AZ-700:Designing and Implementing Azure Networking Solutions

Explore how Azure networking connects virtual networks and on-premises environments, configure virtual network peering, simulate on-prem networks with point-to-site and site-to-site VPNs, and use Network Watcher for monitoring.

Learn to build reusable Azure networking environments with infrastructure as code using Bicep, defining virtual networks, subnets, and virtual machine network security groups for quick, consistent deployments.

Learn to use Bicep to define and deploy Azure infrastructure, including virtual networks, subnets, and virtual machines, with reusable parameter-based files and automation in VS Code.

Discover how Azure virtual networks isolate resources and enable connectivity through virtual network peering, linking two networks hosting workloads and web servers like nginx on VMDevWeb01.

Enable boot diagnostics and use the Azure serial console to manage the virtual machines. Create two-way virtual network peering between vnets to enable private access to a Nginx web server.

Create a gateway subnet in the virtual network to host point-to-site vpn resources, assign a slash 27 or larger ip range, and deploy compute resources managed by the vpn service.

Deploy the VPN gateway to terminate point-to-site connections, route encrypted traffic from clients via the gateway to the virtual network, and authenticate with client certificates.

Create self-signed root and child certificates for a point-to-site vpn, export the root public key, and upload it to azure to enable certificate-based authentication from laptops.

Configure a point-to-site VPN gateway, set the client address pool, select IKEv2 with Azure certificate, and download and install the VPN client to connect to private web server at 10.0.0.4.

Explore point-to-site vpn authentication with Microsoft Entra ID, replacing certificates with centralized identity management, multi-factor authentication, and conditional access for secure connections.

Explore RADIUS authentication for point-to-site VPN, where an on-premises RADIUS server authenticates against Microsoft Active Directory domain services and serves as the authentication broker for the VPN gateway.

Learn how site-to-site VPN securely connects an on-premises data center to an Azure virtual network over the internet, using IPsec and IKE for a protected tunnel for hybrid cloud deployments.

Demonstrate site-to-site vpn deployment by simulating an on-premises site in Azure, provisioning a virtual network with gateway components, and using Windows Server 2025 as a software vpn device with bicep.

Provision on-prem simulation by deploying a new Azure virtual network and Windows Server 2025 VM using Bicep, with on-prem parameters, public IP, and site-to-site VPN groundwork.

Set up a Windows server VM as a VPN device with routing and remote access. Configure a site-to-site VPN to Azure and enable LAN routing and firewall adjustments.

Create a site-to-site vpn by configuring a local network gateway that defines the customer public ip address and private ip address range, then establish an ipsec connection.

Establish a site-to-site VPN between on-premises and the Azure VPN gateway by configuring a demand-dial interface, IKEv2, and a pre-shared key, then verify access to the Nginx server at 10.0.0.4.

Learn how to connect on-premises networks to Azure with site-to-site VPN and virtual network peering, enabling forwarded traffic and remote gateway usage for cross-network reach.

Select the right gateway sku by comparing maximum tunnels, point-to-site connections, throughput, and features such as BGP and zone redundancy, then review pricing to balance needs and budget.

Discover how Azure DNS private resolver forwards queries between Azure virtual networks and on-prem networks via inbound and outbound endpoints, without hosting zones, to set up a private zone.

Create a private dns zone azure.cloudportalhub.com and link virtual networks with auto registration; run a PowerShell setup to deploy corp.cloudportalhub.com with Active Directory Domain Services and integrate with the zone.

Deploy an Azure private DNS resolver, create a delegated subnet with an inbound endpoint, and configure a conditional forwarder to let on-premises domain queries resolve azure.cloudportalhub.com.

Extend your on-premises network onto Azure with a bidirectional tunnel and IP ranges. Connect via Azure network adapter and Windows Admin Center for a point-to-site VPN into a virtual network.

Explore Azure Network Watcher, to monitor, diagnose, and troubleshoot Azure networking with tools such as ip flow verify, next hop, packet capture, vpn monitoring, and virtual network flow logs.

Use Azure Network Watcher ip flow verify to check if inbound tcp traffic on port 80 to a vm is allowed by the network security group.

Use the NextHop network diagnostic tool to verify the path from bm-dev-web01's source IP to the test VM's destination IP, showing traffic traverses the virtual network peering connection.

Use the connection troubleshoot utility to verify TCP or ICMP reachability from a VM, gateway, or bastion to VM, FQDN, URI, or IP, and run connectivity and port scanner tests.

