A comprehensive study guide that will

provide you with great preparation tools

for the AZ-700: Designing and
Implementing Microsoft Azure
Networking Solutions exam

AZ-700
Official
Course Study
Guide

Jordi Koenderink 8/7/2021

Introduction
Welcome to the AZ-700 Study Guide. This guide will go over each topic of the skills outline, provided
by Microsoft for the AZ-700: Designing and Implementing Microsoft Azure Networking Solutions.

For this exam, Microsoft suggests candidates should have subject matter expertise in planning,
implementing, and maintaining Azure networking solutions, including hybrid networking,
connectivity, routing, security, and private access to Azure services.

Candidates for this exam should also have expert Azure administration skills, in addition to extensive
experience and knowledge of networking, hybrid connections, and network security.

About the exam:

• Taking the exam will cost you $165 US dollars.

• Microsoft certification exams are scored out of 1000 points. You need 700 points or higher to
pass the AZ-700 exam and gain your Azure Administrator Badge.
• The AZ-700 exam will need to be renewed every year. Microsoft will, from time to time,
retire certifications, however, and you may also find exam numbers evolve when Microsoft
changes the curriculum substantially for the certification.
• The exam will have around 59 questions for which you have 120min to answer.
• As of this moment of writing, there’re no labs.

Book/e-book:

Azure Networking Cookbook: Practical recipes

for secure network infrastructure, global
application delivery, and accessible
connectivity in Azure Prepare for Microsoft
Exam AZ-700–and help demonstrate your real-
world mastery of implementing and deploying
Microsoft Azure Infrastructure as a Service
(IaaS). Designed for experienced cloud
professionals ready to advance their status,
Exam Ref focuses on the critical thinking and
decision-making acumen needed for success at
the Microsoft Certified Associate level.

• Amazon.com: Azure Networking

Cookbook: Practical recipes for secure
network infrastructure, global application
delivery, and accessible connectivity in
Azure, 2nd Edition: Toroman, Mustafa:
9781800563759: Amazon.com: Books
• Amazon NL: Azure Networking Cookbook:
Practical recipes for secure network
infrastructure, global application delivery,
and accessible connectivity in Azure :
Toroman, Mustafa: Amazon.nl: Boeken
• Amazon UK: Azure Networking Cookbook:
Practical recipes for secure network
infrastructure, global application delivery,
 and accessible connectivity in Azure, 2nd
Edition: Amazon.co.uk: Toroman, Mustafa:
9781800563759: Books
• Amazon FR: Amazon.fr - Azure Networking
Cookbook: Practical recipes for secure
network infrastructure, global application
delivery, and accessible connectivity in
Azure, 2nd Edition - Toroman, Mustafa -
Livres
• Amazon DE: Azure Networking Cookbook:
Practical recipes for secure network
infrastructure, global application delivery,
and accessible connectivity in Azure, 2nd
Edition : Toroman, Mustafa: Amazon.de:
Boeken

Video training:

This course goes through all of the skills needed to take

and pass the AZ-700 exam: Designing and Implementing
Microsoft Azure Networking Solutions. This course
teaches all of the requirements for the exam, one by
one. Each of the things that Microsoft tests will be
covered in this course.

AZ-700 Designing and Implementing Azure Networking

Exam 2021 | Udemy
This path is structured to mimic the organization of the
exam so you can more easily follow along during your
study preparation.

Designing and Implementing Microsoft Azure

Networking Solutions (AZ-700) Path | Pluralsight
Whizlabs’ Microsoft Azure Exam AZ-104 Online Course
helps Professionals to prepare themselves for the actual
certification exam.

https://www.whizlabs.com/microsoft-azure-
certification-az-104/online-course/
Linkedin’s Microsoft Azure Exam AZ-700 Online Course
helps Professionals to prepare themselves for the actual
certification exam.

Azure for Architects: Design a Networking Strategy

(linkedin.com)
Microsoft Learn:

Those tutorial/paths have been combined by Microsoft and published for free. They contain a
collection of text, videos, and exercises for the exam.

AZ-700: Introduction to Azure virtual networks

If you’re an IT Administrator that’s new to
Azure and need to prepare for Exam AZ-700:
Microsoft Azure Administrator, this path is the
place to start. Learn the basic Azure concepts
you’ll need to know as an Azure administrator.

