Updated 1 Nov 2026 · 6 min read
On this page
What the Microsoft AZ-700 is and who it is for
The AZ-700 is the exam behind the Microsoft Certified: Azure Network Engineer Associate certification. Microsoft rates it intermediate and aims it at people who plan, implement and manage Azure networking solutions: core network infrastructure, hybrid connectivity, application delivery services, private access to Azure services and network security.
In Microsoft's description, an Azure network engineer optimises the performance, resiliency, scale and security of Azure networks, monitors them to find issues and resolves connectivity problems. You work alongside solution architects, cloud administrators, security engineers, application developers and DevOps engineers. Microsoft expects experience creating and managing compute, storage and networking resources in Azure, and an understanding of networking fundamentals such as name resolution, network protocols and network address management.
The skills measured were last revised on 27 July 2026. Microsoft's change log for that revision shows no change to any skill area, only minor edits to the objectives on IP addressing, network monitoring and network security groups.
Microsoft AZ-700 at a glance
| Item | Detail |
|---|---|
| Exam code | AZ-700 |
| Time allowed | 100 minutes |
| Passing score | 700 or greater |
| Exam fee | US$165 in the US, priced by the country or region where you sit it |
| Languages | English, German, Spanish, French, Italian, Japanese, Korean, Portuguese (Brazil), Chinese (Simplified) and Chinese (Traditional) |
| Where you sit it | Proctored, scheduled through Pearson VUE |
| Certification valid for | 12 months, renewed with a free online assessment on Microsoft Learn |
Microsoft does not publish a question count for the AZ-700. It says most of its certification exams typically contain between 40 and 60 questions, but that the number varies by exam. The exam may also include interactive components.
What is on the exam
Design and implement core networking infrastructure (25 to 30%). The heaviest domain. IP addressing and subnetting, including subnets for gateways, private endpoints, firewalls, Application Gateway and Azure Bastion, subnet delegation and public IP prefixes. Then name resolution with public and private DNS zones and Azure DNS Private Resolver, routing with VNet peering, gateway transit, Azure Virtual Network Manager, user-defined routes, forced tunnelling, Azure Route Server and NAT Gateway. It ends with monitoring through Network Watcher, DDoS protection and the network recommendations in Microsoft Defender for Cloud.
Design, implement, and manage connectivity services (20 to 25%). Site-to-site VPN, including gateway SKUs, policy-based versus route-based VPNs, local network gateways and IPsec/IKE policies. Point-to-site VPN with tunnel types and RADIUS or Microsoft Entra ID authentication. ExpressRoute connectivity models, SKUs, private and Microsoft peering, Global Reach, FastPath and ExpressRoute Direct. Finally Azure Virtual WAN: SKUs, virtual hubs, scale units and hub routing.
Design and implement application delivery services (15 to 20%). Choosing and configuring Azure Load Balancer (public or internal, regional or cross-region, outbound rules and SNAT) and Traffic Manager, then Application Gateway with listeners, routing rules, health probes, TLS and rewrite rules, and Azure Front Door with tiers, caching, TLS and Private Link origins.
Design and implement private access to Azure services (10 to 15%). Private endpoints, the Private Link service and how both integrate with DNS and on-premises clients, plus service endpoints and service endpoint policies, and when to choose one over the other.
Design and implement Azure network security services (15 to 20%). Network security groups and application security groups, virtual network flow logs and IP flow verify, then Azure Firewall SKUs, rules and Firewall Manager policies, a secured Virtual WAN hub, and Web Application Firewall policies on Front Door and Application Gateway in detection or prevention mode.
Why people fail it
Many objectives start with a choice: which gateway SKU, which ExpressRoute model, which load balancing service, private endpoint or service endpoint. Load Balancer, Application Gateway, Front Door and Traffic Manager all spread traffic, but at different layers and scopes. Candidates who learn each service on its own, without comparing them, struggle when a scenario lists requirements and four plausible services.
Hybrid connectivity is the second trap. Few people have built ExpressRoute or Virtual WAN in their own work, and lab time for them is limited, so these objectives become pure reading. Expect detail on SKUs, peering types and routing.
