Overview
Domain 2 covers how on-premises networks, remote users and branch offices connect to Azure. Microsoft lists four functional groups. Site-to-site VPN covers high-availability design, gateway SKU selection, policy-based versus route-based VPNs, local network gateways, custom IPsec/IKE policies, troubleshooting and Azure Extended Network. Point-to-site VPN covers gateway SKUs, tunnel types, certificate, RADIUS and Microsoft Entra ID authentication, client configuration files, Always On VPN and Azure Network Adapter.
The ExpressRoute group is the longest list in the exam: connectivity models, SKUs and tiers, redundancy and disaster recovery, Global Reach, FastPath, ExpressRoute Direct, private and Microsoft peering, gateways, route advertisement, encryption and Bidirectional Forwarding Detection. The Virtual WAN group covers SKU choice, hub design, scale units, gateway deployment, hub routing and third-party NVAs in the hub.
How it's tested
Connectivity questions usually describe a company's sites, users and bandwidth needs, then ask which gateway, SKU, peering type or Virtual WAN option satisfies them. Several items list configuration steps to order, and some ask for the cheapest option that still meets resiliency, encryption or authentication requirements.
-
Match requirement to SKU
A bandwidth, tunnel count, zone resiliency or authentication need is given, and you pick the VPN gateway, ExpressRoute or Virtual WAN SKU.
-
Pick the peering
Traffic destinations such as VNets or Microsoft 365 are listed, and you choose private peering, Microsoft peering or both.
-
Order the build
You arrange steps such as creating the gateway, local network gateway and connection in the order Azure requires.
A retailer has 40 branches that need connectivity to Azure and to each other, plus remote users, with minimal routing work. Building separate VPN gateways and peerings would be heavy. Virtual WAN Standard provides managed hubs where site-to-site, point-to-site and VNet connections all transit automatically. The Basic SKU supports only site-to-site VPN, so the user requirement rules it out and Standard is the answer.
Functional groups 4
Official functional groups from the Microsoft outline, in outline order.
2.1 Design, implement, and manage a site-to-site VPN connectionS2S design, gateway SKUs, policy versus route-based VPNs, IPsec policies and Azure Extended Network.
- What it means
- This group covers designing site-to-site VPN for high availability, choosing a virtual network gateway SKU, creating local network gateways, virtual network gateways and connections, deciding between policy-based and route-based VPNs, applying custom IPsec/IKE policies, diagnosing gateway connectivity problems and implementing Azure Extended Network to stretch an on-premises subnet into Azure.
- What to understand
- A local network gateway represents the on-premises device: its public IP or FQDN and either its address prefixes or BGP settings. Route-based gateways support IKEv2, multiple sites, BGP, point-to-site and coexistence with ExpressRoute, while policy-based gateways are limited to one tunnel with static policies. Active-active gateways with zone-redundant AZ SKUs give the highest availability, especially when the on-premises side also has two devices. A custom IPsec/IKE policy fixes algorithms and key strengths for one connection.
- How it shows up
- Expect a scenario listing on-premises device limits, tunnel counts and availability goals, followed by a gateway type or SKU choice.
- Common confusion
- Choosing policy-based because the on-premises device is old, when the scenario also needs several sites or point-to-site access.
2.2 Design, implement, and manage a point-to-site VPN connectionP2S SKUs, tunnel types, authentication, client profiles, Always On VPN and Azure Network Adapter.
- What it means
- This group covers choosing a gateway SKU for point-to-site, selecting OpenVPN, IKEv2 or SSTP tunnels, choosing certificate, RADIUS or Microsoft Entra ID authentication, distributing VPN client configuration files, troubleshooting client and authentication issues, and the Azure requirements for Always On VPN and Azure Network Adapter.
- What to understand
- OpenVPN runs over TLS on port 443 and works across Windows, macOS, Linux, iOS and Android. Microsoft Entra ID authentication requires the OpenVPN tunnel type and the Azure VPN Client, which allows Conditional Access and MFA. SSTP is Windows only, and IKEv2 suits native clients on several platforms. RADIUS lets an existing NPS or Active Directory setup authenticate users. The Basic SKU lacks RADIUS, IKEv2 and OpenVPN support. Always On VPN and Azure Network Adapter both need a route-based gateway.
