Most Azure certifications test whether you know what a service does. AZ-700 tests whether you know what happens when services talk to each other — and what breaks when they don't. It is the one Microsoft exam where the portal is the least important skill you bring, and the network diagram is the most important.
The exam is Designing and Implementing Microsoft Azure Networking Solutions, and it earns the Microsoft Certified: Azure Network Engineer Associate credential. It costs $165, runs 40–60 questions, and the pass mark is 700 out of 1,000. Microsoft recommends at least six months of hands-on Azure experience before you sit it, and that recommendation is honest: this exam punishes memorised definitions and rewards people who have actually built — and debugged — a virtual network.
Why AZ-700 is a different kind of Azure exam
AZ-104 teaches you to administer Azure. AZ-305 teaches you to design solutions. AZ-700 sits in the gap between them: it asks you to design and implement the network layer that every other Azure workload depends on. A misconfigured NSG, a wrongly peered VNet, a routing table that sends traffic through a firewall that was never meant to see it — these are the failures AZ-700 is built around, and they are the failures that cost real companies real money.
That is also why the exam has a reputation for being harder than its associate-level label suggests. The questions are scenario-heavy. You will be given a topology, a set of requirements, and a constraint — "traffic between these two VNets must pass through the firewall, but the application gateway must stay reachable from the internet" — and asked which design satisfies all three at once. There is usually one design that does, and three that look plausible until you trace the packet.
The five domains, and where the marks actually live
Microsoft weights the exam across five domains. The weighting tells you where to spend your study time.
Design and implement routing (25–30%) — the biggest domain. This is the heart of the exam: user-defined routes, BGP, route tables, and how Azure decides where a packet goes. The single most tested idea in this domain is effective routes — the combination of system routes, BGP routes, user-defined routes, and the way Azure resolves conflicts between them. If you cannot explain, for a given VM, which route wins and why, you are not ready for this domain. Practice with the effective-routes view in the portal until reading it is second nature, and lab the classic failure: a UDR that sends traffic to a firewall that has no route back.
Design and implement core networking infrastructure (20–25%). Virtual networks, subnets, IP addressing, VNet peering, and Private DNS. The traps here are the ones that look like trivia but are really design decisions: peering is non-transitive, which means a hub-and-spoke design needs the hub to forward, not the spokes to peer with each other; gateway transit only flows one way unless you configure it on both sides; and a subnet delegation is not optional for the services that require it. Know the difference between a service endpoint and a private endpoint cold — the exam tests it from four different angles, and it is the distinction that decides whether your PaaS data plane ever touches the public internet.
Secure and monitor networks (15–20%). NSGs, Azure Firewall, DDoS Protection, and Network Watcher. The exam's favourite trick in this domain is the NSG rule that looks correct but is evaluated in the wrong order, or the rule that allows traffic the application security group never included. Study the five-tuple evaluation order until you can do it in your head: source, source port, destination, destination port, protocol — and remember that default rules exist and that a deny rule you never wrote can still be the reason traffic dies. On monitoring, know what Connection Monitor, IP flow verify, and packet capture each actually tell you, because the exam will give you a symptom and ask which tool finds the cause.
Design, implement, and manage hybrid networking (10–15%). VPN Gateway, ExpressRoute, and Virtual WAN. This is the smallest domain by weight but the one where working engineers have the biggest advantage, because the exam tests failure modes you only learn by operating a hybrid connection: BGP peering that never comes up because the ASN or the shared key is wrong, an ExpressRoute circuit that is provisioned but never peered, a site-to-site VPN that works from one office and not the other because of an overlapping address space. If you have ever troubleshot one of these at 2 a.m., the questions will feel familiar.
Design and implement Private Access to Azure services (10–15%). Private Link, private endpoints, and Private DNS zones. This domain is where the exam catches people who learned networking before Azure: the private endpoint lives in your VNet, the DNS record has to resolve to the private IP, and if the DNS zone is linked to the wrong VNet, everything looks configured and nothing works. The exam loves this exact failure. Lab it once — a storage account reachable only over a private endpoint, with DNS resolved correctly — and you will never miss these questions.
The three mistakes that fail people
Studying services instead of traffic flow. Knowing what Azure Firewall does is worth very little. Knowing what happens to a packet that leaves a VM in a peered VNet, hits a UDR pointing at the firewall, gets SNAT'd, and returns through a different path — that is the exam. Every study session should end with you tracing a packet through a topology you drew yourself.
Treating the portal as the skill. The portal is a UI. The exam tests the model underneath it: how routing decisions are made, how NSG rules are evaluated, how DNS resolution actually works in Azure. People who study by clicking through the portal fail; people who study by drawing the topology and predicting the behaviour pass.
Ignoring the small domains. Hybrid networking and Private Access are only 10–15% each, but together they are a quarter of the exam — more than any single domain except routing. Candidates who skip them to spend more time on routing lose marks they could have banked cheaply, because these domains are narrow and highly learnable in a week.
A six-week plan that respects the exam
Weeks 1–2: routing and core networking. Build a hub-and-spoke topology in a free subscription: hub VNet with a firewall, two spoke VNets, peering with gateway transit, UDRs forcing spoke traffic through the hub. Break it deliberately — remove a route, peer without transit, delegate the wrong subnet — and fix it by reading effective routes, not by guessing.
Weeks 3–4: security, monitoring, and Private Access. Add NSGs with application security groups, an Azure Firewall policy, and a private endpoint for a storage account. Practise the two diagnostics the exam cares about most: IP flow verify for "why is this packet dropped" and Connection Monitor for "where is the latency".
Week 5: hybrid. If you have no ExpressRoute circuit — and almost nobody studying at home does — simulate the concepts: a site-to-site VPN between two VNets, BGP peering, and a Virtual WAN hub. The exam tests the concepts, not your access to a circuit.
Week 6: timed practice. Take full timed practice tests under exam conditions — 40–60 questions, no pausing, no looking up answers. Score yourself by domain, not by total, and spend your final days on your weakest domain, not your favourite one.
Bottom line
AZ-700 is not a test of whether you can use Azure. It is a test of whether you understand what Azure does with your packets when you are not watching. Study topologies, trace traffic, break things in a lab and fix them by reading the routing table — and the exam will feel like a review of work you have already done. Start with a free practice run and see where your routing knowledge actually stands: https://study4pass.com/study-material/microsoft/az-700
Top comments (0)