The third is DNS and routing together. Private endpoints only work when DNS resolves to them, and forced tunnelling or a route table on the wrong subnet breaks traffic quietly. Questions that ask why a connection fails often come down to name resolution or an effective route.
A study plan that fits the exam
Eight weeks suits most people who already manage Azure resources. Core infrastructure and connectivity carry about half the weight, so they get four weeks.
- Week 1: addressing and DNS. Plan a VNet address space and subnets, create public IP prefixes, configure private DNS zones and Azure DNS Private Resolver. Try the free AZ-700 practice questions to find your gaps.
- Week 2: routing and monitoring. Peering with gateway transit, Virtual Network Manager, route tables and forced tunnelling, Route Server and NAT Gateway, then Network Watcher and DDoS protection.
- Week 3: VPN. Build a site-to-site VPN and a point-to-site VPN, compare gateway SKUs and set an IPsec/IKE policy. Diagnose a broken connection on purpose.
- Week 4: ExpressRoute and Virtual WAN. Connectivity models, SKUs and tiers, private and Microsoft peering, Global Reach and FastPath, then virtual hubs and hub routing.
- Week 5: application delivery. Build a Load Balancer with outbound rules, an Application Gateway with rewrite rules and a Front Door profile. Write down when you would use each, and Traffic Manager.
- Week 6: private access. Create private endpoints and a Private Link service, link them to private DNS, and compare them with service endpoints and their policies.
- Week 7: network security. NSGs and ASGs, flow logs, Azure Firewall rules and Firewall Manager, a secured hub, and WAF policies in both modes.
- Week 8: timed runs. Take Microsoft's free Practice Assessment, then work through the 387 questions in the AZ-700 practice question pack in 100 minute blocks and read the explanation for every miss.
On exam day
You schedule through Pearson VUE. Microsoft strongly recommends registering with a personal Microsoft account, because exam records tied to a work or school account are lost if you leave that organisation. Before the day, try Microsoft's exam sandbox to see the question types in the real interface.
You get 100 minutes, and Microsoft suggests allowing 120 minutes of seat time for associate exams of this length. Five minutes of break time is built in. You can take breaks, but the clock keeps running and you cannot return to questions you saw before the break. You can open Microsoft Learn in a split screen during the exam, but the timer does not stop, so keep it for a detail you cannot recall. If the exam is not offered in your preferred language, you can request an extra 30 minutes.
Frequently asked questions
What happens if I fail the AZ-700?
You can retake it after 24 hours. After that, Microsoft imposes a 14 day wait between attempts, with no more than five attempts in 12 months from the first. Microsoft's policy says you must pay to retake the exam where applicable, so plan the next attempt around your weakest areas.
How do I keep the certification?
It expires after 12 months unless you renew it. Once it is within six months of expiry, you can renew at no cost by passing an online renewal assessment on Microsoft Learn. If you fail the renewal assessment, you can try again, with no limit on attempts before the certification expires.
Is the practice pack enough on its own?
No. It is practice, not a course. The 387 questions show how Microsoft frames networking decisions and explain why the other options are wrong, but they do not teach you to build a VPN or troubleshoot a route. Use Microsoft Learn and a test subscription for that, then use the questions to check yourself under time.
When you are ready to test yourself properly, get the AZ-700 practice questions with full explanations.
Sources
The official pages the facts in this guide were checked against.
- learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-700
- learn.microsoft.com/en-us/credentials/certifications/azure-network-engineer-associate/
- learn.microsoft.com/en-us/credentials/exam-pricing.json
- learn.microsoft.com/en-us/credentials/certifications/azure-network-engineer-associate/renew/
- learn.microsoft.com/en-us/credentials/support/retake-policy
- learn.microsoft.com/en-us/credentials/support/exam-duration-exam-experience
What people say about this pack
The best part about these dumps wasn't just the answers, but the explanations. They were clear and helped me actually understand the 'why' behind VPN Gateway configurations. I didn't just memorize; I learned. Passed with a 910.
I was skeptical about dumps, but a friend vouched for Certstash. For the AZ-700, their material is legit. The scenario-based questions are incredibly well-written and force you to think, which is exactly what the real exam does. I'm a believer now.