Introduction to Azure virtual networks - Learn |

Microsoft Docs
AZ-700: Design and implement hybrid
networking
Learn how to manage Azure Active Directory
objects, role-based access control (RBAC),
subscriptions, and governance in Azure. This
learning path helps prepare you for Exam AZ-
700: Microsoft Azure Administrator.

Design and implement hybrid networking -

Learn | Microsoft Docs
AZ-700: Design and implement Azure
ExpressRoute
You will learn how to design and implement
Azure ExpressRoute, ExpressRoute Global
Reach, ExpressRoute FastPath, and when to use
each service according to your environments
requirements.

Design and implement Azure ExpressRoute -

Learn | Microsoft Docs
AZ-700: Load balance non-HTTP(S) traffic in
Azure
You will learn the different load balancer
options in Azure and how to choose and
implement the right Azure solution for non-
HTTP(S) traffic.

Load balance non-HTTP(S) traffic in Azure -

Learn | Microsoft Docs
AZ-700: Load balance HTTP(S) traffic in Azure
You will learn how to design load balancer
solutions for HTTP(S) traffic and how to
implement Azure Application Gateway and
Azure Front Door.

Load balance HTTP(S) traffic in Azure - Learn |

Microsoft Docs
AZ-700: Design and implement network
security
You will learn to design and implement network
security solutions such as Azure DDoS, Network
Security Groups, Azure Firewall, and Web
Application Firewall.

Design and implement network security - Learn

| Microsoft Docs
AZ-700: Design and implement private access
to Azure Services
You will learn to design and implement private
access to Azure Services with Azure Private Link,
and virtual network service endpoints.

Design and implement private access to Azure

Services - Learn | Microsoft Docs
AZ-700: Design and implement network
monitoring
You will learn to design and implement network
monitoring solutions such as Azure Monitor and
Network watcher.

Design and implement network monitoring -

Learn | Microsoft Docs
This guide is divided up into the following sections and is also part of the exam:

• Design, Implement, and Manage Hybrid Networking (10% to 15%)

• Design and Implement Core Networking Infrastructure (20% to 25%)
• Design and Implement Routing (25% to 30%)
• Secure and Monitor Networks (15% to 20%)
• Design and Implement Private Access to Azure Services (10% to 15%)

Feel free to join our Facebook Azure Study Group, or check out the Azure courses on Udemy. Errors
and suggestions can also be reported in the Azure Group on Facebook.

Thank you,

Get Cloud Skills team

Jordi Koenderink
Contents
Introduction............................................................................................................................................. 1
Contents .................................................................................................................................................. 6
Design, Implement, and Manage Hybrid Networking (10–15%) ............................................................ 7
Design, implement, and manage a site-to-site VPN connection..................................................... 7
Design, implement, and manage a point-to-site VPN connection .................................................. 7
Design, implement, and manage Azure ExpressRoute.................................................................... 8
Design and Implement Core Networking Infrastructure (20–25%) ........................................................ 9
Design and implement private IP addressing for VNets.................................................................. 9
Design and implement name resolution ....................................................................................... 10
Design and implement cross-VNet connectivity ........................................................................... 10
Design and implement an Azure Virtual WAN architecture.......................................................... 10
Design and Implement Routing (25–30%)............................................................................................. 11
Design, implement, and manage vnet routing .............................................................................. 11
Design and implement an Azure Load Balancer ............................................................................ 11
Design and implement Azure Application Gateway ...................................................................... 12
Implement Azure Front Door ........................................................................................................ 13
Implement an Azure Traffic Manager profile ................................................................................ 13
Design and implement an Azure Virtual Network NAT ................................................................. 13
Secure and Monitor Networks (15–20%) .............................................................................................. 14
Design, implement, and manage an Azure Firewall deployment ................................................. 14
Implement and manage network security groups (nsgs) .............................................................. 14
Implement a Web Application Firewall (WAF) deployment ......................................................... 15
Monitor networks.......................................................................................................................... 16
Design and Implement Private Access to Azure Services (10–15%) ..................................................... 16
Design and implement Azure Private Link service and Azure Private Endpoint ........................... 16
Design and implement service endpoints ..................................................................................... 17
Configure vnet integration for dedicated platform as a service (paas) services........................... 17
Design, Implement, and Manage Hybrid Networking (10–15%)
Design, implement, and manage a site-to-site VPN connection
Design a site-to-site VPN connection for high availability

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-
rm-ps#about

Select an appropriate virtual network (vnet) gateway SKU

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways#gwsku

Identify when to use policy-based VPN versus route-based VPN

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-
rm-ps#about

Create and configure a local network gateway

https://docs.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-
portal#LocalNetworkGateway

