Overview
Domain 1 is the foundation every other AZ-700 skill area builds on. Microsoft splits it into four functional groups. IP addressing covers address spaces, subnet sizing for gateways, firewalls, Bastion and delegated services, public IP addresses, public IP prefixes and bring-your-own Custom IP prefixes. Name resolution covers VNet DNS settings, public and private DNS zones, virtual network links and Azure DNS Private Resolver. Connectivity and routing covers peering with gateway transit, Azure Virtual Network Manager, user-defined routes, forced tunneling, Azure Route Server and NAT Gateway.
The fourth group, Monitor networks, covers Network Watcher diagnostics and logs, Azure Monitor network insights, DDoS Protection, and the network findings surfaced by Microsoft Defender for Cloud through Secure Score, attack path analysis and Cloud Security Explorer. At 25–30% this is the heaviest domain, and AZ-700 remains an active exam with no retirement announced as of October 2026.
How it's tested
AZ-700 questions in this domain present a network diagram or a requirements list and ask which address plan, DNS design, route or diagnostic tool fits. Expect case studies, drag-and-drop ordering of configuration steps and items where two answers work but only one meets every stated constraint such as cost or least administrative effort.
-
Pick the subnet plan
A set of services is listed, and you choose subnet names and sizes that leave room for gateways, firewalls, Bastion and delegated platform services.
-
Fix the route
Traffic takes the wrong path, and you identify the missing or conflicting user-defined route, peering setting or BGP propagation option.
-
Choose the diagnostic
A connectivity symptom is described, and you select the Network Watcher capability that isolates the cause fastest.
Spoke VMs must reach on-premises through a VPN gateway that lives in the hub. Peering alone does not share the gateway. The hub peering needs Allow gateway transit, and each spoke peering needs Use remote gateways. If the spokes also have their own gateway, Use remote gateways cannot be enabled. Recognizing that the requirement is shared gateway access, not more peering, points to the gateway transit settings.
Functional groups 4
Official functional groups from the Microsoft outline, in outline order.
1.1 Design and implement IP addressing for Azure resourcesAddress spaces, subnet planning, delegation, public IP addresses and prefixes.
- What it means
- This group covers planning non-overlapping address spaces and segmentation, creating VNets, sizing subnets for virtual network gateways, private endpoints, firewalls, application gateways, VNet-integrated platform services and Azure Bastion, choosing shared or dedicated subnets, subnet delegation, public IP addresses, public IP prefixes and Custom IP prefixes for bringing your own ranges.
- What to understand
- Azure reserves five addresses in every subnet, so a /29 yields three usable IPs. Several services require a dedicated, specifically named subnet: GatewaySubnet, AzureFirewallSubnet (/26), AzureBastionSubnet (/26 or larger) and RouteServerSubnet. Delegation hands a subnet to one platform service such as SQL Managed Instance or App Service VNet integration. A public IP prefix reserves a contiguous block of Standard static addresses so allow lists stay stable. A Custom IP prefix onboards a range your organization already owns.
- How it shows up
- Expect a list of planned services and a question about the minimum subnet size, required subnet name or whether a prefix is needed for predictable outbound addresses.
- Common confusion
- Thinking a public IP prefix brings your own addresses; that is a Custom IP prefix, while a public IP prefix is Microsoft-owned space.
1.2 Design and implement name resolutionAzure-provided DNS, custom DNS, public and private zones, links and DNS Private Resolver.
- What it means
- This group covers how VMs in a VNet resolve names, configuring DNS server settings on the VNet, designing and configuring public DNS zones and private DNS zones, linking a private zone to VNets with optional autoregistration, and designing Azure DNS Private Resolver for hybrid resolution between Azure and on-premises.
- What to understand
- By default a VNet uses Azure-provided DNS at 168.63.129.16. Setting custom DNS servers on the VNet changes every NIC unless overridden. A private DNS zone resolves only for VNets that have a virtual network link to it, and autoregistration creates records for VMs in that VNet. DNS Private Resolver uses an inbound endpoint so on-premises servers can forward queries into Azure, and an outbound endpoint with a forwarding ruleset so Azure workloads can resolve on-premises domains, removing the need for DNS server VMs.