Enable continuous connection monitor to track connectivity, latency, and packet loss between a source and destination. Configure HTTP tests every 30 seconds and store results in a log annex workspace.

Learn how Microsoft Defender for Cloud delivers network security recommendations across Azure, multi-cloud, and on-prem deployments, with free and paid tiers, plus cloud security explorer for risk hunting.

Azure ExpressRoute offers a private, dedicated connection from on-premises to the Microsoft cloud, avoiding the internet for private access to Azure virtual networks and public services.

Create and provision an ExpressRoute circuit in Azure by selecting provider or direct, choosing a peering location and bandwidth, and sharing the service key with your provider.

Configure express route peering after provisioning circuit to connect to Azure virtual networks via private peering or to Microsoft cloud services via Microsoft peering, and deploy an express route gateway.

Explore Azure Virtual WAN, a centralized hub-and-spoke networking service that connects on-premises via gateway or express route with virtual networks, point-to-site, site-to-site, and peering.

Create a new Azure virtual WAN, delete legacy site-to-site and point-to-site configurations, and connect virtual networks via a hub with VPN gateway settings.

Connect the dev and test Azure networks via the virtual WAN hub using virtual network peering, then create connections and verify web server access.

Configure a point-to-site VPN in the Azure Virtual WAN hub by creating a user VPN config with certificate-based authentication. Download the profile, install the VPN client, and connect.

Configure a site-to-site vpn with an azure virtual wan hub, linking on-premises infrastructure to a virtual hub using a vpn site and abc123 as the pre-shared key.

Explore Azure Load Balancer, Azure Application Gateway, and Azure Front Door to design application delivery, comparing layer 4 and layer 7 capabilities, HTTP routing, and global edge routing for AZ-700.

Learn how the Azure load balancer, a fully managed layer 4 service for TCP/UDP, distributes traffic across healthy backend virtual machines using a front-end IP and monitors backend health.

Deploy two backend virtual machines with nginx and a simple index.html, then configure the azure load balancer standard sku to distribute requests to private IP addresses.

Deploy a public Azure load balancer, standard sku, in front of two virtual machines, configure a front-end IP, back-end pool, health probe, and a TCP 80 rule for nginx traffic.

Deploy a standard Azure load balancer with a front-end IP and public IP, configure back-end pool health probes and load balancing rules, and secure HTTP traffic.

Map front-end load balancer ports to backend VM ports using inbound NAT rules to securely access virtual machines via ssh, while reducing public exposure.

Enable outbound connectivity on the standard load balancer by configuring outbound rules that perform source network address translation to the frontend IP, with port mapping per backend instance.

Explain how a load balancer can host multiple front-end IP configurations and multiple back-end pools, mapping different domain names to separate back-end pools and routing rules.

Explore how an internal load balancer uses a private IP to enable private communication between web and app layers within a virtual network, ahead of private link service deployment.

Azure global load balancer directs users to the nearest regional load balancer to minimize latency, enables cross-region failover, and balances traffic across East US and North Europe.

Explore deploying a global Azure load balancer by duplicating infrastructure in East US and North Europe, configuring frontend and backend pools, health probes, and load balancing rules with Bicep templates.

Explain the OSI model and how Azure networking maps to it, showing layer 4 load balancers and layer 7 application gateways handling HTTP requests and routing.

Explore azure application gateway basics, a layer seven routing service that inspects http requests, routes by url and headers, enables multi-site hosting, and includes a web application firewall.

Virtual machine scale sets enable on-demand, identical machines as a backend for the application gateway and load balancer, enabling vertical and horizontal scaling driven by CPU thresholds.

Deploy two Ubuntu-based virtual machine scale sets behind an Azure application gateway, using layer seven url routing to serve separate images and videos apps with Nginx.

Configure a virtual machine scale set with custom script extensions to install nginx, serve index.html, and deploy scripts stored in an Azure storage account.

Learn to deploy an Azure application gateway with URL-based routing across two VM scale sets, using two back-end pools for images and videos, with a front-end listener on port 80.

Explore multi-site routing with Azure Web Apps as a managed backend for a load-balancing service, highlighting language support, automatic patching, and high availability alongside virtual machines.

Learn multi-site routing with Azure Application Gateway by hosting two Azure web apps on Azure App Service, mapping cloudportalhub.com and cloudapplearning.com to a single gateway, and managing basic plan quotas.

Create an empty virtual network and subnet for the Azure application gateway, map web apps to custom domains, and validate ownership with A and TXT DNS records.

