Azure Network Engineer Certification Guide

The Azure Network Engineer Associate certification is earned by passing a single Microsoft exam: AZ-700, "Designing and Implementing Microsoft Azure Networking Solutions". It is a 100-minute proctored exam with no prerequisites, scored out of 1,000 with a 700 pass mark, and — a point worth making in a year when Microsoft has retired a string of role-based certifications — it is fully active as of August 2026, with its official page refreshed as recently as late July 2026. This guide answers the questions AZ-700 candidates actually ask: what the exam covers, what it costs, who it suits, how to prepare, and how to know you are ready to book.

Consider a network engineer who has spent eight years with on-premises routers, firewalls and MPLS circuits, and whose employer is now extending the estate into Azure. That person is AZ-700's centre-of-gravity candidate: the exam essentially asks whether you can translate networking judgement you already have — routing, segmentation, load balancing, private connectivity — into Azure's constructs and quirks. Pure cloud administrators come at it from the opposite direction, strong on the portal but lighter on routing instincts, and preparation looks different for each, as we cover below.

What does the AZ-700 exam cover?

The official skills outline organises AZ-700 into five domains. Microsoft publishes the domains but not fixed question counts, so read these as areas of judgement rather than quotas:

Core networking infrastructure. Designing and implementing virtual networks: address-space planning, subnets, name resolution with Azure DNS (public and private), and inter-network routing. Hub-and-spoke topology questions live here, as does user-defined routing — the area where on-premises instincts help most, but where Azure's system routes and route-precedence behaviour differ enough from a traditional router to punish assumptions.

Connectivity services. The hybrid heart of the exam: site-to-site and point-to-site VPNs through VPN Gateway, ExpressRoute circuits and peering options, and Virtual WAN for larger, hub-managed topologies. Expect to weigh VPN against ExpressRoute for a scenario's bandwidth, latency and resilience requirements rather than merely define each.

Application delivery services. Azure's four load-balancing options — Azure Load Balancer, Application Gateway, Front Door and Traffic Manager — and, crucially, when each is the right answer. Layer 4 versus layer 7, regional versus global, and where Web Application Firewall policies attach. Many candidates can describe all four yet stumble when a scenario mixes global HTTP routing with regional non-HTTP traffic; practise choosing, not reciting.

Private access to Azure services. Service endpoints versus Private Link and private endpoints: how to reach platform services such as storage without traversing the public internet, and the DNS work that private endpoints drag with them. This domain is short on concepts and long on configuration consequences — private-endpoint DNS resolution is a classic exam trap because it is a classic production trap.

Azure network security services. Network security groups and application security groups, Azure Firewall and Firewall Manager, and DDoS protection. Scenarios often layer these — an NSG on the subnet, a firewall in the hub — and ask what actually happens to a given flow.

How to read the outline like an examiner

The five domains are not equally forgiving, and treating them as a flat list is the first strategic mistake most candidates make. Notice what the outline emphasises: nearly every domain is framed around designing and implementing, not describing. That verb choice matters. A question rooted in the connectivity domain will rarely ask "what is ExpressRoute?"; it will describe a company with a latency-sensitive workload, an existing VPN, and a compliance requirement to keep traffic off the public internet, then ask what you change. The knowledge being tested is the mapping from requirement to construct, so study each domain by asking "under what circumstances would I choose this over its neighbours?" rather than "what does this do?".

A second reading habit pays off: the domains overlap deliberately. Private endpoints sit in the private-access domain, but their DNS behaviour leans on the core-infrastructure domain's name-resolution material, and their traffic is filtered by the security domain's constructs. Scenario questions exploit these seams — a flow that crosses a peering, hits a firewall and lands on a private endpoint touches three domains in one question. If your notes are organised as five sealed boxes, reorganise them around traffic paths instead: where a packet enters, what routes it, what filters it, and what resolves its destination name. That structure mirrors how the exam actually composes its scenarios.

If your interest runs more to identity, threat protection and security operations than to moving packets, that is a different Microsoft track; the Azure Security Engineer AZ-500 guide covers where that credential stood as Microsoft's 2026 changes hit it.

What are the format, cost and renewal terms?

Format. 100 minutes, proctored, and it may include interactive components alongside conventional questions. Microsoft does not publish how many questions you will face — any specific count you read elsewhere is folklore. The pass mark is 700 on a 1–1,000 scale, and it is a scaled score: 700 does not mean 70% of questions correct, so ignore anyone reverse-engineering "how many you can get wrong".

Cost. Microsoft prices exams by the country or region where they are proctored, so there is no single official figure to quote. Third-party sources commonly cite US$165 for associate-tier exams in the United States; confirm the fee for your country on the exam's Pearson VUE booking page before budgeting.

Delivery. Pearson VUE, either at a test centre or online proctored at home. If you fail, the first retake is available after 24 hours, with longer waiting periods for later attempts.

Prerequisites. None. You do not need AZ-900 or AZ-104 first — although if you are new to Azure entirely, a fundamentals grounding helps, and our Azure Fundamentals AZ-900 guide explains that entry point in one sentence's worth of detour from this page's purpose.