- How it shows up
- Expect hybrid scenarios that ask which resolver endpoint, ruleset or zone link lets a specific client resolve a specific name.
- Common confusion
- Mixing up inbound and outbound endpoints; inbound receives queries from on-premises, outbound sends Azure queries to external DNS servers.
1.3 Design and implement VNet connectivity and routingPeering, gateway transit, Virtual Network Manager, UDRs, forced tunneling, Route Server and NAT Gateway.
- What it means
- This group covers designing service chaining and gateway transit, implementing regional and global VNet peering, managing connectivity at scale with Azure Virtual Network Manager, creating user-defined routes and associating route tables with subnets, forced tunneling, diagnosing routing problems, deploying Azure Route Server for BGP with network virtual appliances, and choosing and implementing Azure NAT Gateway.
- What to understand
- Peering is not transitive, so spoke-to-spoke traffic needs a hub appliance with UDRs, direct peering or a Virtual Network Manager mesh. Azure picks the route with the longest matching prefix, then prefers user-defined over BGP over system routes. Forced tunneling sends 0.0.0.0/0 to on-premises for inspection. Route Server exchanges routes with NVAs over BGP but never carries data traffic. NAT Gateway gives a subnet scalable outbound SNAT and takes priority over load balancer outbound rules and default outbound access.
- How it shows up
- Expect questions about why two spokes cannot talk, which next hop type to use, or what to deploy so NVA routes reach VNets automatically.
- Common confusion
- Assuming Route Server forwards packets; it only exchanges routes, and traffic still flows directly to the NVA.
1.4 Monitor networksNetwork Watcher, Azure Monitor network insights, DDoS Protection and Defender for Cloud findings.
- What it means
- This group covers configuring Network Watcher monitoring, diagnostics and logs, troubleshooting network health with Network Watcher and with Azure Monitor network insights, enabling and monitoring DDoS protection, and evaluating network recommendations from Microsoft Defender for Cloud through Secure Score, attack path analysis and Cloud Security Explorer.
- What to understand
- Network Watcher tools each answer one question: IP flow verify tests an NSG decision, next hop shows the chosen route, connection troubleshoot tests end-to-end reachability, Connection monitor tracks latency and loss over time, and packet capture records traffic. Virtual network flow logs with traffic analytics replace NSG flow logs. DDoS Network Protection covers a whole VNet with cost protection and rapid response support, while DDoS IP Protection is priced per public IP. Defender for Cloud ranks exposures such as internet-facing VMs and shows exploitable attack paths.
- How it shows up
- Expect a symptom followed by four Network Watcher tools, or a request to find all internet-exposed VMs across subscriptions.
- Common confusion
- Using IP flow verify to find routing problems; it only evaluates NSG rules, while next hop reveals the effective route.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Five reserved subnet addresses
Azure keeps the network, gateway, two DNS-mapped and broadcast addresses in every subnet.
- Remember
- Usable hosts equal the subnet size minus five.
- Tested as
- Subnet sizing questions.
- Trap
- Subtracting only two addresses as in traditional networking.
-
GatewaySubnet
The required subnet name for VPN and ExpressRoute gateways.
- Remember
- Use /27 or larger and never attach an NSG that blocks gateway traffic.
- Tested as
- Gateway deployment questions.
- Trap
- Renaming it or sizing it at /29 for a coexistence design.
-
Subnet delegation
Assigning a subnet to one Azure platform service so it can inject resources there.
- Remember
- A delegated subnet serves only that service.
- Tested as
- Subnet planning questions.
- Trap
- Placing VMs in a delegated subnet.
-
Public IP prefix vs Custom IP prefix
A prefix reserves contiguous Microsoft-owned addresses; a Custom IP prefix onboards addresses you own.
- Remember
- Both give predictable outbound and inbound addresses.
- Tested as
- IP planning and allow-list questions.
- Trap
- Treating them as the same feature.
-
Private DNS zone link
A virtual network link that lets a VNet resolve records in a private zone.
- Remember
- Autoregistration is optional and limited to one registration zone per VNet.
- Tested as
- Name resolution questions.
- Trap
- Expecting resolution without a link.
-
DNS Private Resolver endpoints
Inbound accepts queries from on-premises; outbound plus a ruleset forwards Azure queries out.
- Remember
- Each endpoint needs its own delegated subnet.
