Table of Contents
Microsoft Azure Network Engineer Associate Quick Facts
The Microsoft Azure Network Engineer Associate certification highlights your ability to design, implement, and manage cutting-edge networking solutions on Azure that empower secure and reliable cloud connectivity. This overview gives you everything you need to feel confident and excited about preparing for the AZ-700 exam.
How does the Microsoft Azure Network Engineer Associate certification help you grow?
The Microsoft Azure Network Engineer Associate (exam code AZ-700) validates your expertise in delivering secure, scalable, and resilient networking solutions in Azure. You will learn to master Azure networking services such as VNets, load balancers, VPNs, ExpressRoute, Azure Firewall, and private access services. This certification is especially valuable if you are committed to ensuring seamless hybrid connectivity, secure application delivery, and robust enterprise networking architectures. By achieving this credential, you prove that you can confidently support organizations as they expand their infrastructure in the cloud, while also enhancing your career through specialized cloud networking skills.
Exam Domains Covered (Click to expand breakdown)
Exam Domain Breakdown
Domain 1: Design and implement core networking infrastructure (28% of the exam)
Design and implement IP addressing for Azure resources
- Plan and implement network segmentation and address spaces
- Create a virtual network (VNet)
- Plan and configure subnetting for services, including VNet gateways, private endpoints, service endpoints, firewalls, application gateways, VNet-integrated platform services, and Azure Bastion
- Plan and configure subnet delegation
- Plan and configure shared or dedicated subnets
- Create a prefix for public IP addresses
- Choose when to use a public IP address prefix
- Plan and implement a custom public IP address prefix (bring your own IP)
- Create a public IP address
- Associate public IP addresses to resources
- Upgrade IP address SKU
Section summary: This section establishes the foundation of any Azure network by focusing on IP address planning and subnet design. You will learn how to create VNets, segment networks with subnets, and use both shared and dedicated subnet configurations effectively. Special attention is given to services like Azure Bastion, VNet gateways, and service endpoints, equipping you to optimize connectivity and security across Azure environments.
As you progress, you will also become proficient in working with public IP addresses. This includes knowing when and how to use prefixes, planning for bring-your-own-IP scenarios, and associating IPs to meet architectural needs. By understanding these capabilities, you are able to design scalable and secure solutions that align with enterprise-grade cloud networking requirements.
Design and implement name resolution
- Design name resolution inside a VNet
- Configure DNS settings for a VNet
- Design public DNS zones
- Design private DNS zones
- Configure public and private DNS zones
- Link a private DNS zone to a VNet
- Design and implement Azure DNS Private Resolver
Section summary: This section ensures you understand DNS architecture within Azure, both for internal resolution and public-facing services. You’ll gain practical knowledge on when and how to configure DNS for VNets, making workloads discoverable and properly integrated across environments. You’ll also practice creating and managing public and private DNS zones while designing flexible solutions for hybrid name resolution.
The introduction of the Azure DNS Private Resolver adds a powerful capability for enterprises. By mastering its use, you’ll learn how to integrate Azure DNS with on-premises resources, creating consistent hybrid lookup scenarios. This enables seamless naming conventions across complex infrastructures and provides a more reliable networking environment.
Design and implement VNet connectivity and routing
- Design service chaining, including gateway transit
- Implement VNet peering
- Implement and manage virtual network connectivity by using Azure Virtual Network Manager
- Design and implement user-defined routes (UDRs)
- Associate a route table with a subnet
- Configure forced tunneling
- Diagnose and resolve routing issues
- Design and implement Azure Route Server
- Identify appropriate use cases for a network address translation (NAT) gateway
- Implement a NAT gateway
Section summary: This section equips you with the skills needed to interconnect multiple networks within Azure. You’ll understand how to use VNet peering, service chaining, and Virtual Network Manager to create seamless connectivity scenarios for enterprise-grade deployments. You’ll also gain hands-on experience implementing user-defined routes and forced tunneling to optimize traffic flows and enhance security compliance.
Additionally, the section explores advanced routing solutions such as the Azure Route Server and NAT gateway. These tools simplify BGP integration and outbound Internet routing strategies, vital for maintaining scalability. By mastering connectivity services and routing issues, you can ensure that large-scale Azure networks remain efficient and secure.
