AZ-700:Designing and Implementing Azure Networking Solutions

Learn to use Bicep to define and deploy Azure infrastructure, including virtual networks, subnets, and virtual machines, with reusable parameter-based files and automation in VS Code.

Enable boot diagnostics and use the Azure serial console to manage the virtual machines. Create two-way virtual network peering between vnets to enable private access to a Nginx web server.

Create a gateway subnet in the virtual network to host point-to-site vpn resources, assign a slash 27 or larger ip range, and deploy compute resources managed by the vpn service.

Configure a point-to-site VPN gateway, set the client address pool, select IKEv2 with Azure certificate, and download and install the VPN client to connect to private web server at 10.0.0.4.

Explore RADIUS authentication for point-to-site VPN, where an on-premises RADIUS server authenticates against Microsoft Active Directory domain services and serves as the authentication broker for the VPN gateway.

Demonstrate site-to-site vpn deployment by simulating an on-premises site in Azure, provisioning a virtual network with gateway components, and using Windows Server 2025 as a software vpn device with bicep.

Create a site-to-site vpn by configuring a local network gateway that defines the customer public ip address and private ip address range, then establish an ipsec connection.

Establish a site-to-site VPN between on-premises and the Azure VPN gateway by configuring a demand-dial interface, IKEv2, and a pre-shared key, then verify access to the Nginx server at 10.0.0.4.

Learn how to connect on-premises networks to Azure with site-to-site VPN and virtual network peering, enabling forwarded traffic and remote gateway usage for cross-network reach.

Discover how Azure DNS private resolver forwards queries between Azure virtual networks and on-prem networks via inbound and outbound endpoints, without hosting zones, to set up a private zone.

Create a private dns zone azure.cloudportalhub.com and link virtual networks with auto registration; run a PowerShell setup to deploy corp.cloudportalhub.com with Active Directory Domain Services and integrate with the zone.

Deploy an Azure private DNS resolver, create a delegated subnet with an inbound endpoint, and configure a conditional forwarder to let on-premises domain queries resolve azure.cloudportalhub.com.

Use the connection troubleshoot utility to verify TCP or ICMP reachability from a VM, gateway, or bastion to VM, FQDN, URI, or IP, and run connectivity and port scanner tests.

Enable continuous connection monitor to track connectivity, latency, and packet loss between a source and destination. Configure HTTP tests every 30 seconds and store results in a log annex workspace.

Azure ExpressRoute offers a private, dedicated connection from on-premises to the Microsoft cloud, avoiding the internet for private access to Azure virtual networks and public services.

Create and provision an ExpressRoute circuit in Azure by selecting provider or direct, choosing a peering location and bandwidth, and sharing the service key with your provider.

Configure express route peering after provisioning circuit to connect to Azure virtual networks via private peering or to Microsoft cloud services via Microsoft peering, and deploy an express route gateway.

Explore Azure Virtual WAN, a centralized hub-and-spoke networking service that connects on-premises via gateway or express route with virtual networks, point-to-site, site-to-site, and peering.

Create a new Azure virtual WAN, delete legacy site-to-site and point-to-site configurations, and connect virtual networks via a hub with VPN gateway settings.

Connect the dev and test Azure networks via the virtual WAN hub using virtual network peering, then create connections and verify web server access.

Configure a point-to-site VPN in the Azure Virtual WAN hub by creating a user VPN config with certificate-based authentication. Download the profile, install the VPN client, and connect.

Configure a site-to-site vpn with an azure virtual wan hub, linking on-premises infrastructure to a virtual hub using a vpn site and abc123 as the pre-shared key.

Deploy two backend virtual machines with nginx and a simple index.html, then configure the azure load balancer standard sku to distribute requests to private IP addresses.

Deploy a standard Azure load balancer with a front-end IP and public IP, configure back-end pool health probes and load balancing rules, and secure HTTP traffic.

