AZ-700 Designing & Implementing Azure Networking with SIMS

Learn how assignments use simulations, how to start them, open in a new tab, complete and submit, and that only video checkmarks matter for certificates.

Set up a free Azure account to get $200 credit for 30 days and 12 months of services. Sign in at portal.azure.com to start hands-on with VMs, databases, and storage.

Learn how Azure and Microsoft 365 share directory services (Intra ID) and convert a personal account to a business account by updating the user principal name and signing in.

activate a microsoft intra ID p2 license to access premium features, using admin.microsoft.com or portal.azure.com to start a free trial; note regional availability and activation may take 15–30 minutes.

Plan and implement Azure network segmentation with VNets and subnets and address spaces like 10.1.0/16, and use hub and spoke designs, peering, NSGs, and Azure Firewall to manage traffic.

Create a hub-and-spoke vnet architecture on Azure by provisioning four virtual networks in East US, each with one subnet, and note that peering is not configured yet.

Peer virtual networks by configuring hub-to-spoke and spoke-to-hub peerings in the Azure Portal to enable two-way traffic between VNets.

Explore how certain Azure resources require dedicated subnets within a virtual network, such as VPN gateways, ExpressRoute gateways, and Azure Firewall, while application gateway can share subnets.

Plan and configure subnet delegation in Azure to assign a subnet to a specific service, enabling its security and route policies while preserving existing workloads, with customer override options.

Create a public IP prefix to reserve a group of public IP addresses in Azure for services like virtual machines, scale sets, load balancers, and gateways.

Learn when to use a public IP prefix in Azure to assign known static addresses for virtual machines, standard load balancers, Azure Firewall, VPN gateways, and NAT gateways.

Plan and implement a custom ip prefix (bring your own ip) by completing a route origin authorization, provisioning in Azure, and associating the prefix with a single region and zone.

Create and allocate a public IP address from a custom IP prefix in the Azure portal, configure a DNS name, idle timeout, and associate it with a VM.

allocate a public ip prefix address and associate it with a newly created virtual machine in Azure, linking the public IP to VM one via its network interface.

Learn how to easily redo simulations after completing an assignment by navigating to summary, returning to the assignment, and opening the instructions to access the simulation link.

Discover how Azure DNS handles VNet name resolution with public and private name resolution, including zones, registrars, A records, and private zones like exam lab practice internal for VM naming.

Learn how Azure provides a default DNS service for virtual networks, how to use a custom DNS server, and how public DNS names resolve for virtual machines with public addresses.

Learn how to host a public DNS name in Azure by creating a DNS zone for exam lab practice.com, updating records, and migrating from GoDaddy to Azure, with propagation time.

Create a private DNS zone in the Azure portal, link it to internal VNets, and add A and CNAME records to map VM names using Azure provided or custom DNS.

Configure public and private dns zones in Azure, create A records, and understand ns and soa records to map to vm addresses for internet and internal use.

Link a private dns zone to a vnet to enable name resolution for virtual machines. Use virtual network links, hub links, and optional auto registration to automatically create dns records.

Configure an Azure DNS resolver to connect private DNS zone to on-prem networks via VPN or ExpressRoute, using inbound and outbound endpoints and a rule set for conditional forwarding.

Learn how service chaining directs traffic through virtual appliances such as the Azure firewall and load balancer, using peering and user defined routes to control flow.

Learn to design vpn connectivity between vnets using gateways on each vnet, enabling tunneling and an extra encryption layer for stronger inter-vnet security, with cost considerations.

Establish VNet peering to enable bidirectional traffic between VNets, requiring two peerings (hub to spoke and back), including region-based within a region and cross-region global peering, plus routing controls.

Design and implement user-defined routes (UDRs) in Azure by creating a route table, adding routes for on-premises networks, and leveraging built-in routes for subnets within a VNet or peered VNets.

Learn to associate a route table with a subnet in a virtual network using portal.azure.com, and verify linked subnets on the route table overview while noting the same-region requirement.