Create and configure an ipsec/IKE policy

https://docs.microsoft.com/en-us/azure/vpn-gateway/ipsec-ike-policy-howto

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell

Create and configure a virtual network gateway

https://docs.microsoft.com/en-us/azure/vpn-gateway/tutorial-create-gateway-portal

Diagnose and resolve VPN gateway connectivity issues

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-
cannot-connect

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-diagnose-on-premises-
connectivity

Design, implement, and manage a point-to-site VPN connection

Select an appropriate virtual network gateway SKU

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways#gwsku

Plan and configure RADIUS authentication

https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-radius-ps

Plan and configure certificate-based authentication

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-
manager-portal

Plan and configure openvpn authentication

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-openvpn
Plan and configure Azure Active Directory (Azure AD) authentication

https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

Implement a VPN client configuration file

https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-configuration-radius

https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-configuration-azure-
cert

Diagnose and resolve client-side and authentication issues

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-vpn-point-to-site-
connection-problems

https://docs.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-ad-vpn-client

Design, implement, and manage Azure ExpressRoute

Choose between provider and direct model (expressroute Direct)

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-erdirect-about#expressroute-
using-a-service-provider-and-expressroute-direct

Design and implement Azure cross-region connectivity between multiple expressroute

Locations

https://docs.microsoft.com/en-us/azure/expressroute/cross-network-connectivity

Select an appropriate expressroute SKU and tier

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-
gateways#gwsku

Design and implement expressroute Global Reach

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-global-reach

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-howto-set-global-reach

Design and implement expressroute fastpath

https://docs.microsoft.com/en-us/azure/expressroute/about-fastpath

https://docs.microsoft.com/en-us/azure/expressroute/howto-linkvnet-cli#configure-expressroute-
fastpath

Choose between private peering only, Microsoft peering only, or both

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuit-
peerings#routingdomains

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuit-
peerings#peeringcompare
Configure private peering

https://docs.microsoft.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-
peering?toc=/azure/expressroute/toc.json

Configure Microsoft peering

https://docs.microsoft.com/en-us/azure/expressroute/site-to-site-vpn-over-microsoft-peering

Create and configure an expressroute gateway

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-
gateways

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-howto-add-gateway-portal-
resource-manager

Connect a virtual network to an expressroute circuit

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-howto-linkvnet-portal-
resource-manager

Recommend a route advertisement configuration

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-routing#advertising-default-
routes

Configure encryption over expressroute

https://docs.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute

Implement Bidirectional Forwarding Detection

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-bfd

Diagnose and resolve expressroute connection issues

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-troubleshooting-network-
performance

Design and Implement Core Networking Infrastructure (20–25%)

Design and implement private IP addressing for VNets
Create a vnet

https://docs.microsoft.com/en-us/azure/virtual-network/quick-create-portal

Plan and configure subnetting for services, including vnet gateways, private endpoints,

Firewalls, application gateways, and vnet-integrated platform services

https://techcommunity.microsoft.com/t5/itops-talk-blog/configuring-azure-virtual-network-subnets-
with-cidr-notation/ba-p/2047809

https://docs.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure
Plan and configure subnet delegation

https://docs.microsoft.com/en-us/azure/virtual-network/subnet-delegation-overview

https://docs.microsoft.com/en-us/azure/virtual-network/manage-subnet-delegation

Design and implement name resolution

Design public DNS zones

https://docs.microsoft.com/en-us/azure/architecture/hybrid/hybrid-dns-infra

Design private DNS zones

https://docs.microsoft.com/en-us/azure/dns/private-dns-privatednszone

Design name resolution inside a vnet

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-
and-role-instances

Configure a public or private DNS zone

https://docs.microsoft.com/en-us/azure/dns/dns-getstarted-portal

https://docs.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal

Link a private DNS zone to a vnet

https://docs.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal#link-the-virtual-network

Design and implement cross-VNet connectivity

Design service chaining, including gateway transit

https://ravikirans.com/coursera/vnet-service-chaining

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview#service-
chaining

Design vpn connectivity between vnets

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-
manager-portal

Implement vnet peering

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering

Design and implement an Azure Virtual WAN architecture

Design an Azure Virtual WAN architecture, including selecting skus and services

https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

https://docs.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology#architecture

