AZ-700 Exam Guide: The Five Domains, the Format, and the Gap in the Official Learning Path

AZ-700 is Microsoft's associate-level exam for Azure network engineers, and passing it earns the Microsoft Certified: Azure Network Engineer Associate certification. Microsoft publishes five weighted skill areas, allows 100 minutes, and sets the pass mark at 700 on a scaled score. Every number in this guide links to the Microsoft page it came from.

What AZ-700 covers

The AZ-700 study guide carries the current outline, dated as of July 27, 2026, and it is the page that states the weightings. There are five skill areas:

• Core networking infrastructure — 25–30%
• Connectivity services — 20–25%
• Application delivery services — 15–20%
• Network security services — 15–20%
• Private access to Azure services — 10–15%

Microsoft's own headings put design and implement in front of each of those, and add manage to the second one. Read the verbs. This is not an exam that asks you to describe Azure networking; it asks you to build it and keep it running.

Core networking infrastructure, the largest area, is address space and subnet planning, public IP addresses and prefixes, DNS in both its public and private forms including Azure DNS Private Resolver, peering and service chaining, user-defined routes and forced tunneling, Azure Route Server, NAT Gateway, and monitoring through Network Watcher. DDoS protection and the network recommendations that Microsoft Defender for Cloud produces also sit here.

Connectivity services is the hybrid half of the exam: site-to-site and point-to-site VPN, gateway SKU selection, IPsec and IKE policy, client authentication by RADIUS or Microsoft Entra ID, then ExpressRoute at length — connectivity models, SKUs and tiers, peering choices, FastPath, Global Reach, ExpressRoute Direct, encryption and Bidirectional Forwarding Detection. Azure Virtual WAN closes the area, with its hubs, scale units and routing.

Application delivery services is the load-balancing family. Azure Load Balancer covers SKUs and tiers, public against internal, regional against cross-region, load balancing rules, inbound NAT rules and outbound SNAT. Traffic Manager and Gateway Load Balancer appear here too. Application Gateway brings listeners, routing rules, health probes, HTTP settings, TLS and rewrite rule sets; Front Door brings tiers, origins, caching, traffic acceleration, a rules engine and Private Link to an origin. Choosing between those services is a decision the exam returns to often, so we gave it its own article.

Network security services covers network security groups and application security groups, virtual network flow logs and IP flow verify, an NSG configured for remote administration including Azure Bastion, security administration through Azure Virtual Network Manager, Azure Firewall with Firewall Manager policies, and Web Application Firewall on both Application Gateway and Front Door.

Private access to Azure services is the smallest area and has only two parts: Private Link with private endpoints — planning them, creating them, controlling access, wiring them into DNS, reaching them from on-premises clients — and virtual network service endpoints with their policies.

Two notes on that outline are worth reading before you use it as a checklist. Microsoft says the sub-bullets show how each skill is assessed, and that related topics can still appear. It also says most questions sit on generally available features, with preview features possible where they are in common use.

Format and scoring

The certification page allows 100 minutes. It also states that the exam is proctored and that interactive components may appear. Those cost more time per item than a plain multiple-choice question, so watch the clock.

Microsoft does not publish a question count for AZ-700. Several sites quote one. None of them can source it, and we would rather tell you the figure is unpublished than repeat a guess.

You need 700 to pass. Microsoft reports technical exam scores from 1 to 1,000 and scales them. So 700 is not "70% of the questions right", and that page says as much: a scaled score may not equal 70% of the points. Two more things from it are worth knowing on the day. Some items are unscored trial questions and you cannot tell which. And there is no penalty for a wrong answer, so leave nothing blank.

There is no single worldwide price. The certification page says the fee depends on the country or region where the exam is proctored, and Pearson VUE shows your amount while you schedule. The exam is offered in ten languages: English, plus French, German, Italian and Spanish; Japanese, Korean and Brazilian Portuguese; and Chinese in both Simplified and Traditional forms.

If it goes badly, you can book again 24 hours later; waits get longer for further attempts. And this certification does expire. The page gives a renewal frequency of 12 months. Renewal costs nothing and is unproctored and open book. You take it on Microsoft Learn, inside a six-month window before your expiry date. A pass moves that date on by a year.

What the official learning path covers — and what it does not

One learning path on Microsoft Learn belongs to this exam: Design and Implement Microsoft Azure Network Solutions, which carries the AZ-700 code in its title. The page lists eight modules.

Microsoft publishes the size of that path in its own training catalogue: the eight modules hold 68 units and 389 minutes of material, which is 6 hours and 29 minutes. The July 2026 outline holds 136 sub-bullets.

The judgement that follows is ours, and only the judgement. When we built our AZ-700 question bank we had to know where our grounding could come from, so we read every unit in that path and tested every sub-bullet against one rule. Does a unit teach the operation or the decision that the bullet's verb asks for, rather than simply name the topic?

49 of the 136 sub-bullets passed that test — 36%. Another 60 were named without being taught, 6 got a bare mention, and 21 were not named anywhere in the path. The proportion held across all five areas, between 30% and 42%, which tells us this is how the path is built rather than one weak module in it.

That is the honest explanation for something many candidates describe: finishing the official path, then finding that practice questions still go wrong. The path introduces Azure networking well. The exam asks you to choose a gateway SKU against a bandwidth requirement, size a subnet for a service that reserves addresses, pick a peering model, and decide between a service endpoint and a private endpoint for the same storage account.

Microsoft does leave the depth somewhere, and the study guide says where. Its Find documentation section points at the product documentation — ExpressRoute, Azure DNS, Virtual WAN, Route Server, Load Balancer, Application Gateway, Front Door, Traffic Manager, NAT Gateway, Azure Firewall, Web Application Firewall, Azure Monitor, Private Link and more. Those pages carry the operational detail the modules skip, and they are free. Budget real time for them.

Who AZ-700 is for

Microsoft's audience profile expects a candidate who already plans, implements and manages Azure networking solutions as a subject matter expert. Five areas are named: hybrid connectivity, core network infrastructure, application delivery, private access and network security. The profile describes the job as much as the exam — tuning performance, resiliency, scale and security, watching the environment for problems, and fixing connectivity when it breaks.

On background, the study guide asks for experience creating and running Azure compute, storage and networking resources. It also expects the fundamentals: network protocols, name resolution, and how addresses are managed. The learning path adds its own list: IP addressing, DNS and routing, a connectivity method such as VPN or WAN, and comfort with both the Azure portal and Azure PowerShell.

No exam is named as a prerequisite. In practice, if you already administer Azure — the ground AZ-104 covers — you have the starting point this exam assumes. If your networking is strong but your Azure is thin, expect the portal work to cost you more than the theory.

This article covers what AZ-700 is. It leaves two questions alone on purpose. For the schedule, we wrote an AZ-700 study plan; for the difficulty, an honest look at how hard the exam is. Both are built from the same published weightings.

Our AZ-700 practice exams were written against this outline, question by question, with every answer explained and linked to the official Microsoft page behind it. No dumps, ever.

Independent study material. ciply.io is not affiliated with, endorsed by, or sponsored by Microsoft.