AZ-700: Azure Network Engineer Certification Bootcamp

Map AZ-700 objectives, benefits, and exam domains; set expectations, a study plan, and lab setup.

Review cloud networking fundamentals, shared responsibility, and key terminology; contrast traditional versus cloud-native architectures.

Introduce core Azure networking services: VNets, subnets, NSGs, VPN, ExpressRoute, Load Balancer, Application Gateway, DNS, Virtual WAN, and Azure Firewall.

Emphasize scalable, secure design principles, governance, cost awareness, performance, compliance, and resiliency; preview future trends—Zero Trust, automation/IaC, IPv6, SD-WAN, edge, and observability.

Understand Azure Public IP offerings: Basic vs Standard, IPv4/IPv6, SKUs, zones, and association scenarios.

Choose static or dynamic allocation aligned to SLAs, failover requirements, automation, and predictable DNS mapping.

Integrate public IPs with Azure DNS, Application Gateway, Front Door, and Load Balancer for scalable, resilient endpoints.

Apply security best practices—DDoS Protection, NSGs, and minimal exposure—and troubleshoot SNAT exhaustion, port reachability, asymmetric routing, or misrouted traffic to ensure reliable, secure internet-facing services.

Grasp DNS’s role in Azure networking: name resolution, private connectivity, and service discovery.

Configure Azure DNS and Private DNS zones; create records, conditional forwarding, resolvers, and split-horizon patterns.

Integrate DNS with VNets, Private Endpoints, Application Gateway, and hybrid environments; plan namespace strategy and governance.

Strengthen security and reliability with least privilege, auditing, DDoS resilience, caching, redundancy, and health monitoring to deliver fast, consistent resolution for applications across regions and environments.

Define VNet peering and how it enables private, low-latency connectivity between virtual networks without gateways.

Configure step-by-step peering, including permissions, address planning, remote gateway settings, and transitive routing considerations.

Compare regional versus global peering features, limits, and performance; evaluate cost, egress, and bandwidth behavior.

Apply security and operations best practices using NSGs, UDRs, and diagnostic tools; monitor effective routes, detect overlapping spaces, and troubleshoot connectivity for scalable, secure hub-and-spoke architectures.

Master Azure routing fundamentals: system routes, user-defined routes, BGP, and route tables across subnets and VNets.

Implement custom routes for traffic steering, service chaining, and inspection via NVAs; understand route aggregation patterns.

Use forced tunneling to send outbound traffic through on-prem or cloud security stacks; coordinate NSGs for defense-in-depth.

Monitor effective routes, diagnose asymmetric paths or blackholes with Network Watcher, and optimize flows for performance, reliability, and compliance in hybrid architectures.

Understand Azure Virtual Network NAT and when to use NAT Gateway versus load balancers or NVAs for outbound access.

Configure NAT step-by-step: subnet association, public IP or prefix selection, zoning, and availability.

Plan security, scale, and cost: predictable SNAT, high throughput, idle timeouts, and resiliency across regions.

Integrate NAT with Azure Firewall, Load Balancer, and routing; monitor and troubleshoot SNAT port usage, ephemeral ports, and connectivity for reliable internet egress.

Define Azure VPN basics: tunnels, IPsec/IKE, gateways, throughput, SLAs.

Compare Site-to-Site (branch/edge to Azure) and Point-to-Site (user devices).

Explain Virtual Network Gateway and Local Network Gateway roles.

Map use cases, security posture, and reliability needs for each model.

Establish terminology and connectivity patterns that underpin later design, deployment, and troubleshooting.

Apply HA design: active-active gateways, zone redundancy, dual tunnels, and BGP.

Select optimal VpnGw SKUs for performance, features, and cost.

Choose policy-based vs route-based VPN with clear decision criteria.

Plan address spaces, failover, monitoring, and SLA targets.

Document governance, security controls, and scalability for resilient enterprise connectivity.

Create and configure the Local Network Gateway with on-prem IP and prefixes.

Provision the Virtual Network Gateway; align SKUs, zones, and BGP settings.

Build the S2S connection: IPsec/IKE policy, shared keys, and routing.

