AZ-700 cheat sheet
A one-page reference for the Microsoft Azure Network Engineer Associate exam: the format, how the domains are weighted, and the glossary terms for this exam.
Exam at a glance
Vendor
Microsoft
Level
Associate
Questions
60
Time
100 min
Mock pass mark
70%
Domains
5
Practice Qs
152
Code
AZ-700
Domain weightings
How much of the exam each domain covers. Spend your study time in proportion — the heavier the domain, the more questions you'll see.
Key terms
- Virtual Network
- An Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure, providing isolated IP address spaces and subnets. AZ-700 centers on designing and implementing VNets.
- Subnet
- A subnet is a segment of a VNet's address space into which resources and services are deployed. AZ-700 covers subnetting for gateways, endpoints, firewalls, and delegation.
- VNet peering
- VNet peering connects two virtual networks so resources communicate privately across them. AZ-700 covers implementing peering, service chaining, and gateway transit.
- ExpressRoute
- Azure ExpressRoute provides a private, dedicated connection between on-premises networks and Azure that bypasses the public internet. AZ-700 covers ExpressRoute connectivity models, SKUs, and peering.
- Site-to-site VPN
- A site-to-site VPN is an IPsec/IKE tunnel connecting an on-premises network to an Azure VNet over the internet. AZ-700 covers designing highly available site-to-site VPNs and gateway SKUs.
- Virtual network gateway
- A virtual network gateway is the Azure resource that terminates VPN or ExpressRoute connections for a VNet. AZ-700 covers selecting gateway SKUs and configuring connectivity.
- Virtual WAN
- Azure Virtual WAN is a networking service that unifies connectivity through managed virtual hubs at scale. AZ-700 covers designing Virtual WAN architectures and hub routing.
- Azure Load Balancer
- Azure Load Balancer is a Layer 4 service that distributes inbound and outbound traffic across backend resources. AZ-700 covers choosing SKUs and configuring load-balancing and NAT rules.
- Application Gateway
- Azure Application Gateway is a Layer 7 web load balancer with routing, TLS, and WAF capabilities. AZ-700 covers listeners, routing rules, health probes, and rewrite rule sets.
- Azure Front Door
- Azure Front Door is a global, edge-based application delivery and CDN service with routing, TLS, and caching. AZ-700 covers configuring routing, origins, TLS, and caching.
- Private Link
- Azure Private Link provides private connectivity to Azure and partner services through private endpoints, keeping traffic off the internet. AZ-700 covers Private Link services and endpoints with DNS integration.
- Service endpoint
- A virtual network service endpoint extends a VNet's identity to an Azure service over the Azure backbone. AZ-700 covers when to use service endpoints and configuring service endpoint policies.
- Network security group
- A network security group (NSG) filters inbound and outbound traffic to Azure resources with allow and deny rules. AZ-700 covers NSGs, application security groups, and flow logs.
- Azure Firewall
- Azure Firewall is a managed, stateful network firewall service for VNets and Virtual WAN hubs. AZ-700 covers Azure Firewall SKUs, rules, and Firewall Manager policies.
- Web Application Firewall
- A Web Application Firewall (WAF) protects web apps from common exploits and can run on Application Gateway or Front Door. AZ-700 covers WAF policies, detection vs prevention mode, and rule sets.