- Tested as
- Hybrid DNS questions.
- Trap
- Reversing inbound and outbound roles.
-
Gateway transit
Lets peered spokes use the hub's VPN or ExpressRoute gateway.
- Remember
- Allow gateway transit on the hub, Use remote gateways on the spoke.
- Tested as
- Hub-and-spoke questions.
- Trap
- Enabling it on only one side.
-
Route selection order
Longest prefix match first, then UDR over BGP over system routes.
- Remember
- A /24 UDR beats a 0.0.0.0/0 BGP route for its range.
- Tested as
- Routing troubleshooting questions.
- Trap
- Thinking UDR always wins regardless of prefix length.
-
Azure Route Server
A managed BGP peer that exchanges routes between NVAs and the VNet.
- Remember
- It is control plane only and needs RouteServerSubnet.
- Tested as
- NVA integration questions.
- Trap
- Expecting traffic to pass through it.
-
NAT Gateway
Subnet-level outbound SNAT using Standard public IPs or prefixes.
- Remember
- It overrides other outbound methods for that subnet.
- Tested as
- Outbound connectivity questions.
- Trap
- Expecting it to allow inbound connections.
-
Azure Virtual Network Manager
Central management of connectivity, routing and security admin rules across VNets and subscriptions.
- Remember
- Network groups can be static or built dynamically with Azure Policy.
- Tested as
- Scale connectivity questions.
- Trap
- Building dozens of peerings by hand.
-
Network Watcher diagnostics
IP flow verify, next hop, connection troubleshoot, Connection monitor and packet capture.
- Remember
- Match the tool to the symptom.
- Tested as
- Monitoring questions.
- Trap
- Choosing a tool that inspects the wrong layer.
-
Virtual network flow logs
Flow logging at VNet scope that replaces NSG flow logs.
- Remember
- Pair with traffic analytics for insight.
- Tested as
- Logging questions.
- Trap
- Planning new NSG flow logs.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Routing components
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| User-defined route | Static route in a route table on a subnet | Manual, you set the next hop | Forgetting to associate the table |
| BGP routes | Learned from gateways or Route Server | Dynamic, can be suppressed per route table | Ignoring BGP propagation settings |
| System routes | Default routes Azure creates | Lowest preference at equal prefix | Assuming they can be deleted |
| Azure Route Server | BGP peer for NVAs | Exchanges routes, never forwards packets | Placing it in the data path |
Network Watcher tools
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| IP flow verify | Tests if an NSG allows a 5-tuple | NSG decision only | Using it for route issues |
| Next hop | Shows the route chosen for a destination | Routing only | Using it for NSG issues |
| Connection troubleshoot | Tests reachability from a source to a destination | End-to-end check at one point in time | Expecting ongoing trends |
| Connection monitor | Continuous latency and loss tracking | Ongoing monitoring with alerts | Using it for a one-off check |
DNS Private Resolver parts
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Inbound endpoint | Private IP that on-premises DNS forwards to | Traffic into Azure DNS | Using it for outbound forwarding |
| Outbound endpoint | Egress point for Azure queries | Traffic from Azure outward | Forgetting the ruleset |
| Forwarding ruleset | Domain rules that send queries to target DNS servers | Linked to VNets | Not linking it to the spoke VNets |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Peering is transitive
- What candidates pick
- Peer both spokes to the hub and expect spoke-to-spoke traffic.
- Why it looks right
- Hub-and-spoke diagrams look connected.
- Why it's wrong
- Peering connects only the two VNets in the pair, so spoke traffic needs an NVA or firewall with UDRs, direct peering or a managed mesh.
Clue to watch for Two spokes are peered only with the hub.
-
Prefix means BYOIP
- What candidates pick
- Choose a public IP prefix to use company-owned addresses.
- Why it looks right
- Both features contain the word prefix.
- Why it's wrong
- A public IP prefix allocates Microsoft-owned addresses; owned ranges require a Custom IP prefix onboarding process.
Clue to watch for The organization already owns the IP range.
-
Route Server in the path
- What candidates pick
- Send traffic to Route Server as a next hop.
- Why it looks right
- It sounds like a router.
- Why it's wrong
- Route Server only exchanges BGP routes; packets go directly to the NVA it advertised.
