AZ-900 Azure Networking Guide — Virtual Networks and Connectivity 2026
Azure Virtual Networks (VNet) — Fundamentals
An Azure Virtual Network (VNet) is the foundational networking building block in Azure. Think of a VNet as your own private section of the Azure cloud — a logically isolated network where your Azure resources communicate with each other, the internet, and your on-premises networks.
For the AZ-900 exam, you need to understand what a VNet does conceptually, not how to configure one. The key idea: a VNet gives you network isolation and segmentation in the cloud.
Subnets
Within a VNet, you divide the address space into subnets. Subnets let you segment the network for security and organization. For example, you might put web servers in one subnet and databases in another — then use Network Security Groups (NSGs) to control traffic between them.
Key point for AZ-900: subnets allow you to apply different security rules to different parts of your network. You can restrict which subnets can talk to each other and which services can be reached from the internet.
VNet Peering
VNet Peering connects two VNets so resources in each can communicate as if they were on the same network. Traffic between peered VNets travels over Microsoft's backbone network — fast, private, and never touching the public internet.
There are two types:
- Regional VNet Peering — connects VNets in the same Azure region
- Global VNet Peering — connects VNets across different Azure regions
When to use VNet Peering: when you have resources in separate VNets (perhaps in different subscriptions or regions) that need to communicate privately. It's simpler than VPN for Azure-to-Azure connectivity.
Want to understand how networking fits into the broader Azure picture? See our AZ-900 Complete Study Guide for full exam coverage.
AZ Breakdown
- Point 1: Azure Virtual Networks provide isolated, private networking in the cloud
- Point 2: Subnets divide the VNet for segmentation and security
- Point 3: Network Security Groups (NSGs) control inbound/outbound traffic at the subnet or NIC level
- Point 1: Connects Azure VNets to on-premises networks or other VNets over encrypted tunnels
- Point 2: Site-to-Site VPN links your datacenter to Azure
- Point 3: Point-to-Site VPN lets individual devices connect securely
- Point 1: Private, dedicated connection between your on-premises infrastructure and Azure — bypasses the public internet entirely
- Point 2: Offers higher reliability, faster speeds, lower latency, and consistent throughput
- Point 3: Ideal for mission-critical workloads
- Point 1: Azure DNS hosts your domain name records in Azure
- Point 2: Azure CDN delivers content faster by caching it at edge locations near users
- Point 3: Azure DDoS Protection defends against Distributed Denial of Service attacks — Basic is free, Standard adds advanced mitigation
VPN Gateway — Encrypted Connectivity to Azure
A VPN Gateway is an Azure service that sends encrypted traffic between your Azure VNet and another location — either your on-premises network or another VNet. The traffic travels over the public internet but is encrypted, making it secure.
Site-to-Site VPN
Site-to-Site (S2S) VPN creates a persistent, encrypted connection between your entire on-premises network and an Azure VNet. This is what organizations use to extend their datacenter into Azure. Think of it as a permanent secure tunnel between two locations.
Requirements: a VPN device on your on-premises side and an Azure VPN Gateway on the Azure side. Once configured, all traffic between the two networks flows through the encrypted tunnel automatically.
Point-to-Site VPN
Point-to-Site (P2S) VPN lets individual computers (remote workers) connect securely to an Azure VNet. Instead of connecting whole networks, individual devices connect as needed. This is the solution for remote employees who need to access Azure resources securely.
VNet-to-VNet VPN
You can also use VPN Gateway to connect two Azure VNets in different regions. Unlike VNet Peering, this goes through the VPN Gateway infrastructure. For AZ-900, know that VNet Peering is generally preferred for Azure-to-Azure connectivity (simpler and faster).
VPN Gateway is covered as part of the Azure Architecture and Services domain. See our Azure Services overview for how networking services fit alongside compute, storage, and databases.
ExpressRoute — Private Dedicated Connection
Azure ExpressRoute lets you extend your on-premises networks into Microsoft's cloud over a private connection facilitated by a connectivity provider. Unlike a VPN, ExpressRoute connections do not go over the public internet.
Why ExpressRoute Instead of VPN?
ExpressRoute offers several advantages over VPN Gateway:
- No public internet exposure — traffic never touches the internet, reducing security risk
- Higher reliability — SLA-backed uptime, typically 99.95%
- Faster speeds — bandwidth from 50 Mbps to 10 Gbps
- Lower latency — consistent, predictable performance
- Consistent throughput — no congestion from shared internet
When to Use ExpressRoute
ExpressRoute is ideal for:
- Large data migrations to Azure
- Mission-critical business applications that need guaranteed performance
- Compliance requirements that mandate private connections (healthcare, finance)
- Hybrid architectures where consistent, high-speed connectivity is essential
The tradeoff: ExpressRoute is significantly more expensive than VPN and requires working with a connectivity provider. For the AZ-900 exam, the key distinction is private vs. encrypted-over-internet.
