AZ-700 Azure Network Engineer Exam: Skills, Weights and Plan

AZ-700 (Designing and Implementing Microsoft Azure Networking Solutions) is the exam for the Microsoft Certified: Azure Network Engineer Associate certification. You have 100 minutes and need a score of 700 or greater to pass. The most efficient way to prepare is to work through Microsoft's skills outline domain by domain, build each core service at least once in a real Azure subscription, and finish with the free practice assessment. This guide turns the official outline into a six-week plan.

Who this is for and what you will have at the end

This guide is for cloud administrators, network engineers moving from on-premises networking to Azure, and developers or architects who own Azure connectivity. Microsoft's audience profile expects experience creating and managing compute, storage and networking resources in Azure, plus an understanding of name resolution, network protocols and network address management.

By the end you will know the five exam domains and their weights, which services each one covers, which Microsoft resources are free, which lab exercises are worth the Azure spend and how the renewal works. The details below come from Microsoft's AZ-700 study guide, skills measured as of July 27, 2026, and the certification page, checked on 2026-10-30. Skills outlines change, so open the study guide the week you book.

Exam facts

Microsoft notes that the price depends on the country or region where the exam is proctored, so check the exam page for your own figure. Microsoft also recommends registering with a personal Microsoft account rather than a work or school account, because exam records tied to an organizational account can be lost when you leave the organization.

If the exam is not offered in your preferred language, Microsoft says you can request an additional 30 minutes. Candidates who use assistive devices or need other changes can request accommodations through Microsoft's accommodations page.

Skills measured and how to weight your time

The weights below are Microsoft's published ranges. Use them as the starting point for your hours, then shift time toward your weakest area after the first practice assessment.

Microsoft states that the bullets under each skill illustrate how the skill is assessed and that related topics may be covered. It also says most questions cover generally available features, although preview features can appear if they are commonly used. The July 27, 2026 change log marks the IP addressing, monitoring and network security group sections as minor changes, so older study notes are mostly still valid but should be compared against the current outline.

Domain 1: core networking infrastructure (25-30%)

This is the largest domain and it underpins everything else. It covers four areas:

• IP addressing: planning address spaces and segmentation, creating virtual networks, subnetting for services such as virtual network gateways, private endpoints, firewalls, application gateways and Azure Bastion, subnet delegation, public IP addresses and prefixes, and custom IP prefixes (bring your own IP).
• Name resolution: DNS settings for a virtual network, public and private DNS zones, linking a private zone to a virtual network, and Azure DNS Private Resolver.
• Connectivity and routing: virtual network peering and gateway transit, Azure Virtual Network Manager, user-defined routes and route tables, forced tunneling, Azure Route Server, and Azure NAT Gateway.
• Monitoring: Azure Network Watcher diagnostics and logs, Azure Monitor for networks, DDoS protection, and Microsoft Defender for Cloud items such as Secure Score recommendations, attack path analysis and Cloud Security Explorer.

Domain 2: connectivity services (20-25%)

This domain is hybrid connectivity: site-to-site VPN (gateway SKUs, route-based versus policy-based, local network gateway, IPsec/IKE policy), point-to-site VPN (tunnel types, authentication with certificates, RADIUS or Microsoft Entra ID, client configuration), ExpressRoute (connectivity models, SKUs and tiers, private and Microsoft peering, Global Reach, FastPath, ExpressRoute Direct, encryption, Bidirectional Forwarding Detection) and Azure Virtual WAN (SKUs, virtual hubs, scale units, routing and third-party network virtual appliance integration). Expect decision questions: which option meets the requirement for redundancy, throughput or authentication.

Domain 3: application delivery (15-20%)

You need to know when to use Azure Load Balancer, Traffic Manager, Application Gateway and Azure Front Door, and how to configure each. Load Balancer topics include SKU and tier, public versus internal, regional versus cross-region, Gateway Load Balancer, load balancing rules, inbound NAT rules and outbound rules with SNAT. Application Gateway covers backend pools, health probes, listeners, routing rules, HTTP settings, TLS and rewrite rule sets. Front Door covers tiers, routing, origins, TLS, caching, rules and securing an origin with Private Link.

Domain 4: network security (15-20%)

This covers network security groups and application security groups, virtual network flow logs, verifying IP flow, configuring NSGs for remote administration including Azure Bastion, Azure Firewall and Firewall Manager (SKU selection, rules, policies, secure hubs in Virtual WAN) and Web Application Firewall (detection versus prevention mode, rule sets on Front Door and Application Gateway, WAF policies).

Domain 5: private access to Azure services (10-15%)

The smallest domain, but the questions are specific. It covers private endpoints (planning, creating, configuring access and DNS integration), Private Link service (including integration with on-premises clients) and service endpoints (when to choose them, service endpoint policies). The recurring difficulty is DNS: a private endpoint only works for clients that resolve the service name to the private IP.

