AZ-900
Deep Dive
VNet, NSGs, Load Balancer, Application Gateway, VPN, ExpressRoute, DNS, and DDoS. Networking is ~15% of the AZ-900 and the source of the exam's most complex questions.
Contents
What is a VNet?
A private virtual network in Azure. It isolates and segments your network resources. It's the equivalent of a local corporate network, but in the cloud. Each VNet has an IP address space (e.g., 10.0.0.0/16) that is not publicly routed.
Components of a VNet
VNet rules for the exam
Create your first virtual network in Azure and a subnet inside it. VNets are the foundation of private networking in the cloud.
+1 more...
Interactive diagram — hover over each node
Firewall at the subnet or NIC level. A list of allow/deny rules for inbound and outbound traffic.
How NSG rules work
Each rule has a priority (100–4096, lower = higher priority). They are evaluated in order until a match is found. If none match → the default rule applies (Deny All for inbound, Allow VNet/Internet for outbound).
| Priority | Port | Protocol | Source | Action |
|---|---|---|---|---|
| 100 | 443 | TCP | Internet | Allow |
| 110 | 80 | TCP | Internet | Allow |
| 200 | 3389 | TCP | 10.0.0.0/8 | Allow |
| 4096 | * | * | * | Deny |
Common mistake: RDP exposed to the internet
By default, new VMs have NO inbound restriction if a public IP is created. Many admins leave port 3389 (RDP) or 22 (SSH) open to 0.0.0.0/0. Microsoft detects millions of brute force attempts against these ports daily.
Correct solution
Just-in-Time VM Access (Azure Defender): opens the port only when a specific admin requests it, for a limited time, from their IP.
NSG on subnet vs NIC
You can assign an NSG at the subnet level (affects all resources in it) OR at the individual NIC level of a VM. If both have NSGs, both are evaluated — the traffic must pass both. NSG on subnet = first line of defense. NSG on NIC = second line of defense.
Create an NSG and add an inbound rule to allow HTTPS traffic. NSGs are Azure's network-level firewall.
+1 more...
Deploy Azure Bastion to connect to your virtual machines over RDP/SSH without exposing a public IP on the VM.
+1 more...
A website stopped being reachable. Find the NSG rule responsible and fix it — no guided steps.
+1 more...
Azure has 4 distinct load balancing services. Choosing the right one is a frequent AZ-900 question.
Azure Load Balancer
Distributes TCP/UDP traffic across VMs or backends. Operates at the transport level (Layer 4). Doesn't understand HTTP. For non-HTTP traffic or ultra-low latency.
When to use
Don't use for
Doesn't filter by URL or HTTP headers
Azure Application Gateway
Web Application Firewall (WAF) + HTTP/S load balancing. Routes by URL path (/api → backend1, /web → backend2). SSL termination. Protects against OWASP top 10.
When to use
Don't use for
HTTP/S only. Not for TCP/UDP
Azure Traffic Manager
DNS-based load balancing. Routes users to the most appropriate endpoint based on policies (geographic, performance, priority). Doesn't touch traffic directly — it only resolves DNS.
When to use
Don't use for
Not a proxy — cannot inspect traffic
Azure Front Door
CDN + WAF + global HTTP/S load balancing. Accelerates content with edge caching. Routes to the healthiest and closest backend. Combines Traffic Manager + Application Gateway + CDN.
When to use
Don't use for
HTTP/S only. More expensive than Traffic Manager
Quick decision table
| Scenario | Answer |
|---|---|
| Distribute HTTP traffic across 3 VMs in East US | Azure Load Balancer (L4) or Application Gateway (L7) |
| Route /api to backend1 and /web to backend2 | Application Gateway (URL-based routing) |
| Protect a web app against SQL injection | Application Gateway with WAF |
| Send European users to West Europe and American users to East US | Traffic Manager (geographic routing) |
| Low-latency global web app with CDN + WAF | Azure Front Door |
| Automatic failover from primary to secondary region via DNS | Traffic Manager (priority routing) |
Create an Azure Load Balancer to distribute inbound traffic across several VMs, improving availability and scalability.
+1 more...
To connect your on-premises network (or another network) to Azure privately.
Azure VPN Gateway
Encrypted VPN tunnel over the public internet. Secure connection but with variable latency and limited bandwidth (~1 Gbps max). Economical.
Cost/month
~$30–$700 (depending on SKU)
Bandwidth
Up to ~1 Gbps
Latency
Variable (internet)
SLA
99.9%
Azure ExpressRoute
Dedicated private connection to Azure via a telecommunications partner (Telefónica, AT&T, Equinix, etc.). Never touches the public internet. Guaranteed SLA. Up to 100 Gbps.
Cost/month
~$500–$5,000+
Bandwidth
50 Mbps – 100 Gbps
Latency
Predictable and low
SLA
99.95%
VPN vs ExpressRoute — when to choose
Use VPN when:
Use ExpressRoute when:
Azure Public DNS
Hosts public DNS zones (e.g., contoso.com) in Azure. High availability, global anycast, 100% SLA (Microsoft guarantees resolution availability).
Supports all record types: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV
Integration with Azure Resource Manager (RBAC, tags, billing)
Alias Records for Azure resources (automatic IP update if the VM/LB IP changes)
Azure Private DNS
Private DNS resolution for resources within VNets. Without exposing private IPs to public DNS.
vm1.internal.contoso.com → 10.0.1.4 (internal resolution)
Works across linked VNets (VNet links)
PaaS services with Private Endpoints resolve private names
No DNS servers of your own to manage (Azure manages it)
VNet Peering
Connects two VNets so resources can communicate as if they were on the same network. Traffic goes over Azure's backbone network (not the internet). Low latency.
Regional Peering
Two VNets in the same region. Traffic in the same region is free (you only pay standard egress).
Global Peering
Two VNets in different regions. Small additional cost for cross-region traffic.
Peering is NOT transitive. If A→B and B→C, A CANNOT talk to C without creating a direct A→C peering.
Private Endpoints
Exposes Azure PaaS services (Storage, SQL, Key Vault, etc.) with a private IP inside your VNet. Traffic never goes out to the public internet.
Without vs With Private Endpoint
Without Private Endpoint
VM → internet → storage.core.windows.net
Traffic goes out over the internet, potentially interceptable
With Private Endpoint
VM → 10.0.1.5 (PE) → storage (private)
Traffic stays within Azure's private network
DDoS Basic (free)
Automatic protection included in Azure for all infrastructure. Mitigates common volumetric attacks. No additional cost. NO custom dashboards or alerts.
When to use
Always active. No configuration.
DDoS Standard (paid)
Customized mitigation policies per-VNet. Real-time telemetry. Alerts. Specialized support from the DDoS Response Team. Cost guarantee if Azure fails to protect.
When to use
Production apps exposed to the internet with high SLA requirements.
Did you get this topic?
Test what you just learned
Which Azure service lets you connect two VNets so that resources on both can communicate as if they were on the same network?
Put what you learned to the test with original AZ-900 exam questions.
Start AZ-900 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.