AZ-104 · Domain 4 of 5

AZ-104 Domain 4: Implement and manage virtual networking

This domain covers Azure networking: virtual networks, subnets, peering, public IPs and routing; securing access with network security groups, Bastion and private and service endpoints; and name resolution and load balancing.

Exam weight
15–20%
Official functional groups
3
Estimated questions estimate
7–10
Suggested study time estimate
15–20 hrs

About 10 min read Reviewed October 2026

Overview

Implement and manage virtual networking covers building and securing Azure networks. It has three objective groups. Configuring virtual networks covers virtual networks and subnets, peering, public IP addresses, user-defined routes and troubleshooting connectivity. Securing access covers network security groups and application security groups, evaluating effective security rules, Azure Bastion, and service and private endpoints for PaaS. Name resolution and load balancing covers Azure DNS and internal and public load balancers, and troubleshooting load balancing.

At 15–20%, this group tests practical network administration, with a strong troubleshooting element. The exam rewards understanding how NSGs, routes and peering interact to allow or block traffic, how to secure access with Bastion and private endpoints, and how to distinguish load balancer types. Reasoning systematically about why traffic does or does not flow is the central skill.

How it's tested

AZ-104 questions in this group describe a connectivity, security or load-balancing need, often a troubleshooting scenario, and ask how to configure or fix it. Read the exact requirement before choosing, picking the option that most precisely matches the task described.

  • Secure the traffic

    An access-control need is described, and you choose NSG rules, ASGs, Bastion or private endpoints.

  • Diagnose the block

    A connectivity failure is described, and you reason through NSGs, routes and peering to find the cause.

  • Right connectivity or balancing

    A connection or load-distribution need is described, and you choose peering, a load balancer type, or DNS.

Reasoning it through

An administrator must allow secure RDP access to virtual machines without exposing them to the public internet or opening inbound RDP ports. Assigning public IPs and opening RDP in an NSG exposes the VMs to attack. Azure Bastion provides secure RDP and SSH through the portal over TLS without a public IP on the VM or open inbound RDP, which matches the requirement, so Bastion is the service.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

4.1 Configure and manage virtual networks in AzureVirtual networks, subnets, peering, public IPs, routes and troubleshooting.
What it means
This covers creating and configuring virtual networks and subnets, virtual network peering, public IP addresses, user-defined routes, and troubleshooting network connectivity.
What to understand
A virtual network isolates resources, divided into subnets. Peering connects virtual networks so resources communicate. Public IPs expose resources, and user-defined routes override default routing, for example to force traffic through an appliance. Troubleshooting traces the path through routes, peering and security rules.
How it shows up
A connectivity or routing need is described, and you must configure peering, routes or a public IP, or troubleshoot a failure.
Common confusion
Confusing a user-defined route with a network security group; routes control where traffic goes, while NSGs allow or deny it.
4.2 Configure secure access to virtual networksNetwork security groups, application security groups, Bastion, and service and private endpoints.
What it means
This covers creating and configuring network security groups (NSGs) and application security groups (ASGs), evaluating effective security rules, implementing Azure Bastion, and configuring service endpoints and private endpoints for Azure PaaS.
What to understand
NSGs allow or deny traffic by rules and can apply at the subnet or network interface, with effective rules combining both. ASGs group resources so NSG rules reference them. Bastion gives secure RDP and SSH without public IPs. Service endpoints extend the virtual network to a PaaS service, while private endpoints give the service a private IP in the network.
How it shows up
An access-control need is described, and you must choose NSG rules, ASGs, Bastion, or service versus private endpoints.
Common confusion
Confusing service endpoints with private endpoints; a service endpoint keeps the service's public endpoint, while a private endpoint gives it a private IP.
4.3 Configure name resolution and load balancingAzure DNS, internal and public load balancers, and load-balancing troubleshooting.
What it means
This covers configuring Azure DNS for name resolution, configuring internal and public load balancers to distribute traffic, and troubleshooting load balancing.
What to understand
Azure DNS hosts domains and resolves names. A public load balancer distributes internet traffic across backend resources, while an internal load balancer distributes traffic within a virtual network. Health probes determine which backends receive traffic. Choosing the load balancer type matches the traffic source.
How it shows up
A name-resolution or load-distribution need is described, and you must choose Azure DNS or the internal or public load balancer.
Common confusion
Confusing an internal with a public load balancer; a public load balancer handles internet traffic, while an internal one distributes within the virtual network.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Virtual network and subnets

    Isolated network divided into subnets.

