Azure Network Engineer Flashcards & Memory Notes

Two Azure virtual networks so their resources can communicate using private IPs, subject to NSG and route rules.

Allow gateway transit on the hub side and use the remote gateway on the spoke side, subject to supported configurations. Peering is not automatically transitive.

Inbound receives queries into Azure, including from on-premises. Outbound uses forwarding rulesets to send selected Azure queries to other DNS servers; link the ruleset to the required VNets.

No. Longest matching prefix comes first. A /16 peering route beats a /0 UDR. For equal prefixes, the usual order is UDR, BGP, then system, with platform-specific exceptions.

For new internet connections, NAT Gateway takes precedence over Load Balancer outbound rules and instance public IPs. A UDR to an NVA or virtual network gateway can redirect the path. Existing flows may retain earlier translation.

No. Route Server exchanges BGP routing information with NVAs. It is a control-plane service, not the appliance forwarding the application packets.

Whether the specified flow is allowed or denied by applicable NSG and security admin rules. An allowed result does not prove firewall permission, a working route, or a listening application.

A public IP prefix reserves a contiguous Azure address allocation. A custom IP prefix imports an eligible public range you own through BYOIP.

Bringing your own public IP range into Azure so clients continue to see your addresses.

Connectivity and security configurations across many VNets, including security admin rules.

S2S VPN is IPsec over the internet (or over ExpressRoute when designed that way). ExpressRoute is a private circuit through a provider.

Modern Azure designs usually need route-based VPN. Policy-based is limited and rarely preferred for new designs.

The on-premises VPN device address and prefixes Azure should reach over the S2S connection.

OpenVPN with the Azure VPN Client on a supported platform. Check protocol, authentication, client support, and profile settings together; certificate and RADIUS configurations have different requirements.

Connectivity to VNet private address spaces over the ExpressRoute circuit.

No. Microsoft 365 access requires authorization and the appropriate route filter. Microsoft peering and private peering address different destinations.

Connecting on-premises sites to each other through Microsoft's backbone via ExpressRoute.

No. Eligible data traffic can bypass the gateway, but the supported ExpressRoute gateway is still required for route exchange. Verify circuit, SKU, and destination feature support.

No. ExpressRoute is not encrypted by default. MACsec protects the Direct physical links; IPsec can protect an end-to-end network connection. Match the encryption boundary to the requirement.

A Microsoft-managed hub that can host gateways and routing for branch, VNet, and partner NVA connectivity.

Layer 4 (TCP/UDP). It does not route by HTTP path or host header.

When you need regional layer-7 routing, TLS termination, or WAF for HTTP(S) apps.

For global HTTP(S) edge delivery, TLS, routing, and caching. Choose Premium when Private Link to supported origins is required; the client-facing endpoint remains public.

DNS-based global traffic steering. It does not terminate the client's TCP session.

Public has a public frontend IP. Internal uses a private frontend IP inside a VNet.

Inserting network virtual appliances into the traffic path for inspection or advanced networking.

SNAT utilization, connection reuse, and the effective egress method. Explicit Load Balancer outbound rules control its SNAT allocation, while an associated NAT Gateway takes priority for new direct internet flows.

HTTP request or response headers and URL paths according to configured rewrite rule sets.

Premium. Standard supports custom WAF rules but not managed rule sets. A private origin connection must be supported, approved, and validated separately from the public client endpoint.

Regional load balances inside a region. Cross-region (global) Load Balancer fronts regional load balancers.

A private IP on your VNet mapped to an Azure PaaS resource or Private Link service.

No. You must configure public network access separately and validate private DNS.

Your service exposed behind a Standard Load Balancer so consumers can attach private endpoints.

No. Link the appropriate VNets or configure a deliberate forwarding path. With custom DNS, test the resolver actually used by the client; a zone link alone may not change its answers.

Extends VNet identity to the service over the Microsoft backbone while the service keeps its public address.

Azure Storage. Policies constrain permitted Storage destinations through service endpoints; they are not a universal PaaS allowlist and do not grant data permissions.

When the stem requires a private IP on the VNet or fully private PaaS access—use a private endpoint.

Use a reachable Azure resolver or forwarder that can resolve the linked private zone. Forward the recommended public service namespace, such as database.windows.net for Azure SQL, and provide connectivity to the endpoint.

Private endpoints map PaaS into your subnet as a NIC. Some PaaS also use dedicated subnet injection or delegation—read the stem.

No. A service may still have public DNS records after public network access is disabled. Test an actual request and distinguish DNS, network restrictions, and data authorization.

Not necessarily. NSGs are stateful, so validate changes with a new connection. Where subnet and NIC NSGs both apply, the new flow must pass both.

A logical group of NICs used as a source or destination in NSG rules instead of raw IPs.

When you need centralized hub filtering, FQDN application rules, or Firewall Manager policies.

Virtual network flow logs. New NSG flow logs can no longer be created, and existing NSG flow logs retire on September 30, 2027. Correlate flow records with firewall and application logs.

No. It enforces configured actions and evaluation behavior; exclusions and rules matter. Detection observes matches. Investigate the logged rule and request field before narrowly tuning a false positive.

On Application Gateway and Azure Front Door with associated WAF policies.

Firewall policies and secure hub deployments across Azure Firewall instances and Virtual WAN hubs.

Bastion provides RDP/SSH without a public IP on the VM; NSGs should allow Bastion paths rather than opening management to the internet.

Allow continues to NSG evaluation. Always Allow bypasses subsequent NSGs for matching traffic. Deny stops the flow. Verify deployment, scope, and documented service exceptions.

NSG: IP/port filters. Firewall: centralized network/FQDN. WAF: HTTP application threats on App Gateway or Front Door.