The AZ-700 exam tests whether you can choose the right Azure networking approach for a given scenario. A single misconfigured routing table entry can bring down connectivity for hundreds of VMs — in Azure networking, the order of decisions determines the outcome. This exam rewards judgment over memorization. Let's map out which decision each domain covers and where candidates most often go wrong.
The Five-Domain Structure of the Exam
Think of urban planning: first you build the road network, then connect to neighboring cities, direct traffic to key buildings, isolate sensitive districts, and finally deploy CCTV monitoring. The five AZ-700 domains follow exactly this sequence. 'Core Networking Infrastructure' covers Virtual Network design, routing, DNS, and IP addressing, making up roughly a quarter or more of the exam. 'Connectivity Services' covers VPN Gateway, ExpressRoute, and Virtual WAN for linking on-premises to Azure. 'Application Delivery' includes Azure Load Balancer, Application Gateway, and Azure Front Door. 'Private Access' handles Private Endpoint and Private Link for hiding services from the public internet. 'Network Security' encompasses Azure Firewall, Network Security Group, and DDoS Protection.
Learning Roadmap: Order Is Everything
Nobody installs the roof before the foundation. Azure networking study works the same way — skip the foundational pieces and the advanced concepts collapse. Start with Virtual Network CIDR design and subnet segmentation, then add routing tables (UDR) and route propagation behavior. Once you understand how Private DNS Zone attaches to a VNet, Private Endpoint registration flows make intuitive sense. From DNS, move into VPN Gateway and ExpressRoute comparison before tackling Virtual WAN hub architecture. Layer on traffic delivery services and security, and finish with Network Watcher and Azure Monitor for observability. Attempt this in any other order and the 'why' behind each service becomes much harder to grasp.
Core Service Map: Five Categories
Like a terminal map at an airport, grouping services by category means you instantly know which shelf to reach for when a scenario lands in front of you. 'Core' holds Virtual Network, VNet Peering, User Defined Routes (UDR), and Private DNS Zone. 'Connectivity' contains VPN Gateway, ExpressRoute, and Virtual WAN. 'Delivery' has Azure Load Balancer (L4), Application Gateway (L7), and Azure Front Door (global L7). 'Security' covers Azure Firewall, Network Security Group (NSG), and DDoS Protection. 'Monitor' includes Network Watcher, Connection Monitor, and NSG Flow Logs. Keep this five-category mental model sharp and you'll classify exam questions by layer before finishing the second sentence.
Connectivity Services Compared: VPN Gateway, ExpressRoute, Virtual WAN
Choosing how to connect branch offices to Azure is like picking a travel route — the right answer depends on what you value most. VPN Gateway creates an encrypted IPsec tunnel over the public internet: fast to set up, affordable, but bandwidth-limited. ExpressRoute uses a dedicated private circuit from a telecommunications carrier, delivering stable, low-latency connectivity that meets the strict SLA requirements of financial institutions and healthcare environments. Virtual WAN is a managed hub-and-spoke overlay that simplifies route management across many global offices by consolidating connectivity through a Microsoft-managed hub.
| Criteria | VPN Gateway | ExpressRoute | Virtual WAN | |------|-------------|--------------|-------------| | Circuit type | Public internet (IPsec) | Dedicated private line | Both available | | Latency profile | Moderate, variable | Low and consistent | Optimized per hub | | Max bandwidth | Up to 10 Gbps | Up to 100 Gbps | Circuit-dependent | | Management effort | Low | Medium (partner required) | Low (managed hub) | | Best scenario | Fast setup, small scale | Enterprise hybrid workloads | Multi-site global connectivity |
!3 ways to connect to Azure
Traffic Delivery Compared: Azure Load Balancer, Application Gateway, Azure Front Door
Picture a restaurant chain: someone divides orders between kitchen stations inside a branch, someone else seats diners based on their reservation, and a third person tells customers across the country which branch is nearest. Azure Load Balancer distributes traffic at L4 (TCP/UDP) using IP address and port alone — it has no understanding of HTTP content or URLs. Application Gateway operates at L7 (HTTP/HTTPS), routing requests by URL path or host header, and includes a built-in Web Application Firewall (WAF) for filtering malicious traffic. Azure Front Door is the global anycast entry point, steering users worldwide to the nearest Azure edge location and managing cross-region failover automatically.