Explore Azure traffic manager, a global DNS based load balancer that routes traffic to Azure endpoints, external endpoints, or nested endpoints using priority routing and other methods.

Deploy azure traffic manager with priority routing to a primary East US endpoint and a secondary North Europe endpoint, using Bicep to provision Windows Server VMs with Internet Information Services.

Configure a global Azure Traffic Manager profile using priority routing to direct traffic to the primary East US VM and failover to the secondary North Europe VM, with endpoint monitoring.

Learn how Azure Traffic Manager's performance routing directs traffic to the endpoint with the lowest latency, using two endpoints and latency measurements to optimize response times.

Geographic routing in Azure Traffic Manager directs users by region to designated endpoints for data compliance; switching requires deleting endpoints and configuring geo mappings for regions.

Master the weighted routing method in Azure Traffic Manager by assigning endpoint weights, configuring a primary and secondary, and gradually ramping traffic to test new versions.

Demonstrate subnet routing in Azure traffic manager by routing DNS responses based on client subnets. Explain multi-value routing that returns multiple healthy endpoints for high availability.

Learn how traffic manager supports nested endpoints by using a traffic manager profile as an endpoint for another profile, enabling weighted routing alongside existing priority endpoints.

Explore how Azure Front Door delivers global layer 7 load balancing, performance acceleration at the Microsoft global edge, and path-based routing with built-in web application firewall.

Configure azure front door to route user requests to two virtual machine origins with public IPs via latency-based routing, using origin groups and routes across east us and north europe.

Configure a custom domain for Azure Front Door with a CNAME and TXT validation, then associate it with a route.

Explore Azure virtual network service endpoints that extend your network identity to access services like Azure Storage, Azure SQL Database, and Azure Key Vault over the backbone with ip addresses.

Set up Ubuntu server in a virtual network with a public IP using Bicep, deploy Azure storage blob container, and illustrate service endpoints routing traffic over the Microsoft backbone.

Implement virtual network service endpoints to secure Azure storage access, configure firewall rules to allow selected networks, and validate connectivity via the storage browser.

Apply service endpoint policies to restrict a subnet's outbound traffic to an allow-list of storage accounts and block all others.

Discover how Azure private endpoints bring storage and SQL databases into your virtual network, using a private IP entry point and a private DNS zone, with per hour data charges.

Demonstrate implementing an Azure private endpoint for blob storage, disabling public access, provisioning a private NIC in the VNet, and validating private DNS resolves to a private IP.

Expose your service behind an internal load balancer with the Azure Private Link Service to provide private endpoints for cross-tenant consumption.

Configure Azure private link service by deploying provider vms with nginx behind an internal load balancer, and connect a consumer privately to the service via private link.

Explore how to integrate an Azure app service with a virtual network to access a private database on a virtual machine. Learn about outbound connectivity limitations and subnet requirements.

Demonstrates Azure virtual network integration by deploying a private IP MySQL database on an Ubuntu VM and connecting it to an Azure web app.

Deploy a PHP web app on an Azure web app and enable virtual network integration to privately connect to a Linux database server via its private IP.

Demonstrates implementing Azure virtual network integration for an app service by creating a subnet, delegating it to web servers, and privately connecting the web app to a MySQL database.

Learn how to define rules in a network security group, a lightweight stateful firewall at layer 4, and how NSGs apply to network interface or subnet with default rules.

Use Bicep to automate a two-VM Azure network with two subnets and NSGs, deploying nginx on the web server and mysql on the database VM, with parameterized cloud-init.

Explore azure network security groups (NSGs) and learn how inbound and outbound rules, explicit deny entries, and priorities control traffic between two virtual machines and a web server.

Use service tags in network security groups to permit internet access to a web server through a public IP, with NAT to its private IP for http traffic.

Demonstrates configuring outbound security rules on NSGs, denying outbound traffic and testing connectivity for database and web servers, and explains NSG statefulness and how inbound rules affect return traffic.

Explore how to allow outbound connectivity from a VM to Azure storage using network security groups, service tags, and outbound rules, enabling secure access to storage accounts.

Demonstrates configuring service endpoints and NSG outbound rules to secure Azure storage access, showing how deny rules and priority affect connectivity from a virtual network.

Configure private endpoints and NSGs to access storage via a private endpoint, using private DNS and outbound rules that allow https traffic to the private NIC in the web subnet.

