MCA Microsoft Certified Associate Azure Network Engineer Study Guide – Exam AZ–700: Sybex Study Guide

ABOUT THE AUTHORs PUTHIYAVAN UDAYAKUMAR is an infrastructure architect with over 14 years of experience in modernizing and securing IT infrastructure, including the Cloud. He has been writing technical books for more than ten years on various infrastructure and security domains. He has designed, deployed, and secured IT infrastructure out of on-premises and Cloud, including virtual servers, networks, storage, and desktops for various industries, including pharmaceutical, banking, healthcare, aviation, federal entities, etc. He is an open group certified Master certified architect. KATHIRAVAN UDAYAKUMAR is Head of Delivery and Chief Architect for Oracle Digital Technologies (Europe Practice) at Cognizant, covering various elements of technology stack in on-prem and cloud. He has over 18 years of experience in architecture, design, implementation, administration and integration with Green-field IT Systems, ERP, Cloud Platforms and Solutions across various business domains and Industries. He has had a passion for networking since he was an undergraduate and becoming a Cisco Certified Network Associate (CCNA).

Introduction xxv Assessment Test xxxvii Chapter 1 Getting Started with AZ-700 Certification for Azure Networking 1 Basics of Cloud Computing and Networking 2 The Need for Networking Infrastructure 3 The Need for the Cloud 3 Basics of Networking 6 Enterprise Cloud Networking 10 Microsoft Azure Overview 11 Azure Cloud Foundation 12 Azure Global Infrastructure 14 Azure Networking Terminology 20 Azure Networking Overview 21 Azure Networking Services 23 Azure Virtual Network 26 VNet Concepts and Best Practices 28 Deploying a Virtual Network with Azure PowerShell 35 Configure Public IP Services 37 Basic SKUs 38 Standard SKUs 39 Configure a Basic SKU Public IP 40 Configure a Standard SKU Public IP with Zones 40 Configuring Domain Name Services 40 Configure an Azure DNS Zone and Record Using Azure PowerShell 42 Configuring Cross-Virtual Network Connectivity with Peering 43 Configuring Peering between Two Virtual Networks in the Same Region 45 Configuring Virtual Network Traffic Routing 46 Using Forced Tunneling to Secure the VNet Route 52 Configuring Internet Access with Azure Virtual NAT 53 Deploy the NAT Gateway Using Azure PowerShell 54 Summary 56 Exam Essentials 56 Hands-On Lab: Design and Deploy a Virtual Network via the Azure Portal 57 Activity 1: Prepare the Network Schema 58 Activity 2: Build the Aviation Resource Group 60 Activity 3a: Build the CoreInfraVnet Virtual Network and Subnets 60 Activity 3b: Build the EngineeringVnet Virtual Network and Subnets 64 Activity 3c: Build the BranchofficeVnet Virtual Network and Subnets 66 Activity 4: Validate the Build of VNets and Subnets 68 Review Questions 70 Chapter 2 Design, Deploy, and Manage a Site-to-Site VPN Connection and Point-to-Site VPN Connection 75 Overview of Azure VPN Gateway 76 Designing an Azure VPN Connection 79 Design Pattern 1 86 Design Pattern 2 87 Design Pattern 3 88 Choosing a Virtual Network Gateway SKU for Site-to-Site VPN 89 Using Policy-Based VPNs vs. Route-Based VPNs 92 Building and Configuring a Virtual Network Gateway 94 Building and Configuring a Local Network Gateway 97 Building and Configuring an IPsec/IKE Policy 101 Configuration Workflow 104 Diagnosing and Resolving VPN Gateway Connectivity Issues 109 Choosing a VNet Gateway SKU for Point-to-Site VPNs 112 Configuring RADIUS, Certificate-Based, and Azure AD Authentication 116 Configuration Workflow for Native Azure Certification Authentication 117 Configuration Workflow for Native Azure Active Directory 124 Configuration Workflow for Windows Active Directory 127 Diagnosing and Resolving Client-Side and Authentication Issues 133 Summary 136 Exam Essentials 136 Review Questions 140 Chapter 3 Design, Deploy, and Manage Azure ExpressRoute 145 Getting Started with Azure ExpressRoute 146 Key Use Case for ExpressRoute 151 ExpressRoute Deployment Model 151 Choosing Between the Network Service Provider and ExpressRoute Direct 153 Designing and Deploying Azure Cross-Region Connectivity between Multiple ExpressRoute Locations 156 Selecting ExpressRoute Circuit SKUs 156 Estimating Price Based on ExpressRoute SKU 156 Select a Peering Location 157 Select the Proper ExpressRoute Circuit 157 Select a Billing Model 159 Select a High Availability Design 159 Pick a Business Continuity and Disaster Recovery Design Pattern 162 Choosing an