Azure AZ-700 study plan
Azure AZ-700 · Give each week a clear focus.
8 weeks · About 7 hours per week
Design and implement core networking infrastructure
Design a multi-tier VNet address space (gateway, firewall, application, data subnets) and calculate reserved and usable IP counts for each subnet
Build a hub-and-spoke topology with three VNets and configure both regional and global VNet peering
Create user-defined routes that force spoke-to-spoke traffic through a network virtual appliance in the hub
Compare effective routes and next-hop types from each subnet using the effective routes view, and explain where peering transitivity fails
Your checkpoint
A deployed hub-and-spoke lab with a screenshot or exported table of effective routes for every subnet, plus a one-page note explaining each non-default route.
Design and implement core networking infrastructure
Provision public and private Azure DNS zones, link the private zone to two VNets, and verify forward and reverse name resolution from a VM
Configure autoregistration for VM records in a private DNS zone and confirm the A records appear
Deploy a conditional-forwarding pattern from on-premises-style DNS to Azure private DNS and validate resolution of a PaaS private endpoint name
Choose between Azure DNS, private DNS zones, and custom DNS servers for three given scenarios and justify each choice
Detect and remediate an overlapping address space between an on-premises range and an Azure VNet
Your checkpoint
A DNS resolution matrix listing each source (VM in VNet A, VM in VNet B, simulated on-prem) against each target name and the result, with all cells resolving correctly.
Design, implement, and manage connectivity services
Deploy a site-to-site VPN gateway with BGP and verify learned routes in the gateway and on a connected client
Configure point-to-site VPN with Microsoft Entra ID authentication and connect a client successfully
Select gateway SKU, zone redundancy, and active-active settings for three stated throughput and availability requirements
Design an ExpressRoute circuit with private and Microsoft peering, including redundancy and failover to VPN
Compare Virtual WAN hub connectivity against a self-managed hub-and-spoke design for a multi-region scenario
Your checkpoint
A connectivity decision table covering VPN, ExpressRoute, and Virtual WAN for four business scenarios, backed by one working site-to-site VPN lab.
Design and implement application delivery services
Deploy a public and an internal Azure Load Balancer and validate health probes, session persistence, and outbound rules
Configure an Application Gateway with path-based routing across two backend pools and a multi-site listener
Enable a Web Application Firewall policy in prevention mode and confirm a test attack is blocked
Diagnose a failing backend health status by checking NSG rules, probe path, and TLS settings
Your checkpoint
A working Application Gateway with WAF in prevention mode routing two URL paths to different backend pools, plus a log excerpt proving one blocked request and one allowed request.
Design and implement application delivery services
Configure Azure Front Door with two origins, health probes, and a priority-based failover and observe failover behavior
Set up Traffic Manager with performance and priority routing methods and explain when each is preferable to Front Door
Enable caching and compare cache hit behavior for static and dynamic content on the same endpoint
Lock down a Front Door or Application Gateway origin with Private Link or service restrictions
Map five given traffic patterns (global HTTP, regional TCP, multi-region failover, internal-only L7, UDP) to the correct Azure load-balancing service
Your checkpoint
A service-selection matrix matching eight load-balancing scenarios to the correct Azure service with a one-line justification each, plus evidence of a successful Front Door origin failover.
Design and implement private access to Azure services
Deploy a private endpoint for a PaaS service and validate access with the public endpoint disabled
Integrate the private endpoint with a private DNS zone and prove name resolution from a peered VNet
Configure service endpoint policies and compare the security posture against private endpoints for the same storage account
Enable VNet integration for an App Service and route outbound traffic through a subnet with a NAT gateway
Choose between private endpoints, service endpoints, and public access with IP restrictions for four given compliance scenarios
Your checkpoint
A working private endpoint deployment with public access disabled, DNS resolving to the private IP from a VM in a peered VNet, and a written justification for not using service endpoints in that design.
Design and implement Azure network security services
Author NSG rules with application security groups and verify that traffic is allowed and denied as intended
Deploy Azure Firewall with a policy containing DNAT, network, and application rules, and confirm FQDN filtering with a test request
Force all spoke internet-bound traffic through the firewall using UDRs and validate the effective next hop
Enable Azure Bastion for VM access and remove public RDP exposure
Evaluate DDoS Protection tier requirements and design a segmentation plan for a three-tier application
Your checkpoint
A secured hub lab with NSG and ASG rules, an Azure Firewall policy enforcing FQDN egress, Bastion-only management access, and a traffic-flow diagram showing each allow and deny decision.
Design and implement core networking infrastructure & Design, implement, and manage connectivity services & Design and implement application delivery services & Design and implement private access to Azure services & Design and implement Azure network security services
Re-run missed practice questions from weeks 1 through 7 and rewrite the explanation for each until it is correct
Complete two full timed practice exams under exam conditions
Re-verify the weakest two domains by rebuilding the corresponding lab from memory without notes
Summarize the decision criteria for routing, load balancing, private access, and security in a single reference sheet
Your checkpoint
Two completed timed practice exams scoring 80 percent or higher, with a list of remaining weak objectives and a remediation action for each.
Milestones
Week 2: Can explain and demonstrate, without notes, how traffic flows between two peered spokes through a hub NVA and why the route is required, and can resolve a private DNS name from a peered VNet.
Week 4: Can design a hybrid connectivity solution (VPN versus ExpressRoute versus Virtual WAN) for a new scenario and deploy an Application Gateway with WAF that passes a blocked-attack test.
Week 6: Can select the correct Azure load-balancing or application delivery service for any given traffic pattern and justify a private endpoint design that keeps a PaaS service fully off the public internet.
Week 8: Scores 80 percent or higher on two full timed practice exams and can diagram the end-to-end traffic path for a hub-and-spoke workload with firewall egress, private endpoints, and Front Door without reference material.