Monitor networks
- Configure monitoring, network diagnostics, and logs in Azure Network Watcher
- Monitor and troubleshoot network health by using Azure Network Watcher
- Monitor and troubleshoot networks by using Azure Monitor Network Insights
- Activate and monitor distributed denial-of-service (DDoS) protection
- Evaluate network security recommendations identified by Microsoft Defender for Cloud Secure Score
- Evaluate network security recommendations identified by Microsoft Defender For Cloud Attack Path Analysis
- Identify network resources by using Microsoft Defender for Cloud Security Explorer
Section summary: This section emphasizes proactive monitoring and troubleshooting in Azure. Through tools like Network Watcher and Azure Monitor Network Insights, you will learn how to collect diagnostic data, evaluate health, and respond quickly to network performance issues. You’ll also learn how to use logs and built-in monitoring capabilities to keep networks highly available.
Security-focused insights are also covered in detail. You’ll explore how DDoS protection and Microsoft Defender for Cloud complement your monitoring efforts, providing recommendations and attack path analyses. This ensures you can secure environments effectively while keeping networks optimized and future-ready.
Domain 2: Design, implement, and manage connectivity services (23% of the exam)
Design, implement, and manage a site-to-site VPN connection
- Design a site-to-site VPN connection, including for high availability
- Select an appropriate VNet gateway stock-keeping unit (SKU) for site-to-site VPN requirements
- Implement a site-to-site VPN connection
- Identify when to use a policy-based VPN versus a route-based VPN connection
- Create and configure a local network gateway
- Create and configure an IPsec/Internet Key Exchange (IKE) policy
- Create and configure a virtual network gateway
- Diagnose and resolve virtual network gateway connectivity issues
- Implement Azure Extended Network
Section summary: This section covers how to design and establish secure VPN connectivity between Azure VNets and on-premises resources. You will understand policy-based and route-based VPN designs, security policies like IPsec/IKE, and how to select the right gateway SKU for different business requirements. These skills ensure hybrid networks are reliable and secure.
You will also master how to troubleshoot connectivity issues and extend on-premises environments through Azure Extended Network. By gaining this insight, you’ll be equipped to ensure resilient hybrid workloads across diverse enterprise landscapes.
Design, implement, and manage a point-to-site VPN connection
- Select an appropriate virtual network gateway SKU for point-to-site VPN requirements
- Select and configure a tunnel type
- Select an appropriate authentication method
- Configure RADIUS authentication
- Configure authentication by using Microsoft Entra ID
- Implement a VPN client configuration file
- Diagnose and resolve client-side and authentication issues
- Specify Azure requirements for Always On VPN
- Specify Azure requirements for Azure Network Adapter
Section summary: This section focuses on point-to-site VPN solutions that allow individual clients to connect securely to Azure. You’ll understand how to choose the right VPN gateway SKU, configure authentication methods like RADIUS and Entra ID, and implement custom VPN client configurations.
These capabilities provide flexibility for organizations supporting remote teams and distributed users. You’ll also learn best practices for Always On VPN and Azure Network Adapter, ensuring connectivity remains simple and secure for end-users while reinforcing enterprise networking policies.
Design, implement, and manage Azure ExpressRoute
- Select an ExpressRoute connectivity model
- Select an appropriate ExpressRoute SKU and tier
- Design and implement ExpressRoute to meet requirements, including cross-region connectivity, redundancy, and disaster recovery
- Design and implement ExpressRoute options, including Global Reach, FastPath, and ExpressRoute Direct
- Choose between Azure private peering only, Microsoft peering only, or both
- Configure Azure private peering
- Configure Microsoft peering
- Create and configure an ExpressRoute gateway
- Connect a virtual network to an ExpressRoute circuit
- Recommend a route advertisement configuration
- Configure encryption over ExpressRoute
- Implement Bidirectional Forwarding Detection
- Diagnose and resolve ExpressRoute connection issues
Section summary: This section emphasizes the design and implementation of private dedicated Azure connectivity using ExpressRoute. You’ll evaluate models, SKUs, and peering options tailored to workloads requiring redundancy, security, and predictable latency.
