Azure AZ-700 study guide
Azure AZ-700 · Work through your exam, one topic at a time.
The Microsoft Certified: Azure Network Engineer Associate credential is an intermediate-level, role-based certification for professionals who design, implement, and maintain Azure networking infrastructure. Microsoft describes the audience as people with subject matter expertise in planning, implementing, and managing Azure networking solutions - core network infrastructure, hybrid connectivity, application delivery services, private access to Azure services, and network security - and who optimize performance, resiliency, scale, and security while proactively monitoring environments to resolve connectivity issues. The Azure AZ-700 study guide has 5 sections and about 1,644 words.
01Design and Implement Core Networking Infrastructure
A virtual network is defined by one or more CIDR blocks; RFC 1918 and public ranges are both permitted. Subnets must fall wholly inside that space, must not overlap with any peered VNet, and each subnet permanently loses five addresses (network, default gateway, two for Azure DNS mapping, broadcast).
319 words, about 2 min02Design, Implement and Manage Connectivity Services
VPN Gateway provides IPsec/IKE tunnels over the internet. Use route-based gateways (policy-based only exists in legacy Basic SKUs).
315 words, about 2 min03Design and Implement Application Delivery Services
Azure Load Balancer is layer 4. Basic versus Standard matters: Standard adds availability-zone support, HA ports, outbound rules, and is secure by default - no outbound internet until you add an outbound rule or NAT Gateway.
329 words, about 2 min04Design and Implement Private Access to Azure Services
A Private Endpoint is a network interface in your subnet holding a private IP for a PaaS service instance (Storage, SQL, Key Vault, Cosmos DB, and so on). It uses Azure Private Link, so traffic never leaves the Microsoft backbone and is reachable from peered VNets and on-premises.
340 words, about 2 min05Design and Implement Azure Network Security Services
NSG rules run from the lowest priority number upward, are stateful (return traffic is automatically allowed), and end with default rules at 65000–65500 that allow VNet and Azure Load Balancer traffic and deny inbound internet traffic. An NSG can attach to a subnet and to a NIC; inbound is evaluated subnet first, then NIC, and outbound is the reverse - a rule blocked at either level blocks the flow.
341 words, about 2 min