AZ-104 Part 4 — Networking

The building blocks

VNet 10.0.0.0/16
├── Subnet 10.0.1.0/24  (public tier)  --- attached NSG "web-nsg"
├── Subnet 10.0.2.0/24  (app tier)     --- attached NSG "app-nsg"
├── Subnet 10.0.3.0/24  (data tier)    --- attached NSG "db-nsg"
├── VNet Peering  ↔  another VNet (non-transitive)
└── VPN / ExpressRoute Gateway  ↔  on-prem

NSG — the built-in firewall

• Applied at NIC or subnet level.
• Rules ordered by priority (100 = highest, 4096 = lowest).
• Stateful: return traffic is auto-allowed.

az network nsg rule create -g myrg --nsg-name web-nsg \
  --name AllowHTTP --priority 100 \
  --protocol Tcp --direction Inbound \
  --destination-port-ranges 80 --access Allow

VNet Peering vs VPN vs ExpressRoute

Option	Bandwidth	Encryption	Cost
VNet Peering	Backbone (very fast)	Not encrypted at layer 3	💲
VPN Gateway	Up to 10 Gbps	IPsec encrypted	💲💲
ExpressRoute	Up to 100 Gbps	Private circuit	💲💲💲💲

Load Balancer vs Application Gateway

Layer 4 (TCP/UDP)     Layer 7 (HTTP/HTTPS + rules)
+----------------+    +----------------------+
| Load Balancer  |    | Application Gateway  |
| Fast, dumb     |    | Path routing, WAF,   |
| Public/Internal|    | SSL termination      |
+----------------+    +----------------------+

Use App Gateway if you need URL-based routing (/api → api-pool, /static → static-pool), SSL termination, or Web Application Firewall.

Azure DNS & Traffic Manager

• Public DNS Zone — hosts your domain records (A, CNAME, MX…).
• Private DNS Zone — resolves names inside your VNets.
• Traffic Manager — DNS-level global load balancing.

Traffic Manager routing methods (memorise!): Priority · Weighted · Performance · Geographic · Multivalue · Subnet

Real-world example

An e-commerce site puts static images on a global CDN, uses Traffic Manager to send European users to the Ireland region and Indian users to Mumbai, an Application Gateway in each region terminates HTTPS and applies the WAF, and internal APIs sit in a private subnet protected by NSGs. The whole trip from user → app is under 50 ms.

Exam gotchas

• Peered VNets cannot transit through a third VNet by default; enable hub-and-spoke with UDR/NVA.
• NSG rules: lower priority number wins.
• Traffic Manager works at DNS; it never sees traffic itself.
• Site-to-Site VPN needs a public IP on-prem and a VPN Gateway in Azure.