What is the default load-balancing distribution algorithm in Azure Load Balancer?

A 5-tuple hash (source IP, source port, destination IP, destination port, protocol) for hash-based distribution. Session persistence can change this to 2-tuple (source/dest IP) or 3-tuple.

What is the purpose of a health probe in Azure Load Balancer?

A health probe (TCP, HTTP, or HTTPS) checks backend instance health; only healthy instances receive new flows. If an instance fails the probe it is removed from rotation.

What is the difference between a load balancing rule and an inbound NAT rule?

A load balancing rule distributes traffic across all healthy backend instances. An inbound NAT rule forwards traffic on a specific frontend port to a single backend instance/port (e.g., RDP/SSH to one VM).

What is Azure Application Gateway and at which layer does it operate?

Application Gateway is a Layer 7 (HTTP/HTTPS) web traffic load balancer (ADC). It supports URL path-based routing, multi-site hosting, SSL/TLS termination, cookie-based session affinity, and autoscaling (v2).

What is the Web Application Firewall (WAF) on Application Gateway?

WAF is an optional tier that protects web apps from common exploits using OWASP Core Rule Set (e.g., SQL injection, XSS). It runs in Detection or Prevention mode.

What is URL path-based routing in Application Gateway?

It routes requests to different backend pools based on the URL path (e.g., /images/* to one pool, /video/* to another) using path-based rules and a path map.

What is SSL/TLS offloading (termination) in Application Gateway?

The gateway terminates the TLS connection, decrypts traffic at the gateway, and forwards it (optionally re-encrypted with end-to-end TLS) to the backend, reducing crypto load on backend servers.

What is Azure Front Door and how does it differ from Application Gateway?

Front Door is a global Layer 7 load balancer / CDN operating at the network edge (anycast), routing across regions with caching and WAF. Application Gateway is a regional L7 load balancer within one region.

What is Azure Traffic Manager and at which layer does it work?

Traffic Manager is a DNS-based global traffic load balancer (works at DNS level, not in the data path). It directs clients to the best endpoint across regions by returning DNS responses.

List the routing methods available in Azure Traffic Manager.

Priority (failover), Weighted (distribution), Performance (lowest latency), Geographic (by user location), Multivalue (multiple healthy IPs), and Subnet (map source IP ranges to endpoints).

🇬🇧 Microsoft Azure Certifications (e.g. AZ-104, AZ-900) · flashcards

Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Configure and Manage Virtual Networking (AZ-104) Flashcards

59 question-and-answer cards covering Configure and Manage Virtual Networking (AZ-104) as it is examined in Microsoft Azure Certifications (e.g. AZ-104, AZ-900). 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.

59Cards in deck

24Free preview

12Syllabus topics

~194Chars per answer

FreePrice

24 sample cards from the Configure and Manage Virtual Networking (AZ-104) deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

