AZ-700 Cheat Sheet: Hard-to-Remember Items

Subnet names and minimum sizes

• A subnet can be delegated to only one service.
• A delegated subnet can’t hold other resource types.

IP addressing

• Basic public IP and Basic LB: retired Sept 30, 2025. Use Standard.
• Standard PIP: static only, zone-redundant by default, secure by default (a NSG must allow traffic).
• Public IP prefix: Standard only, contiguous, /28 to /31. A prefix is one block, so you can’t mix zones.
• Custom IP prefix (BYOIP): min /24 IPv4 or /48 IPv6. Requires a ROA and RDAP/WHOIS validation. Lifecycle: provisioned → commissioned (advertised).
• Default outbound access: being retired. New VNets default to private subnets. Use NAT Gateway, LB outbound rules, or a PIP.

DNS

• Azure-provided DNS IP: 168.63.129.16. It is also the LB health probe source and the DHCP/DNS/VM agent endpoint.
• Auto-registration: a VNet can link to only one private zone with auto-registration. Auto-registration records are VM only.
• Resolution-only links: a VNet can have many.
• Zone limits: a zone supports 100 registration links and 1,000 resolution links.
• Apex CNAME: not allowed. Use an alias record.
• Custom DNS on a VNet: restart the VMs to pick up the change.
• Private Resolver:
  • Inbound endpoint: on-prem → Azure, using a private IP in the inbound subnet.
  • Outbound endpoint plus forwarding ruleset: Azure → on-prem. Link the ruleset to VNets.
  • It replaces the “DNS forwarder VM”.
• Private endpoint zones: privatelink.blob.core.windows.net, privatelink.database.windows.net, privatelink.vaultcore.azure.net, and so on.
• On-prem to private endpoint: use a conditional forwarder to the public zone name → Private Resolver inbound IP. Do not forward privatelink.* directly.

Peering, routing, NAT

• Peering: non-transitive, and address spaces can’t overlap.
• Gateway transit: the hub sets “Allow gateway transit”. The spoke sets “Use remote gateways”. Only one side can use a given gateway.
• Peering changes: resync after an address space change.
• Global peering: Basic LB frontends aren’t reachable. This is moot now that Basic is retired.
• Route selection: longest prefix match first. Then UDR > BGP > system route.
• UDR next hop types: VirtualAppliance, VirtualNetworkGateway, VnetLocal, Internet, None.
• Forced tunneling: a 0.0.0.0/0 route with next hop VirtualNetworkGateway. For Azure Firewall it needs the management subnet.
• Route Server:
  • BGP peering with NVAs, with a Standard PIP.
  • Azure ASN is 65515. The reserved ASNs are 65515–65520, 8074, 8075 and 12076.
  • Branch-to-branch must be enabled to exchange ER ↔ VPN routes.
  • Up to 8 BGP peers. ⚠️
• NAT Gateway:
  • Subnet-scoped, Standard SKU only, IPv4 only. ⚠️
  • Up to 16 public IPs, 64,512 SNAT ports per IP.
  • Idle timeout default 4 min (range 4–120).
  • Outbound only. It overrides LB outbound rules and default outbound access.
  • Zonal. It can’t span zones.

Azure Virtual Network Manager (AVNM)

• Scope: management group or subscription.
• Network groups: static or dynamic (Azure Policy) membership.
• Connectivity configs: hub-and-spoke or mesh. Direct connectivity is optional.
• Security admin rules: evaluated before NSGs. Actions are Allow, Deny, AlwaysAllow (skips NSGs).
• Deployment: configs do nothing until you deploy them (commit) to regions.

VPN Gateway

• Use the AZ variants (VpnGw1AZ and so on) for zone redundancy. Non-AZ SKUs are being phased out.
• Basic SKU: no BGP, no IKEv2/OpenVPN P2S, no RADIUS, no zone redundancy, no active-active.
• Policy-based VPN: IKEv1 only, a single tunnel, and only on the Basic SKU. Use it only for legacy devices.
• Route-based VPN: IKEv2, multiple tunnels, BGP. Use it for everything else.
• Gateway limits: one VPN gateway per VNet. A VPN gateway and an ER gateway can coexist on the same GatewaySubnet.
• Default gateway BGP ASN: 65515.
• Active-active: 2 public IPs and 2 tunnels per remote site. This is HA.
• Local network gateway: represents the on-prem device (public IP + prefixes, optional BGP).

