AZ-104 Source Audit — Networking
The networking path has good service distinctions. The audit tests whether those distinctions become reproducible packet-path evidence rather than only diagrams and scenario answers.
| Official source bullet (paraphrased) | Concept / route inspected | Procedure and lab evidence inspected | Practice evidence inspected | Overall evidence grade | Conceptual grade | Relationship grade | Relationship evidence | Practical status | Exact remaining gap | Re-audit trigger |
|---|---|---|---|---|---|---|---|---|---|
| Create/configure VNets and subnets | vnet, subnet, 3-networking-moc, az104-vnet-routing-effective-rules-lab | Dedicated lab plans CIDR, creates subnets, captures an overlap failure, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Create/configure VNet peering | vnet-peering, configure-vnet-peering | Module creates reciprocal peering, gateway transit, and service chaining | az104-q-net-001, az104-q-net-005, az104-q-net-011 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Verify non-transitive route output and current cross-region billing source. | Source effective date or product behavior changes. |
| Configure public IP addresses | public-ip-address, 3-networking-moc, az104-vnet-routing-effective-rules-lab | Dedicated lab creates, inspects, detaches, and deletes a Standard public IP and contrasts it with private addressing | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure user-defined routes | route-table, 3-networking-moc, az104-vnet-routing-effective-rules-lab | Dedicated lab uses a temporary None next hop, records Next Hop and failed path, then removes it | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Troubleshoot network connectivity | network-watcher, intro-to-azure-network-watcher | Module uses Topology, IP Flow Verify, and Next Hop | az104-q-net-007, az104-q-net-015 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add connection-monitor results and a documented diagnosis sequence. | Source effective date or product behavior changes. |
| Create/configure NSGs and ASGs | nsg, asg, configure-network-security-groups | Module associates NSG, uses ASGs, and tests IP Flow Verify | az104-q-net-002, az104-q-net-009 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add one intentional subnet/NIC priority conflict. | Source effective date or product behavior changes. |
| Evaluate NSG effective security rules | effective-nsg-rules, 3-networking-moc, az104-vnet-routing-effective-rules-lab | Dedicated lab captures effective rules and IP Flow Verify for a deliberate priority conflict | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Implement Azure Bastion | azure-bastion, 3-networking-moc, az104-private-dns-bastion-lab | Dedicated lab creates the dedicated subnet, connects through browser SSH/RDP, verifies a private-only target, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure PaaS service endpoints | service-endpoint, az104-network-private-access-lab | Expanded lab enables endpoint on a subnet, restricts the PaaS firewall, contrasts public DNS/private endpoint behavior, and breaks the subnet rule | — | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure PaaS private endpoints | private-endpoint, private-dns, private-network lab | Cross-module lab and question diagnose private DNS | az104-q-net-006 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add service-specific DNS zone and public-access-disabled verification evidence. | Source effective date or product behavior changes. |
| Configure Azure DNS | azure-dns, private-dns, 3-networking-moc, az104-private-dns-bastion-lab | Dedicated lab creates/links a private zone, verifies linked-VNet resolution, breaks the link/resolver path, and fixes it | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure an internal or public load balancer | load-balancer, 3-networking-moc, az104-internal-load-balancer-health-lab | Dedicated lab creates an internal Standard frontend, backend pool, probe, rule, and client test | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Troubleshoot load balancing | health-probe, load-balancer, az104-internal-load-balancer-health-lab | Dedicated lab breaks listener/path, port, and NSG probes; inspects Health Probe Status; and restores service | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
Audit result
0 missing, 0 thin, 0 covered, 13 verified. Every networking row now has a dedicated route, source-linked procedure, safe failure, cleanup, and three practice modes. Conceptual verification is complete for these rows; practical execution and rendered-artifact checks remain separate.
Related
Source-to-Vault Audit · Networking path · service-connection · security-group · workload