d084 Configure and manage virtual networks

Ace your homework & exams now with Quizwiz!

subscriptions

You can peer VNets in different ______, even if those ______are under different Azure Active Directory tenants

CIDR /27

Microsoft-recommended best practice is to use a _____ address block to allow for future expansion.

DNS Settings

Network interfaces properties: If specified, these DNS servers are configured on virtual machines in the virtual network in place of the Azure-provided DNS servers. This setting will override the VNet-level _______, if both are specified.

location

Network interfaces properties: The ____of the resource. Must be the same as the _____ of any virtual network or any virtual machine which the network interface will be connected to.

1-80

Network interfaces properties: The network interface name. Must be unique within the resource group. it is between ___ characters, may contain letters (case insensitive), numbers, underscores, periods, or hyphens. Must start with a letter or number and end with a letter, number, or underscore.

hare a single gateway

. Rather than deploy two virtual network gateways, it is much simpler and more cost-efficient for both VNets to s____. This can be achieved, provided both VNets are deployed to the same Azure region, and having the correct configuration of the peering settings.

virtual network gateway

A _____ allows you to create connections from your virtual network to other networks.

hub-and-spoke

A common way to reduce duplication of resources is to use a ____ network topology. n this approach, shared resources (such as domain controllers, DNS servers, monitoring systems, and so on) are deployed into a dedicated VNet.

IP configurations

A list of _____ for the network interface. These are the most important settings, containing the public and private IP address properties.

Global VNet peering.

Peering between VNets in different regions is called _________

properties

Private IP addresses are configured as _____ within the IP configurations of the network interface. They are not a separate resource.

IPv4 or IPv6

Public IP address resources can use either an _____ address (but not both).

Basic or Standard

Public IP addresses are available at two pricing tiers (or SKUs):

DHCP

Static private IP addresses should only be configured in the Azure network interface resource. They will be assigned to the virtual machine using ____, just like with dynamic private IP addresses.

private

The IP ranges in your VNet are ___ to that VNet. An IP address in your VNet can only be accessed from within that VNet, or from other networks connected to the VNet.

4

There are ___ ways to configure a DNS label for an Azure public IP address:

DNS name label property

There are four ways to configure a DNS label for an Azure public IP address: 1. By specifying the _____ of the public IP address resource.

DNS A record

There are four ways to configure a DNS label for an Azure public IP address: 2. By creating a _____ in Azure DNS or a third-party DNS service hosting a DNS domain.

CNAME

There are four ways to configure a DNS label for an Azure public IP address: 3. By creating a DNS _____ record in Azure DNS or a third-party DNS service hosting a DNS domain.

alias

There are four ways to configure a DNS label for an Azure public IP address: 4. By creating an ____ record in Azure DNS.

dynamic or static

There are two methods used to assign private IP addresses: ________.

Service endpoints (and policies)

VNET Subnet Properties: An array of ____ for this subnet. ____ provide a direct route to various Azure PaaS services (such as Azure storage), without requiring an Internet-facing endpoint. ____provide further control over which instances of those services may be accessed.

CIDR /29

the minimum size for the gateway subnet is a _____

Delegations

VNET Subnet Properties: An array of references to ___on the subnet. ____allow subnets to be used by certain Azure services, which will then deploy managed resources (such as an Azure SQL Database Managed Instance) into the subnet. Access to these resources is private and can be controlled using NSGs. ____also support access to and from on-premises networks when hybrid networking is used.

Network security group

VNET Subnet Properties: Reference to the ____ for the subnet. NSGs are essentially firewall rules that can be associated to a subnet and are used to control which inbound and outbound traffic flows are permitted.

Address prefix

VNET Subnet Properties: The IP address range for a subnet, specified in CIDR notation. All subnets must sit within the VNet address space and cannot overlap.Support for multiple IP ranges in a single subnet is currently in preview.

2-80

VNET Subnet Properties: The subnet name must be unique within the VNet. It is between____characters, may contain letters (case insensitive), numbers, underscores, periods, or hyphens. Must start with a letter or number. Must end with a letter, number, or underscore.

Route table

VNET Subnet Properties: ____ applied to the subnet, used to override the default system routes. These are used to send traffic to destination networks that are different than the routes that Azure uses by default.

100

Be aware of the limit of ___peering connections per VNet. This is a hard limit.