With additional features like Global Reach, FastPath, and Direct connections, ExpressRoute offers enterprise-grade performance across regions. By exploring encryption options and troubleshooting processes, you’ll ensure ExpressRoute delivers consistent and secure cross-network performance.
Design and implement an Azure Virtual WAN architecture
- Select a Virtual WAN SKU
- Design a Virtual WAN architecture, including selecting types and services
- Create a hub in Virtual WAN
- Choose an appropriate scale unit for each gateway type
- Deploy a gateway into a Virtual WAN hub
- Configure virtual hub routing
- Integrate a Virtual WAN hub with a third-party NVA for cloud connectivity
Section summary: This section dives into Virtual WAN, Microsoft’s simplified networking service for connecting branches, remote users, and cloud workloads. You’ll learn how to select SKUs, create hubs, configure gateways, and integrate with routing requirements.
These practices make it easier to scale secure global connectivity. You’ll also explore how to integrate third-party NVAs, enhancing workloads with specialized cloud connectivity features in distributed enterprise environments.
Domain 3: Design and implement application delivery services (18% of the exam)
Design and implement Azure Load Balancer and Azure Traffic Manager
- Map requirements to features and capabilities of Azure Load Balancer
- Identify appropriate use cases for Azure Load Balancer
- Choose an Azure Load Balancer SKU and tier
- Choose between public and internal load balancers
- Choose between regional and global load balancers
- Create and configure an Azure Load Balancer
- Implement Azure Traffic Manager
- Implement a gateway load balancer
- Implement a load balancing rule
- Create and configure inbound NAT rules
- Create and configure explicit outbound rules, including source network address translation (SNAT)
Section summary: This section highlights Azure Load Balancer and Traffic Manager as key services for distributing workloads globally and regionally. You’ll learn how to map requirements to features, select the right SKU and tier, and implement load balancer rules effectively.
Alongside performance optimization, the curriculum also covers NAT rules and outbound connections, ensuring that workloads remain accessible and secure. Combining regional and global approaches with services like gateway load balancer creates a resilient traffic management strategy.
Design and implement Azure Application Gateway
- Map requirements to features and capabilities of Azure Application Gateway
- Identify appropriate use cases for Azure Application Gateway
- Choose between manual and autoscale
- Create a back-end pool
- Configure health probes
- Configure listeners
- Configure routing rules
- Configure HTTP settings
- Configure Transport Layer Security (TLS)
- Configure rewrite sets
Section summary: This section explores Azure Application Gateway, an application-level load balancer with features like WAF integration and TLS termination. You’ll discover how to map it to business requirements, choose scaling strategies, and implement health probes to ensure workloads are always healthy.
By learning to configure routing rules and HTTP settings, you’ll also gain practical expertise in achieving secure, high-performing application delivery. TLS configuration and rewrite sets add additional flexibility for advanced traffic management.
Design and implement Azure Front Door
- Map requirements to features and capabilities of Azure Front Door
- Identify appropriate use cases for Azure Front Door
- Choose an appropriate tier
- Configure an Azure Front Door, including routing, origins, and endpoints
- Configure SSL termination and end-to-end SSL encryption
- Configure caching
- Configure traffic acceleration
- Implement rules, URL rewrite, and URL redirect
- Secure an origin by using Azure Private Link in Azure Front Door
Section summary: This section focuses on Azure Front Door, a global entry point for fast, secure delivery of modern web applications. You’ll explore how to configure routing, endpoints, and origins, while enabling performance capabilities such as caching and acceleration.
Security concepts are also emphasized, with SSL encryption and origin protection through Private Link. This combination helps enterprises achieve secure, global traffic distribution while minimizing latency.
Domain 4: Design and implement private access to Azure services (13% of the exam)
Design and implement Azure Private Link service and Azure private endpoints
- Plan private endpoints
- Create private endpoints
- Configure access to private endpoints
- Create a Private Link service
- Integrate Private Link and Private Endpoint with DNS
- Integrate a Private Link service with on-premises clients
Section summary: This section introduces Azure Private Link, which provides secured access to Azure services directly over private connectivity. You’ll learn how to create and configure private endpoints for workloads and services within the cloud.
