Implement and Manage Virtual Networking for AZ-104

Networking is where many AZ-104 questions become scenario-heavy. Azure administrators need to understand not just which network component exists, but how traffic actually moves, where security applies, and why a private-access design fails when the DNS path is wrong.

VNet: Virtual network, the Azure network boundary for subnets, routes, private endpoints, and attached controls.

DNS: Domain Name System, which resolves names to the private or public addresses the workload will actually use.

What this domain is really testing

Expect questions about virtual network topology, security boundaries, route behavior, name resolution, and the difference between exposing a service publicly and reaching it privately. The exam rewards candidates who can reason through packet flow and control-plane placement rather than memorize product names.

Current weight in the study guide

Microsoft currently weights this domain at 15–20% of AZ-104. That still makes networking a major scoring area, and its questions often feel harder because they combine multiple services in one scenario.

Work this domain in order

Start with VNets, Subnets, Peering, Public IPs, and Routing, then move to Secure Private Access Patterns, and finish with Azure DNS and Load Balancing.

Common AZ-104 traps

• forgetting that VNet peering is not transitive by default
• choosing private endpoints but not planning the DNS path
• assuming a load balancer is the same kind of tool as an application gateway
• troubleshooting from symptoms without checking effective routes or effective security rules

If the networking domain feels noisy, fall back to sequence: source, path, security boundary, name resolution, destination. That ordering usually exposes the broken assumption.

In this section

• Configure VNets, Subnets, Peering, Public IPs, and Routing for AZ-104
  Understand the core virtual network topology, peering, addressing, public-IP, and user-defined-route choices that AZ-104 tests.
• Configure Secure Private Access Patterns for AZ-104
  Learn NSGs, ASGs, Bastion, service endpoints, private endpoints, and the DNS implications that matter on AZ-104.
• Configure Azure DNS and Load Balancing for AZ-104
  Cover Azure DNS, internal versus public load balancers, health probes, and troubleshooting patterns relevant to AZ-104.