Azure AZ-700 case studies
Azure AZ-700 · Put your knowledge to work in context.
The Microsoft Certified: Azure Network Engineer Associate credential is an intermediate-level, role-based certification for professionals who design, implement, and maintain Azure networking infrastructure. Microsoft describes the audience as people with subject matter expertise in planning, implementing, and managing Azure networking solutions - core network infrastructure, hybrid connectivity, application delivery services, private access to Azure services, and network security - and who optimize performance, resiliency, scale, and security while proactively monitoring environments to resolve connectivity issues. The Azure AZ-700 case studies are 5 cases and about 3,708 words.
1Spoke Inspection Breaks On-Premises Routing
Contoso's hub VNet is 10.10.0.0/22. GatewaySubnet (10.10.0.0/27) hosts a site-to-site VPN to on-premises 172.16.0.0/16 with BGP enabled; AzureFirewallSubnet (10.10.1.0/26) hosts Azure Firewall at 10.10.1.4.
672 words, about 3 min2ExpressRoute Growth and Business-Unit Isolation
Contoso runs a single ExpressRoute circuit: 1 Gbps, Standard SKU, Microsoft peering not used, private peering established in Amsterdam, currently linked to 6 VNets in West Europe. The roadmap adds 30 business-unit VNets (12 in West Europe, 18 in East US).
667 words, about 3 min3Locking Down App Gateway Behind Front Door
contoso.com is served by two WAF v2 Application Gateways - one in East US, one in West Europe - each with a public listener and its own public IP. Azure Front Door Premium with a WAF policy in Prevention mode sits in front; the origin group contains both App Gateway public IPs.
793 words, about 4 min4Private Endpoint Name Resolution Across Spokes and On-Premises
Contoso has a hub (10.10.0.0/22) peered to spoke1 (10.11.0.0/24) and spoke2 (10.12.0.0/24). Storage account stcontoso01 has a blob private endpoint in hub subnet snet-pe (10.10.2.0/24) with private IP 10.10.2.5.
741 words, about 4 min5Azure Firewall FQDN Egress for Mixed Protocols
App servers in spoke1 (10.21.0.0/24) must reach only three external services. The NSG on the app subnet allows outbound only to 10.0.0.4 (Azure Firewall, hub) on TCP 443, 587 and 8080, and to the hub DNS servers 10.10.3.4/10.10.3.5.
835 words, about 4 min