Azure AZ-700 flashcards
Azure AZ-700 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Subnet IP reservation
- Azure reserves five addresses in every subnet: the first four and the last. Usable host addresses equal 2 raised to the host-bit count minus five.
- VNet peering transitivity
- VNet peering is not transitive. A VM in VNet A cannot reach VNet C through VNet B unless A is peered directly with C or routing forwards traffic.
- UDR next hop types
- User-defined route next-hop types are VirtualNetworkGateway, VirtualNetwork, Internet, VirtualAppliance, and None. Each route also has an address prefix and priority.
- GatewaySubnet naming
- The gateway subnet must be named GatewaySubnet. It requires at least a /29 prefix, and a /27 is recommended for large VPN or ExpressRoute gateway SKUs.
- Service endpoint
- A service endpoint extends a virtual network subnet identity to an Azure PaaS service over the Azure backbone. It does not assign a private IP address to the service.
- Private DNS autoregistration
- Linking a private DNS zone to a virtual network with autoregistration enabled creates A records for virtual machines in that VNet automatically.
- Accelerated networking
- Accelerated networking uses SR-IOV to bypass the host virtual switch, reducing latency and CPU jitter. It is supported only on select VM sizes.
- RouteBased VPN
- A RouteBased VPN gateway uses routing tables and supports BGP, multiple tunnels, and active-active configurations. PolicyBased VPNs use static packet filters instead.
- Active-active VPN gateway
- An active-active VPN gateway uses two gateway instances with two public IP addresses, providing higher throughput and redundancy for site-to-site connections.
- ExpressRoute private peering
- ExpressRoute Azure private peering connects on-premises networks to virtual networks through private IP addresses over the ExpressRoute circuit.
- ExpressRoute FastPath
- FastPath bypasses the virtual network gateway in the data path for ExpressRoute traffic, improving throughput and reducing latency for supported scenarios.
- ExpressRoute Global Reach
- ExpressRoute Global Reach links two ExpressRoute circuits so on-premises networks connected to each circuit can communicate through the Microsoft backbone.
- Virtual WAN hub
- A Virtual WAN hub is a Microsoft-managed virtual network that provides transitive routing among site-to-site VPN, point-to-site VPN, and ExpressRoute connections.
- Point-to-site authentication
- Point-to-site VPN can authenticate users with certificates, RADIUS, or Azure Active Directory. Supported methods depend on the VPN gateway SKU and configuration.
- Azure Load Balancer layer
- Azure Load Balancer operates at Layer 4 and distributes TCP and UDP flows. It does not inspect HTTP headers or provide URL-based routing.
- Application Gateway v2
- Application Gateway v2 is a Layer 7 load balancer that supports autoscaling, zone redundancy, Web Application Firewall, and URL path-based routing.
- Front Door anycast
- Azure Front Door uses global anycast edge locations to terminate client connections, accelerate HTTP and HTTPS traffic, cache content, and fail over between origins.
- Traffic Manager routing
- Traffic Manager is a DNS-based global load balancer. Its routing methods include priority, weighted, performance, geographic, multivalue, and subnet.
- Gateway Load Balancer
- Gateway Load Balancer chains network virtual appliances into the data path using VXLAN. It supports transparent insertion for inspection and security scenarios.
- Cross-region Load Balancer
- Cross-region Load Balancer provides global Layer 4 distribution across regional Standard Load Balancers, supporting geo-redundant applications and failover.
- Private endpoint
- A private endpoint is a network interface with a private IP address in a subnet that connects to a specific Azure PaaS resource over Private Link.
- Private Link service
- Private Link service exposes your own service, typically behind a Standard Load Balancer, to consumers who connect using private endpoints in their virtual networks.
- privatelink DNS zone
- Azure private endpoint DNS names commonly use a privatelink zone, such as privatelink.blob.core.windows.net for Blob Storage private endpoints.
- Private endpoint policies
- Private endpoint network policies control whether NSGs and route tables apply to the private endpoint subnet; they are disabled by default.
- App Service VNet integration
- VNet integration gives an App Service outbound access to virtual network resources. It does not provide inbound private access; use a private endpoint for inbound.
- Azure Private Resolver
- Azure DNS Private Resolver forwards DNS queries between on-premises networks and Azure private DNS zones, enabling hybrid name resolution for private endpoints.
- NSG priority
- Network security group rules are processed by priority from 100 to 4096. Lower numbers have higher precedence, and processing stops at the first match.
- NSG stateful behavior
- Network security groups are stateful. If an inbound flow is allowed, return traffic for that flow is automatically allowed without a separate outbound rule.
- Azure Firewall Premium
- Azure Firewall Premium adds intrusion detection and prevention, TLS inspection, and enhanced URL filtering compared with Azure Firewall Standard.
- DDoS Network Protection
- Azure DDoS Network Protection provides adaptive mitigation, attack analytics, and rapid response support for public IP resources in a virtual network.
- Azure Bastion
- Azure Bastion provides RDP and SSH access to virtual machines through the Azure portal over TLS, avoiding public IP addresses and direct RDP exposure.
- Application Security Group
- An Application Security Group groups network interfaces by workload role. NSG rules can reference the group as source or destination instead of IP addresses.