Learn how forced tunneling routes all Azure traffic through on-prem network via a VPN gateway, using a route table entry for 0.0.0.0/0 to the gateway.

Diagnose and resolve routing issues in Azure by inspecting route tables, using Network Watcher tools like IP Flow verify and next hop, and validating connectivity.

Learn how azure route server acts as a virtual appliance enabling dynamic routing with bgp between on-prem NVAs and azure vnets, automating route updates and improving high availability.

Explain how a virtual network NAT gateway provides outbound internet access for private virtual machines without public IPs, and contrast it with Azure Firewall for cost and security trade-offs.

Learn to create and configure an Azure NAT gateway, assign a public IP or prefix, associate it with a VNet subnet, and verify outbound connectivity and SNAT port behavior.

Delete unused Azure resources to save credits by removing the virtual network gateway and NAT gateway from the resource group after dissociating the subnet.

Create two Windows Server 2022 Data Center virtual machines in a shared VNet and subnet, with auto shutdown at 7 p.m. to save Azure credits and using RDP access.

Learn to configure network watcher for monitoring, diagnostics, and logs in Azure, create a log analytics workspace, visualize topology, and monitor virtual machines, NICs, and NSGs.

Monitor and repair network health with Azure Network Watcher, using IP flow verify, NSG diagnostics, and security rules to test VM connectivity and expose misconfigurations.

Activate Azure DDoS protection to shield resources and monitor the protection plan. Learn to create a DDoS protection plan, add protected resources, and view metrics and alerts.

Enhance Azure DNS security with Microsoft Defender for DNS, monitoring queries to detect data exfiltration via DNS tunneling, malware command-and-control activity, and access to malicious domains and resolvers.

Configure a site-to-site vpn by deploying an Azure VPN gateway with a dedicated gateway subnet to connect an on-premises network over the internet to an Azure VNet, enabling secure communication.

Choose the appropriate Azure VPN gateway SKU when planning site-to-site connections, vnet-to-vnet tunnels, and ikev2 or OpenVPN point-to-site connections, considering bandwidth limits, BGP support, and pricing via the Azure calculator.

Create an Azure site-to-site VPN by provisioning a virtual network gateway, selecting route-based VPN, configuring VNet and public IP, and using Microsoft’s on-premise device scripts for supported routers.

Compare route-based and policy-based VPNs for Azure gateways, explaining IPsec and IKE usage, traffic selectors, and why you cannot change VPN type after creation.

Configure an IPsec/IKE policy for a site-to-site VPN by using PowerShell to define variables, connect to Azure, and create the virtual network gateway and policy with the New-AzIpsecPolicy command.

Diagnose and resolve Azure VPN gateway connectivity issues using Network Watcher and the VPN troubleshoot tool, referencing storage accounts and logs for diagnostics.

Understand Azure extended network, extending an on-prem subnet to the cloud with a pair of Hyper-V appliances and bidirectional VXLAN. Prerequisites include VPN gateway or ExpressRoute.

Select a point-to-site gateway SKU based on IKEv2/OpenVPN support and connection limits (up to 128, 250, 500, or 1000), then verify costs with the Azure Calculator.

Compare the three Azure VPN gateway tunnel types—OpenVPN, SSTP, and IKEv2—and understand SSL‑based versus IPsec options, firewall considerations, and cross‑platform support per Microsoft’s VPN gateway FAQ.

Explore authentication options for an Azure VPN gateway, including Azure Certificate, Radius authentication, and Azure Active Directory, and locate their configuration in portal.azure.com under Point to Site Configuration.

Set up radius authentication for the Azure VPN gateway by configuring a radius server on VM2, creating a back end subnet, and defining radius clients and VPN users group.

Configure certificate-based authentication for an Azure vpn gateway by creating root and client certificates, exporting them, importing into Azure, and using the Azure vpn client to establish and verify connectivity.

