Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Configure and Manage Virtual Networking (AZ-104) Syllabus

Configure and Manage Virtual Networking (AZ-104) syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Configure and Manage Virtual Networking (AZ-104) in Microsoft Azure Certifications (e.g. AZ-104, AZ-900), not a summary of it.

1. 1

   Virtual Networks and Subnets

   3 topics

   • VNet design and addressing
     • Address spaces and subnet segmentation
     • Public and private IP addressing
   • VNet connectivity
     • VNet peering (regional and global)
     • Service chaining and gateway transit
   • Name resolution
     • Azure-provided DNS and custom DNS servers
     • Private DNS zones and auto-registration
2. 2

   Network Security

   3 topics

   • Network Security Groups (NSGs)
     • Inbound and outbound security rules
     • Application Security Groups
     • Effective security rules and evaluation
   • Azure Firewall and protection
     • Azure Firewall rules and policies
     • Service endpoints versus private endpoints
   • Secure access to PaaS services
     • Private Link and private endpoints
     • Restricting access with firewall rules
3. 3

   Load Balancing

   3 topics

   • Azure Load Balancer
     • Public and internal load balancers
     • Backend pools, health probes and rules
   • Application Gateway
     • Layer 7 routing and listeners
     • Web Application Firewall (WAF) integration
   • Global load balancing
     • Azure Traffic Manager profiles
     • Azure Front Door routing
4. 4

   Hybrid Network Connectivity

   3 topics

   • VPN connectivity
     • Site-to-site and point-to-site VPN
     • VPN Gateway SKUs and configuration
   • ExpressRoute and Virtual WAN
     • ExpressRoute circuits and peering
     • Azure Virtual WAN topology
   • Routing in Azure
     • System and user-defined routes
     • Forced tunnelling and route tables

Configure and Manage Virtual Networking (AZ-104) flashcards for Microsoft Azure Certifications (e.g. AZ-104, AZ-900)

24 of 59 cards from the Configure and Manage Virtual Networking (AZ-104) deck — real questions with worked answers.

1. What is an Azure Virtual Network (VNet) and what is its primary scope?

   A VNet is the fundamental building block for private networking in Azure, providing an isolated logical network. Its scope is a single region and a single subscription, though it can be peered across regions and subscriptions.

2. Which private IP address ranges (RFC 1918) are typically used for VNet address spaces?

   $10.0.0.0/8$, $172.16.0.0/12$, and $192.168.0.0/16$. VNet address space is defined using CIDR notation.

3. In any Azure subnet, how many IP addresses are reserved by Azure and cannot be assigned to resources?

   5 addresses are reserved: the network address (first), the default gateway (.1), two for Azure DNS mapping (.2 and .3), and the broadcast address (last).

4. How many usable host IPs are available in an Azure subnet with a $/24$ mask?

   A $/24$ has $2^{8}=256$ total addresses; Azure reserves 5, leaving $256-5=251$ usable IPs.

5. What is the smallest and largest subnet size (CIDR) supported in an Azure VNet?

   Smallest is $/29$ (8 addresses, 3 usable) and largest is $/2$. In practice subnets commonly range from $/29$ to $/8$.

6. Can subnets within the same VNet have overlapping address ranges?

   No. Subnet ranges must be unique and cannot overlap within the VNet, and they must fall within the VNet's defined address space.

7. What is VNet peering and what are its two types?

   VNet peering connects two VNets so traffic routes privately over the Microsoft backbone. Types: regional (VNet) peering (same region) and global VNet peering (different regions).

8. Is VNet peering transitive by default?

   No. Peering is non-transitive. If VNet A peers with B and B peers with C, A cannot reach C unless you add direct peering or use a hub-and-spoke with gateway transit/UDRs/NVA.

9. What feature lets spoke VNets use a hub VNet's VPN/ExpressRoute gateway through peering?

   Gateway transit. The hub allows 'Allow gateway transit' and spokes enable 'Use remote gateways', so spokes share the hub's gateway without their own.

