Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Virtual Network Isolation with Private IPs
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is deploying a multi-tier business application consisting of several virtual machines and database backend services in Microsoft Azure. The security team requires that all compute instances reside within an isolated private network, communicate securely with one another using private IP addresses, and remain restricted from direct public internet exposure by default.
Which Azure service or component should the organization deploy to meet these requirements?
Explanations
Azure Virtual Network (VNet)
Azure Virtual Network (VNet)
What Azure Virtual Network (VNet) is
An Azure Virtual Network (VNet) is the fundamental building block for private networks in Microsoft Azure. It is a logically isolated network hosted within the Azure cloud that represents an organization's own private network environment. VNets allow many types of Azure resources, such as Azure Virtual Machines (VMs), to securely communicate with each other, the internet, and on-premises networks.
How it meets the requirements
- Network isolation: VNets provide complete logical isolation from other tenants and workloads in Azure, ensuring dedicated address space management.
- Private IP communication: Resources connected to the same VNet can communicate directly with one another using assigned private IP addresses without traversing the public internet.
- Access control and security: VNets allow administrators to segment resources into subnets and apply Network Security Groups (NSGs) to strictly control inbound and outbound traffic.
Key advantages and capabilities
- Subnet segmentation: Divides the VNet IP address range into smaller subnets to organize application tiers (e.g., web, application, and database tiers).
- Secure default posture: Keeps internal traffic private and enables filtering of unauthorized external internet traffic.
- Service endpoints and private endpoints: Connects Azure PaaS resources securely into the virtual network address space.
- Hybrid connectivity support: Connects seamlessly to on-premises data centers via Azure VPN Gateway or Azure ExpressRoute.
Why this is optimal
Deploying an Azure Virtual Network is the foundational requirement for establishing private IP communication and network-level security boundaries in Azure IaaS and PaaS architectures.
Azure DNS
Azure DNS
What Azure DNS is and does
Azure DNS is a cloud-hosted Domain Name System resolution service that provides name resolution using Microsoft Azure infrastructure. It allows administrators to host public DNS zones or manage private name resolution across virtual networks using Azure Private DNS zones.
Why it doesn't meet the requirement
Azure DNS only resolves domain names to IP addresses; it does not provide the network infrastructure, IP address allocation, private routing, or network boundary isolation required to host and interconnect virtual machines.
Key characteristics and limitations
- Name resolution only: Translates human-friendly hostnames into numerical IP addresses.
- No compute containment: Cannot host network interfaces, subnets, or virtual machines.
- Complementary service: Operates alongside VNets rather than serving as the network fabric itself.
This answer would be correct if
The scenario specifically asked for a managed service to translate custom internal domain names (such as app.internal.corp) into private IP addresses for Azure resources.
Azure ExpressRoute
Azure ExpressRoute
What Azure ExpressRoute is and does
Azure ExpressRoute is a dedicated hybrid connectivity service that enables organizations to extend their on-premises networks into the Microsoft cloud over a private connection facilitated by a connectivity provider. ExpressRoute connections do not travel over the public internet, offering higher reliability, faster speeds, and consistent latencies.
Why it doesn't meet the requirement
While Azure ExpressRoute enables secure, private hybrid connectivity between an on-premises data center and Azure, it does not create the cloud-native private network container itself. It requires an existing Azure Virtual Network on the cloud side to route traffic to Azure resources.
Key characteristics and limitations
- Dedicated physical circuit: Provides high-speed layer 3 connectivity directly to Microsoft cloud services.
- Requires underlying VNet: Functions as a bridge to an Azure VNet rather than acting as the container for virtual machines.
- Complex provisioning: Requires coordination with third-party telecommunications providers.
This answer would be correct if
The scenario required a dedicated, private, high-throughput connection between an on-premises corporate data center and Azure cloud infrastructure without traversing the public internet.
Azure Application Gateway
Azure Application Gateway
What Azure Application Gateway is and does
Azure Application Gateway is a web traffic load balancer (OSI Layer 7) that manages HTTP and HTTPS traffic routing for web applications. It includes advanced application delivery capabilities such as SSL/TLS termination, cookie-based session affinity, and an integrated Web Application Firewall (WAF).
Why it doesn't meet the requirement
Azure Application Gateway is a specialized layer 7 load balancer and reverse proxy designed to inspect and route web application requests. It must be deployed inside an existing Azure Virtual Network and cannot substitute for the network foundation itself.
Key characteristics and limitations
- Layer 7 routing: Focuses on URL-based routing, HTTP header rewrites, and TLS offloading.
- Application-level scope: Does not supply fundamental IP routing, private address spaces, or general networking infrastructure for non-web workloads.
- Requires a host subnet: Must reside within a dedicated subnet inside an Azure Virtual Network.
This answer would be correct if
The organization needed to route incoming user web requests to different backend pools based on the URL path or needed centralized web application firewall protection.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Virtual Network Subnets
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Private DNS
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Virtual Network Peering
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure VPN Gateway vs ExpressRoute
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Sign-in Logs Conditional Access
Describe Microsoft Entra Conditional Access
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
GitHub Branch Protection Rules and SAML SSO
Design and implement permissions and roles in GitHub
Last updated Validated