IPv4 and IPv6

Both ____ private IP addresses are supported

network interface

Both public and private IP addresses are configured on virtual machines using ____ resources.

0.0.0.0/0

A special case is when routes are configured with the destination IP prefix ____. Given the precedence rules described above, this route controls traffic destined for any IP address is not covered by any other rules.

Virtual Appliance

A variety of different types of next hop are supported. These are: A virtual machine running a network application such as a load-balancer or firewall.

None

A variety of different types of next hop are supported. These are: Used to drop all traffic send to a given IP address or prefix.

Internet

A variety of different types of next hop are supported. These are: Used to route a specific IP address or prefix to the Internet.

Virtual Network Gateway

A variety of different types of next hop are supported. These are: Used to route traffic to a VPN Gateway (but not an ExpressRoute Gateway, which uses BGP for custom routes).

Virtual Network

A variety of different types of next hop are supported. These are: Used to route traffic within the Virtual Network.

resource

A virtual network (VNet) is an Azure ___.

network virtual appliance (NVA)

An alternative approach is to deploy a ______ into the hub, using user-defined routes (UDRs) to route inter-spoke traffic through the _____

automatically

Azure VMs that are added to a VNet can communicate _____ with each other over the network. Even if they are in different subnets or attempting to gain access to the Internet, there are no configurations required by you as the administrator.

3

Azure also holds ____additional addresses for internal use starting from the first address in the subnet.

first and last

Azure reserves the ____ IP addresses in each subnet for network identification and for broadcast, respectively.

5

Azure will hold back a total of ___IP addresses from each subnet.

public IP prefixes

Basic Tier Does not support ___

both static and dynamic

Basic Tier Supports ____ allocation methods.

inbound or outbound

Basic Tier Use NSGs to restrict ____ traffic.

Open

Basic Tier is ___ by default for inbound traffic.

Not zone redundant

Basic Tier is ___, but can be assigned to a specific availability zone.

Internet

By default, Azure implements a system route directing all traffic matching 0.0.0.0/0 (and not matching any other route) to the _____.

IP forwarding

By default, a virtual machine in Azure will not accept a network packet addressed to a different IP address. For that traffic to be allowed to pass into that virtual appliance, you must enable _____ on the network interface of the virtual machine.

forced tunneling

By using a VPN Gateway as the next hop, you can direct all Internet-bound traffic over your VPN connection to an on-premises network security appliance. This is known as ______.

devices

Changes to subnets and address ranges can only be made if there are no ____connected to the subnet.

network settings

Do not configure private IP addresses directly within the virtual machine OS ____.

4

Dynamic allocation assigns private IP addresses from each subnet in order, starting with the lowest available IP in the subnet IP range. Remember that the first ____ IP addresses in each subnet are reserved by the Azure platform.

single network range

Each subnet must also define a ____(in CIDR format).

IP ranges

Each virtual network can use either a single or multiple disjoint ____.

Classless Inter-Domain Routing (CIDR)

IP ranges are defined using ____ notation.

User defined routes

If multiple routes contain the same address prefix, Azure selects the route type, based on the following priority: 1st priority

System routes for traffic in a virtual network, across a virtual network peering, or to a virtual network service endpoint

If multiple routes contain the same address prefix, Azure selects the route type, based on the following priority: 2nd priority

BGP routes

If multiple routes contain the same address prefix, Azure selects the route type, based on the following priority: 3rd priority

Other system routes

If multiple routes contain the same address prefix, Azure selects the route type, based on the following priority: 4th priority

latency

Implementing a custom route using the 0.0.0.0/0 prefix has several implications. First, traffic to Azure platform services will also be routed via your custom route. This may add considerable additional _____ to these connections.

indirect

Implementing a custom route using the 0.0.0.0/0 prefix has several implications. Second, you will no longer be able to access resources in your subnet directly from the Internet. Instead, you will need to configure an ____ path, with inbound traffic passing through the next hop device.

Loopback

In addition, there are a small number of IP ranges reserved by the Azure platform, and which therefore cannot be used. These are: 127.0.0.0/8

Azure-provided DNS

In addition, there are a small number of IP ranges reserved by the Azure platform, and which therefore cannot be used. These are: 168.63.129.16/32

Multicast

In addition, there are a small number of IP ranges reserved by the Azure platform, and which therefore cannot be used. These are: 224.0.0.0/4

Broadcast

In addition, there are a small number of IP ranges reserved by the Azure platform, and which therefore cannot be used. These are: 255.255.255.255/32

Link-local

In addition, there are a small number of IP ranges reserved by the Azure platform, and which therefore cannot be used. These are: 169.254.0.0

static

Standard Tier Supports ____ allocation .