10. What is an Azure NIC (network interface) and how does it relate to private IPs?

    A NIC connects a VM to a subnet and carries the VM's IP configuration. Each NIC has at least one private IP (dynamic or static) and can optionally have a public IP and multiple IP configurations.

11. What are the two allocation methods for private IP addresses in Azure?

    Dynamic (assigned by DHCP from the subnet range, the default) and Static (manually fixed within the subnet range, persists across deallocation).

12. What is the difference between Basic and Standard public IP SKUs?

    Basic: dynamic or static, open by default, no zone redundancy (being retired). Standard: static only, secure by default (closed unless NSG allows), zone-redundant/zonal capable, required for Standard Load Balancer.

13. What does Azure-provided (default) name resolution offer and what are its limits?

    Azure DNS automatically resolves VM hostnames within the same VNet and resolves public DNS names. Limits: no resolution across VNets, no custom DNS records, and no reverse DNS for custom names.

14. What is an Azure Private DNS Zone used for?

    It provides custom DNS domain name resolution within and across VNets without a custom DNS server. You link VNets to the zone and can enable auto-registration of VM records.

15. What does enabling 'auto registration' on a private DNS zone virtual network link do?

    It automatically creates and manages DNS A records for VMs in the linked VNet, and removes them when VMs are deleted. Only one linked VNet per zone can have auto-registration acting as the registration network.

16. How do you make VMs in a VNet use a custom (on-premises) DNS server?

    Set custom DNS servers on the VNet (or NIC). VMs then receive those DNS server IPs via DHCP. The well-known Azure DNS virtual IP is $168.63.129.16$.

17. What is the special Azure IP address $168.63.129.16$ used for?

    It is Azure's virtual public IP used to deliver platform communication: DNS resolution, DHCP lease, health probes (load balancer), and PaaS health/monitoring to the VM.

18. What is a Network Security Group (NSG) and what does it contain?

    An NSG is a stateful packet filter containing a list of security rules that allow or deny inbound and outbound traffic, evaluated by 5-tuple: source, source port, destination, destination port, and protocol.

19. To what Azure resources can an NSG be associated, and how many at once?

    An NSG can be associated to subnets and/or NICs. A subnet or NIC can have at most one NSG, but the same NSG can be associated to many subnets/NICs.

20. How are NSG rules evaluated and what determines precedence?

    Rules are processed in priority order from lowest number to highest (100 to 4096). The first matching rule applies; lower priority number = higher precedence. Once a match is found, no further rules are evaluated.

21. List the default inbound NSG rules (by name) that are always present.

    AllowVNetInBound (65000), AllowAzureLoadBalancerInBound (65001), and DenyAllInBound (65500). Default outbound: AllowVnetOutBound, AllowInternetOutBound, DenyAllOutBound.

22. When both a subnet NSG and a NIC NSG apply, how is traffic evaluated for inbound vs outbound?

    Inbound: subnet NSG is evaluated first, then NIC NSG. Outbound: NIC NSG first, then subnet NSG. Traffic must be allowed by both to reach/leave the VM.

23. What is a service tag in an NSG rule and give two examples?

    A service tag represents a group of Azure service IP ranges managed by Microsoft, simplifying rules. Examples: Internet, VirtualNetwork, AzureLoadBalancer, Storage, Sql, AzureCloud.

24. What is an Application Security Group (ASG) and what problem does it solve?

    An ASG lets you group VMs/NICs by application role (e.g., 'web', 'db') and use that group as source/destination in NSG rules, removing the need to manage explicit IPs in rules.

See more Configure and Manage Virtual Networking (AZ-104) flashcards →

Planning Configure and Manage Virtual Networking (AZ-104) for Microsoft Azure Certifications (e.g. AZ-104, AZ-900)

Configure and Manage Virtual Networking (AZ-104) (Microsoft Azure Certifications (e.g. AZ-104, AZ-900)) FAQ