Examius

🇺🇸 Microsoft Certified: Azure Administrator Associate · subject

Microsoft Certified: Azure Administrator Associate Implement and Manage Virtual Networking Syllabus

Every chapter and topic of Implement and Manage Virtual Networking examined in Microsoft Certified: Azure Administrator Associate — 3 chapters, 13 topics and 13 sub-topics, plus 51 flashcards written against it.

3Chapters
13Topics
13Sub-topics
~10hEst. first pass
17%Of Microsoft Certified: Azure Administrator Associate
51Flashcards

Implement and Manage Virtual Networking syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Implement and Manage Virtual Networking in Microsoft Certified: Azure Administrator Associate, not a summary of it.

  1. Virtual Networks and Subnets

     4 topics
    • Creating virtual networks and address spaces
      • CIDR addressing and subnet design
      • Reserved IP addresses per subnet
    • Public and private IP addressing
      • Static vs dynamic allocation
      • Basic vs Standard SKU public IPs
    • Network interface configuration
    • Azure DNS
      • Public DNS zones and record sets
      • Private DNS zones and autoregistration

  2. Network Security

     4 topics
    • Network security groups (NSGs)
      • Inbound and outbound security rules
      • Default rules and priority evaluation
      • Service tags and application security groups
    • Application security groups (ASGs)
    • Effective security rules evaluation
    • Azure Bastion for secure access

  3. Network Connectivity and Routing

     5 topics
    • Virtual network peering
      • Regional and global peering
      • Gateway transit and forwarded traffic
    • User-defined routes (UDRs)
      • Custom routes and next hop types
      • Route precedence (system, BGP, custom)
    • Service endpoints
    • Private endpoints and Private Link
    • VPN Gateway and ExpressRoute overview

Implement and Manage Virtual Networking flashcards for Microsoft Certified: Azure Administrator Associate

25 of 51 cards from the Implement and Manage Virtual Networking deck — real questions with worked answers.

  1. In Azure, what is the largest address space (CIDR block) you can assign to a single virtual network (VNet)?

    /8 (about 16 million addresses); the smallest supported is /29. Address space is defined using RFC 1918 private ranges and/or public ranges.

  2. How many IP addresses does Azure reserve in every subnet, and what is the usable host formula?

    Azure reserves 5 addresses per subnet. Usable hosts = 2^(32 - prefix) - 5. Example: a /24 has 256 - 5 = 251 usable addresses.

  3. Which 5 addresses does Azure reserve in each subnet?

    The network address (.0), the default gateway (.1), two for Azure DNS mapping (.2 and .3), and the network broadcast address (last address, e.g. .255).

  4. What is the smallest subnet size you can create in an Azure VNet, and how many usable IPs does it give?

    /29 is the smallest, giving 8 total addresses minus 5 reserved = 3 usable IP addresses.

  5. Can a resource in one subnet communicate with a resource in another subnet of the same VNet by default?

    Yes. By default all subnets within a VNet can route to each other; intra-VNet traffic is allowed automatically with no peering or gateway required.

  6. What are the two allocation methods for a public IP address in Azure, and what distinguishes them?

    Dynamic (IP assigned when associated, released when disassociated) and Static (IP assigned immediately and fixed until deleted). Standard SKU public IPs are always Static.

  7. Compare the Basic and Standard SKUs for Azure Public IP addresses.

    Basic: Dynamic or Static, open by default (no NSG required), no zone redundancy, being retired. Standard: Static only, secure by default (closed unless NSG allows), zone-redundant capable, required for Standard Load Balancer.

  8. What private IP address ranges (RFC 1918) can be used in an Azure VNet address space?

    10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. You can also use public IP ranges, but they won't be internet-routable inside Azure.

  9. What is the difference between a dynamic and a static private IP assignment on an Azure NIC?

    Dynamic: Azure assigns the next available IP from the subnet (can change on stop/deallocate). Static: you choose a specific IP that persists; useful for DNS records, domain controllers, and clustered apps.

  10. What is an Azure network interface (NIC) and what is its relationship to a VM?

    A NIC is the interconnect between a VM and a VNet/subnet. A VM must have at least one NIC; NICs hold IP configurations (private/public IP), can attach an NSG, and the number of NICs allowed depends on the VM size.

  11. Can you have multiple IP configurations on a single Azure NIC?

    Yes. A NIC can have one primary IP configuration and multiple secondary IP configurations, each with its own private IP (and optionally a public IP). One must be marked primary.

  12. If a VM has multiple NICs, which NIC's settings determine the default gateway/outbound route?

    The primary NIC. Only one NIC is the primary; its primary IP configuration provides the default route, though all NICs must be in the same VNet (different subnets allowed).

  13. What is Azure DNS (public zones) used for?

    Azure DNS hosting provides name resolution for your public domains using Microsoft's global anycast name servers. It manages DNS records (A, CNAME, MX, TXT, etc.) but does not register domain names.

