Describe Azure architecture and services
Azure Networking
CoreIdentify Azure virtual networking components, hybrid connection options, and endpoint reachability.
Aligned to the AZ-900 skills measured as of July 20, 2026; product behavior verified August 23, 2026.
Why this matters
Networking questions are solved by separating address space, segmentation, name resolution, VNet connectivity, hybrid connectivity, and public or private service reachability.
Must Know
- An Azure virtual network provides a private network boundary for Azure resources; subnets segment its address space.
- VNet peering connects Azure virtual networks directly over the Microsoft backbone.
- Azure DNS hosts and resolves DNS domains; it does not replace a network connection.
- Azure VPN Gateway provides encrypted connectivity over the public internet, while ExpressRoute provides private dedicated connectivity through a connectivity provider.
- A public endpoint is reachable through a public address. A private endpoint assigns a private IP from a VNet to reach a supported service privately.
- Endpoint reachability and identity authorization remain separate decisions.
Compare and Distinguish
- VNet vs subnet: private network boundary versus a segment inside that network.
- Peering vs VPN Gateway vs ExpressRoute: VNet-to-VNet connection, encrypted internet-based hybrid connection, and private dedicated hybrid connection.
- Azure DNS vs connectivity: name resolution versus a path for network traffic.
- Public vs private endpoint: public address reachability versus a private IP in a VNet; neither implies anonymous access.
Scenario examples
- Two Azure VNets need direct connectivity, so the team evaluates peering.
- A branch needs an encrypted connection over the internet, so it evaluates VPN Gateway.
- A company needs private dedicated hybrid connectivity, so it evaluates ExpressRoute.
- A storage service must be reached by private IP from a VNet, so it uses a private endpoint.
Exam traps
- Private endpoints do not replace authentication or authorization.
- Azure DNS does not create network connectivity.
- ExpressRoute is not simply another name for an internet VPN.
Key takeaways
- Map each networking component to one purpose.
- Choose VPN for encrypted public-internet transport and ExpressRoute for private dedicated connectivity.
- Treat endpoint reachability separately from access permission.
Ready for the quiz?
- Which service resolves names?
- How do VPN Gateway and ExpressRoute differ?
- What does a private endpoint change—and what does it not change?
Related objectives
- D2.2.S5 — Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
- D2.2.S6 — Define public and private endpoints