Appropriate ExpressRoute SKU and Tier 169 Designing and Deploying ExpressRoute Global Reach 171 Deploying ExpressRoute Global Reach 173 Use Case 1: Enabling Circuits in the Same Region 173 Use Case 2: Enabling Circuits in Different Regions 174 Designing and Deploying ExpressRoute FastPath 175 Evaluate Private Peering Only, Microsoft Peering Only, or Both 176 Setting Up Private Peering 178 Setting Up Microsoft Peering 181 Building and Configuring an ExpressRoute Gateway 182 Connect a Virtual Network to an ExpressRoute Circuit 186 Recommend a Route Advertisement Configuration 190 Configure Encryption over ExpressRoute 191 Deploy Bidirectional Forwarding Detection 192 Diagnose and Resolve ExpressRoute Connection Issues 193 Summary 196 Exam Essentials 196 Review Questions 199 Chapter 4 Design and Deploy Core Networking Infrastructure: Private IP and DNS 203 Designing Private IP Addressing for VNets 204 Deploying a VNet 210 Preparing Subnetting for Services 213 Subnetting Design Considerations 214 Example Case Study: Preparing Subnetting for Services 218 Configuring Subnetting for Services 220 Preparing and Configuring a Subnet Delegation 223 Configure Subnet Delegation 225 Planning and Configuring Subnetting for Azure Route Server 226 Designing and Configuring Public DNS Zones 231 Creating an Azure DNS Zone and Record Using PowerShell 233 Designing and Configuring Private DNS Zones 235 Creating a Private DNS Zone and Record Using PowerShell 238 Designing Name Resolution Inside a VNet 240 VMs and Role Instances 243 Web Apps 243 Linking a Private DNS Zone to a VNet 245 Summary 248 Exam Essentials 249 Review Questions 251 Chapter 5 Design and Deploy Core Networking Infrastructure and Virtual WANs 255 Overview of Virtual Network Peering, Service Chaining, and Gateway Transit 256 Configure VPN Gateway Transit for Virtual Network Peering 258 Design VPN Connectivity between VNets 263 Deploy VNet Peering 266 Deployment Model 1: Running in the Same Azure Subscription and Deployed Using Azure Resource Manager 267 Deployment Model 2: Running in Different Subscriptions and Deploying Using Resource Manager 270 Deployment Model 3: Running in the Same Subscription and Deploying One VNet Using Resource Manager and Another Using the Classic Model 273 Deployment Model 4: Running in Different Subscriptions and Deploying One VNet Using Resource Manager and Another Using the Classic Model 275 Design an Azure Virtual WAN Architecture 277 Choosing SKUs and Services for Virtual WANs 289 Connect a VNet Gateway to an Azure Virtual WAN and Build a Hub in a Virtual WAN 291 Build a Virtual Network Appliance (NVA) in a Virtual Hub 299 Set Up Virtual Hub Routing 304 Build a Connection Unit 306 Summary 309 Exam Essentials 310 Review Questions 312 Chapter 6 Design and Deploy VNet Routing and Azure Load Balancer 317 Design and Deploy User-Defined Routes 318 Basic Routing Concepts 318 Azure Routes 321 Associate a Route Table with a Subnet 328 Set Up Forced Tunneling 329 Diagnose and Resolve Routing Issues 334 Design and Deploy Azure Route Server 336 Route Server Design Pattern 1 338 Route Server Design Pattern 2 339 Choosing an Azure Load Balancer SKU 344 Choosing Between Public and Internal Load Balancers 349 Build and Configure an Azure Load Balancer (Including Cross-Region) 353 Build and Configure Cross-Region Load Balancer Resources 361 Deploy a Load Balancing Rule 366 Build and Configure Inbound NAT Rules 370 Build Explicit Outbound Rules for a Load Balancer 371 Summary 374 Exam Essentials 375 Review Questions 377 Chapter 7 Design and Deploy Azure application gateway, Azure front door, and Virtual NAT 381 Azure Application Gateway Overview 383 How Application Gateway Works 385 Scaling Options for Application Gateway and WAF 389 Overview of Application Gateway Deployment 390 Front-End Setup 390 Back-End Setup 390 Health Probes Setup 391 Configuring Listeners 393 Redirection Overview 394 Application Gateway Request Routing Rules 395 Redirection Setting 397 Application Gateway Rewrite Policies 397 Features and Capabilities of Azure Front Door SKUs 409 Health Probe Characteristics and Operation 411 Secure Front Door with SSL 412 Front Door for Web Applications with a High-Availability Design Pattern 413 SSL Termination and End-to-End SSL Encryption 421 Multisite Listeners 423 Back-Ends, Back-End Pools, Back-End Host Headers, and Back-End Health Probes 424 Routing and Routing Rules 426 URL Redirection and URL Rewriting in Front Door Standard and Premium 427 Design and Deploy Traffic