Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- Microsoft doesn’t publish a fixed question count or time for AZ-700. Expect roughly 40–60 questions in about 100 minutes of exam time (check your appointment for the exact figure). Question types include multiple choice, case studies, drag-and-drop, and sometimes labs. Pace yourself and flag questions.
- You need a score of 700 out of 1,000 to pass. No penalty for guessing.
- Domain weights (skills measured as of 27 July 2026): core networking 25–30%, connectivity 20–25%, network security 15–20%, application delivery 15–20%, private access 10–15%.
- The exam can include preview features that are commonly used. Old services (Basic Load Balancer, Basic public IP, Application Gateway v1) are retired. Don’t pick them.
How to read an AZ-700 question
Read the last sentence first, then hunt for the constraint words.
| The question says | Think |
|---|---|
| Layer 7, host/path routing, WAF, TLS offload | Application Gateway (regional) or Front Door (global) |
| Any TCP/UDP, non-HTTP, lowest latency | Load Balancer |
| DNS-based, any protocol, global | Traffic Manager |
| Global HTTP, caching, acceleration | Front Door |
| Private IP to a PaaS resource, from on-premises | Private endpoint + private DNS |
| Free, subnet to storage, no on-premises | Service endpoint |
| Predictable, private, dedicated | ExpressRoute |
| Quickly, encrypted, cheap | S2S VPN |
| Many branches, automatic transit | Virtual WAN |
| Hundreds of VNets, rule owners can’t override | Virtual Network Manager |
| Fixed outbound IP, SNAT exhaustion | NAT Gateway (+ public IP prefix) |
| Inspect all traffic centrally | Azure Firewall + UDR (or secured hub) |
Elimination tricks
- Check the subnet name and size first. A wrong subnet name, or a NSG on GatewaySubnet, is a frequent hidden fault.
- “Transitive” through plain peering doesn’t exist. Look for gateway transit, UDR through a firewall, or Virtual WAN.
- A private endpoint with no private DNS zone link doesn’t work. The name still resolves publicly.
- Features that don’t exist: policy-based VPN on VpnGw SKUs, public peering for new circuits, Global Reach over Microsoft peering, WAF on Traffic Manager or Basic Load Balancer.
Subnet names and sizes
| Service | Name | Size |
|---|---|---|
| VPN / ExpressRoute gateway | GatewaySubnet | /27 or larger |
| Azure Firewall | AzureFirewallSubnet | /26 |
| Firewall management | AzureFirewallManagementSubnet | /26 |
| Bastion | AzureBastionSubnet | /26 or larger |
| Route Server | RouteServerSubnet | /27 or larger |
| Application Gateway v2 | Dedicated, any name | /24 recommended |
| Private Resolver endpoint | Dedicated, delegated | /28 or larger |
| Private endpoint, service endpoint | Any | Any |
| Virtual WAN hub | Hub prefix | /24 (/23 for scale) |
Azure reserves 5 IPs per subnet. Smallest IPv4 subnet /29. Azure DNS and probe source: 168.63.129.16.
Routing and DNS rules
- Route choice: longest prefix, then UDR > BGP > system.
- Next hops: Virtual appliance (needs IP forwarding), Virtual network gateway, Virtual network, Internet, None (drop).
- Peering is non-transitive. Hub: Allow gateway transit. Spoke: Use remote gateways.
- Private DNS: zone must be linked to the VNet. Auto-registration works for one zone per VNet.
- On-premises to Azure private names: conditional forwarder to the Private Resolver inbound endpoint. Azure to on-premises: outbound endpoint + ruleset.