Validate end-to-end reachability, latency, and resiliency.

Generate runbooks and artifacts for repeatable deployments and audits.

Use diagnostics: logs, metrics, Connection Monitor, VPN Insights, packet capture.

Verify policies, pre-shared keys, IKE/IPsec parameters, and BGP routes.

Isolate common issues: MTU/fragmentation, NAT-T, asymmetric routing, latency, firewalls.

Assess gateway health, tunnel uptime, and failover behavior.

Establish a structured triage playbook and remediation checklist.

Plan P2S scope: address pools, split vs forced tunneling, DNS resolution.

Compare authentication options: certificates, RADIUS, Azure AD, and OpenVPN.

Define client profiles, platform support, and distribution methods.

Integrate security policies: Conditional Access, MFA, device compliance.

Align capacity, availability, and user experience goals with business requirements.

Configure certificate-based auth: root/child certs, revocation, profile export.

Integrate RADIUS/NPS: policies, group mapping, and high availability.

Enable OpenVPN and Azure AD for modern auth and MFA.

Deploy client profiles via Intune/SCCM; test on Windows/macOS/Linux.

Mitigate risks: key hygiene, certificate lifecycle, posture checks, and logging.

Diagnose client errors: auth failures, missing routes, DNS issues, captive portals.

Analyze logs and packet traces; verify gateway configuration and policies.

Tune performance: protocol choice (IKEv2/OpenVPN), MTU/MSS, split tunneling, caching.

Harden security: MFA, Conditional Access, certificate revocation, least privilege.

Standardize support playbooks for reliable, seamless remote user connectivity.

Introduces Azure ExpressRoute for private, SLA-backed hybrid connectivity.

Maps benefits: predictable latency, higher reliability, and security vs. public internet.

Outlines exam objectives and how ExpressRoute fits modern hub-and-spoke/enterprise edge.

Previews connectivity models, peering, gateways, and operations to be covered.

Compares provider model vs. ExpressRoute Direct for high-capacity needs.

Reviews SKUs/tiers, bandwidth, redundancy, billing, and use-case alignment.

Guides selection based on scale, compliance, and cost optimization.

Designs multi-region ExpressRoute architectures with resilient circuits.

Implements ExpressRoute Global Reach for branch-to-branch transit via Microsoft’s backbone.

Covers capacity planning, failover, and routing domains for scale.

Explains scenarios and requirements for Private Peering and Microsoft Peering.

Details route filters, community tags, and service access considerations.

Walks through step-by-step peering configuration and validation.

Provisions ExpressRoute gateways and associates VNets to circuits.

Configures route advertisement, BGP, and route propagation.

Provides deployment sequencing, testing, and rollback guidance.

Enables FastPath to bypass the gateway for higher throughput/low latency.

Discusses encryption options for private links and data protection.

Implements BFD to speed failure detection and improve resiliency.

Uses Connection Monitor, metrics, and logs to isolate failures.

Checks BGP sessions, route filters, MTU, and asymmetric routing.

Establishes a support playbook for rapid recovery and service health.

Explains private IP addressing strategies and non-overlapping address spaces.

Introduces Azure VNets for secure isolation and segmentation.

Demonstrates creating VNets and assigning private IPs with real examples.

Sets address spaces, regions, subnets, and resource group alignment.

Configures NSGs, service endpoints/Private Link, and diagnostics.

Highlights best practices and common pitfalls during initial setup.

Plans subnets for gateways, private endpoints, firewalls, and app gateways.

Balances performance, security, and growth; avoids IP exhaustion.

Aligns with route/UDR strategy and governance.

Uses subnet delegation to enable PaaS/NVA integrations.

Deploys Azure Route Server to simplify dynamic routing with NVAs.

Covers operational patterns, validation, and troubleshooting.

Reviews DNS fundamentals and namespace planning.

Compares public vs. private DNS zones for hybrid workloads.

Designs VNet-integrated resolution for seamless service discovery.

Consolidates IP/DNS governance, RBAC, auditing, and compliance.

Shares real-world case studies and monitoring strategies.

