Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Configure and Manage Virtual Networking (AZ-104) Syllabus

List the default inbound NSG rules (by name) that are always present.

AllowVNetInBound (65000), AllowAzureLoadBalancerInBound (65001), and DenyAllInBound (65500). Default outbound: AllowVnetOutBound, AllowInternetOutBound, DenyAllOutBound.

When both a subnet NSG and a NIC NSG apply, how is traffic evaluated for inbound vs outbound?

Inbound: subnet NSG is evaluated first, then NIC NSG. Outbound: NIC NSG first, then subnet NSG. Traffic must be allowed by both to reach/leave the VM.

What is a service tag in an NSG rule and give two examples?

A service tag represents a group of Azure service IP ranges managed by Microsoft, simplifying rules. Examples: Internet, VirtualNetwork, AzureLoadBalancer, Storage, Sql, AzureCloud.

What is an Application Security Group (ASG) and what problem does it solve?

An ASG lets you group VMs/NICs by application role (e.g., 'web', 'db') and use that group as source/destination in NSG rules, removing the need to manage explicit IPs in rules.

What does the 'stateful' property of NSGs mean for return traffic?

If inbound traffic is allowed, the response (return) traffic is automatically allowed without an explicit outbound rule, and vice versa, because connection state is tracked.

What is Azure Firewall and what protection layers does it provide?

Azure Firewall is a managed, stateful, cloud-native network firewall (Layer 3-7). It provides NAT rules, network rules (L3/L4), and application rules (FQDN-based L7 filtering) with built-in high availability and threat intelligence.

Compare the three Azure Firewall SKUs: Basic, Standard, Premium.

Basic: SMB use, threat intel alert mode. Standard: L3-L7 filtering, threat intelligence-based filtering. Premium: adds TLS inspection, IDPS (intrusion detection/prevention), URL filtering, and web categories.

In what order does Azure Firewall process its rule collection types?

NAT rules are processed first, then network rules, then application rules. Within Firewall Policy, rule collection groups have priority and rule collections have actions (allow/deny).

What is the difference between Azure Firewall and an NSG?

NSG is a free, basic L3/L4 stateful packet filter on subnets/NICs. Azure Firewall is a paid, managed L3-L7 service with FQDN filtering, threat intel, NAT, and centralized logging. They are complementary, often used together.

What is a Service Endpoint and how does it secure PaaS access?

A Virtual Network Service Endpoint extends the VNet identity to an Azure PaaS service (e.g., Storage, SQL) over the backbone, letting you restrict the PaaS resource's firewall to specific subnets. Traffic still uses the service's public IP.

What is Azure Private Link / a Private Endpoint?

A Private Endpoint is a NIC with a private IP from your VNet that connects privately to a PaaS service via Azure Private Link. Traffic stays on the Microsoft backbone and the service is reachable by a private IP, not its public endpoint.

Key difference between a Service Endpoint and a Private Endpoint for PaaS security?

Service Endpoint: free, uses the PaaS public IP, VNet-level access (service still has public endpoint). Private Endpoint: brings the service into your VNet via a private IP, supports on-prem access, allows disabling public access entirely; has cost.

What is Azure Load Balancer and at which OSI layer does it operate?

Azure Load Balancer is a Layer 4 (TCP/UDP) load balancer that distributes inbound flows to backend pool instances. It is non-terminating, ultra-low latency, and high throughput.

What is the difference between a public and an internal (private) Azure Load Balancer?

Public LB has a public frontend IP and load-balances internet traffic to VMs. Internal LB has a private frontend IP and load-balances traffic within a VNet or from on-premises (e.g., tiers behind it).

Compare Basic and Standard Azure Load Balancer SKUs.

Basic: up to 300 instances, no SLA, no zone redundancy, open by default (free, being retired). Standard: up to 1000 instances, 99.99% SLA, zone redundant, secure by default (needs NSG), HA ports, has cost.

What is the default load-balancing distribution algorithm in Azure Load Balancer?

A 5-tuple hash (source IP, source port, destination IP, destination port, protocol) for hash-based distribution. Session persistence can change this to 2-tuple (source/dest IP) or 3-tuple.

What is the purpose of a health probe in Azure Load Balancer?

A health probe (TCP, HTTP, or HTTPS) checks backend instance health; only healthy instances receive new flows. If an instance fails the probe it is removed from rotation.

What is the difference between a load balancing rule and an inbound NAT rule?

A load balancing rule distributes traffic across all healthy backend instances. An inbound NAT rule forwards traffic on a specific frontend port to a single backend instance/port (e.g., RDP/SSH to one VM).

What is Azure Application Gateway and at which layer does it operate?

Application Gateway is a Layer 7 (HTTP/HTTPS) web traffic load balancer (ADC). It supports URL path-based routing, multi-site hosting, SSL/TLS termination, cookie-based session affinity, and autoscaling (v2).

