AZ-700 study guide · 2026

The 5 AZ-700 domains, explained

5 domains and 16 official functional groups. Design and implement core networking infrastructure carries the most weight at 25–30%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
Not published
Time
100 minutes
Passing score
700 / 1000
Outline
AZ-700 study guide, skills measured as of July 27, 2026 (current)

Exam blueprint

Bar widths follow the official weights, scaled to fit the bar. Weight ranges are drawn at their midpoint.

  1. 1 25–30%
  2. 2 20–25%
  3. 3 15–20%
  4. 4 10–15%
  5. 5 15–20%
  1. 1 Design and implement core networking infrastructure
  2. 2 Design, implement, and manage connectivity services
  3. 3 Design and implement application delivery services
  4. 4 Design and implement private access to Azure services
  5. 5 Design and implement Azure network security services

All 5 domains

16 official functional groups 51–67 hrs suggested study

  1. Domain 01 25–30%

    Design and implement core networking infrastructure

    The largest AZ-700 skill area: planning address space and subnets, public IP resources, Azure DNS and DNS Private Resolver, peering and user-defined routing, Route Server and NAT Gateway, plus monitoring with Network Watcher and Defender for Cloud.

    Inside this domain

    • Design and implement IP addressing for Azure resources
    • Design and implement name resolution
    • Design and implement VNet connectivity and routing
    • Monitor networks

    Watch for Peering is transitive

    Functional groups
    4
    Questions est.
    ~14
    Study time est.
    14–18 hrs
  2. Domain 02 20–25%

    Design, implement, and manage connectivity services

    Hybrid connectivity for Azure: site-to-site and point-to-site VPN gateways, authentication and tunnel types, ExpressRoute circuits, peering and resiliency options, and Virtual WAN hubs with scale units and hub routing.

    Inside this domain

    • Design, implement, and manage a site-to-site VPN connection
    • Design, implement, and manage a point-to-site VPN connection
    • Design, implement, and manage Azure ExpressRoute
    • Design and implement an Azure Virtual WAN architecture

    Watch for Policy-based is simpler

    Functional groups
    4
    Questions est.
    ~12
    Study time est.
    14–18 hrs
  3. Domain 03 15–20%

    Design and implement application delivery services

    Choosing and configuring Azure's load balancing and delivery services: Load Balancer and Gateway Load Balancer at layer 4, DNS-based Traffic Manager, regional Application Gateway at layer 7, and global Azure Front Door with caching and Private Link origins.

    Inside this domain

    • Design and implement Azure Load Balancer and Azure Traffic Manager
    • Design and implement Azure Application Gateway
    • Design and implement Azure Front Door

    Watch for Traffic Manager terminates TLS

    Functional groups
    3
    Questions est.
    ~9
    Study time est.
    9–12 hrs
  4. Domain 04 10–15%

    Design and implement private access to Azure services

    Keeping traffic to Azure PaaS services off the public internet: planning and creating private endpoints, publishing your own Private Link service, integrating privatelink DNS zones and on-premises clients, and using service endpoints with endpoint policies.

    Inside this domain

    • Design and implement Azure Private Link service and Azure private endpoints
    • Design and implement service endpoints

    Watch for Service endpoint for on-premises

    Functional groups
    2
    Questions est.
    ~6
    Study time est.
    5–7 hrs
  5. Domain 05 15–20%

    Design and implement Azure network security services

    Filtering and inspecting Azure network traffic: network and application security groups, VNet flow logs and IP flow verify, Bastion access rules, Azure Firewall SKUs, rules and Firewall Manager policies, secured virtual hubs, and Web Application Firewall policies.

    Inside this domain

    • Implement and manage network security groups
    • Design and implement Azure Firewall and Azure Firewall Manager
    • Design and implement a Web Application Firewall (WAF) deployment

    Watch for NIC allow beats subnet deny

    Functional groups
    3
    Questions est.
    ~9
    Study time est.
    9–12 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 51–67 hrs of study.

  1. 1 Design and implement core networking infrastructure 25–30% · 14–18 hrs
  2. 2 Design, implement, and manage connectivity services 20–25% · 14–18 hrs
  3. 3 Design and implement application delivery services 15–20% · 9–12 hrs
  4. 5 Design and implement Azure network security services 15–20% · 9–12 hrs
  5. 4 Design and implement private access to Azure services 10–15% · 5–7 hrs

Try one

Practice questionDomain 1: Design and implement core networking infrastructure

A company has a hub VNet with an Azure Firewall and two spoke VNets peered only with the hub. Workloads in Spoke1 cannot reach workloads in Spoke2. Security requires all spoke-to-spoke traffic to be inspected. What should you configure?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Peering is transitive

    Clue Two spokes are peered only with the hub.

  • Domain 2

    Policy-based is simpler

    Clue More than one site or remote users appear in the requirements.

  • Domain 3

    Traffic Manager terminates TLS

    Clue Requirement includes TLS offload or caching.

  • Domain 4

    Service endpoint for on-premises

    Clue Clients are in a data center connected by VPN or ExpressRoute.

  • Domain 5

    NIC allow beats subnet deny

    Clue Two NSGs are associated on the path.

Other Networking certifications

Study guides for exams that overlap with AZ-700.

Practise what you read

AZ-700 domains: common questions

How many domains are in the AZ-700 exam?

AZ-700 has 5 domains with 16 official functional groups between them: Design and implement core networking infrastructure, Design, implement, and manage connectivity services, Design and implement application delivery services, Design and implement private access to Azure services and Design and implement Azure network security services.

Which AZ-700 domain carries the most weight?

Design and implement core networking infrastructure is the heaviest at 25–30%, followed by Design, implement, and manage connectivity services (20–25%). The lightest is Design and implement private access to Azure services (10–15%). Weights come from Microsoft's official outline.

What is the AZ-700 exam format?

Questions: Not published. Time allowed: 100 minutes. Passing score: 700 / 1000.

How long should I study for AZ-700?

Our planning estimate is 51–67 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Design and implement core networking infrastructure, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows AZ-700 study guide, skills measured as of July 27, 2026 (current), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (AZ-700 study guide, skills measured as of July 27, 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.