- How it shows up
- Expect a mix of client operating systems and an identity requirement, then a tunnel type plus authentication method choice.
- Common confusion
- Pairing Microsoft Entra ID authentication with IKEv2 or SSTP; Entra ID authentication works only with OpenVPN.
2.3 Design, implement, and manage Azure ExpressRouteConnectivity models, SKUs, peering, gateways, Global Reach, FastPath, Direct, encryption and BFD.
- What it means
- This group covers selecting a connectivity model and SKU tier, designing for cross-region connectivity, redundancy and disaster recovery, Global Reach, FastPath and ExpressRoute Direct, choosing and configuring private and Microsoft peering, creating ExpressRoute gateways and connecting VNets, recommending route advertisement, encrypting traffic and implementing Bidirectional Forwarding Detection, plus troubleshooting circuits.
- What to understand
- Connectivity models are cloud exchange colocation, point-to-point Ethernet, any-to-any IPVPN and ExpressRoute Direct. Local reaches only nearby regions with unmetered data, Standard reaches regions in the same geopolitical area, and Premium reaches all regions with higher route and VNet limits. Private peering reaches VNets; Microsoft peering reaches Microsoft public services with route filters and public prefixes. Global Reach links on-premises sites through two circuits. FastPath sends data around the gateway. Encryption uses IPsec over private peering or MACsec on Direct ports.
- How it shows up
- Expect requirements such as reaching Microsoft 365, linking two data centers, or lowering gateway latency, with each pointing to one ExpressRoute feature.
- Common confusion
- Thinking ExpressRoute traffic is encrypted by default; it is private, but encryption needs MACsec or IPsec added.
2.4 Design and implement an Azure Virtual WAN architectureVirtual WAN SKUs, hubs, scale units, gateways, hub routing and NVAs.
- What it means
- This group covers choosing a Basic or Standard Virtual WAN, designing the architecture and choosing hub types and services, creating virtual hubs, picking scale units for each gateway type, deploying VPN, ExpressRoute and point-to-site gateways into a hub, configuring hub routing with route tables, associations and propagation, and integrating third-party network virtual appliances for cloud connectivity.
- What to understand
- Basic supports only site-to-site VPN; Standard adds ExpressRoute, point-to-site, inter-hub transit, VNet-to-VNet transit and Azure Firewall or NVAs in the hub. Each hub needs its own address space, a /23 or larger as Microsoft recommends. Scale units set gateway throughput independently per gateway type. Hub routing uses association to pick which route table a connection uses and propagation to choose which tables learn its routes. Routing intent simplifies sending private or internet traffic through a hub firewall.
- How it shows up
- Expect large branch estates or global hubs, with questions about SKU, routing tables or adding an SD-WAN appliance in the hub.
- Common confusion
- Confusing association with propagation; association chooses a connection's route table, while propagation advertises its routes to tables.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Route-based vs policy-based VPN
Route-based uses routing and IKEv2; policy-based uses static traffic selectors.
- Remember
- Only route-based supports multiple sites, P2S and BGP.
- Tested as
- Gateway type questions.
- Trap
- Choosing policy-based for a multi-site design.
-
Local network gateway
The Azure object describing the on-premises VPN device and its prefixes or BGP peer.
- Remember
- Update prefixes when on-premises ranges change.
- Tested as
- S2S build questions.
- Trap
- Confusing it with the Azure virtual network gateway.
-
Active-active gateway
Two gateway instances each with its own tunnel and public IP.
- Remember
- Pair with two on-premises devices for full redundancy.
- Tested as
- High availability questions.
- Trap
- Assuming active-standby has no downtime during failover.
-
OpenVPN tunnel type
TLS-based P2S tunnel on port 443 for most client platforms.
- Remember
- Required for Microsoft Entra ID authentication.
- Tested as
- P2S questions.
- Trap
- Selecting SSTP for macOS clients.
-
P2S authentication options
Certificates, RADIUS or Microsoft Entra ID.
- Remember
- Entra ID enables Conditional Access and MFA.