P2S

• Authentication: Azure certificate, RADIUS (needs a RADIUS server reachable from the gateway), Entra ID (OpenVPN only).
• Client config: regenerate and redistribute the VPN client config after changes.
• Always On VPN: needs IKEv2 or SSTP. A device tunnel needs IKEv2 and a machine certificate.
• Azure Network Adapter: Windows Admin Center creates a P2S connection from a server to a VNet gateway.
• Azure Extended Network: stretches an on-prem subnet to Azure over S2S, with Windows Server 2019 VMs.

ExpressRoute

• Models: CloudExchange co-location, point-to-point Ethernet, any-to-any (IPVPN), ExpressRoute Direct (10 or 100 Gbps ports).
• Circuit SKUs:

• Peerings: private (VNets) and Microsoft (M365/PaaS public IPs). Public peering is deprecated. A route filter is required for Microsoft peering.
• Peering addressing: two /30 subnets (primary and secondary), a VLAN ID and an ASN. Microsoft peering needs public IPs you own.
• Gateway SKUs: Standard (ErGw1Az) ~1 Gbps, High Performance (ErGw2Az) ~2 Gbps, Ultra Performance (ErGw3Az) ~10 Gbps. ⚠️
• FastPath: bypasses the gateway on the data path. It needs Ultra Performance or ErGw3Az.
• Global Reach: links on-prem sites via the Microsoft backbone and needs a /29.
• BFD: enabled on private peering. It gives fast failover.
• Encryption: MACsec for ExpressRoute Direct only. IPsec VPN over Microsoft or private peering for any circuit.
• Redundancy: two physical connections per circuit. For resilience, use 2 circuits in different locations.
• Active/active vs active/passive: BGP session settings differ per path. Prefer active/active.
• Route preference: ER wins over VPN for the same prefix. AS-path prepend or longer prefix to steer.

Virtual WAN

• Basic: S2S only. No ER, no P2S, no VNet-to-VNet, no hub routing, no Firewall. You can upgrade Basic to Standard.
• Standard: everything: ER, P2S, inter-hub, secure hub, NVA, routing intent.
• Hub: managed VNet, /23 recommended. The hub router scales from 2 routing infrastructure units. ⚠️
• Scale units:

• Routing: the Default route table and the None route table. Associations and propagations are per connection. Routing intent sends traffic through Firewall or an NVA.
• Secure hub: Azure Firewall in the hub, managed by Firewall Manager.

Load Balancer

• Skus: Basic retired (Sept 30, 2025). Standard: zone-redundant, up to 1,000 instances, 99.99% SLA, secure by default (NSG required).
• Tiers: Regional or Global (cross-region). Global is public only, has a home region, and its frontend is a Global-tier PIP.
• Gateway LB: chains NVAs using VXLAN. An LB frontend (public or internal) is the chain target.
• Probe source: 168.63.129.16. Probe types are TCP, HTTP and HTTPS.
• Distribution: 5-tuple (default), 2-tuple (source IP affinity), 3-tuple (source IP + protocol).
• Idle timeout: 4 min default, up to 30. TCP reset is optional.
• Floating IP: direct server return, needed for SQL AG listeners.
• HA ports: all ports and protocols on internal Standard LB, used for NVAs.
• Outbound: explicit outbound rules configure SNAT. Each frontend IP gives 64k ports. An LB doesn’t allow both Inbound and Outbound rules to share the same frontend IP and backend.

Traffic Manager

• Layer: DNS only. Traffic doesn’t flow through it.
• Routing methods: Priority, Weighted, Performance, Geographic, MultiValue, Subnet.
• Endpoint types: Azure, External, Nested.
• Probes: HTTP, HTTPS or TCP. TTL affects failover speed.