Configuring DNS integration and connecting on-premises clients with private endpoints ensures a seamless hybrid experience. These capabilities strengthen security and reduce exposure to public internet traffic.
Design and implement service endpoints
- Choose when to use a service endpoint
- Create service endpoints
- Configure service endpoint policies
- Configure access to service endpoints
Section summary: This section compares service endpoints against Private Link, exploring the advantages of routing traffic directly from VNets to Azure services. You’ll learn how to create service endpoints and manage service endpoint policies.
By understanding when to use endpoints, you’ll simplify configurations while securing workloads. These choices support scenarios requiring direct, high-throughput connections within Azure.
Domain 5: Design and implement Azure network security services (18% of the exam)
Implement and manage network security groups
- Create a network security group (NSG)
- Associate a NSG to a resource
- Create an application security group (ASG)
- Associate an ASG to a network interface card (NIC)
- Create and configure NSG rules
- Implement virtual network flow logs
- Interpret virtual network flow logs
- Interpret NSG flow logs
- Validate NSG flow rules
- Verify IP flow
- Configure an NSG for remote server administration, including Azure Bastion
- Implement and manage virtual network security by using Azure Virtual Network Manager
Section summary: This section explains how to secure networks using NSGs and ASGs. You’ll practice creating rule sets, verifying flows, and associating groups with resources or NICs. These tools form the core of Azure’s internal access control capabilities.
Complementing these, Azure Virtual Network Manager and Bastion extend visibility and secure access to networks. By interpreting flow logs and implementing governance rules, you’ll have everything you need to tightly control traffic flows in modern cloud deployments.
Design and implement Azure Firewall and Azure Firewall Manager
- Map requirements to features and capabilities of Azure Firewall
- Select an appropriate Azure Firewall SKU
- Design an Azure Firewall deployment
- Create and implement an Azure Firewall deployment
- Configure Azure Firewall rules
- Create and implement Azure Firewall Manager policies
- Create a secure hub by deploying Azure Firewall inside an Azure Virtual WAN hub
Section summary: This section shows how to design and deploy Azure Firewall as a cloud-native firewall solution. You’ll create rules, select the right SKUs, and design deployments that meet real-world enterprise security requirements.
Additionally, Firewall Manager enables you to centralize policies across environments, including Virtual WAN hubs. This ensures consistent, scalable network security across distributed architectures.
Design and implement a Web Application Firewall (WAF) deployment
- Map requirements to features and capabilities of WAF
- Design a WAF deployment
- Configure detection or prevention mode
- Configure rule sets for WAF on Azure Front Door
- Configure rule sets for WAF on Application Gateway
- Implement a WAF policy
- Associate a WAF policy
Section summary: This section focuses on deploying WAF to protect applications from web vulnerabilities. You’ll understand where WAF fits in different scenarios, such as within Application Gateway and Azure Front Door, and learn to configure policies.
By configuring detection and prevention modes, rule sets, and policy associations, you will strengthen applications against a broad range of threats. These skills are crucial for delivering secure web applications at scale.
Who should earn the Microsoft Azure Network Engineer Associate Certification?
The Microsoft Certified: Azure Network Engineer Associate certification is designed for IT professionals who want to validate expertise in Azure networking technologies. It’s a perfect fit for individuals with experience in designing, implementing, and maintaining network infrastructure in Azure, as well as those who want to advance their cloud networking careers.
This exam is especially useful for:
- Network administrators and engineers expanding into the cloud
- Cloud professionals focused on Azure infrastructure
- Security engineers and DevOps engineers collaborating on hybrid cloud networking
- IT pros aiming to specialize in designing reliable and secure Azure network solutions
By achieving this certification, you demonstrate not only strong knowledge of Azure networking but also your ability to optimize performance, security, redundancy, and scalability—skills that are highly valued in modern IT organizations.
What kinds of careers and job roles open up with the AZ-700 certification?
