What's changed: Added §3.3 "AI Services, Copilot, and Responsible AI" covering the AI area added to AZ-900 in the Jan 2026 update (Azure AI Foundry/OpenAI/AI services/AI Search/Content Safety, the Copilot family, and the six Responsible AI principles)
3.2Networking Services
Understand networking basics: virtual networks (VNets) and subnets, VNet peering, connecting on-premises with VPN Gateway and ExpressRoute, plus DNS and public/private endpoints.
Cloud resources must connect securely—to each other, to the outside, and to on-premises. The foundation is the virtual network (VNet): instead of physical cabling, you define your own software-defined network inside Azure and place resources in it. This section covers the basic parts (VNet, subnet, peering), connecting on-premises (VPN Gateway, ExpressRoute), and name resolution and access control (DNS, endpoints, NSG).
3.2.1Virtual networks (VNets) and subnets
A virtual network (VNet) is a private network inside Azure—the foundation for resources to communicate securely. You assign a VNet an address space (an IP range like 10.0.0.0/16) and divide it into subnets (e.g., 10.0.1.0/24) by purpose (web tier, DB tier). Splitting into subnets lets you apply different traffic rules (NSGs, below) per tier, improving security and clarity.
To connect separate VNets, use peering. Peered VNets communicate privately (without going over the internet) as if they were one network. Peering works within a region and across regions.
3.2.2Connecting to on-premises
There are two main ways to link your on-premises network to Azure. VPN Gateway connects over an encrypted tunnel (IPsec) across the internet—relatively easy and inexpensive, but latency and bandwidth vary since it rides the internet. ExpressRoute is a dedicated private connection via a carrier that does not traverse the internet, giving high reliability, consistent low latency, and high bandwidth—suited to core systems and large data transfers (at higher cost).
| Aspect | VPN Gateway | ExpressRoute |
|---|---|---|
| Path | Over the internet (encrypted) | Dedicated private connection |
| Latency/bandwidth | Can vary | Consistent, high bandwidth |
| Reliability | Standard | High |
| Cost/setup | Cheaper, simpler | Pricier, needs a circuit |
| Good for | Small or supplementary links | Core systems, big data, low-latency needs |
3.2.3Name resolution and access control
Azure DNS hosts name resolution, translating domain names (e.g., example.com) into IP addresses. Exposure is set by endpoints: a public endpoint is reachable from the internet, while a private endpoint (Private Link) is reachable only from within the VNet, letting you use a service without exposing it to the internet. An NSG (network security group) then controls by rules which source/destination/port traffic is allowed or denied, at the subnet or NIC level.
Choosing on-prem connectivity: VPN Gateway (over the internet) for quick secure links; ExpressRoute (dedicated, not over the internet) when you need higher reliability and consistent latency. Some designs use both, failing over to VPN if ExpressRoute fails.
Scenario: a three-tier web app. Split one VNet into a web subnet and a DB subnet, and use an NSG on the DB subnet to deny direct internet access (allow only from the web tier). Use a private endpoint so the database is not exposed. Connect to the on-premises core system with ExpressRoute for low latency. Each tier gets its own exposure and traffic rules.
Watch the mix-ups: (1) VPN Gateway (over the internet) vs ExpressRoute (dedicated, not internet)—"dedicated, not over the internet = ExpressRoute." (2) Peering (VNet-to-VNet) vs gateways (on-prem connectivity) are different roles. (3) Public endpoint (exposed) vs private endpoint (VNet-only).
Q. Are NSGs and firewalls the same? For AZ-900, it is enough to see an NSG as basic allow/deny rules at the subnet/NIC level. More advanced, centralized inspection/filtering is handled by Azure Firewall and the like, but first grasp "NSG = the basic traffic control within a VNet."
Common points: VNet = private network in Azure / subnet = division / peering = VNet-to-VNet, VPN Gateway (over the internet) vs ExpressRoute (dedicated, not over the internet), public/private endpoints, and NSG = allow/deny rules.
3.2.4Section summary
- Divide a VNet (private network in Azure) with subnets; connect VNets privately with peering
- On-prem: VPN Gateway = encrypted over the internet / ExpressRoute = dedicated line (reliable, low latency)
- Azure DNS = name resolution; control access and traffic with public/private endpoints and NSGs
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which feature connects two virtual networks (VNets) together?
Q2. Which connects on-premises via a dedicated private connection that does not use the internet?
Q3. Which correctly describes how a VPN Gateway connects?
Q4. Which unit divides a VNet by purpose (e.g., web tier, DB tier)?
Q5. Which lets a service be reachable only from within the VNet, not exposed to the internet?
Q6. Which provides allow/deny traffic rules at the subnet or NIC level?