AZ-900 Azure Networking Guide — Virtual Networks and Connectivity 2026
Master Azure networking for AZ-900: VNet, subnets, VPN Gateway, ExpressRoute, DNS, CDN, and DDoS Protection explained with exam focus.
Azure Virtual Networks (VNet) — Fundamentals
An Azure Virtual Network (VNet) is the foundational networking building block in Azure. Think of a VNet as your own private section of the Azure cloud — a logically isolated network where your Azure resources communicate with each other, the internet, and your on-premises networks.
For the AZ-900 exam, you need to understand what a VNet does conceptually, not how to configure one. The key idea: a VNet gives you network isolation and segmentation in the cloud.
Subnets
Within a VNet, you divide the address space into subnets. Subnets let you segment the network for security and organization. For example, you might put web servers in one subnet and databases in another — then use Network Security Groups (NSGs) to control traffic between them.
Key point for AZ-900: subnets allow you to apply different security rules to different parts of your network. You can restrict which subnets can talk to each other and which services can be reached from the internet.
VNet Peering
VNet Peering connects two VNets so resources in each can communicate as if they were on the same network. Traffic between peered VNets travels over Microsoft's backbone network — fast, private, and never touching the public internet.
There are two types:
- Regional VNet Peering — connects VNets in the same Azure region
- Global VNet Peering — connects VNets across different Azure regions
When to use VNet Peering: when you have resources in separate VNets (perhaps in different subscriptions or regions) that need to communicate privately. It's simpler than VPN for Azure-to-Azure connectivity.
Want to understand how networking fits into the broader Azure picture? See our AZ-900 Complete Study Guide for full exam coverage.
AZ Breakdown
- Point 1: Azure Virtual Networks provide isolated, private networking in the cloud
- Point 2: Subnets divide the VNet for segmentation and security
- Point 3: Network Security Groups (NSGs) control inbound/outbound traffic at the subnet or NIC level
- Point 1: Connects Azure VNets to on-premises networks or other VNets over encrypted tunnels
- Point 2: Site-to-Site VPN links your datacenter to Azure
- Point 3: Point-to-Site VPN lets individual devices connect securely
- Point 1: Private, dedicated connection between your on-premises infrastructure and Azure — bypasses the public internet entirely
- Point 2: Offers higher reliability, faster speeds, lower latency, and consistent throughput
- Point 3: Ideal for mission-critical workloads
- Point 1: Azure DNS hosts your domain name records in Azure
- Point 2: Azure CDN delivers content faster by caching it at edge locations near users
- Point 3: Azure DDoS Protection defends against Distributed Denial of Service attacks — Basic is free, Standard adds advanced mitigation
VPN Gateway — Encrypted Connectivity to Azure
A VPN Gateway is an Azure service that sends encrypted traffic between your Azure VNet and another location — either your on-premises network or another VNet. The traffic travels over the public internet but is encrypted, making it secure.
Site-to-Site VPN
Site-to-Site (S2S) VPN creates a persistent, encrypted connection between your entire on-premises network and an Azure VNet. This is what organizations use to extend their datacenter into Azure. Think of it as a permanent secure tunnel between two locations.
Requirements: a VPN device on your on-premises side and an Azure VPN Gateway on the Azure side. Once configured, all traffic between the two networks flows through the encrypted tunnel automatically.
Point-to-Site VPN
Point-to-Site (P2S) VPN lets individual computers (remote workers) connect securely to an Azure VNet. Instead of connecting whole networks, individual devices connect as needed. This is the solution for remote employees who need to access Azure resources securely.
VNet-to-VNet VPN
You can also use VPN Gateway to connect two Azure VNets in different regions. Unlike VNet Peering, this goes through the VPN Gateway infrastructure. For AZ-900, know that VNet Peering is generally preferred for Azure-to-Azure connectivity (simpler and faster).
VPN Gateway is covered as part of the Azure Architecture and Services domain. See our Azure Services overview for how networking services fit alongside compute, storage, and databases.
ExpressRoute — Private Dedicated Connection
Azure ExpressRoute lets you extend your on-premises networks into Microsoft's cloud over a private connection facilitated by a connectivity provider. Unlike a VPN, ExpressRoute connections do not go over the public internet.
Why ExpressRoute Instead of VPN?
ExpressRoute offers several advantages over VPN Gateway:
- No public internet exposure — traffic never touches the internet, reducing security risk
- Higher reliability — SLA-backed uptime, typically 99.95%
- Faster speeds — bandwidth from 50 Mbps to 10 Gbps
- Lower latency — consistent, predictable performance
- Consistent throughput — no congestion from shared internet
When to Use ExpressRoute
ExpressRoute is ideal for:
- Large data migrations to Azure
- Mission-critical business applications that need guaranteed performance
- Compliance requirements that mandate private connections (healthcare, finance)
- Hybrid architectures where consistent, high-speed connectivity is essential
The tradeoff: ExpressRoute is significantly more expensive than VPN and requires working with a connectivity provider. For the AZ-900 exam, the key distinction is private vs. encrypted-over-internet.
Networking security topics connect closely to identity and access management. Read our AZ-900 Identity & Security guide to see how network security groups, firewalls, and identity work together.
