Browse Certification Practice Tests by Exam Family

Microsoft AZ-720 Cheat Sheet: Azure Connectivity

May 1, 2026

Review the retired Microsoft Azure Support Engineer for Connectivity (AZ-720) route, connectivity troubleshooting, routing, DNS, VPN, PaaS access, and current Azure networking alternatives.

On this page

AZ-720 is a retired Azure connectivity support route. Use this cheat sheet to map troubleshooting concepts to current Azure networking, administrator, and security paths.

Use this as a route check. Review the older connectivity troubleshooting scope, then compare current Azure networking and administrator routes.

Open AZ-720 exam page Compare AZ-700

Exam snapshot

FieldDetail
IssuerMicrosoft
Retired routeAzure Support Engineer for Connectivity Specialty
Exam codeAZ-720
Current statusRetired exam guidance
Closest current choicesAZ-700, AZ-104, AZ-500, and Network+ depending on the learner’s role
IT Mastery statusExam-selection sample question page

Troubleshooting map

AreaWhat to knowCommon trap
Connectivity pathSource, destination, protocol, route, DNS, firewall, and service endpointChanging firewall rules before checking route and DNS evidence
RoutingEffective routes, UDRs, peering, gateways, BGP, and propagationIgnoring asymmetric routing
DNSPrivate DNS zones, name resolution, split-horizon patterns, and recordsTreating every connection failure as routing
Hybrid accessVPN, ExpressRoute, gateways, redundancy, and on-premises dependenciesTroubleshooting Azure only when the failure is hybrid
PaaS connectivityPrivate endpoints, service endpoints, firewall rules, identity, and authorizationConfusing network reachability with permission
MonitoringFlow logs, connection troubleshooters, metrics, service health, and packet path evidenceGuessing instead of collecting network evidence

Must-know distinctions

DistinctionHow to decide
DNS failure vs route failureDNS fails before traffic has a destination IP; route failure occurs after destination resolution.
Network reachability vs authorizationReachability gets packets to a service; authorization allows actions after connection.
VPN vs ExpressRouteVPN uses internet tunnels; ExpressRoute provides private connectivity through a provider.
NSG vs firewallNSGs filter subnet or NIC traffic; firewalls provide centralized inspection and control.
Retired support route vs current networking routeUse AZ-720 as troubleshooting context, but use AZ-700 for current Azure networking preparation.

High-yield checklist

  • Confirm that AZ-720 is not the exam you plan to schedule.
  • Draw the path: source, DNS, route, security control, destination, identity, and service state.
  • Separate DNS, routing, firewall, and authorization symptoms.
  • Use effective routes and network troubleshooting evidence.
  • Check service health and platform incidents before deep tenant troubleshooting.
  • Map support-style connectivity skills to AZ-700 if Azure networking is your goal.

Common traps

  • Fixing network security when the failure is DNS.
  • Fixing DNS when the failure is route propagation.
  • Treating private endpoint access as complete without private DNS.
  • Ignoring identity and service firewall settings for PaaS access.
  • Studying the retired support route instead of a current networking route.

Practice strategy

Use the AZ-720 exam page to understand older Azure support-exam preparation, then move to AZ-700 for current networking preparation or AZ-104 for broader administration.

Revised on Monday, May 25, 2026