You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Gauge your current knowledge
Gauge your current knowledge
When you create a virtual network, you must specify a custom private IP address space using Classless Inter-Domain Routing (CIDR) notation, for example 10.0.0.0/16. This address space must not overlap with any other network you connect to, including on-premises ranges or other Azure virtual networks. Subnets then carve the virtual network into smaller segments, each with its own CIDR range that lies inside the parent address space. For instance, within 10.0.0.0/16 you might create subnets like 10.0.1.0/24 and 10.0.2.0/24. Azure reserves the first four IP addresses and the last IP address in every subnet for internal use, so a /29 subnet gives only three usable IPs. If you plan to use a VPN gateway, you need a dedicated subnet named GatewaySubnet. Always leave room for future subnets instead of consuming the entire address space at once.
Azure offers dynamic or static IP allocation for resources. The default dynamic method assigns an IP address when a virtual machine starts and releases it when the VM stops. For resources that need a fixed address, such as domain controllers or application gateways, choose static allocation so the address persists across restarts. IP addresses in Azure come in two categories: Private IP addresses are used for communication inside the virtual network, with on-premises networks over a VPN, and for outbound internet access through NAT; they are drawn from the subnet’s range. Public IP addresses enable direct inbound and outbound internet communication without NAT and come from Microsoft’s public IP space.
To keep your addressing scheme manageable, prefer fewer large virtual networks over many small ones; this reduces management overhead and simplifies peering. Ensure address ranges never overlap with connected networks so routing works correctly. Some Azure services — such as Azure Bastion or VPN gateways — require specific subnets with reserved IP ranges. For advanced scenarios, consider dual-stack networking that supports both IPv4 and IPv6 ranges in the same virtual network. Use User-Defined Routes (UDRs) to override default system routes and control traffic flow between subnets or through network virtual appliances. Apply Network Security Groups (NSGs) at the subnet or NIC level to filter traffic based on IP addresses, ports, and protocols.
Virtual Network Peering connects two or more Azure virtual networks so they behave as a single network, allowing resources to communicate over private IP addresses without traversing the public internet. Azure offers two types: Regional VNet Peering for networks within the same Azure region and Global VNet Peering for networks in different regions. Both keep traffic on the Microsoft private backbone, giving low latency and high bandwidth. Peering supports seamless data transfer across different subscriptions and tenants and does not cause downtime during setup. Because routing is direct, you avoid the need for complex gateway hardware in most cases.
For more complex topologies, you can use Service Chaining to route traffic through a Network Virtual Appliance (NVA) or a VPN gateway in a peered network. Another option is Subnet Peering, which links specific subnets rather than the whole virtual network address space. Gateway transit lets a spoke network share a single VPN or ExpressRoute gateway located in a hub network, reducing the number of gateways you need to deploy.
The default Azure-provided DNS cannot resolve hostnames across peered virtual networks. Without proper name resolution, resources in connected networks cannot find each other by name even though the network path is open. To fix this, implement Azure Private DNS zones or use custom DNS servers. When you use custom DNS, you must enter the IP addresses of your DNS providers into the virtual network settings — for example, pointing peered networks to the IPs of domain controllers if you use Microsoft Entra Domain Services. After updating the DNS configuration, you must save the settings in the Azure portal and then restart virtual machines so they renew their DHCP leases. Verify connectivity afterward with tools like Azure Network Watcher.
Peered networks must have non-overlapping address spaces to prevent routing conflicts. Remember that peering is non-transitive: connecting Network A to Network B and Network B to Network C does not automatically connect Network A to Network C. After resizing an address space, you must sync the peer relationship again to maintain continuous connectivity. Regular maintenance of these settings is critical for keeping a multi-network environment working.
Subnets are segments inside a virtual network that organize and isolate resources. Each subnet requires a unique name within the virtual network and an address range in CIDR format that does not overlap with other subnets. Optionally, you can add an IPv6 address space to create a dual-stack virtual network. Mark a subnet as private to prevent default outbound access for virtual machines created in it. You can also associate a NAT gateway with a subnet to provide network address translation for outbound traffic from resources on that subnet.
Network Security Groups (NSGs) control inbound and outbound traffic to subnets and network interfaces. Each NSG contains rules that allow or deny traffic based on source IP, destination IP, port, and protocol. You define rules with properties such as protocol, port ranges, address prefixes, traffic direction, priority, and access type. NSGs come with a set of default rules that cannot be deleted or overridden. You can associate an NSG with a subnet — applying the rules to every virtual machine in that subnet — or with an individual network interface card (NIC) to apply rules only to a specific VM.
You can override default Azure routing to prevent direct traffic between subnets or to force traffic through a network virtual appliance (NVA) such as a firewall. Use service endpoints to limit access to Azure resources (like Azure Storage) so that only traffic from specific subnets is allowed. NVAs give you granular control over traffic flow between virtual networks and can inspect or filter packets.
When designing virtual networks and subnets, plan address spaces carefully to avoid overlap with other networks. Use subnets to segment workloads, which improves security by isolating different environments. Enable NSG flow logs to monitor traffic patterns and detect anomalies. Deploy Azure Firewall for centralized, stateful protection that scales across many subnets and virtual networks, making rule management easier than maintaining dozens of individual NSGs.
StudyCerts
StudyCerts