Manager Profiles 429 How Traffic Manager Works 430 Traffic Manager Routing Methods 432 Priority-Based Traffic Routing 433 Weighted-Based Traffic Routing 433 Performance-Based Traffic Routing 435 Geographic-Based Traffic Routing 436 Multivalue-Based Traffic Routing 437 Subnet-Based Traffic Routing 437 Building a Traffic Manager Profile 438 Virtual Network NAT 442 Using a Virtual Network NAT 443 Allocate Public IP or Public IP Prefixes for a NAT Gateway 445 Associate a Virtual Network NAT with a Subnet 447 Summary 451 Exam Essentials 451 Review Questions 455 Chapter 8 Design, Deploy, and Manage Azure Firewall and Network Security Groups 459 Azure Firewall and Firewall Manager Features 460 How Azure Firewall Manager Works 467 How Azure Firewall and Firewall Manager Protect VNets 468 Build and Configure an Azure Firewall Deployment 476 Azure Firewall Policy 495 Build and Configure a Secure Hub within an Azure Virtual WAN Hub 501 Build and Configure a Secure Hub within an Azure Virtual WAN Hub Using Azure PowerShell 503 Integrate an Azure Virtual WAN Hub with a Third-Party Network Virtual Appliance 507 High-Level Use Case for Network Virtual Appliances 508 Create and Attach a Network Security Group to a Resource 509 Create an Application Security Group and Attach It to a NIC 519 Create and Configure NSG Rules and Read Network Security Group Flow Logs 524 Validate NSG Flow Rules 531 Verify IP Flow 534 Summary 536 Exam Essentials 536 Review Questions 539 Chapter 9 Design and Deploy Azure Web Application Firewall and Monitor Networks 543 Azure Web Application Firewall Functions and Features 544 WAF on Application Gateway 547 WAF on Front Door 549 WAF on Azure CDN from Microsoft 550 Set Up Detection or Prevention Mode 551 Azure Front Door WAF Policy Rule Sets 553 Managed Rule Sets 555 Custom Rule Sets 558 WAF Policies 560 Application Gateway WAF Policy Rule Sets 566 Per-Site WAF Policy 568 Per-URI Policy 568 Managed Rules 568 WAF Policies 572 Custom Rules 573 Deploy and Attach WAF Policies 580 Set Up Network Health Alerts and Logging Using Azure Monitor 582 Build and Configure Azure Network Watcher 591 Build and Configure a Connection Monitor Instance 595 Build, Configure, and Use Traffic Analytics 600 Build and Configure NSG Flow Logs 604 Enable and Set Up Diagnostic Logging 607 Enabling Diagnostic Logging 608 Summary 609 Exam Essentials 609 Review Questions 611 Chapter 10 Design and Deploy Private Access to Azure Services 615 Overview of Private Link Services and Private Endpoints 616 Key Benefits of Private Link 618 How Private Link Integrates into an Azure Virtual Network 619 How Azure Private Endpoint Works 619 Plan Private Endpoints 628 Configure Access to Private Endpoints 632 Azure Private Link RBAC Permissions 634 Integrate Private Link with DNS and Private Link Services with On-Premises Clients 634 Use Case 1: Workloads on Virtual Networks without a Custom DNS Server 635 Use Case 2: Workloads That Use a DNS Forwarder On-Premises 637 Use Case 3: Using a DNS Forwarder for Virtual Network Workloads and On-Premises Workloads 640 Set Up Service Endpoints and Configure Service Endpoint Policies 642 Overview of Service Tags and Access to Service Endpoints 646 Configure Access to Service Endpoints 651 Integrating App Services into Regional VNets 657 Azure Regional VNet Integration 658 How Azure Regional VNet Integration Works 659 Subnet Requirements 660 Access Management 661 Route Management 661 Application Route Management 662 Configure Azure Kubernetes Service (AKS) for Regional VNet Integration 665 Configure Clients to Access the App Service Environment 670 Summary 673 Exam Essentials 673 Review Questions 675 Appendix Answers to Review Questions 679 Chapter 1: Getting Started with AZ-700 Certification for Azure Networking 680 Chapter 2: Design, Deploy, and Manage a Site-to-Site VPN Connection and Point-to-Site VPN Connection 681 Chapter 3: Design, Deploy, and Manage Azure ExpressRoute 683 Chapter 4: Design and Deploy Core Networking Infrastructure: Private IP and DNS 685 Chapter 5: Design and Deploy Core Networking Infrastructure and Virtual WANs 686 Chapter 6: Design and Deploy VNet Routing and Azure Load Balancer 688 Chapter 7: Design and Deploy Azure application gateway, Azure front door, and Virtual NAT 690 Chapter 8: Design, Deploy, and Manage Azure Firewall and Network Security Groups 691 Chapter 9: Design and Deploy Azure Web Application Firewall and Monitor Networks 693 Chapter 10: Design and Deploy Private Access to Azure Services 694 Index 697