Certification guide
AZ-700Microsoft Azure Network Engineer Associate: the honest guide
AZ-700 is the Azure networking exam, and it sits a step past AZ-104 in a specific direction: virtual networks, connectivity, application delivery, private access and network security, designed rather than merely configured.
It is the Azure associate exam with the most expensive lab. Virtual networks and peering cost nothing, and the gateways, firewalls and load balancers that carry half the curriculum bill by the hour from the moment they exist.
Who Azure Network Engineer is for
A good fit if
- You hold AZ-104 and networking is the part of Azure you own or want to own.
- You come from an on-premises networking background and need the Azure equivalents to be precise rather than approximate.
- You design hybrid connectivity, and ExpressRoute, VPN and Virtual WAN decisions land on your desk.
- Your organization needs certified staff for a partner competency.
Probably not, if
- You have not done AZ-104 or its equivalent in practice. This exam assumes Azure administration fluency and spends none of its time teaching it.
- You want general cloud networking knowledge. It is specific to Azure's services and their behavior, not to networking concepts.
- Your work never touches connectivity. If VNets and NSGs are the whole of your networking exposure, this exam covers a lot of ground you will not use.
Is Azure Network Engineer worth it?
For a network engineer moving to Azure, this is one of the better-targeted certifications available. The curriculum matches the actual job, and the design questions are the sort you will meet in the first month.
The exam is $165 and the lab is where the real budget goes. That is unusual in this catalog and worth planning for: a forgotten VPN gateway can quietly cost more than the exam fee.
It is not the right exam for a generalist. AZ-104 already covers the networking a general Azure administrator needs, and the additional depth here pays off only if connectivity design is genuinely part of your role.
What the exam actually asks you to do
Multiple choice and multiple response, plus drag-and-drop ordering, hot area items where you click a region of a screenshot, and case studies that hold one scenario across several linked questions.
Item formats
- Multiple choice
- Multiple response
- Drag and drop
- Hot area
- Case study
The highlighted formats are the ones you cannot answer from memory alone. Microsoft Learn, exam duration and question types ↗
Domain breakdown and official weightings
From the official Microsoft Learn study guides. Design and implement core networking infrastructure is the heaviest domain at 28 percent, followed by Design, implement, and manage connectivity services at 23 percent.
- Design and implement core networking infrastructure28%
- Design, implement, and manage connectivity services23%
- Design and implement application delivery services18%
- Design and implement private access to Azure services13%
- Design and implement Azure network security services18%
Study plans by experience level
Network engineer, new to Azure
10 to 12 weeksat 8 hours
- 1Weeks 1 to 2: Azure fundamentals you cannot skip. Subscriptions, resource groups, regions and the resource model, because every networking object lives inside them.
- 2Weeks 3 to 5: core networking infrastructure, the 28 percent domain. VNets, subnets, peering, route tables, NSGs and private DNS, all free to build.
- 3Weeks 6 to 7: connectivity services at 23 percent. One long session for a site-to-site VPN, and reading for ExpressRoute, which cannot be labbed.
- 4Weeks 8 to 9: application delivery and network security, 18 percent each. Load Balancer, Application Gateway, Front Door, Azure Firewall.
- 5Weeks 10 to 12: private access at 13 percent, then the free practice assessment twice.
Azure administrator adding networking depth
6 to 8 weeksat 6 hours
- 1Week 1: read the skills outline and mark every service you have never deployed yourself. That list is the plan, and it is usually gateways and Front Door.
- 2Weeks 2 to 3: connectivity. VPN gateway types, routing behavior and Virtual WAN, in one or two deliberate sessions with everything deleted afterwards.
- 3Weeks 4 to 5: application delivery, with attention to which service belongs at which layer, because that is what the questions turn on.
- 4Weeks 6 to 8: private endpoints and service endpoints, network security services, then the practice assessment.
Designing hybrid connectivity at work
4 weeksat 6 hours
- 1Week 1: the domains your production estate does not use, which for most people is Front Door and Virtual WAN.
- 2Week 2: network security services, since the exam expects Azure Firewall policy structure and DDoS protection tiers precisely.
- 3Week 3: private access to Azure services, the domain most often learned by half.
- 4Week 4: the free practice assessment, then the exam while the material is fresh.
Common mistakes
- Studying networking without building any
- The free half of this curriculum is genuinely free: VNets, peering, route tables, NSGs and private DNS zones cost nothing to create. Candidates who read about effective routes instead of watching one take precedence lose marks they could have bought with an afternoon.
- Leaving gateways running
- A VPN gateway bills hourly from deployment and takes up to 45 minutes to provision, which pushes people into leaving one up 'for tomorrow'. Set a budget alert before the first one, and delete the resource group rather than the connection.
- Trying to lab ExpressRoute
- It needs a connectivity provider and a real circuit, so there is nothing to build. This part of the exam is read from the documentation and the reference architectures, and candidates who postpone it waiting for a lab opportunity run out of preparation time.
- Confusing the delivery services
- Load Balancer, Application Gateway, Front Door and Traffic Manager overlap enough to feel interchangeable and are not. The exam tests which one belongs at which layer and for which traffic pattern, and that distinction is the single most reliable source of lost marks.
- Skipping private access
- Private endpoints versus service endpoints is 13 percent of the exam and is the domain most often learned to a level that sounds right in conversation. The DNS behavior behind a private endpoint is where the questions actually live.
What comes after passing
The certification is valid for one year and renews free through the online assessment on Microsoft Learn, which opens six months before expiry.
AZ-305 is the usual next step if design is where you are heading; the security route runs through SC-300 or SC-200 and then SC-100.
The lab habits are worth keeping. Budget alerts, resource groups per session and deleting rather than deallocating are the difference between a cheap Azure practice habit and an expensive one.
Azure networking moves. Virtual WAN and Front Door have both changed shape since this exam launched, and the annual renewal assessment is a cheap way to notice.
Costs across the full renewal cycle are on the Azure Network Engineer cost page.
Frequently asked questions
Do I need AZ-104 before AZ-700?
Not formally: Microsoft sets no prerequisite for this exam. In practice it assumes AZ-104-level fluency with subscriptions, resource groups and the resource model, and candidates who skip that groundwork spend the exam translating rather than answering.
How much does the lab cost?
The core networking domain is free to practice, because VNets, peering, route tables, NSGs and private DNS cost nothing. Gateways, Azure Firewall and Application Gateway bill hourly, so the practical answer is a few tens of dollars if you batch those sessions and delete everything afterwards, and considerably more if you do not.
Can I practice ExpressRoute?
Not meaningfully. It requires a connectivity provider and a real circuit, so the exam material has to come from Microsoft's documentation and reference architectures. Plan to read that domain rather than build it.
How long is AZ-700 valid?
One year, renewed at no cost through an unproctored assessment on Microsoft Learn. The window opens six months before expiry, and a lapsed certification cannot be renewed: recovery means $165 and the full proctored exam again.
Keep reading
- Azure Network Engineer practice questions
Free sample questions with the full explanation on every answer.
- Free Azure Network Engineer practice test
10 original questions, playable now. No account, no card.
- Azure Network Engineer exam format
How many questions, how long, what the items look like, and how long it stays valid.
- Azure Network Engineer passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is Azure Network Engineer?
An honest difficulty read from the format, the clock and the weights.
- What Azure Network Engineer costs
The voucher price, the retake, and what renewal costs across the cycle.
Practice Azure Network Engineer for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free Azure Network Engineer questions