AZ-700 Course Notes

The exam tests the foundational networking components within Azure, critical for designing secure and scalable solutions. Understanding how to isolate workloads, manage IP addressing, and control DNS resolution is essential for architecting reliable Azure environments.

• **Virtual Network vs. NSG:** Virtual networks provide isolation; NSGs control traffic *within* that isolation.

• Prioritize solutions that leverage managed services like NAT Gateway and Azure DNS Private Resolver to reduce operational overhead.

The exam tests Azure's connectivity services, which are critical for securely connecting on-premises networks to Azure and managing network traffic within Azure. Understanding these services is essential for hybrid cloud deployments and ensuring reliable application access.

• **VPN Gateway vs. ExpressRoute:** VPN Gateways use the public internet, while ExpressRoute provides a dedicated private connection. VPN is generally more cost-effective for lower bandwidth needs, while ExpressRoute is preferred for high bandwidth and stringent security requirements.

• Carefully read the scenario and identify the key requirements (bandwidth, redundancy, security) before selecting a solution.

The exam tests application delivery services in Azure, which are critical for ensuring applications are accessible, scalable, and resilient. These services handle traffic management, routing, and security at various layers, from the transport layer (Layer 4) to the application layer (Layer 7). Understanding the nuances of each service and when to use them is essential for designing robust and efficient Azure solutions.

• **Azure Load Balancer vs. Application Gateway:** Load Balancer operates at Layer 4, while Application Gateway operates at Layer 7. This dictates the routing capabilities available.

• Carefully read the scenario and identify the key requirements. Look for keywords like 'Layer 7 routing,' 'NVA integration,' or 'global distribution.'

The exam tests enabling private access to Azure services, a critical aspect of network security and compliance. Private access solutions ensure that traffic to Azure services remains within the Microsoft backbone network, avoiding exposure to the public internet. This is particularly important for organizations with strict regulatory requirements or those prioritizing data sovereignty.

• **Private Endpoint vs. Service Endpoint:** Private Endpoints create a private IP address and network interface in your VNet and can use Private DNS. Service Endpoints keep the Azure service endpoint publicly routable while using the Azure backbone and virtual network identity to secure access from a subnet.

• Prioritize Private Endpoints when strict network isolation is required.

The exam tests securing Azure networks, a critical aspect of cloud infrastructure. It covers various services and configurations used to protect virtual networks, virtual machines, and applications from threats. Understanding these services is essential for maintaining confidentiality, integrity, and availability of data and resources.

• **NSGs vs. Azure Firewall:** NSGs are stateful subnet/NIC-level packet filters built around source, destination, port, protocol, and priority. Azure Firewall is a fully stateful managed firewall with network, application, and NAT rules, threat intelligence, central policy management, and SKU-dependent inspection capabilities.

• Prioritize understanding the default NSG rules and how they impact connectivity.