Nothing here is narrative — every section below is a table or a list built for a five-minute scan the night before your exam. If you need the "why" behind any of these facts, the AZ-700 study guide covers the reasoning; this page is just the reference.
AZ-700 Quick Facts
| Exam code | AZ-700 |
| Credential | Microsoft Certified: Azure Network Engineer Associate |
| Level | Associate (Intermediate) |
| Questions | 40–60 |
| Duration | 120 minutes |
| Passing score | 700 / 1000 |
| Price | $165 USD |
| Prerequisites | None required (AZ-104 experience strongly recommended) |
| Renewal | Every 12 months, free online assessment |
| Skills measured as of | July 27, 2026 (per Microsoft's official study guide, checked August 4, 2026) |
Source: Microsoft's official AZ-700 exam page, checked August 4, 2026.
Nothing on this page is guessed. Domain weights and every reference link trace back to Microsoft's current AZ-700 exam page, cross-verified against the same source material used to build our 500-question AZ-700 bank.
Domain Weight & Key Services Map
| Domain | Weight | Key services to know cold |
|---|---|---|
| Core networking infrastructure | 25–30% | VNet/subnet design, Public IP prefixes, Azure DNS + Private Resolver, VNet peering, Virtual Network Manager, UDRs, Route Server, NAT Gateway, Network Watcher, Defender for Cloud Secure Score |
| Connectivity services | 20–25% | Site-to-site VPN, Point-to-site VPN, ExpressRoute, Azure Virtual WAN |
| Application delivery services | 15–20% | Azure Load Balancer, Traffic Manager, Application Gateway, Azure Front Door |
| Private access to Azure services | 10–15% | Private Link, Private Endpoints, Service Endpoints |
| Network security services | 15–20% | NSGs, ASGs, Azure Firewall + Firewall Manager, Web Application Firewall |
Weightings and skill groupings per Microsoft's AZ-700 study guide, "Skills measured as of July 27, 2026."
VNet & DNS Quick Reference
Private IP address ranges (RFC 1918)
| 10.0.0.0/8 | 16,777,216 addresses — largest private block, common for enterprise on-premises |
| 172.16.0.0/12 | 1,048,576 addresses — often free for Azure VNets when on-premises already uses 10.0.0.0/8 |
| 192.168.0.0/16 | 65,536 addresses — common on small networks and home/branch routers |
Azure-reserved addresses per subnet
Azure reserves 5 IPs in every subnet: .0 (network address), .1 (default gateway), .2 and .3 (mapped to Azure DNS), .255 (broadcast, if the subnet is not /31 or /32). A /24 subnet has 256 total addresses but only 251 usable.
DNS zone types
| Zone type | Resolves for |
|---|---|
| Public DNS zone | Internet-facing hostnames — anyone can query it |
| Private DNS zone | Internal names for VNets the zone is linked to; supports auto-registration on one linked VNet |
| DNS Private Resolver — inbound endpoint | Lets on-premises DNS servers query Azure private zones without a VM |
| DNS Private Resolver — outbound endpoint | Forwards Azure DNS queries to on-premises DNS via a forwarding ruleset |
Halfway through the sheet
Check Your AZ-700 Readiness in 5 Minutes
A short adaptive quiz estimates whether you're ready to book the exam — no signup required.
Take the Readiness Quiz →VPN Gateway & ExpressRoute SKU Reference
VPN Gateway SKUs
| SKU | Aggregate throughput | S2S/VNet-to-VNet tunnels | P2S connections | BGP |
|---|---|---|---|---|
| Basic | 100 Mbps | 10 | 128 (SSTP only) | Not supported |
| VpnGw1 | 650 Mbps | 30 | 250 | Supported |
| VpnGw2 | 1 Gbps | 30 | 500 | Supported |
| VpnGw3 | 1.25 Gbps | 30 | 1,000 | Supported |
| VpnGw4 (Gen2 only) | 5 Gbps | 100* | 5,000 | Supported |
| VpnGw5 (Gen2 only) | 10 Gbps | 100* | 10,000 | Supported |
*Above 100 S2S tunnels, use Azure Virtual WAN instead. Every AZ variant (VpnGw1AZ–VpnGw5AZ) matches its base SKU's throughput but adds zone redundancy. Source: Azure VPN Gateway documentation.
ExpressRoute peering types
| Peering | Reaches | Max IPv4 routes (Standard / Premium) |
|---|---|---|
| Private peering | VNet resources — VMs, private IaaS/PaaS endpoints | 4,000 / 10,000 |
| Microsoft peering | Microsoft 365 and Azure PaaS public endpoints | 200 / 200 (unchanged by Premium) |
Source: ExpressRoute circuits and peering.
