Microsoft Certified: Azure Administrator Associate Implement and Manage Virtual Networking Syllabus

Are NSGs stateful? Explain what that means for return traffic.

Yes, NSGs are stateful. If you allow inbound traffic, the response (outbound) is automatically allowed without an explicit rule, and vice versa, because the flow's return traffic is tracked.

List the three default inbound NSG rules and what they allow/deny.

AllowVNetInBound (allow VNet-to-VNet), AllowAzureLoadBalancerInBound (allow LB probes), and DenyAllInBound (deny everything else). They have priorities 65000, 65001, 65500.

List the three default outbound NSG rules.

AllowVnetOutBound (allow to VNet), AllowInternetOutBound (allow to internet), and DenyAllOutBound (deny everything else), at priorities 65000, 65001, 65500.

What is a service tag in an NSG rule, and give two examples.

A service tag is a Microsoft-managed group of IP prefixes for an Azure service, removing the need to maintain IP lists. Examples: Internet, VirtualNetwork, AzureLoadBalancer, Storage, Sql, AzureCloud.

What is an Application Security Group (ASG)?

An ASG lets you group VM NICs by application/workload role (e.g., 'WebServers', 'DBServers') and use the group as the source or destination in NSG rules, decoupling rules from explicit IP addresses.

What is a key advantage of using ASGs over IP addresses in NSG rules?

ASGs let you write rules based on workload roles instead of static IPs. As you add/remove VMs from the ASG, rules apply automatically without editing IP ranges, simplifying microsegmentation.

What are the constraints on using ASGs within NSG rules?

All NICs in an ASG must be in the same VNet. If an ASG is used as both source and destination in a rule, those NICs must be in the same VNet. ASGs are referenced like service tags in source/destination.

When both a subnet NSG and a NIC NSG apply to inbound traffic, in what order are they evaluated?

For inbound: the subnet NSG is evaluated first, then the NIC NSG. For outbound: the NIC NSG is evaluated first, then the subnet NSG. Traffic must be allowed by BOTH to pass.

What is 'Effective security rules' in Azure and why is it useful?

It is a diagnostic view (per NIC) that aggregates all rules from the NIC NSG and subnet NSG, showing the net effect of which traffic is allowed/denied. It's used to troubleshoot connectivity issues.

If a subnet NSG denies traffic but the NIC NSG allows it, will the traffic reach the VM?

No. Both the subnet NSG and the NIC NSG must allow the traffic. If either denies it, the traffic is blocked (most restrictive wins).

What is Azure Bastion?

Azure Bastion is a fully managed PaaS service that provides secure RDP/SSH connectivity to VMs directly through the Azure portal over TLS (port 443), without exposing the VMs' public IPs or opening RDP/SSH ports to the internet.

What subnet does Azure Bastion require, and what are its naming and size rules?

It requires a dedicated subnet named exactly 'AzureBastionSubnet', with a minimum size of /26 (Standard SKU recommends /26 or larger; minimum /27 for some). No other resources can be deployed in it.

Does Azure Bastion require a public IP on the target VMs?

No. Bastion itself has a public IP, but it connects to target VMs over their private IP. This means the VMs need no public IP, reducing the attack surface.

What protocol/port does the user use to connect to Azure Bastion from their browser?

HTTPS over port 443 (TLS) through the Azure portal. Bastion then initiates RDP (3389) or SSH (22) to the VM internally over the private network.

What is virtual network peering in Azure?

VNet peering connects two VNets, enabling resources to communicate privately using Microsoft's backbone network with low latency and high bandwidth, as if they were in the same network. Traffic stays on the Azure backbone.

What is the difference between regional VNet peering and global VNet peering?

Regional peering connects VNets in the same Azure region; Global peering connects VNets across different Azure regions. Both use the Microsoft backbone; functionality is largely identical.

Is VNet peering transitive? Explain.

No, peering is non-transitive. If VNet A peers with B and B peers with C, A cannot reach C through B. To enable A-to-C you need a direct peering or a transit solution (hub-and-spoke with NVA/gateway and UDRs).

Can VNets with overlapping IP address spaces be peered?

No. Peered VNets must have non-overlapping (unique) IP address spaces; overlapping CIDR ranges prevent peering from being established.

What is 'Gateway transit' (Use remote gateway) in VNet peering?

It lets a peered VNet use the VPN/ExpressRoute gateway in the remote (hub) VNet for on-premises or cross-network connectivity, so the spoke VNet doesn't need its own gateway. One side allows transit; the other uses the remote gateway.

What is a User-Defined Route (UDR / custom route)?

A UDR is a custom route in a route table associated to a subnet that overrides Azure's default system routes, directing traffic to a specific next hop (e.g., a virtual appliance, VPN gateway, or none).

What are the possible 'next hop types' for a route in an Azure route table?

Virtual network gateway, Virtual network, Internet, Virtual appliance, and None. 'None' drops the traffic; 'Virtual appliance' requires a next-hop IP address.

How does Azure choose between routes when system routes, BGP routes, and user-defined routes overlap?

By longest prefix match first; if prefixes are equal, priority order is: User-defined route > BGP (propagated) route > System route. UDRs win ties over system/BGP routes.

What is a common use case for setting a UDR's next hop to a virtual appliance with destination 0.0.0.0/0?

Forced tunneling / traffic inspection: it routes all internet-bound (default) traffic through a network virtual appliance (NVA) such as a firewall for inspection, instead of going directly to the internet.

What is a Service Endpoint in Azure VNets?

A service endpoint extends your VNet's private identity to an Azure PaaS service (e.g., Storage, SQL) over the Azure backbone, allowing you to secure the resource to specific subnets. The service keeps its public IP/endpoint.

Contrast Service Endpoints with Private Endpoints.

Service Endpoint: secures a PaaS resource to a VNet/subnet but the service keeps a public IP; traffic uses the backbone; free. Private Endpoint: assigns a private IP from your subnet to the PaaS resource via Private Link; accessible from on-prem; has cost.

What is Azure Private Link and a Private Endpoint?

Private Link enables private connectivity to Azure PaaS/partner services. A Private Endpoint is a NIC with a private IP from your subnet that maps to a specific service resource, so traffic never traverses the public internet.

What DNS consideration is critical when using Private Endpoints?

You must configure DNS (typically a Private DNS zone like privatelink.<service>.core.windows.net) so the service's FQDN resolves to the private endpoint's private IP instead of its public IP.

Can a Service Endpoint be accessed from on-premises networks?

Not directly by default — service endpoints apply to traffic originating in the VNet. On-premises access to the secured resource requires Private Endpoints (Private Link) or NAT IP configurations. Private Endpoints support on-prem access via VPN/ExpressRoute.

What is an Azure VPN Gateway and what connection types does it support?

A VPN Gateway is a specific virtual network gateway that sends encrypted traffic over the public internet via IPsec/IKE. It supports Site-to-Site (S2S), Point-to-Site (P2S), and VNet-to-VNet connections. Requires a GatewaySubnet.

What dedicated subnet does a VPN/ExpressRoute gateway require?

A subnet named exactly 'GatewaySubnet'. Recommended minimum size /27 (or larger, e.g. /26) to accommodate gateway services; you should not deploy other resources or NSGs that block gateway traffic in it.

What is Azure ExpressRoute and how does it differ from a VPN Gateway?

ExpressRoute is a private, dedicated connection from on-premises to Azure via a connectivity provider — it does NOT traverse the public internet, offering higher reliability, lower latency, and more bandwidth than an internet-based VPN Gateway.