Renewal. Like all Microsoft role-based associate certifications, Azure Network Engineer Associate is valid for one year — but renewal is free, online, unproctored and open book, via an assessment on Microsoft Learn that opens six months before expiry and can be retaken without limit. The one-year figure alarms people comparing it with other vendors' three-year cycles; in practice the free renewal makes upkeep an afternoon's work.

How should you prepare for AZ-700?

Two profiles, two plans.

If you come from traditional networking: your routing and segmentation judgement transfers; your gaps are Azure-specific behaviours and tooling. Prioritise, in order: virtual network peering and its non-transitive behaviour, user-defined routes versus system routes, private endpoint DNS, the four load balancers' selection criteria, and enough Azure CLI/portal fluency to parse the syntax that questions display. Build everything once by hand in a subscription — a hub with an Azure Firewall, two spokes, a VPN gateway, a private endpoint to a storage account — because Azure's defaults will surprise you in exactly the places the exam probes.

If you come from Azure administration: the portal holds no fear, but AZ-700 asks why traffic flows, not just where to click. Spend your time on routing logic: trace a packet from an on-premises client through a VPN tunnel, into a hub, through a firewall, across peering into a spoke, and to a private endpoint — and be able to say which route table, rule and DNS record touched it at every hop. BGP concepts around ExpressRoute and VPN deserve deliberate study, since day-to-day admin work rarely surfaces them.

Two candidates, sketched properly. Imagine Priya, a network engineer with a CCNA-era background and eight years of enterprise routing, whose firm is migrating workloads into Azure. Her first practice questions on user-defined routes feel easy — until she meets one where a UDR she expects to win is overridden, because Azure's route-selection behaviour differs from the longest-prefix-plus-administrative-distance world she knows. Her plan is therefore not "learn routing"; it is "find every place Azure's behaviour diverges from my instincts and drill exactly those". Peering non-transitivity, private-endpoint DNS and the gateway constructs are her list; concepts like segmentation and BGP need only a light Azure-flavoured refresh.

Now imagine Tomás, an Azure administrator of three years who deploys virtual networks weekly through the portal and infrastructure-as-code. He can build a hub-and-spoke blindfolded, but when a scenario asks why a spoke workload cannot reach on-premises after a firewall is inserted into the hub, he realises he has always consumed route tables someone else designed. His plan inverts Priya's: the Azure vocabulary is free, and the study time goes into first-principles traffic reasoning — effective routes, rule-evaluation order, and BGP's role in hybrid designs. Both candidates can pass; neither can borrow the other's plan.

A decision framework for the connectivity domain. Because hybrid connectivity questions dominate the exam's judgement calls, it is worth internalising an explicit ordering of questions to ask any scenario:

1. Does traffic have to stay off the public internet? If the scenario states a private-connectivity or compliance requirement, VPN over the internet is out of contention and ExpressRoute enters the frame.
2. What do the bandwidth and latency requirements say? VPN gateways suit modest, tolerant workloads; scenarios describing high-throughput or latency-sensitive traffic are steering you towards ExpressRoute.
3. How many sites and virtual networks are involved? One office and a handful of virtual networks is classic gateway territory. Scenarios describing many branches, or a requirement to manage connectivity at scale through hubs, are pointing at Virtual WAN.
4. What does the resilience requirement demand? Watch for the phrase that a link "must not be a single point of failure" — the expected answer often combines technologies, such as a VPN as failover alongside an ExpressRoute circuit, rather than choosing one.
5. What already exists? Exam scenarios frequently include an incumbent — an existing VPN, an existing circuit — and the best answer builds on it rather than replacing it. Read for what is already deployed before deciding what to add.

Run every connectivity practice question through those five filters and the "it depends" fog lifts: most scenarios contain exactly one sentence that eliminates two of the three options.

Choosing among the four load balancers without roulette. The application-delivery domain rewards the same discipline. Ask two questions in sequence: is the traffic HTTP(S) or not? and is the scope regional or global? Non-HTTP traffic rules out Application Gateway and Front Door immediately, leaving Azure Load Balancer for regional scenarios and Traffic Manager's DNS-based routing for global ones. HTTP traffic with layer-7 needs — path-based routing, WAF policies — points to Application Gateway regionally and Front Door globally. Then check the scenario for feature tells: mention of a Web Application Firewall narrows you to the two layer-7 services; mention of DNS-based failover is a Traffic Manager fingerprint. Write this out as your own two-by-two grid during revision and rehearse it until the classification is automatic, because the exam's composite scenarios — global HTTP entry in front of regional non-HTTP tiers — expect you to chain two services, not pick one.

For both profiles, the free Microsoft Learn path for AZ-700 maps to the skills outline and should anchor the plan. Microsoft publishes no official study-hours figure, and honest preparation time varies too much with background for anyone else's number to mean anything; let the readiness checklist below decide when you book, not the calendar.

Where do practice tests fit?

Use them as instruments, not shortcuts. After your first full pass through the material, take a timed set of AZ-700 practice questions and read the results by domain: a strong core-infrastructure score with a weak application-delivery score tells you precisely where the next fortnight goes. ExamPractice offers free samples on the exam page, with fuller question sets and a timed simulation mode for subscribers. Two cautions: never aim to memorise answers — the exam rewards the reasoning behind a scenario, and memorised answers collapse the moment Microsoft varies the scenario — and never trust materials promising "real exam questions", which at best mislead and at worst breach provider policy.