When both a subnet NSG and a NIC NSG apply to inbound traffic, in what order are they evaluated?

For inbound: the subnet NSG is evaluated first, then the NIC NSG. For outbound: the NIC NSG is evaluated first, then the subnet NSG. Traffic must be allowed by BOTH to pass.

What is 'Effective security rules' in Azure and why is it useful?

It is a diagnostic view (per NIC) that aggregates all rules from the NIC NSG and subnet NSG, showing the net effect of which traffic is allowed/denied. It's used to troubleshoot connectivity issues.

If a subnet NSG denies traffic but the NIC NSG allows it, will the traffic reach the VM?

No. Both the subnet NSG and the NIC NSG must allow the traffic. If either denies it, the traffic is blocked (most restrictive wins).

What is Azure Bastion?

Azure Bastion is a fully managed PaaS service that provides secure RDP/SSH connectivity to VMs directly through the Azure portal over TLS (port 443), without exposing the VMs' public IPs or opening RDP/SSH ports to the internet.

What subnet does Azure Bastion require, and what are its naming and size rules?

It requires a dedicated subnet named exactly 'AzureBastionSubnet', with a minimum size of /26 (Standard SKU recommends /26 or larger; minimum /27 for some). No other resources can be deployed in it.

Does Azure Bastion require a public IP on the target VMs?

No. Bastion itself has a public IP, but it connects to target VMs over their private IP. This means the VMs need no public IP, reducing the attack surface.

What protocol/port does the user use to connect to Azure Bastion from their browser?

HTTPS over port 443 (TLS) through the Azure portal. Bastion then initiates RDP (3389) or SSH (22) to the VM internally over the private network.

What is virtual network peering in Azure?

VNet peering connects two VNets, enabling resources to communicate privately using Microsoft's backbone network with low latency and high bandwidth, as if they were in the same network. Traffic stays on the Azure backbone.

What is the difference between regional VNet peering and global VNet peering?

Regional peering connects VNets in the same Azure region; Global peering connects VNets across different Azure regions. Both use the Microsoft backbone; functionality is largely identical.

Is VNet peering transitive? Explain.

No, peering is non-transitive. If VNet A peers with B and B peers with C, A cannot reach C through B. To enable A-to-C you need a direct peering or a transit solution (hub-and-spoke with NVA/gateway and UDRs).

🇺🇸 Microsoft Certified: Azure Administrator Associate · flashcards

Microsoft Certified: Azure Administrator Associate Implement and Manage Virtual Networking Flashcards

51 question-and-answer cards covering Implement and Manage Virtual Networking as it is examined in Microsoft Certified: Azure Administrator Associate. 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.

51Cards in deck

24Free preview

13Syllabus topics

~199Chars per answer

FreePrice

24 sample cards from the Implement and Manage Virtual Networking deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

