Azure Networking
Most Azure networking questions are one of two shapes: why is this traffic blocked, or which connectivity option fits these requirements. The NSG rule table answers the first and the connectivity table answers the second.
Azure Networking · firsttry.app/cheatsheets/azure-networking · original reference written from published exam objectives. Not affiliated with any certification body.
Core objects
| Object | What it does |
|---|---|
| Virtual network (VNet) | An isolated address space in one region |
| Subnet | A range inside a VNet. Azure reserves five addresses per subnet |
| Network security group | Stateful allow and deny rules on a subnet or NIC |
| Application security group | A named group of NICs used as an NSG rule target |
| Route table | User-defined routes that override Azure's defaults |
| Azure Firewall | Managed stateful firewall with threat intelligence |
| Private endpoint | A private IP for a PaaS service inside your VNet |
| Service endpoint | Routes to a PaaS service over the Azure backbone |
| Bastion | Browser-based RDP and SSH without a public IP |
NSG rule evaluation
| Rule | Detail |
|---|---|
| Priority range | 100 to 4096. Lower number is evaluated first |
| First match wins | Evaluation stops at the first matching rule |
| Stateful | A return packet for an allowed flow is permitted automatically |
| Applied at | Subnet and NIC. Both are evaluated, both must allow |
| Default: AllowVNetInBound | 65000. VNet to VNet traffic |
| Default: AllowAzureLoadBalancerInBound | 65001 |
| Default: DenyAllInBound | 65500. The implicit deny at the end |
| Common mistake | A rule at 4000 never fires because a deny sits at 200 |
Connectivity options
| Requirement | Option |
|---|---|
| Connect two VNets | VNet peering. Non-transitive by default |
| Connect on-premises over the internet | Site-to-site VPN gateway |
| Connect one machine to a VNet | Point-to-site VPN |
| Private, high bandwidth to on-premises | ExpressRoute |
| Hub and spoke with transit | Peering plus user-defined routes, or Virtual WAN |
| Resolve private DNS across VNets | Private DNS zone linked to each VNet |
Load balancing
| Service | Layer | Scope | Use |
|---|---|---|---|
| Load Balancer | 4 | Regional | TCP and UDP inside a region |
| Application Gateway | 7 | Regional | HTTP routing, WAF, SSL termination |
| Traffic Manager | DNS | Global | DNS-based routing between regions |
| Front Door | 7 | Global | Global HTTP with WAF and caching |
Try it here
Three verified practice questions on this material. Answer one, and see the official page behind the answer.
Monitor and maintain Azure resources
What is the longest the soft delete retention period for backup data can be extended to?
Design and implement Azure network security services
An engineer wants a separate WAF policy on each listener of one application gateway. Which web application firewall version supports that?
Manage security operations
A SOC needs alerts from many detections grouped into one case that an analyst can own and investigate. What does Microsoft Sentinel produce from correlated alerts?
Five free questions on every practice exam. No account, no card.