Application Gateway

• Layer: L7 (HTTP/S/WebSocket). v1 is retired.
• v2 features: autoscale, zone redundancy, static VIP, header and URL rewrite, WAF_v2, Key Vault integration, Private Link. Max 125 instances.
• Autoscale vs manual: autoscale scales on load. Manual uses a fixed instance count.
• Listeners: Basic (single site) or multi-site (host names, wildcards).
• Rules: Basic (one pool) or path-based (URL map).
• HTTP settings: cookie affinity, connection draining, host header override, custom probe.
• Default probe: interval 30 s, timeout 30 s, unhealthy threshold 3.
• TLS: termination at the gateway, or end-to-end (re-encrypt to the backend; the backend cert must chain to a trusted root).
• NSG rules: allow GatewayManager on ports 65200–65535 (v2) and AzureLoadBalancer.
• Rewrite sets: headers and URL, conditional.

Front Door

• Classic is being retired. Pick Standard or Premium.
• Anycast + split TCP: accelerates traffic from the edge.
• Routing: latency, priority, weighted, session affinity.
• Lock down the origin: the AzureFrontDoor.Backend service tag plus the X-Azure-FDID header check.
• Private Link origin: Premium only. The private endpoint connection needs approval on the origin.
• Rule sets: URL rewrite and URL redirect (301, 302, 307, 308).
• TLS: managed certs or BYO from Key Vault. End-to-end TLS is supported.

Private Link and service endpoints

• One private endpoint per sub-resource (group ID). Approval is automatic or manual.
• Private Link service: fronts your own service behind a Standard LB. It uses a NAT IP, an alias, and visibility and auto-approval by subscription. TCP Proxy v2 is optional.
• Service endpoint scope: regional and paired region.

NSG and flow logs

• Priority: 100–4096, lowest number wins.
• Defaults: 65000 AllowVnetInBound, 65001 AllowAzureLoadBalancerInBound, 65500 DenyAllInBound. Outbound mirrors that. Rules are stateful.
• Evaluation order: inbound hits the subnet NSG, then the NIC NSG. Outbound hits the NIC NSG, then the subnet NSG.
• ASG: all member NICs must be in the same VNet. An ASG can be the source or destination of a rule.
• VNet flow logs: replace NSG flow logs. NSG flow logs can’t be created as of June 30, 2025, and are retired Sept 30, 2027.
  • They log to a storage account, with optional Traffic Analytics via Log Analytics.
  • They cover the whole VNet, subnet or NIC. They also capture traffic that an NSG doesn’t see.
• Bastion NSG rules:
  • Inbound: 443 from Internet, 443 from GatewayManager, 443 from AzureLoadBalancer, 8080/5701 from VirtualNetwork.
  • Outbound: 22/3389 to VirtualNetwork, 443 to AzureCloud, 8080/5701 within the VNet, 80 to Internet.

Bastion SKUs

Azure Firewall

• Rule order: DNAT → network → application. Then collections by priority (100–65,000, lowest first). Within a type, rule collection groups also have priorities.
• Application rules: HTTP, HTTPS and MSSQL. Use network rules for everything else.
• Firewall Manager: policies are hierarchical (parent/child). It also builds secure hubs and manages DDoS and hub VNets.
• Premium TLS inspection: needs an intermediate CA certificate in Key Vault with a managed identity.

WAF

• Platforms: Application Gateway (WAF_v2 only), Front Door (Premium for managed rules), Application Gateway for Containers.
• Modes: Detection (log only) and Prevention (block).
• Rule sets: Default Rule Set (DRS) on Front Door, OWASP CRS 3.x on Application Gateway, plus Bot Manager.
• Custom rules: evaluated before managed rules. Actions are Allow, Block, Log, Redirect (Front Door only). Rate limiting is supported.
• Policy scope: per gateway, per listener or per URI path (Application Gateway).
• Exclusions: per rule or per rule set. Use them for false positives.

DDoS

• Infrastructure protection: free, default, Azure-wide.
• Network Protection: per VNet plan, covers up to 100 public IPs. Includes DDoS Rapid Response, cost protection, and a WAF discount.
• IP Protection: per public IP. No Rapid Response, cost protection or WAF discount.
• Metrics: “Under DDoS attack or not”, “Inbound packets dropped DDoS”.
• Diagnostics: mitigation reports, mitigation flow logs and notifications.

Network Watcher tools

• Network Watcher is created automatically per region (NetworkWatcherRG).
• Azure Monitor Network Insights: a topology and health dashboard.
• Defender for Cloud:
  • Secure Score: ranked recommendations.
  • Attack path analysis and Cloud Security Explorer: need the Defender CSPM plan.
  • Cloud Security Explorer: graph queries against your resources.