Study Guides/AZ-104/Implement and Manage Virtual Networking

15-20% of exam

Implement and Manage Virtual Networking

Design virtual networks and subnets, secure traffic with NSGs, and connect networks with peering, load balancing, and DNS.

Manage Azure Identities and Governance Implement and Manage Storage Deploy and Manage Azure Compute Resources Implement and Manage Virtual Networking Monitor and Maintain Azure Resources

Virtual networks, subnets, and IP addressing

A virtual network (VNet) is an isolated network boundary within a region. Resources inside it can communicate privately, and it's subdivided into subnets for organization and rule scoping.

Core concepts

Address space: the VNet's overall private IP range, defined using CIDR notation (for example, 10.0.0.0/16).
Subnet: a smaller range carved out of the VNet's address space; resources are deployed into a specific subnet, not directly into the VNet.
Azure reserves the first four and the last IP address in every subnet for internal use, which reduces the number of usable addresses.
Private IP: assigned from the VNet/subnet range, used for internal communication.
Public IP: internet-routable, optionally attached to a VM's NIC or a load balancer's frontend.

Common confusion

A VNet's address space cannot overlap with an on-premises network or another VNet it needs to connect to — plan address ranges before deployment, since resizing later is disruptive.

Network security groups and application security groups

Network security groups (NSGs) are the primary way to control inbound and outbound traffic at the network level, independent of what's running inside the VM.

NSG rules

Each rule specifies a priority (lower number evaluated first), source, destination, port, protocol, and action (Allow or Deny).
NSGs can be associated with a subnet, a network interface, or both — when applied to both, both must allow the traffic.
Default rules allow traffic within the VNet and outbound to the internet, and deny inbound traffic from the internet, unless overridden by a custom rule with a lower priority number.

Application security groups (ASGs)

Group VMs by application role (for example, "WebServers") so NSG rules can reference the group instead of individual IP addresses.
Makes rules easier to maintain as VMs are added or removed, since the rule targets the group, not a fixed address list.

Common confusion

NSGs filter traffic; they don't provide routing. A route can exist to a destination that an NSG rule still blocks.

Connecting and resolving names: peering, load balancing, DNS

Once VNets and subnets exist, workloads usually need to reach each other across networks and be reachable by a stable name rather than a changing IP address.

VNet peering

Connects two VNets so resources communicate as if on the same network, using Azure's backbone rather than the public internet.
Non-transitive by default: if VNet A peers with B, and B peers with C, A cannot reach C through B without a direct peering or a hub-and-spoke design using a network virtual appliance.

Load balancing

Azure Load Balancer: Layer 4 (TCP/UDP), distributes traffic across VMs or a scale set based on a hash of source/destination.
Public Load Balancer: distributes internet-facing traffic.
Internal Load Balancer: distributes traffic only within a VNet, with no public exposure.

DNS

Azure-provided DNS gives automatic name resolution within a VNet but doesn't support custom records.
Azure Private DNS zones allow custom domain names resolved privately within one or more linked VNets.
Azure DNS (public zones) hosts internet-facing domains and their records (A, CNAME, MX, and so on).

Back to AZ-104 Overview Practice Questions