Earning the Azure Network Engineer Associate credential signals to employers that you can handle critical responsibilities in cloud networking. This certification is highly relevant for roles such as:
- Azure Network Engineer
- Cloud Infrastructure Engineer
- Cloud Security Engineer
- Network Security Specialist
- Systems Engineer (Cloud Focused)
Additionally, many solutions architects and DevOps engineers benefit from holding this certification since Azure networking is a key building block for scalable and secure solutions. Ultimately, this certification can accelerate your growth into senior roles where you architect hybrid networks, design multi-region connectivity, and strengthen cloud security.
What is the current version of the Microsoft Azure Network Engineer Associate exam?
The latest Microsoft Azure Network Engineer Associate exam you will need to pass is AZ-700, officially called Designing and Implementing Microsoft Azure Networking Solutions. This is the only exam required to earn the certification. Since Microsoft continuously updates its certifications, the AZ-700 exam reflects the most current knowledge and skills needed to design and manage Azure networking solutions effectively.
When preparing, be sure to use updated official resources and high-quality practice tests that align with the current version of the exam.
How much does the AZ-700 exam cost to take?
The cost of the Microsoft Azure Network Engineer Associate certification exam is 165 USD. Pricing can vary slightly depending on your region due to taxes, currency conversions, and additional fees. Microsoft often provides exam discounts through learning partners, organizational programs, and periodic promotions, so it’s worth keeping an eye out for offers that can reduce costs.
Considering the career paths and salary opportunities that this certification unlocks, the investment is highly worthwhile.
How long is the AZ-700 certification exam and how many questions are there?
You’ll be given 100 minutes to complete the exam, which typically contains around 60 questions. These questions may include multiple-choice, multi-select, drag-and-drop scenarios, and case study formats. Time management is key—it’s important to read through scenario-based questions carefully but also keep an eye on pacing so that you allocate enough time across all questions.
Many candidates find that practicing under timed conditions boosts confidence and accuracy on the real exam.
What is the passing score for the AZ-700 exam?
To pass the exam, you’ll need a score of 700 out of 1000. Microsoft uses a scaled scoring system with a compensatory model, meaning you don’t have to pass each section individually. Your overall performance determines whether you pass.
This scoring approach helps ensure that even if you’re stronger in certain domains and weaker in others, you can still succeed by demonstrating a solid level of knowledge overall.
What languages is AZ-700 available in?
The Microsoft Exam AZ-700 is offered in several languages to support candidates globally. The currently available languages include:
- English
- German
- Spanish
- French
- Italian
- Japanese
- Korean
- Portuguese (Brazil)
- Chinese (Simplified)
- Chinese (Traditional)
If your preferred language isn’t listed, you can request an accommodation for additional exam time, ensuring that language doesn’t become a barrier to your success.
What topics are covered in the AZ-700 exam domains?
The AZ-700 exam is structured around five major domains, each with its own weighting:
- Design and implement core networking infrastructure (25–30%)
- VNet design, subnetting, IP addressing, and DNS
- Design, implement, and manage connectivity services (20–25%)
- Site-to-site and point-to-site VPNs, Azure ExpressRoute, Virtual WAN
- Design and implement application delivery services (15–20%)
- Load balancers, Application Gateway, Traffic Manager, Azure Front Door
- Design and implement private access to Azure services (10–15%)
- Private endpoints, Private Link services, service endpoints
- Design and implement Azure network security services (15–20%)
- NSGs, ASGs, Azure Firewall, WAF deployments
Each of these areas ensures that the certified engineer can manage both day-to-day responsibilities and advanced enterprise-level network solutions.
How difficult is the Microsoft Azure Network Engineer Associate certification exam?
The difficulty level depends largely on your existing experience with Azure networking and general networking fundamentals. The AZ-700 exam requires a thorough understanding of hybrid connectivity, load balancing, DNS, security, and private access in Azure.
Candidates who work frequently with Azure VNets, ExpressRoute, Application Gateway, and Firewalls often find the exam aligns well with their daily tasks. Hands-on labs, real-world projects, and solid study resources make preparation very approachable.
Are there any prerequisites for AZ-700?
There are no mandatory prerequisites for this exam, but Microsoft recommends having prior experience with Azure networking, storage, and compute services. You should be comfortable with IP addressing, subnets, name resolution, routing, and network security principles.