Networking security topics connect closely to identity and access management. Read our AZ-900 Identity & Security guide to see how network security groups, firewalls, and identity work together.
Azure DNS, CDN & DDoS Protection
Azure DNS
Azure DNS is a hosting service for DNS domains that provides name resolution using Microsoft Azure infrastructure. If you have a custom domain (like contoso.com), you can use Azure DNS to manage the DNS records — the A records, CNAME records, MX records, and so on.
Key point: Azure DNS does not allow you to purchase a domain name. You buy your domain from a domain registrar, then delegate DNS management to Azure DNS. Azure DNS offers the same reliability and performance as other Azure services, with 100% SLA for DNS query availability.
Azure Content Delivery Network (CDN)
Azure CDN is a distributed network of servers that delivers web content to users based on their geographic location. When a user in Tokyo requests your website content, Azure CDN serves it from a nearby edge location rather than from your origin server in the United States.
Benefits for AZ-900: reduced latency, reduced load on your origin server, and better user experience globally. Azure CDN caches static content (images, CSS, JavaScript, video) at edge locations worldwide.
Azure DDoS Protection
A Distributed Denial of Service (DDoS) attack floods your service with traffic to overwhelm it and make it unavailable. Azure offers two tiers of DDoS protection:
- DDoS Basic (Network Protection) — automatically enabled for all Azure customers at no extra cost. Provides always-on monitoring and real-time mitigation of common network-layer attacks.
- DDoS Standard (IP Protection / Network Protection Standard) — paid tier with advanced attack mitigation, telemetry, logging, and alerting. Includes adaptive tuning, attack analytics, and cost protection guarantees (Azure will credit service cost increases caused by DDoS attacks).
For AZ-900: know that Basic is free and automatic; Standard costs extra but provides enhanced protection and SLA guarantees.
How Networking Topics Appear on the AZ-900 Exam
Azure networking falls within the Azure Architecture and Services domain, which makes up 35–40% of the AZ-900 exam. You will not be asked to configure a VNet or set up a VPN tunnel — the exam tests conceptual understanding: what each service does and when you would choose it.
What to Memorize
VNet: Private, isolated network in Azure. Resources inside can communicate; subnets provide segmentation; NSGs control traffic.
VPN Gateway: Encrypted tunnel over public internet. Site-to-Site = network to network. Point-to-Site = individual device to network. Uses public internet with encryption.
ExpressRoute: Private dedicated connection — never touches public internet. Higher cost, higher reliability, lower latency. Used for mission-critical or compliance-heavy scenarios.
VNet Peering: Connects two Azure VNets privately over Microsoft backbone. Faster and simpler than VPN for Azure-to-Azure connectivity.
Azure DNS: Hosts DNS records in Azure. Does not sell domain names — you bring your own domain.
Azure CDN: Caches content at edge locations near users. Reduces latency and origin server load.
DDoS Protection: Basic is free and automatic. Standard adds advanced mitigation, telemetry, and cost protection.
For exam tips on how to approach networking questions and other domains, visit our AZ-900 Exam Tips and Strategies guide. You can also try our AZ-900 Practice Test to test your networking knowledge.
Key AZ-900 Distinction: VPN Gateway vs ExpressRoute
This comparison is a frequent exam topic. Here's the clearest way to remember it:
| Feature | VPN Gateway | ExpressRoute |
|---|
| Connection type | Encrypted over public internet | Private — no public internet |
| Cost | Lower | Higher |
| Speed | Up to ~10 Gbps (limited by internet) | 50 Mbps to 10 Gbps (dedicated) |
| Latency | Variable (internet congestion) | Consistent and low |
| SLA reliability | 99.9% | 99.95% |
| Best for | Branch offices, remote workers, lower-cost hybrid | Mission-critical, compliance, large data transfer |
Exam tip: If a question mentions "private," "dedicated," "not over the internet," or "compliance" — ExpressRoute is almost always the answer. If it mentions "encrypted," "cost-effective," or "remote workers" — think VPN Gateway.