  14. What is an Azure Private DNS zone and what does it enable?

    A Private DNS zone provides name resolution within and between VNets without a custom DNS server. With autoregistration enabled, VMs' DNS records are automatically created/updated in the linked VNet.

  15. What is Azure-provided default (internal) DNS, and what is its well-known resolver IP?

    Azure provides built-in recursive DNS resolution for resources in a VNet at the virtual IP address 168.63.129.16. It resolves Azure hostnames and the internet by default.

  16. What is the special Azure IP address 168.63.129.16 used for?

    It is a virtual public IP owned by Microsoft used for the host to communicate with platform resources: DNS resolution, DHCP/lease info, load balancer health probes, and the VM agent/health.

  17. What is a Network Security Group (NSG) in Azure?

    An NSG is a stateful packet filter containing inbound and outbound security rules that allow or deny traffic to/from Azure resources, based on 5-tuple (source, source port, destination, destination port, protocol).

  18. To what scopes can an NSG be associated?

    An NSG can be associated to a subnet and/or to a network interface (NIC). It cannot be associated directly to a VM. The same NSG can be associated to multiple subnets/NICs.

  19. What fields make up an NSG security rule?

    Priority, Name, Source (IP/CIDR/service tag/ASG), Source port, Destination, Destination port, Protocol (TCP/UDP/ICMP/Any), Direction (inbound/outbound), and Action (Allow/Deny).

  20. What is the valid priority range for NSG rules, and how is precedence determined?

    Priorities range from 100 to 4096. Lower numbers have higher precedence; the first matching rule is applied and processing stops. Custom rules should use 100-4096.

  21. Are NSGs stateful? Explain what that means for return traffic.

    Yes, NSGs are stateful. If you allow inbound traffic, the response (outbound) is automatically allowed without an explicit rule, and vice versa, because the flow's return traffic is tracked.

  22. List the three default inbound NSG rules and what they allow/deny.

    AllowVNetInBound (allow VNet-to-VNet), AllowAzureLoadBalancerInBound (allow LB probes), and DenyAllInBound (deny everything else). They have priorities 65000, 65001, 65500.

  23. List the three default outbound NSG rules.

    AllowVnetOutBound (allow to VNet), AllowInternetOutBound (allow to internet), and DenyAllOutBound (deny everything else), at priorities 65000, 65001, 65500.

  24. What is a service tag in an NSG rule, and give two examples.

    A service tag is a Microsoft-managed group of IP prefixes for an Azure service, removing the need to maintain IP lists. Examples: Internet, VirtualNetwork, AzureLoadBalancer, Storage, Sql, AzureCloud.

  25. What is an Application Security Group (ASG)?

    An ASG lets you group VM NICs by application/workload role (e.g., 'WebServers', 'DBServers') and use the group as the source or destination in NSG rules, decoupling rules from explicit IP addresses.

See more Implement and Manage Virtual Networking flashcards →

Planning Implement and Manage Virtual Networking for Microsoft Certified: Azure Administrator Associate

Implement and Manage Virtual Networking is about 17% of the Microsoft Certified: Azure Administrator Associate syllabus by topic count — 13 of 77 topics, spread over 3 chapters. At roughly 45 minutes per topic plus 12 minutes per sub-topic, a first pass runs to about 10 hours.

The heaviest chapters are Network Connectivity and Routing (5 topics), Virtual Networks and Subnets (4 topics), Network Security (4 topics) . Front-load those while your energy is high; the short chapters are better revision filler later.

Work top-down: read the chapter, then tick topics off individually rather than marking the whole chapter done. Sub-topics are where silent gaps hide.

Implement and Manage Virtual Networking (Microsoft Certified: Azure Administrator Associate) FAQ

What is in the Microsoft Certified: Azure Administrator Associate Implement and Manage Virtual Networking syllabus?

Implement and Manage Virtual Networking is split into 3 chapters — Virtual Networks and Subnets, Network Security and Network Connectivity and Routing, containing 13 topics and 13 sub-topics in total.

How is Implement and Manage Virtual Networking structured in the Microsoft Certified: Azure Administrator Associate syllabus?

3 chapters. Implement and Manage Virtual Networking accounts for about 17% of the topics in the whole Microsoft Certified: Azure Administrator Associate syllabus (13 of 77).

How long should I spend on Implement and Manage Virtual Networking for Microsoft Certified: Azure Administrator Associate?

Budget around 10 hours for a first pass through Implement and Manage Virtual Networking — about 45 minutes per topic plus 12 minutes per sub-topic across its 13 topics. Add revision cycles on top.

Are there flashcards for Microsoft Certified: Azure Administrator Associate Implement and Manage Virtual Networking?

Yes — a 51-card Implement and Manage Virtual Networking deck. Sample cards are printed on this page, and the full deck is free in the Examius app with spaced repetition scheduling.