Implement and Manage Virtual Networking
This domain covers the design, configuration, and troubleshooting of Azure networking services. Microsoft weights it at 15–20% of the AZ-104 exam, and it consistently tests scenario-based reasoning: given a requirement, pick the correct service, SKU, or configuration. Expect roughly 8–10 questions mixing portal-style tasks, PowerShell/CLI snippets, and architecture scenarios.
VNets, Subnets, IP Addressing, and Public IPs
Virtual Networks and Subnets
A Virtual Network (VNet) is the fundamental private network boundary in Azure. Key facts:
- Scope: regional — a VNet lives in one region and one subscription.
- Address space: one or more CIDR blocks (IPv4 required; IPv6 optional). Minimum /29, maximum /8.
- Subnets divide the VNet address space. Each subnet reserves 5 IP addresses (0=network, 1=default gateway, 2–3=DNS, 255=broadcast). A /29 gives only 3 usable addresses.
- GatewaySubnet: a reserved subnet name required by VPN/ExpressRoute gateways — must exist before deploying a gateway.
- AzureFirewallSubnet and AzureBastionSubnet: required names for those services.
- Subnets in the same VNet can communicate by default (no extra routing needed).
- You can resize a subnet (expand or shrink) only if no resources are deployed in it.
IP Addressing
| Type | Assignment | Persists on stop/deallocate? | SKU |
|---|---|---|---|
| Private static | Manual, from subnet range | Yes | N/A |
| Private dynamic | DHCP, from subnet range | No | N/A |
| Public static | Reserved to your subscription | Yes | Basic or Standard |
| Public dynamic | Assigned at start | No | Basic only |
- Standard SKU public IP: static only, zone-redundant by default, requires explicit NSG to allow inbound traffic, supports Availability Zones.
- Basic SKU public IP: open by default (NSG optional), no zone support — being retired September 30, 2025.
- Public IPs are independent resources that can be associated with NICs, load balancers, VPN gateways, and Application Gateways.
Common Traps
- Forgetting 5 reserved IPs per subnet — the exam tests minimum subnet size for a given host count.
- Confusing "stopped (deallocated)" with "stopped" — only deallocated VMs release dynamic IPs.
- Basic public IPs do not support Availability Zones; Standard does.
- You cannot resize a VNet address space downward if subnets overlap the removed range.
Network Security Groups, Application Security Groups, and Effective Rules
NSGs
A Network Security Group (NSG) is a stateful packet filter containing inbound and outbound security rules. It can be associated with:
- Subnets (applies to all NICs in the subnet)
- NICs (applies only to that NIC)
Both can apply simultaneously. Azure evaluates subnet NSG first (inbound) → NIC NSG second (inbound); for outbound, NIC NSG first → subnet NSG second.
Default rules (cannot be deleted, priority 65000–65500):
- AllowVNetInBound / AllowVNetOutBound — allows all VNet-to-VNet traffic.
- AllowAzureLoadBalancerInBound — allows health probes.
- DenyAllInBound / DenyAllOutBound — implicit deny at priority 65500.
Rules are evaluated lowest priority number first (priority 100 = highest precedence, 4096 = lowest user-defined).
Application Security Groups (ASGs)
ASGs let you group VMs by logical role (e.g., WebServers, DbServers) and use those groups as source/destination in NSG rules — replacing explicit IP ranges. Key rules:
- A NIC can be a member of multiple ASGs.
- All NICs in an ASG must be in the same VNet.
- ASGs work only within NSG rules — they are not standalone enforcement points.
Effective Rules
Use Network Watcher → Effective security rules or the NIC blade to see the merged, priority-sorted rule set. This is the exam-tested troubleshooting path.
| Scenario | Answer |
|---|---|
| Need to block a specific IP for all VMs in a subnet | Subnet-level NSG deny rule |
| Need to allow port 1433 only between web tier and DB tier | ASG-based NSG rule |
| Traffic blocked unexpectedly | Check effective rules via Network Watcher |
| Want to allow HTTPS to a VM but nothing else | Add inbound allow rule priority < 65500 deny-all |
Common Traps
- NSGs are stateful — return traffic is automatically allowed; you do not need a matching outbound rule.
- Priority numbers: lower number = higher priority (100 beats 200).
- A deny rule in the subnet NSG blocks traffic even if the NIC NSG has an allow rule — the subnet deny is evaluated first on inbound.
- ASG members must share the same VNet — cross-VNet ASG membership is not supported.
Unlock with a paid plan
9 more sections (about 2,623 words) continue below. Every paid plan unlocks all AZ-104 study guides, the full question bank and mock exams, from $4.97/month.