Virtual Networks
The regional, isolated network boundary that every IaaS and most PaaS private connectivity features attach to.
Readiness
0%
2h 10m baseline
Exam memorization points
- A virtual network is regional and scoped to one subscription, with one or more IPv4 address spaces expressed in CIDR notation.
- Address spaces must not overlap with any network you intend to peer or connect to on-premises.
- Azure reserves five IP addresses in every subnet: the network address, three for Azure platform services, and the broadcast address.
- DNS options are Azure-provided DNS or custom DNS servers set at the VNet level; changing them requires a VM restart to take effect on guests.
- VNet peering connects networks over the Microsoft backbone and never over the public internet.
- Default outbound internet access is being retired in favour of explicit NAT Gateway or explicit outbound methods.
Traps & distractors
- Planning overlapping address space and only discovering it when peering fails - peering validates non-overlap at creation.
- Believing a VNet can span regions. Cross-region connectivity is global VNet peering, not one VNet.
- Forgetting the five reserved addresses when sizing subnets, which turns a /29 into three usable addresses.
- Assuming removing an address space is always possible. Existing subnets and resources block shrinking or removal.
Suggested lab
Design a non-overlapping address plan
Plan CIDR space that will still peer cleanly later.
- 1Create a VNet with address space 10.10.0.0/16 in one region.
- 2Add subnets 10.10.1.0/27 (workload), 10.10.2.0/26 (AzureBastionSubnet) and 10.10.3.0/27 (GatewaySubnet).
- 3Deploy a VM into the workload subnet and inspect the usable addresses to confirm the five reserved IPs.
- 4Add a second, non-overlapping address space 10.11.0.0/24 to the same VNet.
- 5Attempt to remove the original 10.10.0.0/16 space and record the error.
Microsoft Learn
- Azure Virtual Network overviewdoc
- Search Microsoft Learn: virtual network address space reserved IP addresses DNS peeringsearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
Critical priority
High-yield and still weak. Study this next.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight78% × 25% = 19.4
This topic's domain carries 17.5% of the exam objectives.
- Dependency leverage80% × 20% = 15.9
14 later topics depend on it.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Baseline study time
2h 10m
Complexity
3 / 5
Remaining to target
1h 51m
Status weight
0%
Topics: vnet, address space, cidr, reserved ip, dns, regional
Weak neighbours in Networking