Azure AZ-720 study plan

Map every Azure network diagnostic tool (Network Watcher connection troubleshoot, IP flow verify, next hop, effective security rules, VPN troubleshoot) to the symptom each one resolves, and write a one-line selection rule for each

Trace a simulated site-to-site VPN failure end to end by ordering the checks: gateway health, tunnel status, IKE/IPsec parameters, shared key, on-premises firewall, and BGP peering state

Diagram a hub-and-spoke topology with peering, user-defined routes, and an NVA, then annotate the three most common misconfigurations that silently drop traffic

Configure and interpret NSG flow logs and effective security rules for a subnet that appears blocked in both directions

Differentiate ExpressRoute failure modes (circuit down, peering misconfigured, route filter, asymmetric routing) and state the first verification step for each

Resolve DNS failures across hybrid name resolution by comparing Azure-provided DNS, custom DNS, private DNS zones, and conditional forwarders

Diagnose load balancer and Application Gateway distribution problems using health probe results, backend pool membership, and NSG interaction

Practice reading effective routes and next hop output to prove where a packet is actually being sent

Isolate hybrid identity sync failures by inspecting Entra Connect sync status, connector space, and export errors

Distinguish authentication failures caused by Conditional Access, MFA registration state, and legacy protocol blocking

Verify token and sign-in diagnostics by reading sign-in log error codes and correlating them with a specific policy

Test hybrid join and device-based access failures against the device registration record

Diagnose RBAC and deny-assignment conflicts by computing effective permissions for a principal across management group, subscription, and resource scope

Resolve managed identity and service principal consent or credential failures for a workload accessing another resource

Troubleshoot RDP and SSH connectivity to a VM by separating NSG, public IP, just-in-time access, and guest OS firewall causes

Use boot diagnostics and serial console output to recover a VM that is unreachable at the network layer

Isolate VM-level connectivity faults by separating platform causes (host node, accelerated networking, NIC reset) from configuration causes

Diagnose PaaS connectivity failures by checking private endpoint DNS resolution, service endpoint configuration, and firewall allowlists

Resolve App Service networking issues involving VNet integration, access restrictions, and hybrid connections

Compare PaaS and IaaS failure signatures to pick the correct diagnostic entry point within the first two minutes

Evaluate backup and replication health for VMs, SQL, and storage by reading job status, recovery point age, and replication lag

Diagnose failover failures by checking regional capacity, paired-region constraints, and dependency ordering

Troubleshoot PaaS data-tier issues including connection throttling, scaling limits, and transient fault handling

Verify restore operations and identify why a restore target may be rejected

Rehearse timed troubleshooting scenarios that combine network, connectivity, and access control symptoms in a single incident

Practice articulating root cause to a non-technical stakeholder in under two minutes

Close knowledge gaps by re-testing every missed item from earlier weeks and recording why the first diagnosis was wrong

Verify command fluency for the ten most-used diagnostic commands without consulting notes

Run a full-length timed practice assessment and score each domain separately

Re-study only the two weakest domains using targeted labs rather than rereading notes

Confirm readiness by restating the diagnostic entry point for each of the six domains from memory

Finalize a one-page pre-exam reference sheet of commands and decision rules