Azure Networking
Most Azure networking questions are one of two shapes: why is this traffic blocked, or which connectivity option fits these requirements. The NSG rule table answers the first and the connectivity table answers the second.
Azure Networking · firsttry.app/cheatsheets/azure-networking · original reference written from published exam objectives. Not affiliated with any certification body.
Core objects
| Object | What it does |
|---|---|
| Virtual network (VNet) | An isolated address space in one region |
| Subnet | A range inside a VNet. Azure reserves five addresses per subnet |
| Network security group | Stateful allow and deny rules on a subnet or NIC |
| Application security group | A named group of NICs used as an NSG rule target |
| Route table | User-defined routes that override Azure's defaults |
| Azure Firewall | Managed stateful firewall with threat intelligence |
| Private endpoint | A private IP for a PaaS service inside your VNet |
| Service endpoint | Routes to a PaaS service over the Azure backbone |
| Bastion | Browser-based RDP and SSH without a public IP |
NSG rule evaluation
| Rule | Detail |
|---|---|
| Priority range | 100 to 4096. Lower number is evaluated first |
| First match wins | Evaluation stops at the first matching rule |
| Stateful | A return packet for an allowed flow is permitted automatically |
| Applied at | Subnet and NIC. Both are evaluated, both must allow |
| Default: AllowVNetInBound | 65000. VNet to VNet traffic |
| Default: AllowAzureLoadBalancerInBound | 65001 |
| Default: DenyAllInBound | 65500. The implicit deny at the end |
| Common mistake | A rule at 4000 never fires because a deny sits at 200 |
Connectivity options
| Requirement | Option |
|---|---|
| Connect two VNets | VNet peering. Non-transitive by default |
| Connect on-premises over the internet | Site-to-site VPN gateway |
| Connect one machine to a VNet | Point-to-site VPN |
| Private, high bandwidth to on-premises | ExpressRoute |
| Hub and spoke with transit | Peering plus user-defined routes, or Virtual WAN |
| Resolve private DNS across VNets | Private DNS zone linked to each VNet |
Load balancing
| Service | Layer | Scope | Use |
|---|---|---|---|
| Load Balancer | 4 | Regional | TCP and UDP inside a region |
| Application Gateway | 7 | Regional | HTTP routing, WAF, SSL termination |
| Traffic Manager | DNS | Global | DNS-based routing between regions |
| Front Door | 7 | Global | Global HTTP with WAF and caching |
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.