if you’re looking to sit the exam.

The content of this exam was recently updated on April 25, 2024. This study guide reflects the latest objectives

The AZ-700 exam is the only exam needed to obtain the Microsoft Certified: Azure Network Engineer Associate certification. According to Microsoft -

“As a candidate for this exam, you should have subject matter expertise in planning, implementing, and managing Azure networking solutions”

“As an Azure network engineer, your responsibilities include optimizing performance, resiliency, scale, and security of Azure networking solutions. You proactively monitor network environments to identify issues and minimize risk. You also identify and resolve connectivity issues.”

“…you should have experience creating and managing compute, storage, and networking resources in Azure”

The high-level view of the skills measured in the exam are -

• Design and implement core networking infrastructure (25–30%)

• Design, implement, and manage connectivity services (20–25%)

• Design and implement application delivery services (15–20%)

• Design and implement private access to Azure services (10–15%)

• Design and implement Azure network security services (15–20%)

More information can be found on the exam’s website. The exam has a passing score of 700.

Free Microsoft Learn resources

Microsoft Learn is an ever-expanding catalogue of free training courses provided by Microsoft. After you've reviewed the exam objectives, I highly recommend working through these next. They're in nice bite-sized sections, and you can easily track your progress.

Microsoft Learn contains a dedicated learning path for the AZ-700 exam, which contains 8 modules -

• Introduction to Azure Virtual Networks

• Design and implement hybrid networking

• Design and implement Azure ExpressRoute

• Load balance non-HTTP(S) traffic in Azure

• Load balance HTTP(S) traffic in Azure

• Design and implement network security

• Design and implement private access to Azure Services

• Design and implement network monitoring

According to Microsoft, these modules should take around 9 hours to complete. I completed the entire course, and this feels about right. I needed to do additional reading for some of the topics, while I felt confident enough to skip through quite quickly for others.

Videos

I highly recommend John Savill’s YouTube study guide if you prefer to learn via video.

Microsoft’s own Exam Readiness Zone also has five exam prep videos for AZ-700 here.

Online Paid Training Courses

In addition to Microsoft's free resources, there are several paid options for online training courses. These are often more interactive and provide a useful way to fill in any gaps in your knowledge.

Below, I've linked to what I think are the best options for the AZ-204 exam -

• Pluralsight: Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) (11hrs, 5 courses)

• Udemy AZ-700: Designing and Implementing Azure Networking (7.5hrs, 1 practice test)

• Udemy AZ-700: Designing and Implementing Azure Networking (an excellent alternative to the Udemy course above)

AZ-700 Books

Some people prefer to use books to study, which is why Microsoft still publishes the Exam Ref series. As exam objectives get updated reasonably regularly, make sure that you get the latest edition of any study guides -

• Exam Ref AZ-700 Designing and Implementing Microsoft Azure Networking Solution (May 2022)

Practice Exams

So you’ve studied for the exam and want to assess your readiness?

Practice tests are a great way to assess your readiness for the actual exam. Here are some links to the most popular ones -

• Official Microsoft AZ-700 practice test (free)

• MeasureUp AZ-700: Practice Test (131 questions, updated May ‘24)

• Scott Duffy’s AZ-700 Practice Exams on Udemy (4 x practice tests)

If you’re new to certification exams, Microsoft recently announced an “exam sandbox.” The aim is to allow you to experience the look and feel of a certification exam before you sit one for real.

Microsoft Docs for AZ-700

This section links each exam topic to the relevant Microsoft documentation.

There's a lot of content here, but all of the exam questions will be based on these topics. Skim through as many of these as possible and deep dive into those you are less familiar with.

