Training course

This is a free, self-paced reading course for AZ-700: Designing and Implementing Microsoft Azure Networking Solutions, the associate-level credential for engineers who own the network side of an Azure estate. The distinction that matters is the one between knowing a virtual network exists and being able to build one that works: subnet planning that accounts for the five reserved addresses, gateway transit that flows in the direction you intended, private DNS zones linked to the right virtual networks, ExpressRoute peering that carries the traffic you expect, and firewall rules that inspect the hop you meant to inspect. This course is written to close that gap.

The course is organized as one module per official exam domain, in the order Microsoft publishes them, and each module carries the domain’s published weight. That matters more on AZ-700 than on most exams because the weighting is genuinely uneven: core networking infrastructure alone is 25-30%, and together with connectivity services it accounts for roughly half of the exam. Reading in published order also happens to be the right build order, addressing and DNS come before hybrid links, which come before what you put in front of the workload.

AZ-700 Associate level 5 modules Domain-weighted Self-paced Free account

What the course covers

Design and implement core networking infrastructure

Module 1 · 25-30%

The largest domain and the foundation everything else sits on. IP addressing and subnet planning, including the five reserved IPs in every subnet, subnet delegation for services such as SQL Managed Instance, and public IP prefixes with BYOIP; DNS design across public and private zones, virtual network links, and the DNS Private Resolver for hybrid name resolution; virtual network connectivity through peering, gateway transit, service chaining, and user-defined routes; the Azure Route Server for dynamic route exchange with network virtual appliances; NAT Gateway for outbound SNAT; and monitoring through Network Watcher, Azure Monitor for Networks, DDoS Protection, and Defender for Cloud.

Design, implement, and manage connectivity services

Module 2 · 20-25%

Hybrid connectivity, where most enterprise design decisions actually get made. Site-to-site VPN, active-active versus active-standby, policy-based versus route-based tunnels, VPN gateway SKU sizing, and local network gateway configuration. Point-to-site VPN and the OpenVPN, IKEv2, and SSTP trade-offs, with authentication by certificate, RADIUS, or Microsoft Entra ID. ExpressRoute end to end: circuit models, SKUs and tiers, private versus Microsoft peering, and the add-ons: Global Reach, FastPath, ExpressRoute Direct, and encryption over the circuit. Azure Virtual WAN closes the module as the managed hub-and-spoke transit fabric, with routing intent, secured hubs, and any-to-any connectivity.

Design and implement application delivery services

Module 3 · 15-20%

The layer-4 and layer-7 traffic distribution stack, and choosing correctly between its four options. Azure Load Balancer at layer 4: Standard SKU capabilities, HA ports, zone redundancy, internal versus public frontends, cross-region load balancing, inbound NAT rules, and explicit outbound SNAT rules. Azure Application Gateway at layer 7 within a region, backend pools, health probes, path- and host-based routing, TLS termination and re-encryption, and rewrite rules. Azure Front Door at the global edge: Standard versus Premium, routing rules, caching, end-to-end TLS, and Private Link origins that let a global service front a private backend. Traffic Manager completes the set as the DNS-layer global router.

Design and implement private access to Azure services

Module 4 · 10-15%

The smallest domain by weight and the most heavily concept-tested. Private endpoints, which give a PaaS resource a private IP inside your virtual network, allow the public endpoint to be disabled, and depend on a linked private DNS zone such as privatelink.database.windows.net to resolve the resource’s FQDN to that private IP. Private Link service as the provider side: publishing a workload behind a Standard internal load balancer so customer virtual networks can connect through their own private endpoints, governed by visibility and auto-approval lists. Service endpoints as the older, lighter alternative, traffic still targets the public IP but takes an optimized backbone path, and can be narrowed with service endpoint policies. The module concentrates on when each option fits and, just as importantly, what breaks if you pick the other one.

Design and implement Azure network security services

Module 5 · 15-20%

Network security groups and how rule priority is evaluated, application security groups for tag-based grouping, virtual network flow logs, IP Flow Verify, and effective security rules for troubleshooting. Azure Virtual Network Manager security admin rules, which evaluate ahead of NSGs and cannot be overridden by workload owners, the enterprise enforcement layer. Azure Firewall across the Basic, Standard, and Premium SKUs, with the Premium capabilities called out separately (TLS inspection, IDPS, URL filtering, web categories), plus DNAT rule design and Firewall Manager for hierarchical policy across multiple firewalls. Web Application Firewall on both Application Gateway and Front Door, covering detection versus prevention mode, custom rules, and exclusions for false positives.

