Implement and manage virtual networking
This domain focuses on designing and securing connectivity: VNets and subnets, peering, routing, name resolution, and load balancing.
VNet and security
Plan non-overlapping address spaces; overlapping ranges block peering and VPN. Azure reserves five addresses in each subnet, so a /24 yields 251 usable. Network security groups filter traffic at subnet or NIC level with prioritized allow and deny rules; application security groups group NICs by workload. Effective rules combine both NSGs. Azure Load Balancer is Layer 4, Application Gateway is Layer 7 with optional WAF, Front Door is global HTTP(S), and Traffic Manager routes by DNS. Service endpoints extend the VNet identity to PaaS; private endpoints give a private IP through Private Link.
Hybrid and DNS
Site-to-site VPN runs over the internet with IPsec; ExpressRoute is a private circuit. Peering is non-transitive, so hub-and-spoke needs gateway transit or user-defined routes through a firewall. Azure DNS hosts public zones; Azure Private DNS zones resolve names inside linked VNets and can auto-register VM records.
Worked example
Two peered VNets must allow only HTTPS into one subnet. Create an NSG on the target subnet with priority 100 allowing TCP 443 from the source VNet address space and a later deny-all inbound rule; associate it to the subnet, not the NIC, to cover all VMs. Reasoning: peering provides the path, but NSGs still filter; the default deny-all inbound rule sits at 65500.
Traps
Peering is not transitive; a UDR or gateway transit is required. NSG rules are stateful, so return traffic is allowed. Service endpoints do not give a private IP. Private endpoint DNS must resolve to the private address. Basic SKU load balancers lack zone redundancy. GatewaySubnet must be named exactly that and sized appropriately.