Establishes proactive operations and incident response patterns.

Reviews Azure networking fundamentals and hub-and-spoke evolution.

Positions Virtual WAN for scalable, secure, global connectivity.

Sets module goals: resiliency, performance, and operational excellence.

Implements VNet peering with security and routing best practices.

Designs cross-VNet communications at scale with governance.

Addresses performance, cost, and segmentation considerations.

Builds service chains through NVAs for inspection and policy.

Uses Gateway Transit to centralize egress and simplify routing.

Optimizes paths for security, cost, and manageability.

Configures VPN gateways and S2S tunnels between VNets.

Ensures encryption, availability, and cross-region resiliency.

Validates throughput, latency, and failover behavior.

Evaluates WAN types/services and Microsoft backbone advantages.

Maps Virtual WAN design frameworks for scale and redundancy.

Plans identity, security, and observability from day one.

Creates Virtual Hubs and connects VNets/gateways to vWAN.

Integrates NVAs and establishes connection units.

Orchestrates deployment, testing, and rollback for reliability.

Configures hub routing, route tables, and policies.

Tunes traffic engineering for performance and compliance.

Monitors routes, detects asymmetry, and maintains SLA targets.

Clarifies VNets, subnets, route tables, and system routes.

Explains user-defined routes (UDRs) and forced tunneling to steer egress through NVAs/Azure Firewall.

Illustrates traffic flows (intra-subnet, cross-subnet, VNet-to-VNet, hybrid via VPN/ExpressRoute).

Highlights security, compliance, and performance design patterns for scalable hub-and-spoke architectures and AZ-700 success.

Creates UDRs and associates route tables to subnets with least-surprise, deterministic paths.

Implements forced tunneling, default routes (0.0.0.0/0), and service insertion for inspection.

Covers address planning, service tags, next hops (NVA, Internet, Virtual Appliance).

Includes validation steps, rollback, governance, and common pitfalls (overlapping prefixes, blackholing).

Diagnoses routing with Effective Routes, IP Flow Verify, and packet capture.

Resolves asymmetric paths, MTU fragmentation, and propagation issues.

Introduces Azure Route Server to enable dynamic routing/BGP with NVAs.

Optimizes convergence, scales multi-region designs, and formalizes a routing triage playbook.

Explains Public vs. Internal Load Balancer roles and scenarios.

Compares Basic vs. Standard SKUs, zones, and features (HA Ports, Diagnostics).

Details backend pools, health probes, rules, and NAT capabilities.

Provides selection guidance for high-throughput, low-latency, resilient designs.

Walks through creating a Standard Load Balancer, backend pools, probes, and rules.

Configures inbound NAT for targeted management access and port mapping.

Addresses cross-zone/region considerations, security (NSGs, Just-in-Time), and logging.

Validates connectivity, failover, and documents repeatable deployment steps.

Implements granular LB rules, HA Ports, and session persistence.

Configures explicit outbound rules to manage SNAT ports and egress at scale.

Tunes health probes, idle timeouts, and concurrency; monitors metrics and alerts.

Aligns with UDRs/NAT Gateway/Azure Firewall for consistent traffic engineering.

Applies end-to-end patterns combining UDRs with Load Balancer for secure flows.

Reviews case studies: service chaining, inspection, blue/green, and multi-region failover.

Troubleshoots blackholes, asymmetric routing, probe failures, and SNAT exhaustion.

Summarizes best practices and exam tips for AZ-700.

Positions Azure Application Gateway (Standard v2/WAF v2) in L7 architectures.

Explains autoscale vs. manual, zones, and SLAs.

Introduces core components: backend pools, health probes, listeners, HTTP settings, rules.

Maps scenarios: web apps, TLS offload, cookie affinity, and WAF protection.

Builds end-to-end configs: backend pools, probes, listeners (basic/path-based), and routing rules.

Implements TLS/SSL, end-to-end encryption, custom error pages, and redirects.

Uses rewrite sets and header manipulation; enables WAF policies and exclusions.

Validates with diagnostics, access logs, and metrics.

Selects Standard/Premium SKUs, custom domains, and certificates.

