3-networking-moc

Configure & Manage Virtual Networks — MOC

MS Learn path: Configure and manage virtual networks for Azure administrators · Largest skill area on the AZ-104 exam.

Map / Canvas

• Open the mind-map canvas

The core idea

Virtual networks are Azure’s software-defined networking. You design IP space (CIDR), segment it into subnets, connect VNets to each other (vnet-peering) and to on-premises (vpn-gateway/expressroute), secure traffic (nsg/asg/azure-firewall), route it (route-table/bgp), resolve names (azure-dns/private-dns), and balance load (load-balancer/application-gateway/traffic-manager). One network, many layers — this MOC ties them together.

Concepts (linked from here)

Core topology

• Virtual network
• subnet
• IP addressing / CIDR
• Public IP addresses
• Route tables & UDR
• BGP
• Network Watcher
• Connection Monitor

Connectivity

• vnet-peering
• VPN Gateway
• ExpressRoute
• Virtual WAN

Security

• Network security groups
• Effective NSG rules
• Application security groups
• Azure Firewall
• Azure DDoS Protection
• Azure Bastion
• Service endpoints
• Private Endpoints

Name resolution

• Azure DNS
• Azure Private DNS

Load balancing & traffic

• Azure Load Balancer
• Application Gateway (WAF)
• Traffic Manager
• Azure Front Door

Modules in this path

• 1 · Configure Virtual Networks — design/implement IP addressing & VNets/subnets
• 2 · Configure Virtual Network Peering — vnet-peering, gateway transit, hub & spoke
• 3 · Configure Network Security Groups — nsg/asg
• 4 · Manage & Control Traffic Flow with Routes — UDRs & NVAs
• 5 · Host Your Domain on Azure DNS — azure-dns
• 6 · Introduction to Azure Load Balancer — load-balancer
• 7 · Introduction to Azure Application Gateway — application-gateway (WAF)
• 8 · Introduction to Azure Network Watcher — network-watcher

Hybrid connectivity is covered conceptually here via vpn-gateway and expressroute (no dedicated module in this path; see the associated hybrid-networking learn path).

Skills measured (current exam blueprint)

1. Configure VNets, subnets, peering, public IPs, UDRs, and troubleshoot connectivity.
2. Configure NSGs/ASGs, evaluate effective rules, Azure Bastion, service endpoints, and private endpoints.
3. Configure Azure DNS, internal/public Load Balancer, and troubleshoot load balancing.

Route check: Draw a packet’s route from a VM to a private PaaS endpoint, naming the subnet, NSG, route, DNS record, and endpoint involved. The coverage audit identifies remaining gaps, including public IPs and effective NSG-rule evaluation.

Cross-module lab

• Private networking diagnosis
• VNet addressing, routes, and effective rules
• Private DNS and Bastion administration
• Internal Load Balancer health diagnosis

Ordered practice route

1. Complete configure-virtual-networks, then az104-vnet-routing-effective-rules-lab. You should now be able to distinguish address planning, routing, and NSG authorization from their observable outputs.
2. Complete host-domain-azure-dns, then az104-private-dns-bastion-lab. You should now be able to trace private name resolution and reach a private-only VM without creating a VM public IP.
3. Complete intro-to-azure-load-balancer, then az104-internal-load-balancer-health-lab. You should now be able to inspect a private frontend and diagnose a failed backend health probe.

Practice questions

• Q: peering vs gateway
• Q: NSG rule evaluation
• Q: App Gateway vs Load Balancer
• Q: VPN Gateway vs ExpressRoute
• Q: peering with overlapping address space
• Q: Private Endpoint DNS diagnosis
• Q: effective NSG rules
• Q: Bastion secure VM access

Conceptual checkpoint

Explain the sequence in this path using one workload scenario: identify the boundary being changed, the identity or tool acting on it, the expected evidence, and the failure that would change your decision.

Sources and re-audit

• AZ-104 course overview, checked 2026-08-31.
• AZ-104 study guide, checked 2026-08-31.

Re-audit when the AZ-104 course path, study-guide effective date, or the services and permissions taught here change.