Networking and Connectivity
Virtual network anatomy
A VPC/VNet is an isolated IP range defined in CIDR (for example 10.0.0.0/16), subdivided into subnets, each with its own route table. A subnet is public when its route table sends 0.0.0.0/0 to an internet gateway; it is private when the default route points to a NAT gateway (egress only, no inbound from the internet). Peering joins two networks privately, and it fails by design if the CIDR ranges overlap - a favourite exam trap. Hub-and-spoke topologies use a transit gateway or virtual WAN to avoid a mesh of peerings.
Filtering and distribution
Security groups are stateful, allow-only rules attached to network interfaces. Network ACLs are stateless, support allow and deny, and are evaluated in numbered order per subnet. Stateful means return traffic is automatically permitted; stateless means you must write both directions. Load balancers operate at layer 4 (TCP, fast, no content awareness) or layer 7 (HTTP, path/host routing, TLS termination, sticky sessions). DNS services offer routing policies - simple, weighted, latency, geolocation, failover - which are health-check driven. CDNs cache at the edge to cut latency and origin load.
Connecting sites
Site-to-site VPN runs encrypted tunnels over the public internet: fast to set up, cheap, variable latency. Dedicated private circuits (Direct Connect, ExpressRoute, Interconnect) give predictable latency and bandwidth at higher cost and with weeks of lead time; many designs use both, VPN as backup. Private endpoints / PrivateLink expose provider services inside your network without traversing the internet.
Rule of thumb: "does the subnet need to accept inbound connections from the internet?" Yes → internet gateway. No, but it needs outbound patching and API calls → NAT gateway.
Trap: watch for egress data charges and the assumption that VPN guarantees latency - only dedicated circuits do.