Global Reach
Links two ExpressRoute circuits pairwise so on-premises sites can reach each other over Microsoft's backbone. Not transitive — connecting A↔B and B↔C does not give A↔C.
FastPath
Bypasses the ExpressRoute virtual network gateway in the data path for higher throughput. Requires Ultra Performance or ErGw3AZ gateway SKU on provider circuits (or ExpressRoute Direct).
ExpressRoute Direct
Connects your routers straight to Microsoft's network over dual 10, 100, or 400 Gbps ports — no connectivity provider in the path.
Application Delivery Quick-Pick Table
| Service | OSI layer | Scope | Standout feature |
|---|---|---|---|
| Azure Load Balancer | Layer 4 | Regional | Lowest latency, any TCP/UDP protocol |
| Gateway Load Balancer | Layer 4 | Regional | Transparently chains traffic through third-party NVAs |
| Application Gateway | Layer 7 | Regional | Path-based routing, SSL termination, integrated WAF |
| Azure Traffic Manager | DNS | Global | DNS-based routing for HTTP and non-HTTP endpoints alike |
| Azure Front Door | Layer 7 | Global | Anycast edge routing, caching, and edge WAF in one service |
Read order for scenario questions: scope (regional vs global) narrows to 2 options, then protocol (HTTP-only vs any) picks the final answer.
Private Access & Security Rule Reference
NSG default rules (cannot be deleted)
| Priority | Name | Direction | Action |
|---|---|---|---|
| 65000 | AllowVNetInBound | Inbound | Allow |
| 65001 | AllowAzureLoadBalancerInBound | Inbound | Allow |
| 65500 | DenyAllInBound | Inbound | Deny |
| 65000 | AllowVNetOutBound | Outbound | Allow |
| 65001 | AllowInternetOutBound | Outbound | Allow |
| 65500 | DenyAllOutBound | Outbound | Deny |
Custom rules use priority 100–4096 (lower number evaluated first; first match wins). Inbound evaluation order is subnet NSG, then NIC NSG. Outbound evaluation order is NIC NSG, then subnet NSG — both NSGs must allow the traffic when both exist.
Private Endpoint vs Service Endpoint
| Private Endpoint | Service Endpoint | |
|---|---|---|
| Gets a private IP in your VNet | Yes | No |
| PaaS resource keeps a public endpoint | Optional — can be disabled | Always remains |
| Reachable cross-VNet or on-premises via peering/VPN | Yes | No (subnet-local only) |
Azure Firewall SKU tiers
| Capability | Basic | Standard | Premium |
|---|---|---|---|
| Throughput | Up to 250 Mbps | Up to 30 Gbps | Up to 100 Gbps |
| Threat intelligence filtering | Alert only | Alert + Deny | Alert + Deny |
| DNS proxy / web categories | No | Yes | Yes |
| TLS inspection / IDPS / full-URL filtering | No | No | Yes |
Source: Choose the right Azure Firewall SKU. WAF (on Application Gateway or Front Door) runs in Detection mode (log only) or Prevention mode (actively block) against the OWASP Core Rule Set.
Network Watcher Tool Reference
| Tool | Answers this question |
|---|---|
| Next hop | What route is a VM's NIC actually using to reach a given destination? |
| IP flow verify | Would this source→destination flow be allowed or denied by the effective NSGs right now? |
| Connection troubleshoot | Is there end-to-end connectivity between two endpoints, and what's the latency and hop-by-hop path? |
| Connection Monitor | Is a VPN, ExpressRoute, or VNet path staying healthy over time, with alerting on degradation? |
| NSG / VNet flow logs | What traffic was actually allowed or denied over a historical time window (forensics)? |
| Packet capture | What's literally inside the packets crossing this NIC right now? |
| Traffic Analytics | Which flows dominate my traffic, and which were blocked, visualized from flow log data? |
Portal Path & CLI Quick Reference
| Task | Azure CLI |
|---|---|
| Create a VNet | az network vnet create |
| Create a private endpoint | az network private-endpoint create |
| Link a private DNS zone to a VNet | az network private-dns link vnet create |
| Create a route table / add a route | az network route-table create / route create |
| Enable BGP on a VPN gateway | az network vnet-gateway update --asn |
| Test whether an NSG blocks a flow | az network watcher test-ip-flow |
| Check the effective next hop | az network watcher show-next-hop |
| Turn on NSG flow logs | az network watcher flow-log create |
| Add a Firewall Policy rule collection | az network firewall policy rule-collection-group create |
| Create a WAF policy | az network application-gateway waf-policy create |
AZ-700 doesn't test exact CLI syntax, but recognizing the right command group under scenario pressure is a fast way to confirm you've picked the right service.