Free and low-cost resources

Microsoft provides these directly:

• Study guide: the skills outline with change log, linked from the certification page.
• Learn training: self-paced learning paths and modules, free to anyone. Signing in lets you track progress and register for exams.
• Practice assessment: free practice questions. Microsoft's certification page says it is now on AI Skills Navigator and that you must be signed in to launch it.
• Exam sandbox: a demo that lets you experience the exam interface and question types before test day.
• Exam prep videos: the AZ-700 exam prep video series linked from the certification page.
• Product documentation: Microsoft's study guide links documentation for VPN, ExpressRoute, DNS, Virtual WAN, Route Server, Load Balancer, Application Gateway, Front Door, Traffic Manager, NAT Gateway, Firewall, WAF, Azure Monitor and Private Link.

About free labs

Many guides tell you to use the free Learn sandboxes. According to Microsoft's Learn FAQ, sandboxes are no longer available. To complete module exercises you need an Azure subscription, and Microsoft points to a free 30-day Azure trial or a pay-as-you-go subscription. Plan your lab budget on that basis, and check the current free account terms on Microsoft's Azure free account page before you sign up, since offers change.

Six-week study plan

The plan assumes about eight to ten hours a week and some prior Azure experience. Stretch it if virtual networking is new to you.

1. Week 1: baseline and core networking. Take the free practice assessment cold to see your gaps. Then study address planning, subnets, DNS zones and Private Resolver. Lab: build a hub virtual network and two spoke virtual networks, peer them, and link a private DNS zone.
2. Week 2: routing and monitoring. Study UDRs, forced tunneling, Route Server, NAT Gateway and Network Watcher. Lab: route spoke traffic through a test virtual machine acting as a next hop, then use Network Watcher's connection troubleshoot and next hop tools to verify it.
3. Week 3: hybrid connectivity. Study VPN gateway SKUs, IKE policy, point-to-site authentication, ExpressRoute models and Virtual WAN. Labs here are expensive because gateways bill while they exist, so use documentation and diagrams for ExpressRoute, and build one site-to-site or point-to-site gateway only if your budget allows. Delete it when done.
4. Week 4: application delivery. Compare Load Balancer, Application Gateway, Front Door and Traffic Manager in a decision table. Lab: a small Application Gateway with health probes and a listener, plus a basic load balancer rule.
5. Week 5: security and private access. Study NSGs, ASGs, flow logs, Azure Firewall, WAF and private endpoints. Lab: create a private endpoint for a storage account and prove DNS resolves to the private address from inside the virtual network.
6. Week 6: review and rehearse. Retake the practice assessment, redo labs for weak objectives, rewrite your decision tables from memory and run through the exam sandbox so the interface is familiar.

Lab habits that save money

Gateways, Azure Firewall, Application Gateway and Bastion are billed resources, so remove them when you finish. Put every lab in its own resource group so you can delete it in one step, and check cost analysis in the Azure portal at the end of each session.

# Delete a lab resource group and everything in it
az group delete --name rg-az700-lab --yes --no-wait

The command comes from the Azure CLI. Confirm the resource group name first, because deletion cannot be undone.

Decision tables worth memorizing

Scenario questions often ask you to pick between similar services. Build tables like these from Microsoft's documentation and fill in the details as you study.

Confirm each row against the service documentation before you rely on it for the exam, since the outline expects you to know limits and tier differences that a one-line table cannot hold.

Troubleshooting your preparation

Practice scores stall. Group missed questions by domain. If the misses cluster in connectivity or application delivery, the usual cause is comparing options without hands-on context. Build the service once, then re-read.

You cannot afford hybrid labs. Use the documentation, architecture diagrams and the Learn modules for ExpressRoute and Virtual WAN. Build only the pieces that are cheap, and delete them quickly.

Private endpoint labs fail to connect. Check DNS first. The name must resolve to the private IP from the client network, which means the private DNS zone must be linked to the virtual network the client uses.

Study material no longer matches the exam. Compare it against the change log in Microsoft's study guide. The July 27, 2026 update lists minor changes in IP addressing, monitoring and NSG areas.

Exam-day checklist

1. Confirm your name, account and ID match your registration, and schedule with a personal Microsoft account.
2. Open the exam sandbox once so the interface and question types are familiar.
3. Plan your pacing for 100 minutes and flag hard questions rather than stalling.
4. Review the change log in the study guide one last time.
5. After you pass, add the certification to your Learn profile and set a calendar reminder for renewal within 12 months.

For related preparation, see AZ-500 study guide for Azure Security Engineer and AZ-204 study guide for Azure Developer Associate.

References

• Study guide for Exam AZ-700: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-700
• Microsoft Certified: Azure Network Engineer Associate: https://learn.microsoft.com/en-us/credentials/certifications/azure-network-engineer-associate/
• Microsoft Learn FAQ (sandbox status): https://learn.microsoft.com/en-us/training/support/faq