Learn to implement a centralized subnet-level network security group, attach it to multiple subnets, and migrate rules while ensuring inbound access (ssh, http) and a deny-all baseline.

Define and use application security groups to simplify NSG rules by mapping sources and destinations to groups, easing maintenance as web and database servers scale.

Use application security groups to replace IP-based NSG rules by tagging VM network interfaces for web and database workloads, enabling scalable, maintainable access control.

Understand that attaching an NSG to the Bastion subnet is optional. If used, define inbound and outbound rules before linking, including https traffic and gateway manager considerations.

Discover how the web application firewall inspects layer 7 traffic to block SQL injection and XSS, and enable it on Azure application gateway or Azure Front Door in detection mode.

Deploy an Azure application gateway with web application firewall v2 in front of two virtual machines running nginx, configure two subnets, and set up path-based routing for images and videos.

Configure an Azure application gateway with a web application firewall in detection mode, push logs to Log Analytics, and manage OWASP rules and policy overrides.

Add a custom rule to the Azure web application firewall policy to block a specific IP address range, then switch from detection to prevention mode to enforce 403 forbidden.

Learn to add multiple web application firewall policies to an Azure application gateway, assign policies at the gateway and listener levels, and understand policy precedence and detection mode.

Explore Azure Firewall service, a managed stateful firewall with high availability that filters traffic with rules, supports fully qualified domain name filtering and TLS detection across basic, standard, premium SKUs.

Deploy and configure Azure Firewall infrastructure within a hub-and-spoke virtual network, including specialized Azure Firewall subnet and firewall management subnet, using Bicep deployments and VNet peering.

Deploy an Azure firewall to a virtual network, select East US with the Standard SKU, attach a firewall policy, and provision a public IP for firewall connectivity.

Route internet traffic from spoke networks through the azure firewall using user-defined routes and route tables, then add an application rule to allow destinations like www.google.com.

Create Azure firewall application rules to allow fully qualified domain names from the spoke network; add a rule collection with priority and allow google.com, plus assign a public IP.

Learn how Azure Firewall DNAT rules translate traffic from the firewall's public IP to a private IP within virtual network, enabling SSH access to a spoke VM on port 22.

Enter the practice section to cement your Azure networking knowledge with practice tests, labs, and demos that test understanding beyond theory, not copying exact exam questions.

Learn how to structure this AZ-700 course from creating an Azure free account to mastering networking services with labs, resources, and a practice test.

Deploy a new Azure virtual machine within an existing virtual network using the Azure portal wizard, selecting Windows Server 2019 or Ubuntu, configuring size, networking, and public IP.

Configure a basic load balancer with a backend pool of virtual machines, add a tcp health probe, and implement a port 80 front-end to back-end rule to distribute requests.

Implement a two-site Azure application gateway setup with dual backend pools and routing rules, configuring listeners for cloud to hub.com and cloud portal hub.com, and map them with DNS records.

Learn how a radius server authenticates on-premises Active Directory users for point-to-site VPN connections to an Azure virtual network.

Explore how Azure Virtual WAN centralizes network connectivity with a virtual hub, linking multiple Azure virtual networks and on-premises via site-to-site and point-to-site VPNs.

Delete prior network gateway and peering resources, then create an Azure Virtual WAN, choose basic for VPN site-to-site only or standard for point-to-site, ExpressRoute, and VNet connectivity.

Learn to create an Azure virtual hub within a virtual WAN, configure hub address space, and set up point-to-site and site-to-site VPN gateways with certificate-based authentication.

Connect Azure virtual networks to a virtual WAN hub by creating virtual network connections, associating with the hub and route table, and verify inter-network communication via demo and peering VM.

Configure point-to-site VPN with Azure Virtual WAN hub, download and install the VPN profile, connect, and access the private VM Default.html page via the assigned client IP and routes.

Learn to set up a site-to-site VPN with Azure Virtual WAN by creating a VPN site, linking it to the virtual hub, and importing VPN config to your hardware router.

Explore the theory of Azure ExpressRoute and its direct connections via ISP or the Microsoft backbone. Understand exam-focused objectives and note demo challenges, with future lab possibilities.

Understand Azure ExpressRoute SKUs local, standard, and premium, and how pricing and connectivity vary by region and geopolitical boundaries. Learn to create an ExpressRoute circuit and share it across subscriptions.

Configure coexisting Azure ExpressRoute connections by deploying two gateways, one for ExpressRoute and one for site-to-site VPN, and link up to ten virtual networks to the ExpressRoute circuit.