Configure and Manage Virtual Networking
This domain covers building and securing connectivity in Azure using virtual networks and related services. You will design subnets, filter traffic, connect networks, resolve names, and balance and secure traffic. Selecting the correct networking service for each requirement is the recurring theme.
VNets, Subnets, NSGs, and ASGs
A virtual network (VNet) is your isolated network in Azure, segmented into subnets that host resources. Network security groups (NSGs) contain prioritized allow and deny rules that filter inbound and outbound traffic at the subnet or NIC level. Application security groups (ASGs) let you group VM network interfaces so NSG rules reference logical application tiers instead of IP addresses. Together they provide flexible, maintainable traffic filtering.
Connecting Networks: Peering and VPN Gateway
Virtual network peering links two VNets directly over the Azure backbone with low latency and no gateway required, working within or across regions. A VPN Gateway creates encrypted tunnels for site-to-site connections to on-premises networks or VNet-to-VNet links when peering is unsuitable. Point-to-site VPN connects individual client devices. Choosing peering versus a gateway depends on cost, latency, and whether cross-premises encryption is needed.
Azure DNS
Azure DNS hosts your public DNS zones for internet name resolution using Azure's global name servers. Private DNS zones provide name resolution within and between virtual networks without exposing records publicly, and can auto-register VM records. This lets resources resolve each other by name across peered VNets. DNS handles name-to-address mapping and is distinct from the connectivity that peering or gateways provide.
Load Balancing: Load Balancer versus Application Gateway
Azure Load Balancer is a layer 4 (TCP/UDP) service that distributes traffic across backend instances based on network-level rules and health probes. Application Gateway is a layer 7 (HTTP/HTTPS) load balancer that supports URL path-based and host-based routing plus an optional Web Application Firewall. Use Load Balancer for high-performance non-HTTP traffic and Application Gateway when you need application-aware routing or WAF protection. Matching the OSI layer to the requirement is a common exam decision.
Secure Access with Azure Bastion and Network Watcher
Azure Bastion provides secure RDP and SSH access to VMs through the Azure portal over TLS, so VMs need no public IPs and no open management ports. This reduces the attack surface compared to exposing RDP or SSH to the internet. Network Watcher offers diagnostic tools like connection troubleshoot, IP flow verify, and NSG flow logs to investigate connectivity problems. These services support secure operation and troubleshooting of the network.