AZ-700 Course Notes

Core Azure network design starts with address space, subnet boundaries, and the traffic paths those boundaries create. Virtual network peering gives low-latency private connectivity between VNets, but it is not transitive by default. Gateway transit is the clue that a spoke should use a hub gateway instead of deploying its own, while user-defined routes and virtual appliances decide whether east-west or north-south traffic is inspected.

• Assuming VNet peering is transitive and that spokes can automatically route through each other without explicit hub routing.

• Use peering for private VNet connectivity, gateway transit for shared gateway access, and UDRs when the next hop must change.

Hybrid connectivity decisions usually start with transport and resiliency. Site-to-site VPN is faster to deploy and encrypted over the internet, while ExpressRoute gives private, provider-backed connectivity with more predictable routing and performance. Active-active VPN gateways add tunnel resiliency and throughput, but the gateway SKU still controls limits, availability zone support, and cost.

• Choosing VPN Gateway for workloads that require ExpressRoute private routing, predictable performance, or provider-backed connectivity.

• Use VPN for encrypted internet tunnels and ExpressRoute for private predictable enterprise connectivity.

Application delivery architecture starts by choosing the layer that should make the decision. Azure Load Balancer is layer 4 and distributes TCP or UDP flows using frontend IPs, backend pools, rules, and health probes. Application Gateway is layer 7 and can route HTTP or HTTPS by host name, URL path, headers, and WAF policy. Front Door is the global edge option for internet-facing HTTP applications, while Traffic Manager is DNS-based endpoint selection and never sees the actual request payload.

• Choosing Traffic Manager when the scenario needs layer 7 routing, TLS termination, WAF, or HTTP path decisions.

• Load Balancer is layer 4, Application Gateway is regional layer 7, Front Door is global edge layer 7, and Traffic Manager is DNS steering.

Private access questions often turn on Service Endpoint versus Private Endpoint. A service endpoint keeps traffic from a subnet to a supported Azure service on the Microsoft backbone, but the service still uses its public endpoint and public IP space. A private endpoint creates a network interface with a private IP in the VNet, so clients reach the service through private addressing and DNS rather than the public endpoint.

• Treating service endpoints and private endpoints as the same design even though private endpoints create a private IP in the VNet.

• Service endpoints keep service traffic on the Azure backbone but still target the public service endpoint.

Layered Azure network security starts by separating subnet filtering from centralized inspection. NSGs are the right control for allowing or denying traffic at subnet or NIC boundaries with priority-based rules. Azure Firewall is the right control when traffic must be inspected, logged, NATed, filtered by FQDN or application rule, or forced through a hub. A common design mistake is using NSGs as if they provide stateful centralized egress inspection.

• Using NSGs as if they provide centralized egress inspection, FQDN filtering, or application rules like Azure Firewall.

• NSGs filter at subnet or NIC boundaries; Azure Firewall provides centralized stateful inspection and logging.