Blog Post
Master the most difficult AZ-104 networking concepts. Learn how NSGs, UDRs, VNet peering, and private endpoints interact so you can pass the exam.
Checking sign-in status...
Most AZ-104 candidates expect the exam to be hard on identity and governance. Those sections are manageable. Networking is where prepared candidates get surprised.
Several Azure networking features look similar and overlap in function, and the exam tests how they interact under specific conditions rather than as individual components.
Below are the concepts that produce the most exam mistakes, why they are confusing, and what you need to understand to get them right consistently.
Before you start:
Related: AZ-104 Study Guide 8-Week Plan ↗
Core behavior: NSGs have rules with priority (100–4096). Lower numbers are evaluated first. First match wins.
What candidates miss:
Exam questions describing traffic allowed at subnet level but denied are often testing the two‑level evaluation.
User Defined Routes (UDRs) are a way to override the default routing decisions that Azure makes automatically. By default, Azure creates system routes that control how traffic flows, such as sending internet-bound traffic directly out to the internet. UDRs override that default path to redirect traffic. Whenever a UDR exists for a destination, Azure uses it over the system default, giving you precise control over where your traffic goes.
One important thing to understand is that UDRs are attached to subnets, not to the VNet as a whole. If you have multiple subnets and want all of them to route traffic through a specific device, you must associate the UDR with each subnet individually. This is a detail that catches a lot of people off guard, and it comes up frequently in exams because it is easy to assume the route applies to the entire VNet when it does not.
A common real-world scenario and a frequent exam question is when a company wants all outbound internet traffic to pass through a firewall or Network Virtual Appliance (NVA) before it reaches the internet. The problem is that Azure's default system route sends that traffic straight out, bypassing your firewall entirely. To fix this, create a UDR with a route for 0.0.0.0/0 that points to the private IP address of your NVA. Without that UDR, your firewall does not process outbound traffic because Azure's default route sends packets directly to the internet.
VNet peering is not transitive. If A peers with B, and B peers with C, A cannot reach C through B.
Gateway transit: If B has a VPN/ExpressRoute gateway, A can use B’s gateway if:
This applies only to gateways, not to other VNets behind B.
Related: How Hard Is AZ-104 ↗
Azure-provided DNS (168.63.129.16) is the default service, which resolves Azure public names and default internal names.
Azure Private DNS Zones need VNet links to be usable by resources in that VNet. Auto‑registration automatically creates A records for VMs in that VNet. Only one private zone per VNet can have auto‑registration enabled.
To resolve names across peered VNets, the private zone must be linked to both VNets.
| Service | Layer | Use when |
|---|---|---|
| Azure Load Balancer | L4 (TCP/UDP) | Non‑HTTP workloads, simple port‑based distribution |
| Application Gateway | L7 (HTTP/HTTPS) | Path‑based routing, SSL termination, WAF |
| Azure Front Door | L7 (global) | Multi‑region HTTP routing with WAF |
| Traffic Manager | DNS‑based | Global DNS‑level failover (not proxying) |
Exam signals: “path‑based routing” indicates Application Gateway, while “DNS‑based failover” indicates Traffic Manager.
| Feature | How it works | When to use |
|---|---|---|
| Service Endpoint | Extends VNet identity to PaaS service; traffic stays on Azure backbone but service still has public IP. Free. | No on‑premises access requirement; cost‑sensitive. |
| Private Endpoint | Places a private IP in your VNet mapped to the PaaS resource. True network isolation. Has hourly + per‑GB cost. | On‑premises access via VPN/ExpressRoute, or requirement that service not be reachable from public internet. |
VPN Gateway is an encrypted tunnel over the public internet. It is sufficient for moderate hybrid needs.
ExpressRoute is a private dedicated circuit. It is required when:
ExpressRoute Global Reach enables on‑premises sites to communicate via Azure backbone. ExpressRoute FastPath bypasses the gateway for lowest latency.
AzureFirewallSubnet (/26).Use both together: Firewall for centralised inspection and FQDN filtering; NSGs for granular subnet/NIC filtering.
An exam scenario that features “centralised inspection across multiple VNets” or “FQDN filtering” indicates Azure Firewall.
It is a managed jump host that provides browser-based RDP/SSH (port 443, TLS) without public IPs on target VMs. It is deployed into the AzureBastionSubnet (minimum /26).
It does not replace VPN/ExpressRoute for application connectivity. It solves administrative access to VMs.
If a Bastion deployment isn’t working, check the subnet name first.
Related: Azure Administrator Roadmap 2026 ↗
Central hub VNet contains shared services (Firewall, VPN Gateway, Bastion). Spoke VNets peer to hub, not to each other.
To make it work:
0.0.0.0/0 and inter-spoke traffic to the Azure Firewall.Common failures:
Consistent daily scenario practice helps you apply these concepts reliably.
Use the ExamOS Daily Sprint to practice AZ-104 scenarios that combine multiple concepts in realistic questions.
Azure networking rewards systematic thinking. Most exam mistakes come from applying a concept correctly in isolation but failing to account for how it interacts with adjacent features. Master the finite set of interactions that AZ‑104 tests, and the networking section stops being the one that surprises you.
Preparing for AZ-104? Pressure-test your networking knowledge with the Daily Sprint on ExamOS.
The "Implement and manage virtual networking" domain makes up 15 to 20 percent of the exam. Networking concepts also overlap with compute and storage domains, making it a critical area to master.
You need a scaled score of 700 out of 1000 to pass. This scaled score does not map directly to a raw percentage of 70 percent correct answers.
UDRs allow you to override Azure's default system routing decisions. When a UDR exists for a destination, Azure prioritizes it over the default system route to direct traffic through custom paths.
You can practice scenario-based questions using the Daily Sprint or Mock Exam modes on ExamOS. Your Readiness Score will indicate when you are prepared to book the real exam.