Azure AZ-700 cheat sheet
Azure AZ-700 · Keep the key ideas within reach.
Design and implement core networking infrastructure
Azure reserves five IP addresses per subnet: the first four addresses and the last address; usable hosts = 2^(host bits) - 5.
VNet peering is non-transitive; traffic between peered VNets requires a direct peering, gateway transit, or user-defined routing.
User-defined route next-hop types are VirtualNetworkGateway, VirtualNetwork, Internet, VirtualAppliance, and None.
The gateway subnet must be named GatewaySubnet; the minimum prefix is /29, and /27 is recommended for large gateway SKUs.
Service endpoints extend subnet identity to an Azure service over the Azure backbone; private endpoints assign a private IP through a NIC.
Azure DNS private zones require a virtual network link; autoregistration creates A records for virtual machines in linked VNets.
Global VNet peering connects VNets in different Azure regions; regional VNet peering connects VNets in the same region.
Accelerated networking uses SR-IOV and is supported only on select VM sizes; it reduces latency and CPU jitter.
Azure Virtual Network Manager applies connectivity and security admin rules across multiple virtual networks at scale.
Design, implement, and manage connectivity services
VPN Gateway Basic SKU lacks BGP, active-active, and zone-redundant capabilities; VpnGw SKUs support BGP and active-active.
PolicyBased VPN uses static packet filters and one tunnel; RouteBased VPN uses routing tables and supports BGP and multiple tunnels.
ExpressRoute peering types are Azure private, Azure public, and Microsoft; Azure private peering connects to virtual networks.
ExpressRoute FastPath bypasses the virtual network gateway in the data path for supported ExpressRoute traffic.
ExpressRoute Global Reach connects two ExpressRoute circuits so on-premises networks communicate through the Microsoft backbone.
Virtual WAN hubs provide transitive routing among site-to-site VPN, point-to-site VPN, and ExpressRoute connections.
Site-to-site VPN requires a public IP address on the on-premises VPN device and matching pre-shared keys on both gateways.
Point-to-site VPN authentication options include certificates, RADIUS, and Azure AD, depending on gateway SKU and configuration.
Zone-redundant VPN and ExpressRoute gateways require AZ-enabled SKUs and are deployed across availability zones.
Design and implement application delivery services
Azure Load Balancer operates at Layer 4 for TCP and UDP; Application Gateway operates at Layer 7 for HTTP and HTTPS.
Standard Load Balancer requires explicit NSG rules to allow backend traffic; Basic Load Balancer has different default behavior.
Application Gateway v2 supports autoscaling, zone redundancy, Web Application Firewall, and URL path-based routing.
Azure Front Door is a global anycast Layer 7 service with caching, WAF, origin groups, and failover.
Traffic Manager is DNS-based; routing methods include priority, weighted, performance, geographic, multivalue, and subnet.
Gateway Load Balancer chains third-party network virtual appliances using VXLAN for transparent traffic inspection.
Cross-region Load Balancer provides global Layer 4 distribution across regional Standard Load Balancer backends.
Health probes determine backend endpoint membership; Application Gateway uses probe settings in backend HTTP settings.
Design and implement private access to Azure services
A private endpoint is a NIC with a private IP address in a subnet that connects to a specific Azure PaaS resource through Private Link.
Private Link service exposes your own service, typically behind a Standard Load Balancer, to consumers using private endpoints.
Private endpoint DNS names commonly use privatelink zones, such as privatelink.blob.core.windows.net for Blob Storage.
Private endpoint network policies control whether NSGs and route tables apply to the endpoint subnet; they are disabled by default.
Service endpoints keep traffic on the Azure backbone but do not assign a private IP address to the Azure service.
App Service private endpoints provide inbound private access; VNet integration provides outbound access from the app.
Azure DNS Private Resolver forwards DNS queries between on-premises environments and Azure private DNS zones.
Private endpoint connections require approval unless the target resource owner configures automatic approval.
Design and implement Azure network security services
NSG rules are stateful and evaluated by priority from 100 to 4096; a lower number has higher precedence.
Default NSG rules include AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound, AllowVnetOutBound, AllowInternetOutBound, and DenyAllOutBound.
Azure Firewall Standard supports FQDN filtering, threat intelligence, and DNAT; Premium adds IDPS and TLS inspection.
Azure Firewall Policy supports parent and child policy inheritance with rule collection groups.
DDoS Network Protection provides adaptive mitigation and attack analytics; DDoS IP Protection is applied per public IP address.
Web Application Firewall protects HTTP and HTTPS workloads on Application Gateway and Azure Front Door using managed rule sets.
Azure Bastion provides RDP and SSH over TLS without requiring public IP addresses on virtual machines.
Application Security Groups group NICs by workload role so NSG rules can reference the group instead of IP addresses.