Microsoft AZ-700: Hybrid Networking — Study Guide
Part of the Microsoft Azure Network Engineer AZ-700 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.
Hybrid connectivity fundamentals and addressing constraints
Hybrid connectivity is about reliable, routable, and secure IP reachability between on-premises and Azure virtual networks. When planning virtual network addressing, remember that some Azure-managed resources inside a subnet require contiguous, non-conflicting address allocation and sometimes specific reserved addresses: Azure load balancers and gateway subnets must be carved out deliberately (the GatewaySubnet must be named exactly and sized to accommodate gateway SKU scale), and private endpoints and Azure-managed service endpoints require addresses drawn from the hosting VNet. Overlapping on-prem and Azure prefixes is the most common trap: overlapping ranges break routing and BGP route selection, create asymmetric routing, and complicate firewall policies. Use at least /27–/24 segments for subnets hosting stateful firewalls, load balancers, or many private endpoints; reserve a dedicated GatewaySubnet (/27 or larger depending on SKU). DNS is equally critical: private endpoints use platform private DNS zones (for example, privatelink.database.windows.net) so conditional forwarders or Azure DNS Private Resolver are needed on-prem to resolve Azure private names. Design trade-offs center on IP utilization versus resilience: denser IPv4 schemes save address space but increase collision and migration risk, while larger, less-efficient prefixes simplify future expansion and BGP advertisement strategies.
VPN Gateway SKUs, BGP fundamentals, and Local Network Gateways
Choosing the right VPN gateway SKU (VpnGw1–VpnGw5, Basic where legacy) directly affects throughput, concurrent S2S/P2S sessions, and available features like active-active or route limits. Use route-based gateways for modern hybrid designs; policy-based is legacy and limits BGP. BGP provides dynamic exchange of prefixes and supports path resilience, automatic failover, and prefix prioritization — configure the Azure VPN Gateway ASN (default 65515) and match or peer with the on-prem ASN in the Local Network Gateway object. The Local Network Gateway stores the on-prem public IP, the address space(s) and optional BGP peer IP and ASN; forgetting to populate BGP peer IP or mismatching ASNs prevents route propagation and leads to static route workarounds. Consider Azure Virtual WAN hubs for multi-site scale and built-in transit routing; VWAN hubs support high-scale S2S and P2S, and integrate with Azure Firewall and ExpressRoute. Watch out for route table propagation: by default some hub-to-spoke or virtual appliance topologies suppress automatic propagation; explicit UDRs or BGP route advertisements may be required. Trade-offs: higher SKUs and VWAN increase cost but reduce management overhead and improve throughput and routing scale.
Point-to-Site design choices, client support, and DNS integration
Point-to-Site (P2S) choices determine client compatibility, authentication, and scale. OpenVPN (SSL) is the most cross-platform and recommended for macOS, Linux, and mobile clients; IKEv2 is lightweight and works well with macOS native clients; SSTP remains an option for older Windows-only scenarios. Authentication modes include Azure Active Directory (recommended for identity integration and conditional access), certificate-based, and RADIUS for on-premises MFA or radius-based solutions. The VPN Gateway SKU dictates the P2S tunnel counts and throughput; pick VpnGw2/3 for medium to large user pools and VpnGw4/5 for heavy scale or throughput-sensitive use. Private endpoints and P2S interact via DNS: to allow P2S clients to resolve private endpoint names (privatelink zones), either link private DNS zones to the VNet or use Azure DNS Private Resolver and conditional forwarders from on-prem or client DNS. A frequent trap is forgetting that P2S clients normally use the gateway-provided Azure DNS only when the client pushes routes and DNS settings; explicit DNS suffix and forwarder configs avoid “can’t resolve private endpoint” issues. Balance scalability and cost: certificate auth is low-cost but harder to revoke; Azure AD offers modern security controls but adds licensing/complexity.
Transit routing, forced tunneling, inspection, and security appliance placement
Designing transit between multiple VNets, on-prem, and inspection appliances requires clear enforcement of routing and NAT boundaries. Forcing traffic through Azure Firewall or virtual appliances requires user-defined routes (UDRs) pointed at the firewall private IP or use of Virtual WAN hub routing to centralize inspection. If you need full transparent proxying or TLS inspection, place the appliance in a dedicated inspection subnet and ensure the gateway subnet and firewall SKUs support transit for expected throughput. Pay attention to SNAT behavior and public IP SKU choices: Standard Public IPs and NAT Gateway are recommended for predictable outbound SNAT and security rules; NAT Gateway paired with a set of Standard public IPs offloads SNAT and avoids per-VM public IP sprawl. One trap is asymmetric routing when on-prem routes and Azure UDRs cause return traffic to bypass the intended appliance; ensure all spokes advertise required prefixes via BGP or have UDRs that funnel to the inspection point. Performance vs cost: a hub-and-spoke with Azure Firewall Premium or third-party high-throughput appliances increases protection and central management but raises cost and single-hub failure risk unless you deploy active-active redundant hubs and pair gateways across regions.
Practical Problem: Use-Case Scenario
Scenario: Contoso Ltd has two on-prem datacenters (Seattle and Amsterdam) and an existing Azure environment with three VNets (VNet-Prod, VNet-Shared, VNet-Dev) in a single hub VNet (VNet-Hub). They currently use a VpnGw1 VPN Gateway for Seattle and a site-to-site to an Azure Virtual WAN hub for Amsterdam. Private endpoints are used for Azure SQL in VNet-Shared.
Challenge: Contoso needs resilient, scalable hybrid connectivity with dynamic routing (BGP) between both datacenters and Azure, reliable P2S support for macOS users, DNS resolution of private endpoints from on-prem, and centralized inspection of outbound traffic from spokes through Azure Firewall.
Recommended Approach:
- Deploy a new VpnGw3 route-based VPN Gateway in VNet-Hub configured active-active with BGP enabled (set gateway ASN explicitly) and update the Local Network Gateway objects with on-prem BGP peer IPs and ASNs; migrate Seattle S2S to the new gateway to support higher throughput and route limits.
- Consolidate Amsterdam connection into the hub by establishing ExpressRoute or migrating the VWAN hub to hub peering with VNet-Hub; ensure BGP route exchange across both datacenters to avoid static routes and enable automatic failover.
- Configure P2S using OpenVPN protocol with Azure AD authentication on the VpnGw3 to support macOS clients (IKEv2 as fallback), and size client pools per VpnGw3 limits; publish a conditional forwarder on on-prem DNS to forward privatelink.* zones to an Azure DNS Private Resolver deployed in VNet-Shared linked to the private DNS zones for private endpoints.
- Deploy Azure Firewall (Standard or Premium if TLS inspection required) in VNet-Hub in active-active configuration and create UDRs for spoke subnets that direct 0.0.0.0/0 to the Firewall private IP; attach a NAT Gateway with Standard public IPs to the firewall or use Firewall’s public IP for explicit SNAT and logging to central Log Analytics.
Rationale: Using VpnGw3 with BGP provides dynamic route propagation and throughput for multi-site resilience; OpenVPN+Azure AD supports macOS users securely; DNS forwarding to Azure DNS Private Resolver ensures private endpoint name resolution from on-prem; centralizing inspection in an Azure Firewall hub with UDRs avoids asymmetric routing and simplifies policy management while trading cost for centralized security and observability.
← Azure Virtual Network Design · All domains · Azure DNS →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →