Microsoft Certified: Azure Network Engineer Associate (AZ-700)

Design and implement IP addressing for Azure resources including planning and implementing network segmentation and address spaces, creating virtual networks (VNets), planning and configuring subnetting for services (VNet gateways, private endpoints, service endpoints, firewalls, application gateways, VNet-integrated platform services, Azure Bastion), planning and configuring subnet delegation, planning and configuring shared or dedicated subnets, creating prefixes for public IP addresses, choosing when to use public IP address prefixes, planning and implementing custom public IP address prefixes (bring your own IP), creating public IP addresses, and associating public IP addresses to resources. Design and implement name resolution including designing name resolution inside a VNet, configuring DNS settings for a VNet, designing public DNS zones, designing private DNS zones, configuring public and private DNS zones, linking private DNS zones to VNets, and designing and implementing Azure DNS Private Resolver. Design and implement VNet connectivity and routing including designing service chaining (gateway transit), implementing VNet peering, implementing and managing virtual network connectivity using Azure Virtual Network Manager, designing and implementing user-defined routes (UDRs), associating route tables with subnets, configuring forced tunneling, diagnosing and resolving routing issues, designing and implementing Azure Route Server, identifying appropriate use cases for NAT gateway, and implementing NAT gateway. Monitor networks including configuring monitoring, network diagnostics, and logs in Azure Network Watcher, monitoring and troubleshooting network health using Azure Network Watcher, monitoring and troubleshooting networks using Azure Monitor Network Insights, activating and monitoring DDoS protection, evaluating network security recommendations identified by Microsoft Defender for Cloud Secure Score, evaluating network security recommendations identified by Microsoft Defender for Cloud Attack Path Analysis, and identifying network resources using Microsoft Defender for Cloud Security Explorer.

Design, implement, and manage a site-to-site VPN connection including designing site-to-site VPN connections (including high availability), selecting appropriate VNet gateway SKUs for site-to-site VPN requirements, implementing site-to-site VPN connections, identifying when to use policy-based VPN versus route-based VPN connections, creating and configuring local network gateways, creating and configuring IPsec/Internet Key Exchange (IKE) policies, creating and configuring virtual network gateways, diagnosing and resolving virtual network gateway connectivity issues, and implementing Azure Extended Network. Design, implement, and manage a point-to-site VPN connection including selecting appropriate virtual network gateway SKUs for point-to-site VPN requirements, selecting and configuring tunnel types, selecting appropriate authentication methods, configuring RADIUS authentication, configuring authentication using Microsoft Entra ID, implementing VPN client configuration files, diagnosing and resolving client-side and authentication issues, specifying Azure requirements for Always On VPN, and specifying Azure requirements for Azure Network Adapter. Design, implement, and manage Azure ExpressRoute including selecting ExpressRoute connectivity models, selecting appropriate ExpressRoute SKUs and tiers, designing and implementing ExpressRoute to meet requirements (cross-region connectivity, redundancy, disaster recovery), designing and implementing ExpressRoute options (Global Reach, FastPath, ExpressRoute Direct), choosing between Azure private peering only, Microsoft peering only, or both, configuring Azure private peering, configuring Microsoft peering, creating and configuring ExpressRoute gateways, connecting virtual networks to ExpressRoute circuits, recommending route advertisement configurations, configuring encryption over ExpressRoute, implementing Bidirectional Forwarding Detection, and diagnosing and resolving ExpressRoute connection issues. Design and implement an Azure Virtual WAN architecture including selecting Virtual WAN SKUs, designing Virtual WAN architectures (selecting types and services), creating hubs in Virtual WAN, choosing appropriate scale units for each gateway type, deploying gateways into Virtual WAN hubs, configuring virtual hub routing, and integrating Virtual WAN hubs with third-party NVAs for cloud connectivity.

Design and implement Azure Load Balancer and Azure Traffic Manager including mapping requirements to features and capabilities of Azure Load Balancer, identifying appropriate use cases for Azure Load Balancer, choosing Azure Load Balancer SKUs and tiers, choosing between public and internal load balancers, choosing between regional and global load balancers, creating and configuring Azure Load Balancers, implementing Azure Traffic Manager, implementing gateway load balancers, implementing load balancing rules, creating and configuring inbound NAT rules, and creating and configuring explicit outbound rules (source network address translation/SNAT). Design and implement Azure Application Gateway including mapping requirements to features and capabilities of Azure Application Gateway, identifying appropriate use cases for Azure Application Gateway, choosing between manual and autoscale, creating back-end pools, configuring health probes, configuring listeners, configuring routing rules, configuring HTTP settings, configuring Transport Layer Security (TLS), and configuring rewrite sets. Design and implement Azure Front Door including mapping requirements to features and capabilities of Azure Front Door, identifying appropriate use cases for Azure Front Door, choosing appropriate tiers, configuring Azure Front Door (routing, origins, endpoints), configuring SSL termination and end-to-end SSL encryption, configuring caching, configuring traffic acceleration, implementing rules (URL rewrite, URL redirect), and securing origins using Azure Private Link in Azure Front Door.

Design and implement Azure Private Link service and Azure private endpoints including planning private endpoints, creating private endpoints, configuring access to private endpoints, creating Private Link services, integrating Private Link and Private Endpoint with DNS, and integrating Private Link services with on-premises clients. Design and implement service endpoints including choosing when to use service endpoints, creating service endpoints, configuring service endpoint policies, and configuring access to service endpoints.

Implement and manage network security groups including creating network security groups (NSGs), associating NSGs to resources, creating application security groups (ASGs), associating ASGs to network interface cards (NICs), creating and configuring NSG inbound and outbound security rules, implementing virtual network flow logs, interpreting virtual network flow logs, verifying IP flow, configuring NSGs for remote server administration (including Azure Bastion), and implementing and managing virtual network security using Azure Virtual Network Manager. Design and implement Azure Firewall and Azure Firewall Manager including mapping requirements to features and capabilities of Azure Firewall, selecting appropriate Azure Firewall SKUs, designing Azure Firewall deployments, creating and implementing Azure Firewall deployments, configuring Azure Firewall rules, creating and implementing Azure Firewall Manager policies, and creating secure hubs by deploying Azure Firewall inside Azure Virtual WAN hubs. Design and implement a Web Application Firewall (WAF) deployment including mapping requirements to features and capabilities of WAF, designing WAF deployments, configuring detection or prevention mode, configuring rule sets for WAF on Azure Front Door, configuring rule sets for WAF on Application Gateway, implementing WAF policies, and associating WAF policies.