AZ Checklist
Understand what a VNet is and why it provides network isolation in Azure Know the purpose of subnets and how NSGs control traffic between them Explain VNet Peering and when to use it vs VPN for Azure-to-Azure connectivity Distinguish Site-to-Site VPN (network-to-network) from Point-to-Site VPN (device-to-network) Know that VPN Gateway uses the public internet with encryption — ExpressRoute does not List three advantages of ExpressRoute over VPN (private, reliable, consistent throughput) Identify when ExpressRoute is preferred: compliance, mission-critical, high-bandwidth Explain what Azure DNS does (hosts DNS records) and what it does NOT do (sell domains) Describe Azure CDN's purpose: edge caching to reduce latency for global users Distinguish DDoS Basic (free, automatic) from DDoS Standard (paid, advanced mitigation) Understand how network security (NSGs, firewalls, DDoS) connects to Azure security posture AZ Pros and Cons
Pros
- Online testing eliminates travel time and costs, making the exam more accessible for candidates in remote areas
- Flexible scheduling windows for online delivery allow candidates to test at their preferred time of day
- Online delivery often supports on-screen calculators, scratch paper tools, and accessible features for candidates who need them
- Immediate or faster score delivery compared to some paper-based testing formats
- Candidates who perform better in familiar environments may find home testing conditions less stressful than test centers
Cons
- Technical requirements (reliable internet, compatible hardware, quiet room) create barriers for some candidates
- Remote proctoring software can generate false security violations, leading to score cancellations that require appeals
- Home testing environments introduce interruptions and distractions that dedicated testing centers eliminate
- Technical issues during the exam require time-consuming support processes that may not be resolved before session timeout
- Not all exam versions or score types are available via online delivery — some credentials require in-person testing for official certification
AZ-900 Azure Networking Questions and Answers
What is an Azure Virtual Network (VNet) and why does it matter for AZ-900?
An Azure Virtual Network (VNet) is a logically isolated network in Azure that lets your Azure resources communicate privately with each other, with the internet, and with on-premises networks. For AZ-900, VNets represent the foundational networking concept. The exam tests whether you understand that VNets provide isolation and segmentation — not the technical steps to configure one. Subnets divide the VNet into segments, and Network Security Groups control traffic between them.
What is the difference between Site-to-Site and Point-to-Site VPN in Azure?
Site-to-Site (S2S) VPN connects an entire on-premises network to an Azure VNet over an encrypted tunnel through the public internet — think datacenter to Azure. Point-to-Site (P2S) VPN connects individual devices (like a remote worker's laptop) to an Azure VNet. Both use Azure VPN Gateway and both encrypt traffic over the public internet. The distinction for AZ-900 is network-level vs. device-level connectivity.
When should you choose ExpressRoute instead of VPN Gateway?
Choose ExpressRoute when you need a private dedicated connection — one that never traverses the public internet. ExpressRoute is ideal for compliance-heavy industries (healthcare, finance), mission-critical applications requiring consistent performance, and large-scale data migrations. It offers higher reliability (99.95% SLA), consistent low latency, and dedicated bandwidth. VPN Gateway is the better choice when cost matters more than guaranteed performance or when you need remote worker access.
What does Azure DDoS Protection Basic include, and when would you upgrade to Standard?
Azure DDoS Protection Basic is automatically enabled for all Azure services at no additional cost. It provides always-on traffic monitoring and real-time mitigation of common network-layer DDoS attacks. You would upgrade to DDoS Protection Standard when you need advanced attack mitigation tailored to your specific Azure resources, detailed attack analytics and telemetry, rapid response support, and cost protection (Azure credits if a DDoS attack causes your Azure bill to spike). Standard is recommended for public-facing applications that require high availability guarantees.
How does Azure CDN improve performance for global users?
Azure Content Delivery Network (CDN) caches static content — images, videos, CSS, JavaScript — at edge servers located around the world (called Points of Presence or PoPs). When a user requests content, Azure CDN serves it from the edge location nearest to that user rather than from your origin server. This reduces latency, decreases bandwidth costs on your origin, and improves the user experience for global audiences. For AZ-900, the key concept is geographic caching to reduce latency.
How does networking connect to identity and security in Azure?
Azure networking and security are deeply interconnected. Network Security Groups (NSGs) act as firewalls at the subnet or NIC level, allowing or denying traffic based on rules — this is a network-layer control. Azure Firewall provides centralized, cloud-native firewall-as-a-service. Private Endpoints let you connect to Azure services (like Storage or SQL) over a private IP in your VNet rather than over the public internet. Azure DDoS Protection defends the network perimeter. Together, these controls complement identity-based security (Azure AD, RBAC, MFA) to create a defense-in-depth strategy. The AZ-900 exam expects you to understand that security is layered across network, identity, and application controls.