- Tested as
- Identity questions.
- Trap
- Choosing RADIUS on a Basic SKU gateway.
-
ExpressRoute SKUs
Local, Standard and Premium tiers with metered or unlimited data.
- Remember
- Premium enables global reach across geopolitical regions.
- Tested as
- Circuit design questions.
- Trap
- Choosing Standard for cross-geography VNets.
-
Private vs Microsoft peering
Private peering reaches VNets; Microsoft peering reaches Microsoft public services.
- Remember
- Microsoft peering needs public IPs and route filters.
- Tested as
- Peering selection questions.
- Trap
- Using private peering for Microsoft 365.
-
Global Reach
Connects two on-premises sites through their ExpressRoute circuits over the Microsoft backbone.
- Remember
- It links circuits, not VNets.
- Tested as
- Site-to-site over ExpressRoute questions.
- Trap
- Using it to connect VNets.
-
FastPath
Sends data straight to VMs, bypassing the ExpressRoute gateway in the data path.
- Remember
- It needs a high-performance gateway SKU.
- Tested as
- Latency and throughput questions.
- Trap
- Expecting it to remove the need for a gateway.
-
ExpressRoute encryption
IPsec VPN over private peering or MACsec on ExpressRoute Direct.
- Remember
- ExpressRoute is private but not encrypted by default.
- Tested as
- Compliance questions.
- Trap
- Assuming default encryption.
-
Bidirectional Forwarding Detection
Fast link failure detection on BGP sessions.
- Remember
- Configure it on the customer edge routers too.
- Tested as
- Failover speed questions.
- Trap
- Tuning BGP timers instead.
-
Virtual WAN Basic vs Standard
Basic offers S2S VPN only; Standard adds ER, P2S, transit and firewalls.
- Remember
- Upgrade from Basic to Standard is supported, not the reverse.
- Tested as
- Virtual WAN design questions.
- Trap
- Picking Basic when users need P2S.
-
Hub scale units
Throughput setting for each hub gateway type.
- Remember
- Scale VPN, ER and P2S separately.
- Tested as
- Capacity questions.
- Trap
- Assuming one setting covers all gateways.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
VPN tunnel types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| OpenVPN | TLS tunnel on port 443 | Broadest client support and Entra ID auth | Thinking it needs a third-party server |
| IKEv2 | Standards-based IPsec tunnel | Native on many platforms, may be blocked by firewalls | Using it with Entra ID auth |
| SSTP | Microsoft TLS-based tunnel | Windows clients only | Choosing it for macOS or Linux |
ExpressRoute tiers
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Local | Access to regions near the peering location | Data transfer included | Expecting distant regions |
| Standard | Access to regions in the same geopolitical area | Default choice for single geography | Using it across geographies |
| Premium | Access to all regions with higher limits | More routes and VNet links | Paying for it when not needed |
Hybrid connectivity choices
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Site-to-site VPN | Encrypted tunnel over the internet | Fast to deploy, internet performance | Expecting fixed latency |
| ExpressRoute | Private circuit through a provider | Predictable performance, no default encryption | Assuming it is encrypted |
| Virtual WAN | Managed hubs with automatic transit | Scales to many branches | Choosing Basic for ExpressRoute |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Policy-based is simpler
- What candidates pick
- Choose a policy-based VPN for any static on-premises device.
- Why it looks right
- It sounds like the conservative option.
- Why it's wrong
- Policy-based gateways support only one site-to-site tunnel and no point-to-site, so most multi-requirement scenarios need route-based.
Clue to watch for More than one site or remote users appear in the requirements.
-
Private peering reaches everything
- What candidates pick
- Use only private peering to reach Microsoft 365 and Azure PaaS public endpoints.
- Why it looks right
- Private sounds more secure.
- Why it's wrong
- Private peering reaches VNet address space; Microsoft public services need Microsoft peering with route filters.
Clue to watch for Requirement names Microsoft 365 or public service endpoints.
-
Global Reach links VNets
- What candidates pick
- Enable Global Reach so two VNets can talk.
- Why it looks right
- Global sounds like VNet-wide connectivity.
- Why it's wrong
- Global Reach connects on-premises networks through their circuits; VNets connect via peering or gateways.