Configure a point-to-site VPN gateway with Azure AD authentication, including audience and tenant IDs and issuer, then import the VPN config into the Azure VPN client and verify connectivity.

Diagnose and resolve client-side VPN connection and authentication issues using Azure VPN client logs and reliability history, then use Azure portal diagnostics, metrics, and log analytics to troubleshoot point-to-site connections.

Learn how to enable Windows always-on VPN for a VPN gateway, configure certificate-based authentication, and deploy the setup via PowerShell, Intune, or Config Manager.

Explore how the azure network adapter enables a point-to-site vpn connection from an on premise server to an azure virtual network, bridging on premise and azure environments.

Remove the virtual network gateway to stop consuming Azure credits, then delete the gateway from the portal to free up resources.

Explore the four ExpressRoute connectivity models—cloud exchange co-location, point-to-point Ethernet, any-to-any IP VPN, and direct connection—showing how each provides layer 2 or layer 3 access to the Microsoft cloud.

Choose an ExpressRoute SKU and tier for the virtual network gateway to optimize performance and bandwidth. Some SKUs support Fastpath and coexistence, with different circuit, route, and throughput limits.

Explore how to design and implement express route with cross-region redundancy between on-prem offices and Azure VNets, including VNet peering and disaster recovery considerations.

Explore express route features global reach, fast path, and express route direct to connect offices via a global reach private network, enabling redundancy and faster vm access.

Choose between private peering, Microsoft peering, or both for expressroute; private peering grants Azure IaaS and PaaS access, while Microsoft peering enables direct access to Microsoft 365 services via expressroute.

Create an ExpressRoute circuit in the Azure portal, select provider options, peering location, and bandwidth, then review and create, enabling Azure private or Microsoft peering to access Azure services.

Learn to set up an express route gateway in Azure via the portal, including selecting express route, configuring gateway subnet and public IP, and optional tier upgrade.

ExpressRoute encryption offers two options—Maxus and IPsec—using 256-bit AES in Galois counter mode with Azure Key Vault, and both can be used together.

Enable bidirectional forwarding detection to dramatically shorten express route failover from three minutes to ten seconds, ensuring rapid connectivity recovery between on-premise and Azure in redundant setups.

Diagnose ExpressRoute connectivity issues with the Azure portal's diagnose and solve problems tool. Inspect metrics, set up a log analytics workspace, and run queries to troubleshoot on premise connectivity.

Remove unused ExpressRoute resources to save Azure credits before moving on, including deleting the ExpressRoute circuit and the Express Route gateway in the Azure portal.

demonstrates how Azure Virtual WAN connects multiple locations via hubs, enabling traffic flow between sites and VNets, using VPN routers or express route to link to Azure.

Compare Azure Virtual WAN SKUs: basic supports site-to-site VPN, while standard offers express route, inner hub and VNet-to-VNet, Azure Firewall, and network appliance support; upgrade from basic and check pricing.

Design a virtual wan architecture that connects headquarters and branch offices to Azure using express route, site-to-site vpn, and point-to-site for users, enabling cross-region traffic between vnets and app services.

Create an Azure virtual wan hub in East US using the portal, choose standard, and review before creating. Then open the hubs blade to configure the new hub.

Configure scale units for your virtual wan hub to balance throughput and cost; one unit provides 500 mbps for vpn or 2 gbps for expressroute, with a minimum of two.

Deploy a point-to-site gateway inside the Azure Virtual WAN hub by creating a user VPN gateway with certificate authentication and configuring it for hub-based connectivity.

Configure virtual hub routing to manage site-to-site and point-to-site traffic by creating and reviewing routing tables, including the default table and a custom headquarters route (192.168.10.0/24).

Integrate a third-party network virtual appliance with your Azure Wan to enable communication via the virtual Wan hub; learn to select a supported appliance and follow vendor configuration guides.

Conserve Azure credits by removing the virtual WAN resources: delete the hub and gateway in the portal, wait for deletion, then delete the virtual WAN itself.