IP address block.

Standard Tier Supports public IP prefixes, allowing IP addresses to be assigned from a contiguous___

allow

Standard Tier Use NSGs to ____ inbound traffic

restrict

Standard Tier Use NSGs to ___outbound traffic.

Zone redundant

Standard Tier is ___ by default, or can instead be assigned to a specific availability zone

Closed

Standard Tier is ____ by default for inbound traffic.

name

The ____ of a subnet must be unique within that VNet. You cannot change the subnet ____after is has been created.

user defined routes (UDRs).

The _____ is implemented by creating a route table resource.

dynamic

The default allocation method is ____, where the IP address is automatically allocated from the resource's subnet

default system

The following are the ____ routes that Azure will use and provide for you: Within the same subnet From one subnet to another within a VNet VMs to the Internet A VNet to another VNet through a VPN gateway A VNet to another VNet through VNet peering A VNet to your on-premises network through a VPN gateway or ExpressRoute

non-overlapping

The peered VNets must have _____ IP address spaces.

Source Network Address Translation (SNAT)

Traffic leaves the virtual machine via the private IP address, and ____is used to map the outbound traffic from the private IP address to the public IP address.

next hop

UDR: Each route specifies the destination IP range (in CIDR notation) and the ____ IP address.

routes of exposure

UDR: Within the route table, a number of _____are configured.

Public IP addresses

Used for communication with the Internet.

Private IP addresses:

Used for communication within Azure virtual networks and connected on-premises networks.

IP forwarding

Used to enable _____ on this network interface. It is used for network virtual appliances to allow the virtual machine to receive packets addressed to other networks.

IPv6

VMs cannot communicate between private ___addresses on a VNet, since they can only use ___ to receive and respond to inbound traffic from the Internet when using an Internet-facing load balancer.

Address Space

VNET Properties: An array of IP address ranges available for use by subnets.

location

VNET Properties: Azure ____must be the same as the VNet. Each VNet is tied to a single Azure region, and can only be used by resources (such as Virtual Machines) in that region.

DHCP Options

VNET Properties: Contains an array of DNS servers. If specified, these DNS servers are configured on virtual machines in the virtual network in place of the Azure-provided DNS servers.

DDOS Protection

VNET Properties: Settings to defines whether additional DDoS protection is provided for resources in the VNet, and if so which protection plan is used

2-64

VNET Properties: The VNet name. It must be unique within the resource group. It is between ____ characters, may contain letters (case insensitive), numbers, underscores, periods, or hyphens. Must start with a letter or number and end with a letter, number, or underscore

Peerings

VNET Properties: The list of peerings configured for this VNet. Peerings are used to create network connectivity between separate VNets.

Subnets

VNET Properties: The list of subnets configured for this VNet.

RFC 1918

Your VNet IP ranges will typically be taken from the private address ranges defined in ____

VNet peering

____ allows virtual machines in two separate virtual networks to communicate directly, using their private IP addresses.

Static public IP addresses

____ are typically used in scenarios where a dependency is taken on a particular IP address. For example: commonly used in the following scenarios: Where firewall rules specify an IP address. Where a DNS record would need to be updated when an IP address changes. Where the source IP address is used as a (weak) form of authentication of the traffic source. Where an SSL certificate specifies an explicit IP address rather than a domain name.

Subnets

____ are used to divide the VNet IP space.

Static private

_____ IP addresses are commonly used for: Virtual machines that act as domain controllers or DNS servers Resources that require firewall rules using IP addresses Resources accessed by other apps/resources through an IP address explicitly, rather than a domain name.

VPN gateways

_____ can be used to create VPN connections, either to on-premises networks or to other virtual networks.

IPv6

_______ support is limited as follows: Only the Basic tier is supported. Only dynamic allocation is supported. Only Internet-facing load balancers (and not virtual machines) can be assigned a public IPv6 add


Related study sets

Jacob Riis/How The Other Half Lives Review

View Set

The Canterbury Tales study guide

View Set

U.S History The great Railroad strike

View Set