    Remember
    The foundation of Azure networking.
    Tested as
    Networking questions.
    Trap
    Overlapping address spaces.

  • Virtual network peering

    Connects virtual networks for communication.

    Remember
    Peering is not transitive by default.
    Tested as
    Connectivity questions.
    Trap
    Expecting transitive peering.

  • Network security group

    Allows or denies traffic by rule, stateful.

    Remember
    Return traffic is allowed automatically.
    Tested as
    Security questions.
    Trap
    Expecting it to behave statelessly.

  • Effective security rules

    The combination of subnet and NIC NSGs.

    Remember
    Both levels apply together.
    Tested as
    Troubleshooting questions.
    Trap
    Checking only one NSG level.

  • Application security group

    Groups resources for NSG rules.

    Remember
    It simplifies rule management.
    Tested as
    Security questions.
    Trap
    Expecting it to filter alone.

  • Azure Bastion

    Secure RDP and SSH without public IPs.

    Remember
    It removes the need to expose management ports.
    Tested as
    Access questions.
    Trap
    Opening inbound RDP instead.

  • Service endpoint vs. private endpoint

    Extends the VNet to a PaaS service versus giving it a private IP.

    Remember
    Private endpoints remove the public endpoint.
    Tested as
    PaaS access questions.
    Trap
    Confusing the two.

  • User-defined routes

    Override default routing.

    Remember
    Force traffic through an appliance or path.
    Tested as
    Routing questions.
    Trap
    Confusing routes with NSGs.

  • Public vs. internal load balancer

    Distributes internet versus internal traffic.

    Remember
    Match the type to the traffic source.
    Tested as
    Load-balancing questions.
    Trap
    Confusing the two types.

  • Health probes

    Determine which backends receive traffic.

    Remember
    Unhealthy backends are removed.
    Tested as
    Load-balancing questions.
    Trap
    Overlooking probe configuration.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

NSG vs. ASG vs. user-defined route

ConceptMeaningKey differenceCommon trap
NSG Allows or denies traffic Stateful filtering Expecting stateless behavior
ASG Groups resources for NSG rules Simplifies rules, does not filter alone Expecting it to filter
User-defined route Controls where traffic goes Routing, not filtering Confusing with an NSG

Service endpoint vs. private endpoint

ConceptMeaningKey differenceCommon trap
Service endpoint Extends the VNet to a PaaS service Keeps the public endpoint Thinking it removes public access
Private endpoint Gives the service a private IP Removes the public endpoint Confusing with a service endpoint

Public vs. internal load balancer

ConceptMeaningKey differenceCommon trap
Public load balancer Distributes internet traffic Internet-facing Using it for internal-only traffic
Internal load balancer Distributes within the VNet Private traffic Using it for internet traffic

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Public IP and open RDP

    What candidates pick
    Give VMs public IPs and open inbound RDP in the NSG for remote access.
    Why it looks right
    It enables RDP directly.
    Why it's wrong
    That exposes the VMs to attack; Azure Bastion gives secure RDP and SSH without public IPs or open inbound RDP.

    Clue to watch for Secure remote access is needed without exposing VMs.

  2. One NSG level

    What candidates pick
    Troubleshoot a blocked connection by checking only the subnet NSG.
    Why it looks right
    It is one place to look.
    Why it's wrong
    Effective security rules combine subnet and NIC NSGs; both must be evaluated.

    Clue to watch for Traffic is blocked despite the subnet NSG looking correct.

