Virtual Networks, Subnets and Address Planning
A virtual network is a private address space in one region and one subscription, carved into subnets that must fit inside it and must not overlap each other. Azure takes five addresses from every subnet: the network address, three reserved by the platform for the default gateway and DNS, and the broadcast address, so a /24 offers 251 usable addresses rather than 256, and the smallest usable subnet is a /29. Some services demand their own dedicated subnet with a fixed name, notably GatewaySubnet for a VPN or ExpressRoute gateway and AzureBastionSubnet for Bastion, and both have minimum sizes. Address planning matters more in Azure than it might seem because peering will not work between virtual networks with overlapping ranges, and you cannot renumber a network with resources in it without moving them. Name resolution defaults to Azure-provided DNS, which resolves names within the same virtual network only. Anything more, resolution across peered networks, from on-premises, or for a private endpoint, needs an Azure private DNS zone linked to each virtual network, optionally with auto-registration so VM records are created and removed automatically, or a custom DNS server set at the virtual network level.
Exam tip. Count usable addresses carefully when a question gives a subnet size and an instance count. Five addresses gone per subnet is the single most common arithmetic trap in this domain.
Network Security Groups, ASGs and Effective Rules
A network security group is a stateful firewall of allow and deny rules, each with a priority from 100 to 4096, evaluated lowest number first, and the first match wins so nothing after it is considered. Because it is stateful, an allowed inbound connection has its replies allowed automatically and no matching outbound rule is needed. Every NSG carries default rules you cannot delete: inbound, AllowVNetInBound at 65000, AllowAzureLoadBalancerInBound at 65001 and DenyAllInBound at 65500; outbound, AllowVnetOutBound at 65000, AllowInternetOutBound at 65001 and DenyAllOutBound at 65500. An NSG can be attached to a subnet, to a network interface, or to both, and when both exist the order differs by direction: inbound traffic is filtered by the subnet NSG and then the NIC NSG, while outbound traffic is filtered by the NIC NSG and then the subnet NSG. Traffic must be allowed by both to pass. Application security groups remove the need to hard-code addresses: NICs are placed into an ASG and rules then reference the ASG as source or destination, so scaling the application does not mean editing rules. When rules do not behave as expected, the effective security rules view on the network interface shows what is genuinely being applied after both NSGs are combined.
Exam tip. If a scenario adds a permissive rule and traffic is still blocked, check whether an existing deny sits at a lower priority number. Higher priority means a lower number, and the new rule must be numbered below the deny to take effect.
Peering, VPN Gateways, ExpressRoute and Routing
Virtual network peering connects two virtual networks over the Microsoft backbone with no gateway, no encryption overhead and no bandwidth penalty. Regional peering joins networks in the same region and global peering joins networks in different regions. The rule that generates most exam questions is that peering is not transitive: if A is peered with B and B is peered with C, A cannot reach C, and the fix is either a direct peering or a hub and spoke design where the hub runs a gateway or a network virtual appliance and the spokes use the gateway transit and use remote gateways options. For hybrid connectivity, a site-to-site VPN connects a whole on-premises network over an encrypted tunnel across the public internet, a point-to-site VPN connects one client device, and ExpressRoute leaves the internet entirely for a private circuit from a connectivity provider, with higher throughput, predictable latency and a connectivity SLA that a VPN cannot offer. A VPN gateway needs a subnet named GatewaySubnet and comes as route-based, which is the modern default and supports point-to-site and coexistence with ExpressRoute, or policy-based, which is limited to a single site-to-site tunnel with IKEv1. Routing itself follows a strict order of preference: a user-defined route beats a BGP route, which beats a system route, and among routes of equal type the longest matching prefix wins.
Exam tip. When traffic must pass through a firewall appliance, a peering or a security group is never the whole answer. Something has to send the packets to the appliance, and that something is a user-defined route with a virtual appliance next hop.
Load Balancing, Azure DNS and Private Endpoints
Azure has four load balancing services and picking between them comes down to two questions: which layer, and regional or global. Azure Load Balancer works at layer 4 on TCP and UDP within a region, and it is configured from four pieces: a frontend IP, a backend pool, a health probe and a load balancing rule. It comes in public and internal forms, where an internal load balancer carries a private frontend for traffic that must not leave the virtual network. Application Gateway works at layer 7 within a region, which is what lets it route by URL path or host header, terminate TLS and run a Web Application Firewall. Azure Front Door is the global layer 7 service, adding edge acceleration and global failover, and Traffic Manager is global DNS-based routing that hands clients different addresses rather than proxying traffic. On the DNS side, creating a public zone in Azure DNS does nothing until the domain's registrar is updated to point at the Azure name servers listed on the zone. For private access to platform services, a service endpoint keeps traffic on the Azure backbone but the service keeps its public address and is reached over the internet route, while a private endpoint places a private IP from your subnet in front of the service, which is what allows on-premises access over VPN or ExpressRoute and requires a private DNS zone to resolve the name to that private address.
Exam tip. Any requirement mentioning access from on-premises to a PaaS service over a private connection is a private endpoint, not a service endpoint, and the follow-up detail is nearly always the private DNS zone needed to resolve the name.