Configures origins/origin groups, health probes, and caching options.

Enables SSL termination, end-to-end encryption, and WAF policies at the edge.

Sets multisite listeners and global load balancing for high-performance apps.

Creates Traffic Manager profiles for DNS-based global routing.

Chooses methods: Priority, Performance, Weighted, Geographic, Subnet, MultiValue.

Adds endpoints (Azure/external), health checks, and TTL tuning.

Integrates with Front Door/App Gateway for layered traffic control and DR.

Decides when to use NAT Gateway vs. Load Balancer outbound/NVA.

Allocates public IPs/prefixes; associates NAT Gateway to subnets.

Ensures predictable SNAT, higher scale, and simplified egress.

Applies monitoring, idle timeouts, and SNAT port management best practices.

Introduces Azure Firewall and NSGs, contrasting roles (stateful NGFW vs. subnet/NIC filtering).

Outlines module outcomes: design, deploy, manage, and monitor controls.

Frames Zero Trust, segmentation, and compliance as guiding principles.

Assesses requirements: hubs, regions, throughput, and resiliency.

Plans hub-and-spoke, zone-redundancy, DNAT/SNAT, and policy hierarchy.

Integrates with Private Link, Route Server, and Virtual WAN; budgets for cost.

Creates Azure Firewall/Firewall Policy; configures app, network, and DNAT rules.

Enables Threat Intelligence, FQDN tags, and DNS proxy if needed.

Sets diagnostics (logs/metrics), alerts, and change control; validates traffic flows.

Uses Azure Firewall Manager and Secure Virtual Hub for centralized policy.

Applies rule collections, inheritance, and DevOps workflows.

Integrates third-party NVAs and coordinates routing for layered defense.

Creates NSGs; associates to subnets/NICs; orders rules with service tags.

Uses Application Security Groups to simplify micro-segmentation.

Aligns NSG strategy with UDRs, Firewalls, and platform defaults.

Configures granular inbound/outbound rules, priority tuning, and deny-by-default.

Enables NSG Flow Logs and Traffic Analytics for visibility and tuning.

Troubleshoots connectivity with Effective Security Rules and metrics.

Verifies IP flows with Network Watcher tools; confirms rule intent vs. effect.

Addresses overlapping rules, service tag updates, and ephemeral ports.

Documents best practices for lifecycle management, alerts, and governed change.

Differentiate Azure WAF vs. Azure Firewall roles in layered defense.

Position NSGs and ASGs for subnet/NIC filtering and micro-segmentation.

Outline core threats, Zero Trust principles, and compliance goals.

Map module objectives: design, deploy, manage, and monitor web and network protection.

Plan hub-and-spoke or Secure Virtual Hub topologies.

Select SKUs, zones, and capacity; define routing and inspection points.

Integrate with Private Link, Route Server, and identity controls.

Capture governance: RBAC, change control, logs, and cost modeling.

Deploy via Portal, ARM/Bicep, or Terraform.

Integrate VNets, UDRs, and public IPs; enable DNS proxy if needed.

Configure initial rule collections and Threat Intel.

Validate flows, failover, and baseline metrics for operational readiness.

Centralize policy with Azure Firewall Manager.

Build app/network/DNAT rule collections; use FQDN tags and IP groups.

Apply staged changes, rule hierarchy, and diagnostics.

Troubleshoot misordered rules, asymmetric paths, and route conflicts.

Create NSGs; associate at subnet/NIC; use service tags.

Group workloads with ASGs to simplify rules.

Enforce least privilege, deny-by-default, and environment separation.

Align NSGs with Firewall and UDR strategies.

Enable NSG Flow Logs and Traffic Analytics for visibility.

Interpret allow/deny patterns, ports, and top talkers.

Validate access using IP Flow Verify and Connection Troubleshoot.

Automate alerts, baselines, and anomaly detection.

Deploy Azure Firewall in Virtual WAN Secure Hub.

Integrate third-party NVAs for advanced IDS/IPS or proxy needs.

Orchestrate routing, BGP, and policy consistency at scale.

Validate end-to-end paths; implement health probes and failover playbooks.