How to use it

Read a module, then work the matching portion of the AZ-700 practice exam before moving on. AZ-700 rewards the ability to choose between options that all technically work, so the useful signal is not whether you recognize Azure Front Door but whether you can say why it beats Application Gateway for a given requirement, and that only surfaces when you answer questions. The exam also includes case studies and, on some sittings, hands-on portal labs, so reading alone will not carry you: pair each module with a subscription and actually build the peering, the private endpoint, and the firewall policy you are reading about. The course modules themselves open once you are signed in to a free Certifym account.

Do module 1 properly even if you find it familiar; addressing, DNS, and routing mistakes cascade into every later domain, and it is the heaviest block on the exam. For exam logistics (question types, timing, the 700-of-1000 scaled cut score, pricing, and how the compensatory scoring model works) see the AZ-700 certification guide.

AZ-700: Designing and Implementing Microsoft Azure Networking Solutions

One module per AZ-700 exam domain, weighted the way Microsoft weights them.

A self-paced reading course for AZ-700: Designing and Implementing Microsoft Azure Networking Solutions, the associate-level credential for engineers who own the network side of an Azure estate. The course is organized as one module per official exam domain, in the order Microsoft publishes them, and each module carries the domain's published weight, so the time you spend maps to the time the exam spends.

You work through core networking infrastructure — address planning, subnet and delegation rules, public and private DNS, peering and hub-and-spoke topology, routing and Route Server, outbound connectivity, and Network Watcher — then hybrid connectivity across VPN gateways, ExpressRoute circuits and peerings, and Azure Virtual WAN. From there the course covers the application delivery stack of Load Balancer, Application Gateway, Front Door, and Traffic Manager; private access through private endpoints, Private Link service, and service endpoints; and the security layers of network security groups, Virtual Network Manager security admin rules, Azure Firewall, and the web application firewall.

The material assumes AZ-104-level Azure experience or the hands-on equivalent. It goes considerably deeper into virtual networking than an administrator course does, and it is written to be paired with a subscription of your own — AZ-700 measures design judgment and applied configuration skill, so build the peering, the private endpoint, and the firewall policy you are reading about. Every lesson ends with its key terms and further reading, so the course works as a reference after the first pass as well as a syllabus during it. Certifym is an independent study publisher and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation.

Module 1: Design and implement core networking infrastructure 28% of exam

The largest domain and the foundation everything else sits on. You start with IP addressing and subnet planning — including the five reserved addresses in every subnet, the named platform subnets and their minimum sizes, delegation to managed services, and public IP prefixes and bring-your-own-IP — then move through DNS design across public zones, private zones and their virtual network links, and the DNS Private Resolver for hybrid name resolution.The second half is connectivity and observability inside Azure: virtual network peering and its configuration matrix, hub-and-spoke topology with gateway transit, service chaining through network virtual appliances, system and user-defined routes with the rules that decide which one wins, Azure Route Server for dynamic route exchange, NAT Gateway for outbound connectivity, and the Network Watcher, DDoS Protection, and monitoring tools you use to see what the network is actually doing.

1.1 Address space planning for an Azure estate 5 min Free preview
1.2 Subnet design, reserved addresses, and delegation 5 min 🔒
1.3 Public IP addresses, prefixes, and bring your own IP 5 min 🔒
1.4 Azure DNS public zones and delegation 5 min 🔒
1.5 Private DNS zones, virtual network links, and autoregistration 5 min 🔒
1.6 Azure DNS Private Resolver and hybrid name resolution 5 min 🔒
1.7 Virtual network peering and its configuration matrix 5 min 🔒
1.8 Hub-and-spoke topology and gateway transit 5 min 🔒
1.9 Service chaining and network virtual appliances 5 min 🔒
1.10 System routes, user-defined routes, and route selection 5 min 🔒
1.11 Azure Route Server and dynamic routing with appliances 6 min 🔒
1.12 NAT Gateway and outbound connectivity design 6 min 🔒
1.13 Network Watcher: diagnostics and monitoring tools 5 min 🔒
1.14 DDoS Protection and platform-level network monitoring 5 min 🔒