Clue to watch for Two data centers must exchange traffic over Microsoft's backbone.
-
FastPath removes the gateway
- What candidates pick
- Delete the ExpressRoute gateway after enabling FastPath.
- Why it looks right
- FastPath bypasses the gateway.
- Why it's wrong
- The gateway still handles route exchange; FastPath bypasses it only for data packets.
Clue to watch for Requirement is lower latency on an existing connection.
-
Default encryption
- What candidates pick
- Rely on ExpressRoute alone for encryption compliance.
- Why it looks right
- The circuit is private.
- Why it's wrong
- A private circuit is not encrypted; add MACsec on Direct ports or an IPsec tunnel over private peering.
Clue to watch for Regulation demands encryption in transit.
-
One scale unit for all
- What candidates pick
- Set a single Virtual WAN scale setting for every gateway.
- Why it looks right
- Hubs feel like one appliance.
- Why it's wrong
- Each gateway type in a hub has its own scale unit count and throughput.
Clue to watch for Different bandwidth figures are given for VPN and ExpressRoute.
Answer framework
Apply these steps to any AZ-700 hybrid connectivity scenario.
- Identify who connects: whole sites, individual users, many branches or other clouds, since each points to S2S, P2S, ExpressRoute or Virtual WAN.
- Read the performance, latency and encryption requirements to decide between internet VPN, ExpressRoute with optional MACsec or IPsec, or both together.
- Pick the SKU last but carefully, checking tunnel counts, authentication types, zone resiliency, ExpressRoute tier and Virtual WAN Basic versus Standard.
- Choose peering and routing details: private or Microsoft peering, route advertisement preferences, BFD, Global Reach or FastPath where a requirement names them.
- Confirm resiliency by adding active-active gateways, a second circuit or peering location, or a VPN backup path for ExpressRoute.
Practice question
Want more like this? The AZ-700 practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Build a requirement-to-feature map for this domain before anything else. Write each likely requirement on the left, such as Microsoft 365 access, macOS users, MFA, two data centers or lowest latency, and the matching feature on the right. Most AZ-700 connectivity items reduce to one row of that map.
Next, deploy a route-based VPN gateway in a lab and connect it to another VNet or a simulated on-premises network to see local network gateways, connections and BGP settings. Configure point-to-site with certificate authentication, then switch to Microsoft Entra ID and note which tunnel types disappear.
ExpressRoute is hard to lab, so study the Microsoft Learn architecture pages and diagrams for peering types, tiers, resiliency models, Global Reach and FastPath. Finish with Virtual WAN, focusing on SKU differences, scale units and hub routing. Practice questions that ask for the cheapest compliant option are especially useful here, since many distractors are technically valid but oversized.
FAQ
How much of AZ-700 is Domain 2, Design, implement, and manage connectivity services?
Microsoft weights it at 20–25% of the exam, across four functional groups: site-to-site VPN, point-to-site VPN, ExpressRoute and Virtual WAN.
When do I need ExpressRoute Premium?
When VNets are in a different geopolitical region from the peering location, or when you need more routes or VNet links than Standard allows.
Which authentication works with OpenVPN only?
Microsoft Entra ID authentication for point-to-site requires the OpenVPN tunnel type and the Azure VPN Client.
Is ExpressRoute encrypted?
Not by default. Use MACsec on ExpressRoute Direct ports or run an IPsec VPN over private peering when encryption is required.
What is the difference between Global Reach and FastPath?
Global Reach connects on-premises sites to each other through their circuits. FastPath improves data path performance by bypassing the ExpressRoute gateway.
Can I upgrade Virtual WAN from Basic to Standard?
Yes. Basic can be upgraded to Standard, but Standard cannot be downgraded to Basic.
Can VPN and ExpressRoute gateways coexist?
Yes, a route-based VPN gateway and an ExpressRoute gateway can share one VNet, with the VPN used as a backup path.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have covered site-to-site and point-to-site VPN, ExpressRoute features and Virtual WAN hubs. Test whether you can map hybrid requirements to the right gateway and SKU.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the AZ-700 AI tutor Get any concept explained your way