Connect a vnet gateway to Azure Virtual WAN

https://docs.microsoft.com/en-us/azure/virtual-wan/connect-virtual-network-gateway-vwan
Create a hub in Virtual WAN

https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal#hub

Create a network virtual appliance (NVA) in a virtual hub

https://docs.microsoft.com/en-us/azure/virtual-wan/about-nva-hub

https://docs.microsoft.com/en-us/azure/virtual-wan/how-to-nva-hub

Configure virtual hub routing

https://docs.microsoft.com/en-us/azure/virtual-wan/about-virtual-hub-routing

https://docs.microsoft.com/en-us/azure/virtual-wan/how-to-virtual-hub-routing

Create a connection unit

https://docs.microsoft.com/en-us/azure/virtual-wan/pricing-concepts#connection-unit

Design and Implement Routing (25–30%)

Design, implement, and manage vnet routing
Design and implement user-defined routes (udrs)

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-
defined

https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal

Associate a route table with a subnet

https://docs.microsoft.com/en-us/azure/virtual-network/manage-route-table#associate-a-route-
table-to-a-subnet

Configure forced tunneling

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm

Diagnose and resolve routing issues

https://docs.microsoft.com/en-us/azure/network-watcher/diagnose-vm-network-routing-problem-
powershell

https://docs.microsoft.com/en-us/azure/virtual-network/diagnose-network-routing-problem

Design and implement an Azure Load Balancer

Choose an Azure Load Balancer SKU (Basic versus Standard)

https://docs.microsoft.com/en-us/azure/load-balancer/skus

Choose between public and internal

https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview
Create and configure an Azure Load Balancer (including cross-region)

https://docs.microsoft.com/en-us/azure/load-balancer/quickstart-load-balancer-standard-public-
portal?tabs=option-1-create-load-balancer-standard

https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-cross-region-portal

Implement a load balancing rule

https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-load-balancer#create-a-
load-balancer-rule

Create and configure inbound NAT rules

https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-port-forwarding-
portal#create-an-inbound-nat-port-forwarding-rule

Create explicit outbound rules for a load balancer

https://docs.microsoft.com/en-us/azure/load-balancer/outbound-rules

https://docs.microsoft.com/en-us/azure/load-balancer/quickstart-load-balancer-standard-public-
portal?tabs=option-1-create-load-balancer-standard#create-outbound-rule-configuration

Design and implement Azure Application Gateway

Recommend Azure Application Gateway deployment options

https://docs.microsoft.com/en-us/azure/application-gateway/quick-create-portal

Choose between manual and autoscale

https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-autoscaling-zone-
redundant#scaling-application-gateway-and-waf-v2

Create a back-end pool

https://docs.microsoft.com/en-us/azure/application-gateway/quick-create-portal#backends-tab

Configure health probes

https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-create-probe-
portal#create-probe-for-application-gateway-v2-sku

Configure listeners

https://docs.microsoft.com/en-us/azure/application-gateway/configuration-listeners

Configure routing rules

https://docs.microsoft.com/en-us/azure/application-gateway/configuration-request-routing-rules

Configure HTTP settings

https://docs.microsoft.com/en-us/azure/application-gateway/configuration-http-settings

Configure Transport Layer Security (TLS)

https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-end-to-end-ssl-
powershell
Configure rewrite policies

https://docs.microsoft.com/en-us/azure/application-gateway/rewrite-url-portal

Implement Azure Front Door

Choose an Azure Front Door SKU

https://docs.microsoft.com/en-us/azure/frontdoor/standard-premium/tier-comparison

Configure health probes, including customization of HTTP response codes

https://docs.microsoft.com/en-us/azure/////frontdoor/front-door-health-probes

Configure SSL termination and end-to-end SSL encryption

https://docs.microsoft.com/en-us/azure/frontdoor/standard-premium/how-to-configure-https-
custom-domain

Configure multisite listeners

https://docs.microsoft.com/en-us/azure/application-gateway/multiple-site-overview

Configure back-end targets

https://docs.microsoft.com/en-us/azure/frontdoor/front-door-backend-pool

Configure routing rules, including redirection rules

https://docs.microsoft.com/en-us/azure/frontdoor/front-door-route-matching

https://docs.microsoft.com/en-us/azure/frontdoor/front-door-how-to-redirect-https

Implement an Azure Traffic Manager profile

Configure a routing method (mode)

https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods

https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-configure-priority-routing-
method