Design and implement core networking infrastructure (25–30%)

Design and implement IP addressing for Azure resources

• Plan and implement network segmentation and address spaces

• Create a virtual network (VNet)

• Plan and configure subnetting for services, including VNet gateways, private endpoints, service endpoints, firewalls, application gateways, VNet-integrated platform services, and Azure Bastion

• Plan and configure subnet delegation

• Plan and configure shared or dedicated subnets

• Create a prefix for public IP addresses

• Choose when to use a public IP address prefix

• Plan and implement a custom public IP address prefix (bring your own IP)

• Create a public IP address

• Associate public IP addresses to resources

Design and implement name resolution

• Design name resolution inside a VNet

• Configure DNS settings for a VNet

• Design public DNS zones:

• Design private DNS zones

• Configure public and private DNS zones

• Link a private DNS zone to a VNet

• Design and implement Azure DNS Private Resolver

Design and implement VNet connectivity and routing

• Design service chaining, including gateway transit

• Implement VNet peering

• Implement and manage virtual networks by using Azure Virtual Network Manager

• Design and implement user-defined routes (UDRs)

• Associate a route table with a subnet

• Configure forced tunnelling

• Diagnose and resolve routing issues

• Design and implement Azure Route Server

• Identify appropriate use cases for a network address translation (NAT) gateway

• Implement a NAT gateway

Monitor networks

• Configure monitoring, network diagnostics, and logs in Azure Network Watcher

• Monitor and troubleshoot network health by using Azure Network Watcher

• Monitor and troubleshoot networks by using Azure Monitor Network Insights

• Activate and monitor distributed denial-of-service (DDoS) protection

• Evaluate network security recommendations identified by Microsoft Defender for Cloud Secure Score

• Evaluate network security recommendations identified by Microsoft Defender For Cloud Attack Path Analysis

• Identify network resources by using Microsoft Defender for Cloud Security Explorer

Design, implement, and manage connectivity services (20–25%)

Design, implement, and manage a site-to-site VPN connection

• Design a site-to-site VPN connection, including for high-availability

• Select an appropriate VNet gateway stock-keeping unit (SKU) for site-to-site VPN requirements

• Implement a site-to-site VPN connection

• Identify when to use a policy-based VPN versus a route-based VPN connection

• Create and configure a local network gateway

• Create and configure an IPsec/Internet Key Exchange (IKE) policy

• Create and configure a virtual network gateway

• Diagnose and resolve virtual network gateway connectivity issues

• Implement Azure Extended Network

Design, implement, and manage a point-to-site VPN connection

• Select an appropriate virtual network gateway SKU for point-to-site VPN requirements

• Select and configure a tunnel type

• Select an appropriate authentication method

• Configure RADIUS authentication

• Configure authentication by using Microsoft Entra ID

• Implement a VPN client configuration file

• Diagnose and resolve client-side and authentication issues

• Specify Azure requirements for Always On VPN

• Specify Azure requirements for Azure Network Adapter

Design, implement, and manage Azure ExpressRoute

• Select an ExpressRoute connectivity model

• Select an appropriate ExpressRoute SKU and tier

• Design and implement ExpressRoute to meet requirements, including cross-region connectivity, redundancy, and disaster recovery

• Design and implement ExpressRoute options, including Global Reach, FastPath, and ExpressRoute Direct

• Choose between Azure private peering only, Microsoft peering only, or both

• Configure Azure private peering

• Configure Microsoft peering

• Create and configure an ExpressRoute gateway

• Connect a virtual network to an ExpressRoute circuit

• Recommend a route advertisement configuration

• Configure encryption over ExpressRoute

• Implement Bidirectional Forwarding Detection

• Diagnose and resolve ExpressRoute connection issues

Design and implement an Azure Virtual WAN architecture

• Select a Virtual WAN SKU

• Design a Virtual WAN architecture, including selecting types and services

• Create a hub in Virtual WAN

• Choose an appropriate scale unit for each gateway type

• Deploy a gateway into a Virtual WAN hub

• Configure virtual hub routing

• Integrate a Virtual WAN hub with a third-party NVA for cloud connectivity

Design and implement application delivery services (15–20%)