When both a subnet NSG and a NIC NSG apply to inbound traffic, in what order are they evaluated?
For inbound: the subnet NSG is evaluated first, then the NIC NSG. For outbound: the NIC NSG is evaluated first, then the subnet NSG. Traffic must be allowed by BOTH to pass.
What is 'Effective security rules' in Azure and why is it useful?
It is a diagnostic view (per NIC) that aggregates all rules from the NIC NSG and subnet NSG, showing the net effect of which traffic is allowed/denied. It's used to troubleshoot connectivity issues.
If a subnet NSG denies traffic but the NIC NSG allows it, will the traffic reach the VM?
No. Both the subnet NSG and the NIC NSG must allow the traffic. If either denies it, the traffic is blocked (most restrictive wins).
What is Azure Bastion?
Azure Bastion is a fully managed PaaS service that provides secure RDP/SSH connectivity to VMs directly through the Azure portal over TLS (port 443), without exposing the VMs' public IPs or opening RDP/SSH ports to the internet.
What subnet does Azure Bastion require, and what are its naming and size rules?
It requires a dedicated subnet named exactly 'AzureBastionSubnet', with a minimum size of /26 (Standard SKU recommends /26 or larger; minimum /27 for some). No other resources can be deployed in it.
Does Azure Bastion require a public IP on the target VMs?
No. Bastion itself has a public IP, but it connects to target VMs over their private IP. This means the VMs need no public IP, reducing the attack surface.
What protocol/port does the user use to connect to Azure Bastion from their browser?
HTTPS over port 443 (TLS) through the Azure portal. Bastion then initiates RDP (3389) or SSH (22) to the VM internally over the private network.
What is virtual network peering in Azure?
VNet peering connects two VNets, enabling resources to communicate privately using Microsoft's backbone network with low latency and high bandwidth, as if they were in the same network. Traffic stays on the Azure backbone.
What is the difference between regional VNet peering and global VNet peering?
Regional peering connects VNets in the same Azure region; Global peering connects VNets across different Azure regions. Both use the Microsoft backbone; functionality is largely identical.
Is VNet peering transitive? Explain.
No, peering is non-transitive. If VNet A peers with B and B peers with C, A cannot reach C through B. To enable A-to-C you need a direct peering or a transit solution (hub-and-spoke with NVA/gateway and UDRs).
Can VNets with overlapping IP address spaces be peered?
No. Peered VNets must have non-overlapping (unique) IP address spaces; overlapping CIDR ranges prevent peering from being established.
What is 'Gateway transit' (Use remote gateway) in VNet peering?
It lets a peered VNet use the VPN/ExpressRoute gateway in the remote (hub) VNet for on-premises or cross-network connectivity, so the spoke VNet doesn't need its own gateway. One side allows transit; the other uses the remote gateway.
What is a User-Defined Route (UDR / custom route)?
A UDR is a custom route in a route table associated to a subnet that overrides Azure's default system routes, directing traffic to a specific next hop (e.g., a virtual appliance, VPN gateway, or none).
What are the possible 'next hop types' for a route in an Azure route table?
Virtual network gateway, Virtual network, Internet, Virtual appliance, and None. 'None' drops the traffic; 'Virtual appliance' requires a next-hop IP address.
How does Azure choose between routes when system routes, BGP routes, and user-defined routes overlap?
By longest prefix match first; if prefixes are equal, priority order is: User-defined route > BGP (propagated) route > System route. UDRs win ties over system/BGP routes.
What is a common use case for setting a UDR's next hop to a virtual appliance with destination 0.0.0.0/0?
Forced tunneling / traffic inspection: it routes all internet-bound (default) traffic through a network virtual appliance (NVA) such as a firewall for inspection, instead of going directly to the internet.
What is a Service Endpoint in Azure VNets?
A service endpoint extends your VNet's private identity to an Azure PaaS service (e.g., Storage, SQL) over the Azure backbone, allowing you to secure the resource to specific subnets. The service keeps its public IP/endpoint.
Contrast Service Endpoints with Private Endpoints.
Service Endpoint: secures a PaaS resource to a VNet/subnet but the service keeps a public IP; traffic uses the backbone; free. Private Endpoint: assigns a private IP from your subnet to the PaaS resource via Private Link; accessible from on-prem; has cost.
What is Azure Private Link and a Private Endpoint?
Private Link enables private connectivity to Azure PaaS/partner services. A Private Endpoint is a NIC with a private IP from your subnet that maps to a specific service resource, so traffic never traverses the public internet.
What DNS consideration is critical when using Private Endpoints?
You must configure DNS (typically a Private DNS zone like privatelink.<service>.core.windows.net) so the service's FQDN resolves to the private endpoint's private IP instead of its public IP.
Can a Service Endpoint be accessed from on-premises networks?
Not directly by default — service endpoints apply to traffic originating in the VNet. On-premises access to the secured resource requires Private Endpoints (Private Link) or NAT IP configurations. Private Endpoints support on-prem access via VPN/ExpressRoute.
What is an Azure VPN Gateway and what connection types does it support?
A VPN Gateway is a specific virtual network gateway that sends encrypted traffic over the public internet via IPsec/IKE. It supports Site-to-Site (S2S), Point-to-Site (P2S), and VNet-to-VNet connections. Requires a GatewaySubnet.
What dedicated subnet does a VPN/ExpressRoute gateway require?
A subnet named exactly 'GatewaySubnet'. Recommended minimum size /27 (or larger, e.g. /26) to accommodate gateway services; you should not deploy other resources or NSGs that block gateway traffic in it.
What is Azure ExpressRoute and how does it differ from a VPN Gateway?
ExpressRoute is a private, dedicated connection from on-premises to Azure via a connectivity provider — it does NOT traverse the public internet, offering higher reliability, lower latency, and more bandwidth than an internet-based VPN Gateway.

What this deck covers

The Implement and Manage Virtual Networking deck follows the Microsoft Certified: Azure Administrator Associate Implement and Manage Virtual Networking syllabus — 3 chapters and 13 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 17.0 cards per chapter.

Answers are written to be recallable, not just readable — averaging about 199 characters, which is long enough to carry the reasoning and short enough to say out loud.

A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.

Implement and Manage Virtual Networking flashcards FAQ

How many Implement and Manage Virtual Networking flashcards are in this Microsoft Certified: Azure Administrator Associate deck?

51 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.

Are these Microsoft Certified: Azure Administrator Associate flashcards free?

Yes. The preview here is free to read with no signup, and the full 51-card deck is free inside the Examius app.

What do the Implement and Manage Virtual Networking cards cover?

They follow the Microsoft Certified: Azure Administrator Associate Implement and Manage Virtual Networking syllabus — 3 chapters and 13 topics — so the questions track what is actually examinable.

How should I use these flashcards?

Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.