What is the Web Application Firewall (WAF) on Application Gateway?

WAF is an optional tier that protects web apps from common exploits using OWASP Core Rule Set (e.g., SQL injection, XSS). It runs in Detection or Prevention mode.

What is URL path-based routing in Application Gateway?

It routes requests to different backend pools based on the URL path (e.g., /images/* to one pool, /video/* to another) using path-based rules and a path map.

What is SSL/TLS offloading (termination) in Application Gateway?

The gateway terminates the TLS connection, decrypts traffic at the gateway, and forwards it (optionally re-encrypted with end-to-end TLS) to the backend, reducing crypto load on backend servers.

What is Azure Front Door and how does it differ from Application Gateway?

Front Door is a global Layer 7 load balancer / CDN operating at the network edge (anycast), routing across regions with caching and WAF. Application Gateway is a regional L7 load balancer within one region.

What is Azure Traffic Manager and at which layer does it work?

Traffic Manager is a DNS-based global traffic load balancer (works at DNS level, not in the data path). It directs clients to the best endpoint across regions by returning DNS responses.

List the routing methods available in Azure Traffic Manager.

Priority (failover), Weighted (distribution), Performance (lowest latency), Geographic (by user location), Multivalue (multiple healthy IPs), and Subnet (map source IP ranges to endpoints).

Which Azure services are global vs regional load balancers? Classify Traffic Manager, Front Door, Load Balancer, Application Gateway.

Global: Traffic Manager (DNS, any protocol) and Front Door (L7 HTTP/S). Regional: Application Gateway (L7) and Azure Load Balancer (L4).

What is a Site-to-Site (S2S) VPN connection in Azure?

An IPsec/IKE encrypted tunnel over the public internet between an Azure VPN gateway and an on-premises VPN device, connecting whole networks. Requires a VPN gateway and a local network gateway.

What is the difference between Point-to-Site (P2S) and Site-to-Site (S2S) VPN?

P2S connects an individual client device to the VNet (good for remote workers, uses SSTP/OpenVPN/IKEv2). S2S connects an entire on-premises network to Azure via a VPN device using IPsec/IKE.

What are the two VPN gateway types and which supports policy-based routing?

Route-based (dynamic) and Policy-based (static). Policy-based supports only one S2S tunnel and is Basic SKU only; route-based is recommended and supports P2S, coexistence, and multiple tunnels.

What is Azure ExpressRoute and how does it differ from a VPN?

ExpressRoute is a private, dedicated connection from on-premises to Azure through a connectivity provider, bypassing the public internet. It offers higher reliability, faster speeds, lower latency, and more security than internet-based VPN.

What are ExpressRoute peering types?

Azure private peering (access to VNets/private IPs) and Microsoft peering (access to Microsoft 365 and Azure PaaS public services). Public peering is deprecated, merged into Microsoft peering.

What is Azure Virtual WAN?

Virtual WAN is a managed networking service that unifies many connectivity types (S2S VPN, P2S VPN, ExpressRoute, and inter-VNet) into a single hub-and-spoke architecture with automated routing through Microsoft-managed virtual hubs.

In Azure system (default) routes, what are the next hop types?

Virtual network (intra-VNet), Internet (default 0.0.0.0/0 to internet), None (drops traffic), Virtual network gateway, and VNet peering. These are created automatically by Azure.

What is a User-Defined Route (UDR) and why use one?

A UDR is a custom route in a route table associated to a subnet that overrides Azure's default system routes, e.g., to force traffic through a network virtual appliance (NVA) or Azure Firewall. Next hop can be Virtual appliance, VNet gateway, Internet, VirtualNetwork, or None.

How does Azure select which route to use when multiple routes match a destination?

Longest prefix match (most specific CIDR) wins. If prefixes are equal, source priority is: User-defined route > BGP route > System route.

What is BGP in the context of Azure networking and where is it used?

Border Gateway Protocol dynamically exchanges routes between Azure and on-premises networks. It is used with route-based VPN gateways and ExpressRoute to automatically advertise and learn prefixes instead of static routing.

What is forced tunneling in Azure routing?

Forced tunneling redirects all internet-bound traffic from a subnet back to the on-premises site (or an NVA/firewall) for inspection, instead of allowing direct internet egress. It is implemented via UDRs or BGP advertising a default route.

What is the maximum number of VNet peerings recommended/allowed per virtual network (default limit)?

By default a VNet supports up to 500 peerings (raised from the older limit of 500), enabling large hub-and-spoke topologies. (Exam-level: know that peering scales to hundreds.)

What does HA Ports load balancing rule on a Standard Load Balancer do?

HA Ports load-balances all flows on all ports (protocols TCP and UDP) simultaneously using a single rule, which is essential for active-active network virtual appliance (NVA) scenarios.