  3. Service endpoint for private IP

    What candidates pick
    Use a service endpoint to give a PaaS service a private IP in the VNet.
    Why it looks right
    Both relate to PaaS access.
    Why it's wrong
    A service endpoint keeps the service's public endpoint; a private endpoint gives it a private IP.

    Clue to watch for The requirement is a private IP with no public endpoint.

  4. Transitive peering

    What candidates pick
    Expect two VNets to communicate through a third they are both peered with.
    Why it looks right
    Peering connects VNets.
    Why it's wrong
    Peering is not transitive by default; connectivity requires direct peering or a hub routing solution.

    Clue to watch for Three VNets must all communicate.

  5. Public LB for internal

    What candidates pick
    Use a public load balancer to distribute traffic between internal tiers.
    Why it looks right
    It balances traffic.
    Why it's wrong
    An internal load balancer distributes traffic within the VNet; a public one is internet-facing.

    Clue to watch for The traffic is internal to the virtual network.

Answer framework

For any Domain 4 scenario, use these steps to find the answer AZ-104 expects.

  1. Identify whether the need is connectivity, access security, or name resolution and load balancing.
  2. For connectivity, configure virtual networks, subnets and peering, remembering peering is not transitive, and use user-defined routes to control paths.
  3. For security, apply NSG rules evaluating effective rules from subnet and NIC, use ASGs to simplify rules, Bastion for secure access, and private endpoints for private PaaS access.
  4. For troubleshooting, trace the path through routes, peering and NSGs systematically to find what blocks traffic.
  5. For name resolution and balancing, use Azure DNS, and choose a public load balancer for internet traffic or an internal one for VNet traffic, with health probes.

Practice question

An administrator must provide secure RDP and SSH access to virtual machines for management, without assigning public IP addresses to the VMs or opening inbound RDP and SSH ports to the internet. Which Azure service should be used?

Want more like this? The AZ-104 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This domain is heavy on security and troubleshooting, so study a systematic method for how traffic flows and is filtered. Start with virtual networks, subnets and peering, remembering peering is not transitive, and user-defined routes for path control. Then master NSGs, especially that effective rules combine subnet and NIC NSGs, which is a common troubleshooting trap.

Next, learn secure access: Azure Bastion for management without public IPs, and the service-versus-private-endpoint distinction for PaaS. Then cover name resolution with Azure DNS and the internal-versus-public load balancer choice with health probes.

Because much of this is troubleshooting, practice building a network, deliberately blocking traffic, and diagnosing it with effective rules and Network Watcher. Use IP flow verify and next hop in Network Watcher on your own lab VMs, including across a peered network and through a user-defined route, until you can predict their answers before running them. Afterwards, move to Domain 5, monitoring and maintaining resources.

FAQ

How much of AZ-104 is Domain 4?

Implement and manage virtual networking is 15–20% of the exam, with a strong troubleshooting element.

Is virtual network peering transitive?

No, not by default. Two virtual networks peered with a third do not communicate through it unless a routing solution such as a hub is configured.

How do effective NSG rules work?

Network security groups can apply at both the subnet and the network interface. The effective rules are the combination of both levels, so troubleshooting must consider both.

What is the difference between a service endpoint and a private endpoint?

A service endpoint extends the virtual network identity to a PaaS service but keeps its public endpoint. A private endpoint gives the service a private IP inside the virtual network and removes public exposure.

When should I use Azure Bastion?

To provide secure RDP and SSH to VMs through the portal without assigning public IPs or opening inbound management ports to the internet.

What is the difference between an internal and a public load balancer?

A public load balancer distributes internet-facing traffic to backend resources. An internal load balancer distributes traffic within a virtual network.

How does Domain 4 connect to the rest of the exam?

Networking connects the compute resources from Domain 3, secures access to the storage from Domain 2 with private endpoints, and is governed by Domain 1 and monitored by Domain 5.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered virtual networks, security, name resolution and load balancing. Test whether you can secure access and diagnose connectivity under exam conditions.

Take the AZ-104 practice test Check your AZ-104 readiness

Keep going