AZ-700 exam domains
The AZ-700 exam is weighted across 5 domains. Pick any domain below to drill it — or read the full breakdown in the FAQ.
| Exam domain | Exam weight | Practice |
|---|---|---|
| Design and implement core networking infrastructure | 28% | Practice this topic |
| Design, implement, and manage connectivity services | 23% | Practice this topic |
| Design and implement application delivery services | 18% | Practice this topic |
| Design and implement private access to Azure services | 13% | Practice this topic |
| Design and implement Azure network security services | 18% | Practice this topic |
Sample AZ-700 questions
A sample of the AZ-700 questions on this hub. Each links through to the full question, the correct answer, and an explanation of why every other option is wrong.
- Your company runs a web application behind an Azure Application Gateway v2 (Standard_v2). Traffic is highly variable, spiking during business hours an…View question
- Your company runs a web tier across a VM Scale Set and a set of on-premises IIS servers reachable over an ExpressRoute private connection. You must fr…View question
- Your company hosts a legacy web application behind an Azure Application Gateway v2. The application stores session state locally in memory on each bac…View question
- Your company runs a web application behind an Azure Application Gateway v2. The backend pool contains three VMs that host an API. The application's he…View question
- Your company runs a stateful web application behind an Azure Application Gateway v2. During deployments, backend VMs in the pool are removed and repla…View question
- Your company hosts an e-commerce site behind an Azure Application Gateway v2. Security requires that all client traffic use HTTPS. Currently the gatew…View question
- Your company runs Azure Application Gateway v2 with a single public frontend IP on port 443. You have configured three multi-site listeners that use o…View question
- Your company hosts two web applications, shop.contoso.com and portal.contoso.com, behind a single Azure Application Gateway v2. Both applications shar…View question
- Your company hosts two public web applications, shop.contoso.com and portal.contoso.com, behind a single Azure Application Gateway v2. Both must be re…View question
- A financial services company runs an Azure Application Gateway v2 in front of a REST API used by partner organizations. Compliance requires that only…View question
Key AZ-700 terms
Start with these terms, then explore the full glossary. Each links to a plain-English definition written for the AZ-700 exam.
AZ-700 frequently asked questions
What is the AZ-700 certification?+
Microsoft positions the Azure Network Engineer as planning, implementing, and managing Azure networking — core infrastructure, hybrid connectivity, application delivery, private access, and network security — while optimizing performance, resiliency, scale, and security.
It expects experience creating and managing compute, storage, and networking in Azure, plus networking fundamentals such as name resolution, protocols, and address management.
What topics are on the AZ-700 exam?+
The AZ-700 exam is organised into five weighted domains. The percentages below are the midpoints of Microsoft’s published ranges, normalized to total 100. Core networking infrastructure carries the most weight.
Design and implement core networking infrastructure (28%)
The heaviest domain. It covers IP addressing (segmentation, VNets, subnetting, public and custom IP prefixes), name resolution (VNet DNS, public and private zones, DNS Private Resolver), VNet connectivity and routing (peering, Virtual Network Manager, user-defined routes, Route Server, NAT Gateway), and monitoring with Network Watcher and Azure Monitor.
Design, implement, and manage connectivity services (23%)
Covers site-to-site VPN (HA design, gateway SKUs, policy vs route-based), point-to-site VPN (tunnel types, authentication), Azure ExpressRoute (connectivity models, SKUs, peering, Global Reach/FastPath/Direct), and Azure Virtual WAN (architecture, virtual hubs, hub routing).
Design and implement application delivery services (18%)
Covers Azure Load Balancer and Traffic Manager (SKUs, public vs internal, regional vs cross-region, rules, NAT/SNAT), Azure Application Gateway (backend pools, health probes, listeners, routing, TLS, rewrites), and Azure Front Door (routing, origins, TLS, caching, Private Link).
Design and implement private access to Azure services (13%)
The smallest domain. It covers Azure Private Link and private endpoints (planning, creating, DNS integration, on-premises access) and service endpoints (when to use, service endpoint policies, access configuration).