Design and implement Azure Load Balancer and Azure Traffic Manager

• Map requirements to features and capabilities of Azure Load Balancer

• Identify appropriate use cases for Azure Load Balancer

• Choose an Azure Load Balancer SKU and tier

• Choose between public and internal load balancers

• Choose between regional and global load balancers

• Create and configure an Azure Load Balancer

• Implement Azure Traffic Manager

• Implement a gateway load balancer

• Implement a load-balancing rule

• Create and configure inbound NAT rules

• Create and configure explicit outbound rules, including source network address translation (SNAT)

Design and implement Azure Application Gateway

• Map requirements to features and capabilities of Azure Application Gateway

• Identify appropriate use cases for Azure Application Gateway

• Choose between manual and autoscale

• Create a back-end pool

• Configure health probes

• Configure listeners

• Configure routing rules

• Configure HTTP settings

• Configure Transport Layer Security (TLS)

• Configure rewrite sets

Design and implement Azure Front Door

• Map requirements to features and capabilities of Azure Front Door

• Identify appropriate use cases for Azure Front Door

• Choose an appropriate tier

• Configure an Azure Front Door, including routing, origins, and endpoints

• Configure SSL termination and end-to-end SSL encryption

• Configure caching

• Configure traffic acceleration

• Implement rules, URL rewrite, and URL redirect

• Secure an origin by using Azure Private Link in Azure Front Door

Design and implement private access to Azure services (10–15%)

Design and implement Azure Private Link service and Azure private endpoints

• Plan private endpoints

• Create private endpoints

• Configure access to private endpoints

• Create a Private Link service

• Integrate Private Link and Private Endpoint with DNS

• Integrate a Private Link service with on-premises clients

Design and implement service endpoints

• Choose when to use a service endpoint

• Create service endpoints

• Configure service endpoint policies

• Configure access to service endpoints

Design and implement Azure network security services (15–20%)

Implement and manage network security groups

• Create a network security group (NSG)

• Associate an NSG to a resource

• Create an application security group (ASG)

• Associate an ASG to a network interface card (NIC)

• Create and configure NSG rules

• Interpret NSG flow logs

• Validate NSG flow rules

• Verify IP flow

• Configure an NSG for remote server administration, including Azure Bastion

Design and implement Azure Firewall and Azure Firewall Manager

• Map requirements to features and capabilities of Azure Firewall

• Select an appropriate Azure Firewall SKU

• Design an Azure Firewall deployment

• Create and implement an Azure Firewall deployment

• Configure Azure Firewall rules

• Create and implement Azure Firewall Manager policies

• Create a secure hub by deploying Azure Firewall inside an Azure Virtual WAN hub

Design and implement a Web Application Firewall (WAF) deployment

• Map requirements to features and capabilities of WAF

• Design a WAF deployment

• Configure detection or prevention mode

• Configure rule sets for WAF on Azure Front Door

• Configure rule sets for WAF on Application Gateway

• Implement a WAF policy

• Associate a WAF policy

Additional Tips

My approach for tackling this exam was to start with the Microsoft Learn courses. From my experience, this wasn’t sufficient to pass the exam unless you already know the topics well - this can be a challenging exam!

To give yourself the best chance of success, my recommendations are -

• Lab and practice anything you’re not familiar with

• There are many different topics covered in depth - read as many of the MS docs pages as you can using the links I’ve provided above

• Understand how different SKUs and tiers for each service impact their features and performance

• Understand how VNET peering, VPN and ER gateways, BGP etc. work together

I find deploying the relevant Azure resources and configuring their features to be hugely beneficial to my learning for any of the Azure certifications. You can grab a free Azure trial to receive 12 months of free popular services, $200 free credit, and 25+ always free services.

Microsoft is also offering “Exam Replay”, which gives you a second chance to pass the exam. If you’re not 100% sure you’re ready for the exam one approach is just to sit the exam. If you pass the first time, great! If not, at least you’ll have a good feel for the types of questions, etc., for your second attempt.

I hope you found this study guide helpful. Good luck! Please let me know of any other resources that you found useful for the exam.