Module 2: Design, implement, and manage connectivity services 23% of exam

Hybrid connectivity, where most enterprise design decisions actually get made. The module opens with VPN gateway architecture and sizing, then site-to-site VPN end to end — local network gateways, IPsec and IKE policy, BGP, and the active-active and dual-redundancy configurations that determine how quickly a failure recovers. Point-to-site follows, covering the OpenVPN, IKEv2, and SSTP trade-offs and the certificate, RADIUS, and Microsoft Entra ID authentication methods.ExpressRoute occupies the middle of the module: circuits and connectivity models, Local, Standard, and Premium SKUs, private and Microsoft peering with route filters and BGP path selection, and the add-ons — Global Reach, FastPath, ExpressRoute Direct, and encryption over the circuit. Azure Virtual WAN closes it as the managed transit fabric, with hub sizing, association and propagation, routing intent, and secured hubs.

2.1 VPN gateway architecture, SKUs, and sizing 5 min 🔒
2.2 Site-to-site VPN: local network gateways and IPsec policy 5 min 🔒
2.3 VPN high availability: active-active and redundant tunnels 5 min 🔒
2.4 Point-to-site VPN: protocols, tunnel types, and client configuration 5 min 🔒
2.5 Point-to-site authentication: certificates, RADIUS, and Microsoft Entra ID 5 min 🔒
2.6 VNet-to-VNet connections, transit choices, and forced tunneling 5 min 🔒
2.7 ExpressRoute circuits, connectivity models, and SKUs 5 min Free preview
2.8 ExpressRoute peering types, BGP, and route filters 5 min 🔒
2.9 Global Reach, FastPath, ExpressRoute Direct, and circuit resiliency 5 min 🔒
2.10 ExpressRoute coexistence with VPN, monitoring, and troubleshooting 5 min 🔒
2.11 Azure Virtual WAN architecture and hub design 5 min 🔒
2.12 Virtual WAN routing, routing intent, and secured hubs 5 min 🔒

Module 3: Design and implement application delivery services 18% of exam

The layer-4 and layer-7 traffic distribution stack, and choosing correctly between its options. The module starts with the decision framework itself — protocol decides the layer, geography decides the scope — then works through Azure Load Balancer at layer 4, including Standard SKU behavior, health probes and distribution modes, HA ports for appliance clusters, zone redundancy, and the cross-region global tier.Application Gateway follows at layer 7 within a region: listeners, routing rules, backend settings and probes, TLS termination and end-to-end encryption, and header and URL rewriting. Azure Front Door covers the global edge, including origin groups, caching, the rules engine, custom domains and certificates, and Private Link origins that let a global service front a private backend. Traffic Manager completes the set as the DNS-layer global router, and the module ends on the metrics and logs that explain a delivery failure.

3.1 Choosing between Load Balancer, Application Gateway, Front Door, and Traffic Manager 6 min 🔒
3.2 Azure Load Balancer: SKUs, frontends, pools, and rules 5 min 🔒
3.3 HA ports, zone redundancy, and cross-region load balancing 5 min 🔒
3.4 Application Gateway architecture: listeners, rules, and backend pools 5 min 🔒
3.5 TLS termination, end-to-end encryption, and rewrite rules 5 min 🔒
3.6 Azure Front Door: profiles, routes, origins, and caching 5 min 🔒
3.7 Front Door custom domains, certificates, and Private Link origins 5 min 🔒
3.8 Traffic Manager profiles, routing methods, and endpoint monitoring 5 min 🔒
3.9 Monitoring and troubleshooting application delivery 5 min 🔒

Module 4: Design and implement private access to Azure services 13% of exam

The smallest domain by weight and the most heavily concept-tested. Private endpoints give a platform resource a private IP inside your virtual network, and the module covers what one actually creates, how sub-resources scope it, the connection approval workflow, and the private DNS integration that everything depends on — including why a client that resolves the public address looks perfectly healthy right up until public access is disabled.From there the module covers Private Link service as the provider side, publishing a workload behind a Standard internal load balancer with visibility and auto-approval controls; service endpoints and service endpoint policies as the older, lighter alternative and when each fits; the network policy setting that determines whether security groups and routes apply to private endpoint traffic at all; and the hub patterns, governance policies, and hybrid resolution design that make private access work across a whole estate.