Map front-end load balancer ports to backend VM ports using inbound NAT rules to securely access virtual machines via ssh, while reducing public exposure.

Enable outbound connectivity on the standard load balancer by configuring outbound rules that perform source network address translation to the frontend IP, with port mapping per backend instance.

Explain how a load balancer can host multiple front-end IP configurations and multiple back-end pools, mapping different domain names to separate back-end pools and routing rules.

Azure global load balancer directs users to the nearest regional load balancer to minimize latency, enables cross-region failover, and balances traffic across East US and North Europe.

Explore deploying a global Azure load balancer by duplicating infrastructure in East US and North Europe, configuring frontend and backend pools, health probes, and load balancing rules with Bicep templates.

Explore azure application gateway basics, a layer seven routing service that inspects http requests, routes by url and headers, enables multi-site hosting, and includes a web application firewall.

Virtual machine scale sets enable on-demand, identical machines as a backend for the application gateway and load balancer, enabling vertical and horizontal scaling driven by CPU thresholds.

Configure a virtual machine scale set with custom script extensions to install nginx, serve index.html, and deploy scripts stored in an Azure storage account.

Learn to deploy an Azure application gateway with URL-based routing across two VM scale sets, using two back-end pools for images and videos, with a front-end listener on port 80.

Explore multi-site routing with Azure Web Apps as a managed backend for a load-balancing service, highlighting language support, automatic patching, and high availability alongside virtual machines.

Create an empty virtual network and subnet for the Azure application gateway, map web apps to custom domains, and validate ownership with A and TXT DNS records.

Explore Azure traffic manager, a global DNS based load balancer that routes traffic to Azure endpoints, external endpoints, or nested endpoints using priority routing and other methods.

Deploy azure traffic manager with priority routing to a primary East US endpoint and a secondary North Europe endpoint, using Bicep to provision Windows Server VMs with Internet Information Services.

Geographic routing in Azure Traffic Manager directs users by region to designated endpoints for data compliance; switching requires deleting endpoints and configuring geo mappings for regions.

Master the weighted routing method in Azure Traffic Manager by assigning endpoint weights, configuring a primary and secondary, and gradually ramping traffic to test new versions.

Learn how traffic manager supports nested endpoints by using a traffic manager profile as an endpoint for another profile, enabling weighted routing alongside existing priority endpoints.

Explore how Azure Front Door delivers global layer 7 load balancing, performance acceleration at the Microsoft global edge, and path-based routing with built-in web application firewall.

Configure azure front door to route user requests to two virtual machine origins with public IPs via latency-based routing, using origin groups and routes across east us and north europe.

Configure a custom domain for Azure Front Door with a CNAME and TXT validation, then associate it with a route.

Explore Azure virtual network service endpoints that extend your network identity to access services like Azure Storage, Azure SQL Database, and Azure Key Vault over the backbone with ip addresses.

Set up Ubuntu server in a virtual network with a public IP using Bicep, deploy Azure storage blob container, and illustrate service endpoints routing traffic over the Microsoft backbone.

Implement virtual network service endpoints to secure Azure storage access, configure firewall rules to allow selected networks, and validate connectivity via the storage browser.

Demonstrate implementing an Azure private endpoint for blob storage, disabling public access, provisioning a private NIC in the VNet, and validating private DNS resolves to a private IP.

Expose your service behind an internal load balancer with the Azure Private Link Service to provide private endpoints for cross-tenant consumption.

Explore how to integrate an Azure app service with a virtual network to access a private database on a virtual machine. Learn about outbound connectivity limitations and subnet requirements.

Demonstrates Azure virtual network integration by deploying a private IP MySQL database on an Ubuntu VM and connecting it to an Azure web app.

Deploy a PHP web app on an Azure web app and enable virtual network integration to privately connect to a Linux database server via its private IP.

Demonstrates implementing Azure virtual network integration for an app service by creating a subnet, delegating it to web servers, and privately connecting the web app to a MySQL database.