Azure DNS, CDN & DDoS Protection
Azure DNS
Azure DNS is a hosting service for DNS domains that provides name resolution using Microsoft Azure infrastructure. If you have a custom domain (like contoso.com), you can use Azure DNS to manage the DNS records — the A records, CNAME records, MX records, and so on.
Key point: Azure DNS does not allow you to purchase a domain name. You buy your domain from a domain registrar, then delegate DNS management to Azure DNS. Azure DNS offers the same reliability and performance as other Azure services, with 100% SLA for DNS query availability.
Azure Content Delivery Network (CDN)
Azure CDN is a distributed network of servers that delivers web content to users based on their geographic location. When a user in Tokyo requests your website content, Azure CDN serves it from a nearby edge location rather than from your origin server in the United States.
Benefits for AZ-900: reduced latency, reduced load on your origin server, and better user experience globally. Azure CDN caches static content (images, CSS, JavaScript, video) at edge locations worldwide.
Azure DDoS Protection
A Distributed Denial of Service (DDoS) attack floods your service with traffic to overwhelm it and make it unavailable. Azure offers two tiers of DDoS protection:
- DDoS Basic (Network Protection) — automatically enabled for all Azure customers at no extra cost. Provides always-on monitoring and real-time mitigation of common network-layer attacks.
- DDoS Standard (IP Protection / Network Protection Standard) — paid tier with advanced attack mitigation, telemetry, logging, and alerting. Includes adaptive tuning, attack analytics, and cost protection guarantees (Azure will credit service cost increases caused by DDoS attacks).
For AZ-900: know that Basic is free and automatic; Standard costs extra but provides enhanced protection and SLA guarantees.
How Networking Topics Appear on the AZ-900 Exam
Azure networking falls within the Azure Architecture and Services domain, which makes up 35–40% of the AZ-900 exam. You will not be asked to configure a VNet or set up a VPN tunnel — the exam tests conceptual understanding: what each service does and when you would choose it.
What to Memorize
VNet: Private, isolated network in Azure. Resources inside can communicate; subnets provide segmentation; NSGs control traffic.
VPN Gateway: Encrypted tunnel over public internet. Site-to-Site = network to network. Point-to-Site = individual device to network. Uses public internet with encryption.
ExpressRoute: Private dedicated connection — never touches public internet. Higher cost, higher reliability, lower latency. Used for mission-critical or compliance-heavy scenarios.
VNet Peering: Connects two Azure VNets privately over Microsoft backbone. Faster and simpler than VPN for Azure-to-Azure connectivity.
Azure DNS: Hosts DNS records in Azure. Does not sell domain names — you bring your own domain.
Azure CDN: Caches content at edge locations near users. Reduces latency and origin server load.
DDoS Protection: Basic is free and automatic. Standard adds advanced mitigation, telemetry, and cost protection.
For exam tips on how to approach networking questions and other domains, visit our AZ-900 Exam Tips and Strategies guide. You can also try our AZ-900 Practice Test to test your networking knowledge.
Key AZ-900 Distinction: VPN Gateway vs ExpressRoute
This comparison is a frequent exam topic. Here's the clearest way to remember it:
| Feature | VPN Gateway | ExpressRoute |
|---|---|---|
| Connection type | Encrypted over public internet | Private — no public internet |
| Cost | Lower | Higher |
| Speed | Up to ~10 Gbps (limited by internet) | 50 Mbps to 10 Gbps (dedicated) |
| Latency | Variable (internet congestion) | Consistent and low |
| SLA reliability | 99.9% | 99.95% |
| Best for | Branch offices, remote workers, lower-cost hybrid | Mission-critical, compliance, large data transfer |
Exam tip: If a question mentions "private," "dedicated," "not over the internet," or "compliance" — ExpressRoute is almost always the answer. If it mentions "encrypted," "cost-effective," or "remote workers" — think VPN Gateway.
AZ Checklist
AZ Pros and Cons
- +Online testing eliminates travel time and costs, making the exam more accessible for candidates in remote areas
- +Flexible scheduling windows for online delivery allow candidates to test at their preferred time of day
- +Online delivery often supports on-screen calculators, scratch paper tools, and accessible features for candidates who need them
- +Immediate or faster score delivery compared to some paper-based testing formats
- +Candidates who perform better in familiar environments may find home testing conditions less stressful than test centers
- −Technical requirements (reliable internet, compatible hardware, quiet room) create barriers for some candidates
- −Remote proctoring software can generate false security violations, leading to score cancellations that require appeals
- −Home testing environments introduce interruptions and distractions that dedicated testing centers eliminate
- −Technical issues during the exam require time-consuming support processes that may not be resolved before session timeout
- −Not all exam versions or score types are available via online delivery — some credentials require in-person testing for official certification
AZ-900 Azure Networking Questions and Answers
About the Author
Educational Psychologist & Academic Test Preparation Expert
Columbia University Teachers CollegeDr. Lisa Patel holds a Doctorate in Education from Columbia University Teachers College and has spent 17 years researching standardized test design and academic assessment. She has developed preparation programs for SAT, ACT, GRE, LSAT, UCAT, and numerous professional licensing exams, helping students of all backgrounds achieve their target scores.