4.1 Private endpoints: architecture, sub-resources, and approval 5 min 🔒
4.2 Private endpoint DNS integration and the privatelink zones 5 min 🔒
4.3 Private Link service: publishing your own workload privately 5 min 🔒
4.4 Service endpoints and service endpoint policies 5 min 🔒
4.5 Securing private endpoint subnets: network policies, NSGs, and routes 5 min 🔒
4.6 Private access at scale: hub patterns and hybrid resolution 5 min 🔒

Module 5: Design and implement Azure network security services 18% of exam

Network security groups first: rule anatomy, service tags, the default rules you cannot delete, and the priority and stateful evaluation that decide every outcome, followed by application security groups for role-based rules and virtual network flow logs and traffic analytics for seeing what traffic actually occurred. A troubleshooting lesson covers effective security rules, IP Flow Verify, and the failure patterns that account for most filtering incidents.Azure Virtual Network Manager introduces the enterprise enforcement layer, with network groups and security admin rules that evaluate ahead of network security groups and cannot be overridden by workload owners. Azure Firewall then gets three lessons — SKUs and deployment, the fixed rule processing order and DNAT design, and the Premium capabilities of TLS inspection, IDPS, URL filtering, and web categories — followed by Firewall Manager and hierarchical policy. The module closes on the web application firewall across Application Gateway and Front Door, covering modes, managed rule sets, custom and rate limit rules, and tuning exclusions.

5.1 Network security groups and how rules are evaluated 6 min 🔒
5.2 Application security groups and virtual network flow logs 5 min 🔒
5.3 Troubleshooting filtering with effective rules and IP Flow Verify 5 min 🔒
5.4 Azure Virtual Network Manager and security admin rules 5 min 🔒
5.5 Azure Firewall: SKUs, architecture, and deployment 6 min 🔒
5.6 Azure Firewall rule types, processing order, and DNAT 6 min 🔒
5.7 Azure Firewall Premium: TLS inspection, IDPS, and URL filtering 5 min 🔒
5.8 Firewall Manager, hierarchical policy, and firewall monitoring 5 min 🔒
5.9 Web Application Firewall on Application Gateway and Front Door 5 min 🔒

Frequently asked questions about the AZ-700 training course

Is the AZ-700 training course free?

Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.

How is the course structured?

One module per official AZ-700 exam domain, in Microsoft’s published order, with each module weighted to the domain’s published percentage range. Within each module the material is broken into short lessons, followed by key terms and further reading.

Does this replace Microsoft’s official training?

No. Microsoft Learn publishes free official learning paths for AZ-700, and they are the authoritative source. This course is an independent study companion, written to be read quickly and to slot alongside practice questions, not a substitute for the official study guide.

Do I need AZ-104 before starting?

There are no formal prerequisites, but AZ-700 assumes AZ-104-level Azure experience or the hands-on equivalent. A candidate who is still learning to navigate the portal will spend the exam on basics rather than on networking. If that describes you, work through the AZ-104 training course first. AZ-700 goes far deeper into the same virtual networking material AZ-104 introduces.

What should I do after finishing the course?

Move to the AZ-700 practice exam and keep working until you are clearing 70% across every domain rather than only the two heavy ones. The exam is compensatory, so a strong module 1 can offset a weaker module 4, but you should not plan around that. Then book with Pearson VUE.

Is the course current with the latest AZ-700 outline?

The course is built against the outline as updated on April 24, 2026, which brought minor refinements across all five domains, no weightings shifted, and no domains were added or removed. Microsoft can revise the outline at any time; verify the current study guide on Microsoft Learn before you sit the exam.

Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Microsoft®, Azure®, Microsoft Certified, Microsoft Entra™, and Azure Network Engineer Associate are trademarks or registered trademarks of Microsoft Corporation. AZ-700 is Microsoft’s exam code for the Designing and Implementing Microsoft Azure Networking Solutions exam and is used here nominatively to identify the certification these study materials are intended for. The AZ-700 study guide and its skills outline are the property of Microsoft Corporation; candidates should review the official, current study guide directly on Microsoft Learn.

All course content, questions, answers, and explanations on Certifym are original content created for study purposes. Nothing here is drawn from actual exam content, from Microsoft’s official practice assessment, or from any third-party question bank, and none of it is represented as Microsoft training material. Domain names and weightings are cited from Microsoft’s publicly published exam skills outline. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and renewal policies are set by Microsoft and may change; always verify current details on Microsoft Learn before scheduling your exam.