Azure AZ-700 key terms

A logically isolated, software-defined network in Azure that you define with your own private IP address space. Resources in a VNet can communicate with each other, with the internet, and with on-premises networks.

A range of IP addresses carved out of a virtual network's address space. Resources such as virtual machines and private endpoints are deployed into a subnet, which can carry its own routing and security rules.

A custom route added to a route table to override Azure's default system routing. A UDR sends traffic to a virtual appliance, a gateway, or the internet by specifying a next-hop type and address.

An Azure resource holding a collection of routes that determine where traffic leaving a subnet is forwarded. It is associated with subnets and evaluated together with Azure's built-in system routes.

A managed outbound-only network address translation service attached to a subnet. It gives virtual machines a predictable public IP for internet-bound traffic and removes the need to assign public IPs directly to them.

A network design in which a central hub virtual network hosts shared services such as firewalls and gateways, while spoke virtual networks peer with the hub to reach those services and each other.

A management service that centrally creates and enforces network configurations across many virtual networks and subscriptions using network groups, connectivity configurations, and security admin rules.

A hosting service for public DNS domains that answers queries through Azure's global name server network. Records are managed with Azure role-based access control and support custom domain names.

A service that resolves names between on-premises DNS systems and Azure private DNS zones without you deploying your own DNS servers on virtual machines. It uses inbound and outbound endpoints.

A regional service offering diagnostic and monitoring tools for Azure networks, including topology views, IP flow verification, packet capture, connection troubleshooting, and flow log collection.

A feature that records IP traffic flowing through a virtual network, capturing source, destination, port, and whether the flow was allowed or denied, for auditing and traffic analysis.

A connection between two virtual networks that lets resources communicate over private IP addresses as if they were in one network, without gateways or the public internet.

Peering between virtual networks that sit in different Azure regions. Traffic travels over the Microsoft backbone, and the two networks must not have overlapping address spaces.

An Azure resource that provides the VPN and ExpressRoute connectivity endpoints for a virtual network. It is deployed in a dedicated gateway subnet and can host site-to-site, point-to-site, and ExpressRoute connections.

An IPsec/IKE tunnel between an Azure virtual network gateway and an on-premises VPN device that joins entire networks to each other over the public internet.

A VPN connection from an individual client device to an Azure virtual network using VPN client software. It suits remote workers who do not have a site-to-site VPN device.

A private, dedicated connection between on-premises networks and Azure provided through a connectivity partner. Traffic bypasses the public internet, giving predictable performance and higher reliability.

A feature that links two ExpressRoute circuits so that on-premises sites connected to different circuits can exchange traffic over the Microsoft backbone instead of the public internet.

An option that gives an organization physical ports at a Microsoft peering location, enabling large-scale direct connections to ExpressRoute with granular bandwidth allocation across circuits.

A networking service that bundles VPN, ExpressRoute, and user connectivity into a single managed hub-and-spoke architecture that Microsoft operates on your behalf.

A Microsoft-managed virtual network created by Virtual WAN that acts as the central point of connectivity for VPN, ExpressRoute, and spoke virtual networks attached to it.

A service that exchanges routes dynamically by using BGP between a virtual network and network virtual appliances or on-premises gateways, so static user-defined routes are not required.

A managed jump-host service that provides secure RDP and SSH access to virtual machines through the Azure portal over TLS, without exposing public IP addresses on those machines.

A technology that provides private, IP-based access to Azure PaaS services, Microsoft services, and your own services by bringing them into a virtual network through private endpoints.

A network interface placed in your subnet that connects privately to one specific service instance. Traffic to that service stays on the Microsoft backbone and needs no public IP or gateway.

A resource that lets you expose your own service, typically running behind a standard load balancer, to consumers who connect to it through private endpoints in their own virtual networks.

A subnet-level setting that extends the virtual network identity to an Azure service, so traffic from that subnet reaches the service over the Azure backbone and the service can restrict access to the subnet.

A DNS zone hosted in Azure that resolves names only for the virtual networks linked to it. It is commonly used to resolve the fully qualified domain names of private endpoints.

A regional layer-7 load balancer that routes HTTP and HTTPS traffic using URL path or host-based rules, supports TLS termination, and can include a web application firewall.

A global layer-7 entry point that routes client requests to the fastest healthy backend using anycast, caching, and health probes, with an optional web application firewall policy.

A layer-4 load balancing service that distributes TCP and UDP traffic across backend pool members in a single region, using health probes and configurable load-balancing rules.

A DNS-based global traffic manager that directs clients to endpoints in different regions according to a routing method such as priority, weighted, performance, or geographic.

A set of allow and deny rules that filter inbound and outbound traffic for subnets or network interfaces. Rules match on a five-tuple and can reference service tags and application security groups.

A logical grouping of virtual machine network interfaces that you reference in NSG rules, so security policy can be written by workload role instead of by IP address.

A label that represents a group of IP address prefixes for an Azure service or category, usable in NSG, firewall, and routing rules so addresses do not need to be hardcoded.

A managed, stateful cloud firewall for virtual networks that enforces rules based on IP address, port, protocol, and fully qualified domain name, with threat intelligence and built-in high availability.

A reusable resource that holds rule collections, threat intelligence settings, and other configuration for one or more Azure Firewalls, and can be shared across subscriptions and firewalls.

A service that monitors virtual network traffic and automatically mitigates volumetric, protocol, and application-layer attack traffic, while providing telemetry and rapid-response support.

A layer-7 filter that inspects HTTP requests and blocks common attacks such as SQL injection and cross-site scripting. It is available on Application Gateway and Front Door.