VPN, ExpressRoute and Virtual WAN
| Thing | Fact |
|---|---|
| Route-based VPN | IKEv1/2, BGP, P2S, multi-site, active-active. Use it by default |
| Policy-based VPN | Basic SKU only, IKEv1, one tunnel |
| Azure default BGP ASN | 65515 |
| S2S tunnels | 30 (VpnGw1–3), 100 (VpnGw4–5) |
| P2S tunnels | OpenVPN (TCP 443), IKEv2 (UDP 500/4500), SSTP (TCP 443, Windows, max 128) |
| P2S + Entra ID | OpenVPN only, Azure VPN Client, Conditional Access and MFA |
| ER SKUs | Local (metro, unlimited), Standard (geopolitical region), Premium (global, more VNets and routes) |
| ER peerings | Private (VNets, /30 pairs), Microsoft (public prefixes, route filter) |
| ER route limit | 4,000 private-peering prefixes (10,000 Premium) |
| FastPath | Needs ErGw3AZ / Ultra Performance or ErGwScale |
| Global Reach | On-premises to on-premises over private peering |
| ER encryption | MACsec (Direct only), IPsec over ER, TLS |
| BFD | On by default at Microsoft. Enable on your router |
| vWAN scale units | S2S VPN 500 Mbps, P2S 500 Mbps / 500 users, ER 2 Gbps |
| vWAN Basic | S2S only, no ER, no P2S, no hub-to-hub, no secured hub |
Load balancing numbers
| Thing | Value |
|---|---|
| Standard LB backend size | 1,000 |
| LB idle timeout | 4 min default, up to 30 |
| SNAT ports | 64,000 per frontend IP (LB), 64,512 per IP (NAT Gateway, up to 16 IPs) |
| NAT Gateway idle timeout | 4 min default, up to 120 |
| App Gateway v2 capacity | Up to 125 instances, autoscale minimum can be 0 |
| App Gateway default probe | 30 s interval, 30 s timeout, 3 failures, 200–399 |
| App Gateway NSG | Allow GatewayManager 65200–65535 |
| Traffic Manager probe | 10 or 30 s interval, tolerated failures 0–9 |
| Front Door tiers | Standard (custom WAF rules), Premium (managed WAF, Private Link origins) |
| Lock a public origin to Front Door | AzureFrontDoor.Backend tag and X-Azure-FDID header |
Security numbers
| Thing | Value |
|---|---|
| NSG priorities | 100–4096. Defaults 65000, 65001, 65500 |
| NSG evaluation | Inbound: subnet then NIC. Outbound: NIC then subnet |
| ASG rule | NICs in the same VNet |
| Bastion inbound | 443 from Internet and GatewayManager. 8080, 5701 inside the VNet |
| Firewall rule order | DNAT, Network, Application, then deny |
| Firewall rule priority | 100–65000 |
| Firewall SKUs | Basic (~250 Mbps), Standard (~30 Gbps), Premium (~100 Gbps, TLS inspection, IDPS, URL filtering) |
| AVNM security admin | Evaluated before NSGs. Always Allow and Deny skip the NSG |
| WAF anomaly threshold | 5 (Critical 5, Error 4, Warning 3, Notice 2) |
| WAF order | Custom rules first, then managed rules |
| WAF association | Per-URI beats per-site beats global |
Pairs people mix up
| A | B | The difference |
|---|---|---|
| Private endpoint | Service endpoint | Private IP, on-premises reachable, per resource / public IP, subnet identity, free |
| Private Link service | Private endpoint | Provider side behind a Standard LB / consumer side NIC |
| Application Gateway | Front Door | Regional, in the VNet / global edge, CDN |
| Front Door | Traffic Manager | Reverse proxy / DNS answer |
| Load Balancer | Gateway Load Balancer | Distribute traffic / chain NVAs transparently |
| Route Server | Virtual WAN hub router | BGP for a VNet hub you build / built in |
| NSG | Azure Firewall | Layer 3/4 filter on a subnet or NIC / central FQDN, TLS and IDPS |
| IP flow verify | Connection troubleshoot | One NSG decision / end-to-end test |
| Global Reach | ExpressRoute Direct | Site to site over the backbone / dedicated ports |
| Local network gateway | Virtual network gateway | The on-premises device / the Azure endpoint |
Defaults that are usually right
- Standard SKUs everywhere (public IP, Load Balancer). v2 for Application Gateway. Front Door Standard/Premium.
- Hub-and-spoke or Virtual WAN, with a firewall in the hub and UDRs (or routing intent).
- NAT Gateway for outbound. Bastion for admin. Private endpoints with central private DNS zones.
- Route-based VPN with BGP, active-active, zone-redundant SKUs. ExpressRoute with a VPN or second circuit as backup.
- WAF in Detection to tune, then Prevention. Entra ID for P2S auth.