Design and implement Azure network security services (18%)
Covers network security groups and application security groups (rules, flow logs, IP flow verify, Virtual Network Manager), Azure Firewall and Firewall Manager (SKUs, rules, policies, secure hubs), and Web Application Firewall (policies, detection vs prevention, rule sets for Front Door and Application Gateway).
Is the AZ-700 hard?+
AZ-700 is an associate exam that expects real networking depth — designing hybrid connectivity, routing, and security on Azure — not just recognition of services. Prior networking fundamentals are essential.
The difficulty comes from the breadth across connectivity, delivery, and security and from scenario questions that hinge on the right gateway, routing, or firewall design. Practising in an Azure subscription is the key.
How many questions are on the AZ-700 exam and how long is it?+
Microsoft does not fix a single public question count for AZ-700; it typically presents roughly 40–60 questions in a mix of formats — multiple choice, multiple response, and case studies — and Microsoft allots 100 minutes to complete the assessment.
Our full-length practice mock uses a 60-question, 100-minute session so you can rehearse pacing under realistic time pressure before test day.
What score do you need to pass the AZ-700?+
Microsoft scores AZ-700 on a scale of 1 to 1,000, and the passing score is 700. That is a scaled score rather than a raw 70%, because Microsoft adjusts for question difficulty, and there is no penalty for wrong answers, so you should never leave a question blank. Our practice mock uses a 70% threshold to give you a comparable target.
How much does the AZ-700 exam cost?+
The AZ-700 exam fee is set by Microsoft and varies by region — check the Microsoft certification page for current pricing. Microsoft associate certifications are valid for one year and can be renewed for free through an online assessment on Microsoft Learn. Everything on this hub is free.
Who should take the AZ-700?+
AZ-700 is aimed at network engineers and cloud engineers who plan, implement, and manage Azure networking, and at on-premises network engineers moving to Azure.
Microsoft recommends experience with Azure compute, storage, and networking, plus networking fundamentals such as name resolution, protocols, and address management, though there is no formal prerequisite.
What jobs and salaries can the AZ-700 lead to?+
AZ-700 maps to roles such as Azure network engineer, cloud network engineer, and infrastructure engineer, where designing and operating Azure networking is central to the job.
How much any certification affects pay depends heavily on geography, seniority, and hands-on experience, so treat any single salary figure with caution. AZ-700 is best viewed as validation of Azure networking skill rather than a guaranteed raise on its own.
How long does it take to study for the AZ-700?+
Candidates with networking experience often need six to ten weeks; those newer to Azure networking should plan longer. The most efficient path is to study each domain while building VNets, gateways, and load balancers in an Azure subscription.
Review every explanation, including for questions you answered correctly, because AZ-700 distractors are built from plausible but incorrect networking designs. Use the per-domain results here to find and shore up your weakest area, then finish with full-length timed mocks.
How should you prepare for the AZ-700?+
Study the five domains above, giving the most time to core networking infrastructure, then drill scenario questions domain by domain. Every MockAPI question reveals a full explanation and tells you why each wrong answer is wrong — essential for an exam that turns on exact networking designs.
When you can answer scenarios comfortably, move to full-length timed mocks, ideally alongside hands-on practice in Azure. Use the glossary to keep the services straight, and aim to score consistently above the pass mark before you book.
Can you take the AZ-700 exam online?+
Yes. Microsoft delivers AZ-700 through Pearson VUE, so you can test at a physical Pearson VUE centre or online with remote proctoring (OnVUE). The online exam requires a private, quiet room, a clear workspace, a webcam and microphone, a stable connection, and government-issued photo ID, with a proctor monitoring you and a room scan before you start.
If you do not pass, Microsoft requires a 24-hour wait before a second attempt; after that, a 14-day wait applies between further attempts, with a limit of five attempts in a 12-month period, and each attempt needs its own registration.
What certification should you take after the AZ-700?+
After AZ-700, common next steps include the Azure Solutions Architect Expert (AZ-305) for broader design, or the Azure Security Engineer (AZ-500) to deepen network security.
For many, the real next step is owning Azure networking for an organization. Pairing AZ-700 with hands-on experience is what turns the certificate into a career.