Home
Azure
AZ-700
Syllabus

AZ-700 syllabus

5 domains and 121 topics, updated November 2026

Overview Syllabus Notes Patterns Revision Sample questions Practise

AZ-700 is about designing, building and troubleshooting Azure networks: addressing and routing, hybrid links, traffic delivery, private access and traffic filtering. This outline lists what each domain expects, in plain terms. Tick topics off as you cover them. Your ticks are saved in this browser.

This outline follows the official AZ-700 exam guide. Check it for the exact wording.

Design and implement core networking infrastructure

25–30%

Addressing, DNS, VNet connectivity and routing, and monitoring. The largest domain (25–30%).

IP addressing and subnets

Planning non-overlapping address spaces and segmenting a network
Creating a virtual network
Sizing and naming subnets for gateways, private endpoints, service endpoints, firewalls, application gateways, VNet-integrated PaaS and Bastion
Delegating a subnet to a platform service
Choosing between shared and dedicated subnets

Public IP addresses and prefixes

Creating a public IP address and associating it with resources
Creating a public IP prefix and knowing when to use one
Planning and onboarding a custom IP prefix (bring your own IP)

Name resolution

Designing name resolution inside a VNet and setting a VNet's DNS servers
Designing, creating and configuring public DNS zones
Designing, configuring and linking private DNS zones to VNets
Designing and deploying Azure DNS Private Resolver with endpoints and rulesets

VNet connectivity and routing

Service chaining and gateway transit across peered VNets
Implementing VNet peering
Connecting and managing many VNets with Azure Virtual Network Manager
Designing UDRs, associating route tables with subnets and configuring forced tunneling
Diagnosing and fixing routing problems
Designing and deploying Azure Route Server
Choosing and implementing Azure NAT Gateway

Monitoring networks

Configuring Network Watcher tools, diagnostics and logs, and using them to troubleshoot
Using Azure Monitor for networks (Network insights)
Turning on and monitoring DDoS protection
Reading Defender for Cloud secure score, attack path analysis and cloud security explorer for network findings

Read the notes Practise this domain

Design, implement and manage connectivity services

20–25%

Site-to-site and point-to-site VPN, ExpressRoute and Virtual WAN.

Site-to-site VPN

Designing S2S VPN for high availability
Choosing a VPN gateway SKU for S2S needs
Implementing a S2S VPN connection
Choosing policy-based or route-based VPN
Creating a local network gateway
Creating an IPsec/IKE policy
Creating a virtual network gateway
Diagnosing and fixing gateway connectivity
Implementing Azure Extended Network

Point-to-site VPN

Choosing a gateway SKU for P2S needs
Choosing and configuring a tunnel type
Choosing an authentication method
Configuring RADIUS authentication
Configuring Microsoft Entra ID authentication
Distributing the VPN client configuration
Fixing client-side and authentication problems
Azure requirements for Always On VPN
Azure requirements for Azure Network Adapter

ExpressRoute

Choosing a connectivity model
Choosing a SKU and billing tier
Designing for cross-region reach, redundancy and disaster recovery
Using Global Reach, FastPath and ExpressRoute Direct
Choosing private peering, Microsoft peering or both
Configuring private peering
Configuring Microsoft peering
Creating the ExpressRoute gateway
Connecting a VNet to a circuit
Recommending route advertisement settings
Encrypting traffic over ExpressRoute
Enabling Bidirectional Forwarding Detection
Diagnosing and fixing ExpressRoute problems

Azure Virtual WAN

Choosing a Virtual WAN SKU
Designing a Virtual WAN with the right types and services
Creating a virtual hub
Choosing scale units for each gateway type
Deploying gateways into a hub
Configuring hub routing
Integrating a hub with a third-party NVA

Read the notes Practise this domain

Design and implement application delivery services

15–20%

Load Balancer, Traffic Manager, Application Gateway and Front Door.

Load Balancer and Traffic Manager

Mapping requirements to Load Balancer features and use cases
Choosing an SKU and tier
Choosing public or internal, regional or cross-region
Creating and configuring a load balancer
Implementing Traffic Manager
Implementing Gateway Load Balancer
Load balancing rules
Inbound NAT rules
Explicit outbound rules and SNAT

Application Gateway

Mapping requirements to features and use cases
Choosing manual or autoscale
Backend pools
Health probes
Listeners
Routing rules
HTTP (backend) settings
TLS configuration
Rewrite rule sets

Azure Front Door

Mapping requirements to features and use cases
Choosing a tier
Routing, origins and endpoints
TLS termination and end-to-end TLS
Caching
Traffic acceleration
Rules, URL rewrite and URL redirect
Securing origins with Private Link

Read the notes Practise this domain

Design and implement private access to Azure services

10–15%

Private endpoints, Private Link service, DNS integration and service endpoints.

Private Link and private endpoints

Planning private endpoints
Creating private endpoints
Controlling access to private endpoints
Creating a Private Link service
Integrating Private Link and private endpoints with DNS
Integrating a Private Link service with on-premises clients

Service endpoints

Deciding when a service endpoint is right
Creating service endpoints
Configuring service endpoint policies
Configuring access to service endpoints

Read the notes Practise this domain

Design and implement network security

15–20%

NSGs, Azure Firewall and Firewall Manager, and WAF.

Network security groups

Creating an NSG
Associating an NSG with a subnet or NIC
Creating an application security group
Associating an ASG with a NIC
Inbound and outbound security rules
Implementing VNet flow logs
Interpreting VNet flow logs
Verifying IP flow
Securing remote administration, including Azure Bastion
Managing security with Azure Virtual Network Manager

Azure Firewall and Firewall Manager

Mapping requirements to Azure Firewall features
Choosing an Azure Firewall SKU
Designing an Azure Firewall deployment
Creating and implementing a deployment
Configuring firewall rules
Creating Firewall Manager policies
Building a secure hub with Azure Firewall in a Virtual WAN hub

Web Application Firewall

Mapping requirements to WAF features
Designing a WAF deployment
Detection or prevention mode
Rule sets for WAF on Front Door
Rule sets for WAF on Application Gateway
Implementing a WAF policy
Associating a WAF policy

Read the notes Practise this domain