Clue to watch for The scenario needs NVA routes learned automatically.
-
UDR always wins
- What candidates pick
- Assume a user-defined route beats any learned route.
- Why it looks right
- UDR has the highest preference.
- Why it's wrong
- Preference applies only at equal prefix length; a more specific BGP or system route still wins.
Clue to watch for Route prefixes of different lengths overlap.
-
Outbound needs a load balancer
- What candidates pick
- Add a public load balancer with outbound rules for subnet egress.
- Why it looks right
- Outbound rules are familiar from older designs.
- Why it's wrong
- NAT Gateway gives scalable outbound SNAT for a whole subnet with less configuration and takes precedence over load balancer outbound rules.
Clue to watch for Requirement mentions SNAT exhaustion or many outbound connections.
-
Resolver without links
- What candidates pick
- Deploy DNS Private Resolver and expect spokes to use forwarding rules.
- Why it looks right
- The resolver lives in the hub.
- Why it's wrong
- A forwarding ruleset applies only to VNets linked to it, so each spoke needs a ruleset link or DNS settings pointing at the hub.
Clue to watch for Spoke VMs cannot resolve on-premises names.
Answer framework
Use these steps to work through a Domain 1 infrastructure scenario on AZ-700.
- Start with addressing: confirm the address spaces do not overlap with peers or on-premises, and size each subnet after removing the five reserved addresses.
- List services that demand dedicated or named subnets, such as gateways, firewalls, Bastion, Route Server and delegated platform services, and reserve those first.
- Decide how names resolve: Azure-provided DNS, custom servers, private zones with links, or DNS Private Resolver endpoints for hybrid queries.
- Trace each traffic path, checking peering settings, gateway transit, user-defined routes, BGP propagation and longest prefix match, and pick NAT Gateway for subnet egress.
- For any failure, choose the narrowest Network Watcher tool or Defender for Cloud view that proves the cause.
Practice question
Want more like this? The AZ-700 practice test has questions for every domain.
Checklist
0 of 15
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start this domain in a lab subscription, because the concepts stick far better once you have watched a peering fail to carry spoke traffic. Build a hub and two spokes, add a small VM in each, and test reachability. Then add a route table, change next hops, and watch the effective routes on a NIC. Size every subnet deliberately and write down which services need named subnets.
Next, work on DNS. Create a private DNS zone, link it with and without autoregistration, and point a VNet at custom DNS servers to see the effect. Read the DNS Private Resolver architecture until you can explain both endpoints and the ruleset from memory.
Finish with monitoring. Run IP flow verify, next hop and connection troubleshoot against the lab, enable virtual network flow logs, and open the Defender for Cloud network recommendations. Because this domain is up to 30% of the exam and feeds every other domain, revisit it after you study connectivity and security, then take timed practice sets focused on routing and DNS.
FAQ
How much of AZ-700 is Domain 1, Design and implement core networking infrastructure?
Microsoft weights it at 25–30%, the largest of the five skill areas, with four functional groups covering addressing, name resolution, routing and monitoring.
Is VNet peering transitive?
No. Each peering connects only two VNets. Spoke-to-spoke traffic needs a hub NVA or firewall with user-defined routes, a direct peering, or a mesh built with Azure Virtual Network Manager.
What is the difference between Azure Route Server and a user-defined route?
A UDR is a static route you write in a route table. Route Server learns routes from NVAs over BGP and programs them into the VNet automatically.
When should I use NAT Gateway?
Use it when a subnet needs reliable, scalable outbound internet access with fixed public IPs, especially when SNAT port exhaustion is a risk.
What does Azure DNS Private Resolver replace?
It replaces custom DNS forwarder VMs for hybrid resolution, offering managed inbound and outbound endpoints and forwarding rulesets.
Which Network Watcher tool shows why traffic goes to the wrong place?
Next hop shows the route Azure selects for a destination from a VM, including the next hop type and route table responsible.
Is AZ-700 being retired?
No retirement had been announced as of October 2026. The current study guide lists skills measured as of July 27, 2026.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have reviewed addressing, DNS, peering, routing, NAT Gateway and network monitoring. Check whether you can trace a packet and pick the right fix under timed conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the AZ-700 AI tutor Get any concept explained your way