Learn how to define rules in a network security group, a lightweight stateful firewall at layer 4, and how NSGs apply to network interface or subnet with default rules.

Use service tags in network security groups to permit internet access to a web server through a public IP, with NAT to its private IP for http traffic.

Demonstrates configuring outbound security rules on NSGs, denying outbound traffic and testing connectivity for database and web servers, and explains NSG statefulness and how inbound rules affect return traffic.

Explore how to allow outbound connectivity from a VM to Azure storage using network security groups, service tags, and outbound rules, enabling secure access to storage accounts.

Configure private endpoints and NSGs to access storage via a private endpoint, using private DNS and outbound rules that allow https traffic to the private NIC in the web subnet.

Use application security groups to replace IP-based NSG rules by tagging VM network interfaces for web and database workloads, enabling scalable, maintainable access control.

Understand that attaching an NSG to the Bastion subnet is optional. If used, define inbound and outbound rules before linking, including https traffic and gateway manager considerations.

Discover how the web application firewall inspects layer 7 traffic to block SQL injection and XSS, and enable it on Azure application gateway or Azure Front Door in detection mode.

Deploy an Azure application gateway with web application firewall v2 in front of two virtual machines running nginx, configure two subnets, and set up path-based routing for images and videos.

Configure an Azure application gateway with a web application firewall in detection mode, push logs to Log Analytics, and manage OWASP rules and policy overrides.

Add a custom rule to the Azure web application firewall policy to block a specific IP address range, then switch from detection to prevention mode to enforce 403 forbidden.

Explore Azure Firewall service, a managed stateful firewall with high availability that filters traffic with rules, supports fully qualified domain name filtering and TLS detection across basic, standard, premium SKUs.

Deploy an Azure firewall to a virtual network, select East US with the Standard SKU, attach a firewall policy, and provision a public IP for firewall connectivity.

Create Azure firewall application rules to allow fully qualified domain names from the spoke network; add a rule collection with priority and allow google.com, plus assign a public IP.

Learn how Azure Firewall DNAT rules translate traffic from the firewall's public IP to a private IP within virtual network, enabling SSH access to a spoke VM on port 22.

Learn how to structure this AZ-700 course from creating an Azure free account to mastering networking services with labs, resources, and a practice test.

Configure a basic load balancer with a backend pool of virtual machines, add a tcp health probe, and implement a port 80 front-end to back-end rule to distribute requests.

Implement a two-site Azure application gateway setup with dual backend pools and routing rules, configuring listeners for cloud to hub.com and cloud portal hub.com, and map them with DNS records.

Learn how a radius server authenticates on-premises Active Directory users for point-to-site VPN connections to an Azure virtual network.

Explore how Azure Virtual WAN centralizes network connectivity with a virtual hub, linking multiple Azure virtual networks and on-premises via site-to-site and point-to-site VPNs.

Delete prior network gateway and peering resources, then create an Azure Virtual WAN, choose basic for VPN site-to-site only or standard for point-to-site, ExpressRoute, and VNet connectivity.

Learn to create an Azure virtual hub within a virtual WAN, configure hub address space, and set up point-to-site and site-to-site VPN gateways with certificate-based authentication.

Configure point-to-site VPN with Azure Virtual WAN hub, download and install the VPN profile, connect, and access the private VM Default.html page via the assigned client IP and routes.

Learn to set up a site-to-site VPN with Azure Virtual WAN by creating a VPN site, linking it to the virtual hub, and importing VPN config to your hardware router.

Understand Azure ExpressRoute SKUs local, standard, and premium, and how pricing and connectivity vary by region and geopolitical boundaries. Learn to create an ExpressRoute circuit and share it across subscriptions.

Configure coexisting Azure ExpressRoute connections by deploying two gateways, one for ExpressRoute and one for site-to-site VPN, and link up to ten virtual networks to the ExpressRoute circuit.