Microsoft Certified: Azure Administrator Associate Configure Load Balancing and Network Monitoring Syllabus

What are the three main components of an Application Gateway request flow?

Listeners (receive incoming requests), rules (define how requests are routed), and backend pools (the targets that serve the request).

What is a listener in Application Gateway?

A listener is a logical entity that checks for incoming connection requests using a configured protocol, port, host, and IP address; it determines whether a request is accepted.

What are the two types of listeners in Application Gateway?

Basic listeners (route based only on port/protocol) and multi-site listeners (route based on the host header/domain name to support multiple sites on one gateway).

What is path-based routing in Application Gateway?

Path-based (URL path) routing directs requests to different backend pools based on the URL path of the request (e.g., /images/* to one pool, /video/* to another) using a path-based routing rule with a URL path map.

What is multi-site routing in Application Gateway?

Multi-site routing hosts multiple web applications/domains on the same Application Gateway, routing requests to different backend pools based on the host header (e.g., contoso.com vs fabrikam.com).

What is a Web Application Firewall (WAF) in the context of Application Gateway?

WAF is a feature of Application Gateway that provides centralized protection of web apps against common exploits such as SQL injection and cross-site scripting (XSS), based on OWASP core rule sets.

Which OWASP rule set versions does Azure WAF support?

Azure WAF supports OWASP Core Rule Set (CRS), including versions such as CRS 3.2, 3.1, and 3.0 (and newer), which define managed rules against common attacks.

What are the two modes of Azure Web Application Firewall?

Detection mode (monitors and logs threats but does not block) and Prevention mode (blocks intrusions and attacks detected by the rules).

On which Application Gateway tier is WAF available?

WAF requires the WAF or WAF_v2 (Standard_v2-based) SKU/tier of Application Gateway; it is not available on the basic Standard tier.

What is Azure Network Watcher?

Network Watcher is a regional service providing tools to monitor, diagnose, view metrics, and enable/disable logging for resources in an Azure virtual network.

List four diagnostic tools provided by Azure Network Watcher.

IP flow verify, Next hop, Connection troubleshoot, Connection monitor, Packet capture, VPN troubleshoot, NSG flow logs, and Effective security rules (any four).

What does the IP flow verify tool in Network Watcher do?

IP flow verify checks whether a packet is allowed or denied to/from a VM based on Network Security Group rules, and identifies the specific NSG rule responsible for the decision.

What inputs does IP flow verify require?

Direction (inbound/outbound), protocol (TCP/UDP), local IP and port, and remote IP and port for the target VM.

What does the Next hop tool in Network Watcher determine?

Next hop determines how traffic from a VM is routed to a destination IP, returning the next hop type (e.g., Internet, VirtualAppliance, VirtualNetworkGateway, None) and the route table that produced it, useful for diagnosing routing issues.

What does Connection troubleshoot in Network Watcher do?

Connection troubleshoot tests and diagnoses a connection between a source (VM) and a destination (VM, FQDN, URI, or IP), returning reachability status, latency, hop-by-hop topology, and any issues (NSG, route, or CPU/memory).

What is the difference between Connection Monitor and Connection troubleshoot?

Connection troubleshoot performs a one-time, on-demand connectivity check, while Connection Monitor provides continuous, ongoing monitoring of connectivity over time with alerting.

What are NSG flow logs in Network Watcher?

NSG flow logs record information about IP traffic flowing through a Network Security Group, capturing allowed and denied flows; logs are stored in an Azure Storage account in JSON format.

Where are NSG flow logs stored?

In an Azure Storage account (as JSON), from which they can be analyzed manually or ingested by Traffic Analytics.

What are the two versions of NSG flow logs and how do they differ?

Version 1 logs basic 5-tuple flow and allow/deny decisions; Version 2 adds throughput information (bytes and packets transmitted in each direction) and flow state.

What is Traffic Analytics in Azure?

Traffic Analytics is a cloud-based solution that processes NSG flow logs to provide visibility into network activity, identify hotspots, security threats, traffic flow patterns, and usage across the Azure environment; it uses a Log Analytics workspace.

What prerequisite is required to use Traffic Analytics?

NSG flow logs must be enabled, and a Log Analytics workspace must be configured to store and process the analyzed data.

What does the Effective routes feature show for a VM?

Effective routes displays the combined/aggregated routes applied to a VM's network interface, including system (default) routes, BGP routes, and user-defined routes (UDRs), showing which route actually applies.

What does the Effective security rules feature show?

Effective security rules show the aggregated NSG rules applied to a network interface, combining subnet-level and NIC-level NSG rules to reveal the net effect on traffic.

What are the possible next hop types returned by the Next hop diagnostic?

Internet, VirtualAppliance, VirtualNetworkGateway, VnetLocal, VnetPeering, VirtualNetworkServiceEndpoint, and None (traffic dropped).

When Next hop returns 'None', what does it indicate?

It indicates there is no valid route for the destination (often due to a user-defined route directing traffic to 'None'), so the traffic is dropped/blackholed.

Can Basic Load Balancer backend pools span across availability sets or virtual networks?

No. Basic Load Balancer backend members must be in a single availability set or VM scale set; Standard Load Balancer backend members can be any VM in a single virtual network (more flexible).

What type of public IP does Standard Load Balancer use, and is it zone-redundant?

Standard Load Balancer uses a Standard SKU public IP, which is created as zone-redundant by default (can also be zonal).

What is the purpose of outbound rules in Standard Load Balancer?

Outbound rules provide explicit, configurable SNAT (source NAT) for backend instances to reach the internet, letting you define outbound port allocation and which frontend IPs are used.

What is a key cost difference between Basic and Standard Load Balancer?

Basic Load Balancer is free (no charge), while Standard Load Balancer is charged based on the number of rules configured and the volume of data processed.

Which load balancing solution should you choose for SSL/TLS termination and cookie-based session affinity?

Application Gateway (Layer 7), because it supports SSL/TLS termination, end-to-end SSL, and cookie-based session affinity; Azure Load Balancer (Layer 4) cannot do these.

What does Connection Monitor measure between endpoints?

Connection Monitor measures connectivity, round-trip latency, and percentage of packet loss between source and destination endpoints continuously, and can alert when thresholds are breached or topology changes.