While not required, many candidates find it helpful to earn the Microsoft Azure Administrator Associate certification first, as it provides a solid foundation for understanding Azure resources before diving deep into networking specifics.
How long is the Microsoft Azure Network Engineer Associate certification valid?
Your certification is valid for 12 months. Microsoft requires annual renewal to ensure professionals remain up to date with the latest cloud networking advances. Renewals are free and can be done online through Microsoft Learn by passing a short assessment.
This ensures that your credential always reflects the current best practices in Azure technology.
Where can I take the AZ-700 exam?
Microsoft offers two convenient ways to take the certification exam:
- Online, with remote proctoring. You’ll need a webcam, stable internet connection, and quiet space to take the test.
- In person, at a Pearson VUE testing center near you.
Both options provide a secure and professional testing environment, so you can choose whichever is more comfortable for your schedule and setting.
What is the format of questions in the AZ-700 exam?
The AZ-700 exam includes a blend of:
- Multiple-choice questions
- Multi-select questions
- Drag-and-drop items
- Case studies and scenario-based exercises
This variety helps Microsoft validate not only your knowledge but also your ability to apply concepts in real-world situations. Expect practical, problem-solving style questions rather than just theoretical knowledge checks.
How should I study for the Microsoft Certified Azure Network Engineer Associate exam?
The best preparation includes a mix of self-paced study, practice questions, and hands-on labs. Microsoft Learn offers free resources and documentation to guide your studies. In addition, high-quality practice tests are invaluable for gaining confidence.
Be sure to supplement theory with real lab work in Azure—deploy VNets, set up a VPN, test configurations, and troubleshoot. Hands-on experience is one of the most effective ways to master the skills required for the exam.
Where can I find good practice exams for AZ-700?
To sharpen your knowledge and test-taking strategy, you’ll benefit from realistic Microsoft Azure Network Engineer Associate practice exams that mirror the format, difficulty, and style of the AZ-700 certification exam. These practice exams give you detailed explanations for answers and are a fantastic tool for identifying gaps in your understanding before the real test.
What networking fundamentals should I review before the test?
Azure networking heavily relies on strong core networking concepts. Be sure to review:
- DNS fundamentals and how name resolution works inside VNets
- IP addressing and subnetting, including planning address space segmentation
- Routing protocols, NAT, and user-defined routes
- Network security principles, such as NSGs, firewalls, and isolation models
These skills will help you connect traditional networking knowledge with Azure cloud capabilities.
How important is hands-on practice in Azure for exam prep?
Practical, hands-on practice is one of the most effective ways to ensure success. Reading theory prepares you intellectually, but actually creating and configuring VNets, ExpressRoute circuits, Firewalls, and Load Balancers in Azure reinforces your understanding in a concrete way.
If you have access to a sandbox Azure environment or the free tier, use it to simulate the real-world scenarios you might see on the exam.
Does the certification focus on hybrid cloud networking?
Yes! Hybrid networking plays a significant role in the AZ-700 exam and in real-world Azure solutions. Topics include VPNs, ExpressRoute, and Virtual WAN—all tools that connect on-premises environments to the cloud.
Understanding how to design and implement hybrid solutions is critical, as many enterprises rely on hybrid networks during their cloud adoption journey.
What resources does Microsoft provide for AZ-700?
Microsoft always provides excellent learning resources. You can explore self-paced training, documentation, prep videos, and sandbox environments. Many professionals start with Microsoft Learn’s guided learning paths and official exam study guide.
There are also community support forums, Q&A hubs, and Microsoft Tech Community groups where you can engage with peers and experts while studying.
Where do I officially register for the AZ-700 exam?
You can register for the AZ-700 exam directly on the official Microsoft Azure Network Engineer Associate certification page. From there, you’ll be able to schedule your exam with Pearson VUE either online or in-person at a test center. This official hub also provides the most up-to-date details on the certification requirements and resources.
The Microsoft Certified: Azure Network Engineer Associate certification is one of the most valuable credentials for IT professionals specializing in cloud networking. With thorough preparation, hands-on practice, and the right study resources, you’ll be ready to prove your skills and take your cloud career to the next level. This certification doesn’t just validate your knowledge—it positions you as a go-to expert in an area of high demand across industries.