What is the default load-balancing distribution algorithm in Azure Load Balancer?
A 5-tuple hash (source IP, source port, destination IP, destination port, protocol) for hash-based distribution. Session persistence can change this to 2-tuple (source/dest IP) or 3-tuple.
What is the purpose of a health probe in Azure Load Balancer?
A health probe (TCP, HTTP, or HTTPS) checks backend instance health; only healthy instances receive new flows. If an instance fails the probe it is removed from rotation.
What is the difference between a load balancing rule and an inbound NAT rule?
A load balancing rule distributes traffic across all healthy backend instances. An inbound NAT rule forwards traffic on a specific frontend port to a single backend instance/port (e.g., RDP/SSH to one VM).
What is Azure Application Gateway and at which layer does it operate?
Application Gateway is a Layer 7 (HTTP/HTTPS) web traffic load balancer (ADC). It supports URL path-based routing, multi-site hosting, SSL/TLS termination, cookie-based session affinity, and autoscaling (v2).
What is the Web Application Firewall (WAF) on Application Gateway?
WAF is an optional tier that protects web apps from common exploits using OWASP Core Rule Set (e.g., SQL injection, XSS). It runs in Detection or Prevention mode.
What is URL path-based routing in Application Gateway?
It routes requests to different backend pools based on the URL path (e.g., /images/* to one pool, /video/* to another) using path-based rules and a path map.
What is SSL/TLS offloading (termination) in Application Gateway?
The gateway terminates the TLS connection, decrypts traffic at the gateway, and forwards it (optionally re-encrypted with end-to-end TLS) to the backend, reducing crypto load on backend servers.
What is Azure Front Door and how does it differ from Application Gateway?
Front Door is a global Layer 7 load balancer / CDN operating at the network edge (anycast), routing across regions with caching and WAF. Application Gateway is a regional L7 load balancer within one region.
What is Azure Traffic Manager and at which layer does it work?
Traffic Manager is a DNS-based global traffic load balancer (works at DNS level, not in the data path). It directs clients to the best endpoint across regions by returning DNS responses.
List the routing methods available in Azure Traffic Manager.
Priority (failover), Weighted (distribution), Performance (lowest latency), Geographic (by user location), Multivalue (multiple healthy IPs), and Subnet (map source IP ranges to endpoints).
Which Azure services are global vs regional load balancers? Classify Traffic Manager, Front Door, Load Balancer, Application Gateway.
Global: Traffic Manager (DNS, any protocol) and Front Door (L7 HTTP/S). Regional: Application Gateway (L7) and Azure Load Balancer (L4).
What is a Site-to-Site (S2S) VPN connection in Azure?
An IPsec/IKE encrypted tunnel over the public internet between an Azure VPN gateway and an on-premises VPN device, connecting whole networks. Requires a VPN gateway and a local network gateway.
What is the difference between Point-to-Site (P2S) and Site-to-Site (S2S) VPN?
P2S connects an individual client device to the VNet (good for remote workers, uses SSTP/OpenVPN/IKEv2). S2S connects an entire on-premises network to Azure via a VPN device using IPsec/IKE.
What are the two VPN gateway types and which supports policy-based routing?
Route-based (dynamic) and Policy-based (static). Policy-based supports only one S2S tunnel and is Basic SKU only; route-based is recommended and supports P2S, coexistence, and multiple tunnels.
What is Azure ExpressRoute and how does it differ from a VPN?
ExpressRoute is a private, dedicated connection from on-premises to Azure through a connectivity provider, bypassing the public internet. It offers higher reliability, faster speeds, lower latency, and more security than internet-based VPN.
What are ExpressRoute peering types?
Azure private peering (access to VNets/private IPs) and Microsoft peering (access to Microsoft 365 and Azure PaaS public services). Public peering is deprecated, merged into Microsoft peering.
What is Azure Virtual WAN?
Virtual WAN is a managed networking service that unifies many connectivity types (S2S VPN, P2S VPN, ExpressRoute, and inter-VNet) into a single hub-and-spoke architecture with automated routing through Microsoft-managed virtual hubs.
In Azure system (default) routes, what are the next hop types?
Virtual network (intra-VNet), Internet (default 0.0.0.0/0 to internet), None (drops traffic), Virtual network gateway, and VNet peering. These are created automatically by Azure.
What is a User-Defined Route (UDR) and why use one?
A UDR is a custom route in a route table associated to a subnet that overrides Azure's default system routes, e.g., to force traffic through a network virtual appliance (NVA) or Azure Firewall. Next hop can be Virtual appliance, VNet gateway, Internet, VirtualNetwork, or None.
How does Azure select which route to use when multiple routes match a destination?
Longest prefix match (most specific CIDR) wins. If prefixes are equal, source priority is: User-defined route > BGP route > System route.
What is BGP in the context of Azure networking and where is it used?
Border Gateway Protocol dynamically exchanges routes between Azure and on-premises networks. It is used with route-based VPN gateways and ExpressRoute to automatically advertise and learn prefixes instead of static routing.
What is forced tunneling in Azure routing?
Forced tunneling redirects all internet-bound traffic from a subnet back to the on-premises site (or an NVA/firewall) for inspection, instead of allowing direct internet egress. It is implemented via UDRs or BGP advertising a default route.
What is the maximum number of VNet peerings recommended/allowed per virtual network (default limit)?
By default a VNet supports up to 500 peerings (raised from the older limit of 500), enabling large hub-and-spoke topologies. (Exam-level: know that peering scales to hundreds.)
What does HA Ports load balancing rule on a Standard Load Balancer do?
HA Ports load-balances all flows on all ports (protocols TCP and UDP) simultaneously using a single rule, which is essential for active-active network virtual appliance (NVA) scenarios.

What this deck covers

The Configure and Manage Virtual Networking (AZ-104) deck follows the Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Configure and Manage Virtual Networking (AZ-104) syllabus — 4 chapters and 12 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 14.8 cards per chapter.

Answers are written to be recallable, not just readable — averaging about 194 characters, which is long enough to carry the reasoning and short enough to say out loud.

A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.

Configure and Manage Virtual Networking (AZ-104) flashcards FAQ

How many Configure and Manage Virtual Networking (AZ-104) flashcards are in this Microsoft Azure Certifications (e.g. AZ-104, AZ-900) deck?

59 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.

Are these Microsoft Azure Certifications (e.g. AZ-104, AZ-900) flashcards free?

Yes. The preview here is free to read with no signup, and the full 59-card deck is free inside the Examius app.

What do the Configure and Manage Virtual Networking (AZ-104) cards cover?

They follow the Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Configure and Manage Virtual Networking (AZ-104) syllabus — 4 chapters and 12 topics — so the questions track what is actually examinable.

How should I use these flashcards?

Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.