Configure endpoints

https://docs.microsoft.com/en-us/azure/traffic-manager/quickstart-create-traffic-manager-
profile#add-traffic-manager-endpoints

Create HTTP settings

https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-monitoring#configure-
endpoint-monitoring

Design and implement an Azure Virtual Network NAT

Choose when to use a Virtual Network NAT

https://docs.microsoft.com/en-us/azure/virtual-network/nat-overview

Allocate public IP or public IP prefixes for a NAT gateway

https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway-resource
Associate a Virtual Network NAT with a subnet

https://docs.microsoft.com/en-us/azure/virtual-network/nat-overview

Secure and Monitor Networks (15–20%)

Design, implement, and manage an Azure Firewall deployment
Design an Azure Firewall deployment

https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal

Create and implement an Azure Firewall deployment

https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal-policy

Configure Azure Firewall rules

https://docs.microsoft.com/en-us/azure/firewall/rule-processing

Create and implement Azure Firewall Manager policies

https://docs.microsoft.com/en-us/azure/firewall-manager/policy-overview

Create a secure hub by deploying Azure Firewall inside an Azure Virtual WAN hub

https://docs.microsoft.com/en-us/azure/virtual-wan/howto-firewall

https://docs.microsoft.com/en-us/azure/firewall-manager/secure-cloud-network

Integrate an Azure Virtual WAN hub with a third-party NVA

https://docs.microsoft.com/en-us/azure/virtual-wan/about-nva-hub

https://docs.microsoft.com/en-us/azure/virtual-wan/scenario-route-through-nva

Implement and manage network security groups (nsgs)

Create an NSG

https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group#create-a-
network-security-group

Associate an NSG to a resource

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-
interface#associate-or-dissociate-a-network-security-group

https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic#associate-
network-security-group-to-subnet

Create an application security group (ASG)

https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic#create-
application-security-groups

Associate an ASG to a NIC

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-
interface#associate-or-dissociate-a-network-security-group
Create and configure NSG rules

https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group#create-a-
security-rule

Interpret NSG flow logs

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-read-nsg-flow-logs

Validate NSG flow rules

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-
overview

Verify IP flow

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

https://channel9.msdn.com/Blogs/Azure-Help/Troubleshoot-NSG-configuration-using-IP-Flow-Verify

Implement a Web Application Firewall (WAF) deployment

Configure detection or prevention mode

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview#waf-modes

https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-create-
portal#change-mode

Configure rule sets for Azure Front Door, including Microsoft managed and user defined

https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-create-
portal#default-rule-set-drs

https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-
drs?tabs=drs20

https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-custom-rules

Configure rule sets for Application Gateway, including Microsoft managed and user Defined

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-
rulegroups-rules?tabs=owasp31

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview

https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/web-application-
firewall/ag/create-custom-waf-rules.md

Implement a WAF policy

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

Associate a WAF policy

https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/associate-waf-policy-existing-
gateway
Monitor networks
Configure network health alerts and logging by using Azure Monitor

https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-insights-
overview#networkhealth

Create and configure a Connection Monitor instance

https://docs.microsoft.com/en-us/azure/network-watcher/connection-monitor-create-using-portal

Configure and use Traffic Analytics

https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics

Configure NSG flow logs

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-azure-
resource-manager

Enable and configure diagnostic logging

https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD

Configure Azure Network Watcher

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-create

Design and Implement Private Access to Azure Services (10–15%)

Design and implement Azure Private Link service and Azure Private Endpoint
Create a Private Link service

https://docs.microsoft.com/en-us/azure/private-link/create-private-link-service-portal

Plan private endpoints

https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview

Create private endpoints

https://docs.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal

Configure access to private endpoints

https://docs.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

Integrate Private Link with DNS

https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-
practices/private-link-and-dns-integration-at-scale

Integrate a Private Link service with on-premises clients

https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-sql-portal
Design and implement service endpoints
Create service endpoints

https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-restrict-network-access-to-
resources

Configure service endpoint policies

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-
portal

Configure service tags

https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview

Configure access to service endpoints

https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-service-endpoints

Configure vnet integration for dedicated platform as a service (paas) services

Configure App Service for regional vnet integration

https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet

Configure Azure Kubernetes Service (AKS) for regional vnet integration

https://docs.microsoft.com/en-us/azure/aks/private-clusters

Configure clients to access App Service Environment

https://docs.microsoft.com/en-us/azure/app-service/environment/using-an-ase#app-access