| Service | Layer | Core capability | Best fit | |------|--------|----------|------------| | Azure Load Balancer | L4 TCP/UDP | IP and port distribution | Internal VM traffic | | Application Gateway | L7 HTTP/S | URL routing, WAF | Single-region web apps | | Azure Front Door | Global L7 | Anycast entry, multi-region failover | Global user distribution |
Private Endpoint vs Service Endpoint
Imagine putting a restaurant inside a gated apartment complex versus building a residents-only side entrance to a restaurant on the street. Private Endpoint assigns a private IP from your VNet directly to an Azure service such as Azure Storage or Azure SQL Database. That service becomes reachable only from within the VNet — its public endpoint is disabled. Service Endpoint, by contrast, keeps the service's public IP intact but routes your VNet's traffic to that service over the Microsoft backbone network, bypassing the public internet for the data path. When an exam scenario calls for 'eliminating the public endpoint' or 'complete network isolation,' Private Endpoint is the answer. When it calls for 'optimizing the path' without removing public access, Service Endpoint fits.
Common Exam Traps and How to Navigate Them
When VPN Gateway and ExpressRoute both look plausible, find the two-word signal in the scenario. 'Dedicated circuit' or 'consistent low-latency SLA' means ExpressRoute. 'Quick deployment' or 'cost-sensitive' means VPN Gateway. The Application Gateway versus Azure Front Door split hinges on a single qualifier: 'global.' If the scenario mentions global users or cross-region failover, Azure Front Door is the answer; if it describes a single-region web application, Application Gateway applies. Azure Firewall and Network Security Group are another classic confusion pair. NSG applies allow/deny rules at the VM or subnet level based on IP and port. Azure Firewall is a fully managed, centralized L7 firewall that inspects traffic across the entire hub, supports FQDN filtering, and enforces policy from a single control plane.
Domain Deep-Dive Series
The five categories covered in this overview are broken into ten posts, each going deep on service-level configuration and troubleshooting.
Core Networking Infrastructure: VNet, Subnets, and NAT Gateway, UDR, BGP, and Hub-Spoke Routing, Azure DNS and Private DNS Zones
Connectivity Services: VPN Gateway Site-to-Site and Point-to-Site, ExpressRoute and Virtual WAN
Application Delivery: Azure Load Balancer and Application Gateway, Azure Front Door and Traffic Manager
Private Access: Private Endpoint and Private Link
Network Security: NSG, Azure Firewall, and WAF, Network Watcher and Connection Monitor
Exam Key Takeaways
"L4 VM traffic distribution" -- Azure Load Balancer "URL path routing, built-in WAF" -- Application Gateway "Global anycast entry point, multi-region failover" -- Azure Front Door "Dedicated circuit, low latency, enterprise SLA" -- ExpressRoute "Multi-site global managed hub" -- Virtual WAN "Private IP in VNet, public endpoint disabled" -- Private Endpoint "Backbone path optimization, public IP retained" -- Service Endpoint "Centralized L7 firewall, FQDN filtering" -- Azure Firewall "VM and subnet-level allow/deny rules" -- Network Security Group "Packet capture and connection diagnostics" -- Network Watcher "Direct single-hop connection between VNets" -- VNet Peering "Custom routes to override default Azure routing" -- User Defined Routes (UDR)
Azure Load Balancer = L4 distribution, Application Gateway = L7 intelligent routing, Azure Front Door = global anycast entry point
Ready to test where you stand? Try the AZ-700 practice exam now.