AZ-700 Exam-Day Traps
- • Basic VPN Gateway has zero BGP support — not reduced, not optional. Any dynamic-routing requirement eliminates Basic immediately.
- • Microsoft peering route limits don't scale with Premium. Premium raises private peering from 4,000 to 10,000 routes; Microsoft peering stays capped at 200 either way.
- • FastPath needs a specific gateway SKU. On provider circuits it requires Ultra Performance or ErGw3AZ — a lower SKU with FastPath enabled is a distractor, not a valid answer.
- • Firewall Basic needs a second subnet. It requires its own AzureFirewallManagementSubnet (/26 minimum) in addition to AzureFirewallSubnet — Standard and Premium don't.
- • Global Reach is pairwise, not transitive. Linking circuit A to B and B to C does not connect A to C — you must explicitly pair A and C.
- • Inbound and outbound NSG evaluation order differ. Inbound: subnet NSG first, then NIC NSG. Outbound: NIC NSG first, then subnet NSG. Both must allow the traffic when both exist.
- • Service Endpoint traffic never gets a private IP. It only optimizes routing over the Azure backbone — the PaaS resource keeps its public endpoint unless you separately lock it down with a Private Endpoint.
Acronym Quick List
VNet — Virtual Network
NSG — Network Security Group
ASG — Application Security Group
UDR — User-Defined Route
WAF — Web Application Firewall
IDPS — Intrusion Detection and Prevention System
BGP — Border Gateway Protocol
BFD — Bidirectional Forwarding Detection
S2S / P2S — Site-to-Site / Point-to-Site (VPN)
SNAT / DNAT — Source / Destination Network Address Translation
NVA — Network Virtual Appliance
CRS — Core Rule Set (OWASP, used by WAF)
MSEE — Microsoft Enterprise Edge (ExpressRoute peering router)
FQDN — Fully Qualified Domain Name
Drill what tripped you up
MSCertQuiz sells full AZ-700 practice-exam access (500 questions across all five domains, $14.99) — this cheat sheet was written by the same team that builds those questions, drawn from the SKU tables, rule sets, and decision points candidates ask about most in our question bank. Start with 40 free questions to see the format before you buy.
AZ-700 FAQ Quick Answers
What is the difference between a VPN Gateway and ExpressRoute?
A VPN Gateway builds an encrypted IPsec tunnel over the public internet — cheaper, but variable latency. ExpressRoute is a private, dedicated circuit that never touches the public internet, with predictable low latency and an SLA-backed bandwidth guarantee up to 100 Gbps with ExpressRoute Direct.
Which VPN Gateway SKU is the minimum that supports BGP?
VpnGw1. The Basic SKU does not support BGP at any throughput level, so any scenario requiring dynamic route propagation rules out Basic regardless of bandwidth needs.
Does a Service Endpoint give a resource a private IP address?
No. Service Endpoints optimize routing to the service over the Azure backbone, but the resource keeps its public endpoint. Only a Private Endpoint creates a private IP address inside your VNet for the resource.
What is the AZ-700 passing score and question count?
700 out of 1000, with 40–60 questions in a 120-minute window, per Microsoft's official exam page. The exam costs $165 USD and has no formal prerequisite, though AZ-104 experience is strongly recommended.
Which Azure Firewall SKU supports TLS inspection?
Only Premium. Standard adds DNS proxy and web-category filtering over Basic, but TLS inspection, IDPS, and full-URL filtering are Premium-exclusive features, per Microsoft's Firewall SKU comparison.
Can ExpressRoute Global Reach connect three circuits automatically?
No. Global Reach links exactly two circuits per configuration. If circuit A is linked to B, and B is linked to C, A and C still cannot reach each other until you explicitly enable Global Reach between A and C directly.
What is the maximum throughput of Azure Firewall Standard?
Up to 30 Gbps with auto-scale, versus 250 Mbps for Basic and 100 Gbps for Premium. Standard also supports 1 Gbps of sustained "fat flow" throughput, well below Premium's 10 Gbps.
Which Network Watcher tool identifies a blocking NSG rule fastest?
IP flow verify. It evaluates all NSGs effective on a NIC — subnet and NIC level — for a specific source/destination/port combination and returns exactly which rule allows or denies it, without reading every rule manually.
Continue Your AZ-700 Prep
AZ-700 Study Guide
Full domain breakdown, 6-week study plan, and exam-day strategy.
Free AZ-700 Practice Questions
25 scenario questions with full rationale for every answer choice.
AZ-700 Certification Page
Exam format, domain weights, and what MSCertQuiz covers.
All Microsoft Certifications
Browse every certification MSCertQuiz covers by track.