Azure Virtual Network, subnets and peering for AZ-900

Your private network in Microsoft Azure, sliced into subnets, joined by peering, and reaching PaaS over private endpoints — the structure the exam tests, pinned down. AZ-900, 2026 edition.

Here are 7 typical Virtual Network questions in the exam's own style — free, each answer explained, no sign-up.

Straight to the 7 free questions ↓

Azure networking looks intimidating on the AZ-900 until you see it is really one structure with a few named parts. The diagram above lays them all out: a Virtual Network with subnets inside it, peering to a second VNet, and a private endpoint reaching a PaaS service. Learn how those pieces fit and this whole corner of the exam turns into free points.

The Virtual Network is your private network in Azure

An Azure Virtual Network (VNet) is the private network you define in the cloud. You give it an address space (say 10.0.0.0/16), drop resources like virtual machines inside it, and they get private IP addresses and talk to each other over that network — not the public internet. Do not confuse it with a resource group (a management container) or a subscription (a billing and access boundary). A VNet is about connectivity; those others are about organization.

One scope rule the exam loves: a VNet lives in exactly one region and one subscription. It does not span the globe on its own.

Subnets segment the VNet

Inside a VNet you carve the address space into subnets — smaller ranges like 10.0.1.0/24 for web servers and 10.0.2.0/24 for databases. Subnets let you group and isolate resources by role. Crucially, subnets in the same VNet are routed together by default: two VMs in different subnets of one VNet reach each other by private IP with no extra configuration. Segmentation organizes; it does not sever communication.

Peering connects two VNets

When you have two separate VNets — perhaps in different regions or subscriptions — and want their resources to talk privately, you use VNet peering. Peering joins the networks over Microsoft’s backbone, with no VPN and no gateway required. It is the standard AZ-900 answer to “connect two VNets privately.” A VPN Gateway is different — that is for reaching an on-premises network across the public internet through an encrypted tunnel.

Reaching PaaS privately: private and service endpoints

Sometimes a resource in your VNet needs to reach an Azure PaaS service (like Azure Storage) without the traffic crossing the public internet. Two features handle this:

A private endpoint gives the PaaS service a private IP inside your subnet — you pull the service onto your VNet.
A service endpoint extends your VNet’s identity to the service over the Microsoft backbone, securing the route to the service’s own endpoint.

Both keep traffic off the general internet; the difference is that a private endpoint hands the service a private IP in your network, while a service endpoint secures the path to the service’s public endpoint. Note that filtering what traffic is allowed is a separate job — that belongs to a network security group, not to the VNet structure itself.

The real exam mixes multiple-choice, true/false, and drag-and-drop formats; the seven questions below are standard multiple-choice, and every explanation carries a “why not the others” so the wrong options teach you as much as the right one.

A structural diagram of Microsoft Azure networking. On the left, a large box labelled VNet A, tagged as scoped to one region with an address space of 10.0.0.0/16, contains two smaller subnet boxes: Subnet web on 10.0.1.0/24 holding a virtual machine, and Subnet app on 10.0.2.0/24 holding a second virtual machine; a dotted line between the two subnets is labelled private IP, no gateway, showing that resources inside one VNet talk privately by default. A double-headed arrow labelled VNet peering connects VNet A to a second box on the right, VNet B, also one region, on address space 10.1.0.0/16 — private connection over the Microsoft backbone, no VPN. Below Subnet app, a small node labelled Private Endpoint links by a private line to an external rounded box marked PaaS service, for example Azure Storage, captioned reached over the private network, not the public internet. A footnote reads: a VNet lives in a single region and one subscription; peering joins VNets, a private endpoint pulls a PaaS service onto your VNet.

7 free AZ-900 practice questions

Answers and explanations — no email wall

AZ-900 Question 1 of 7

A team is moving to Microsoft Azure and wants an isolated private network space of their own — one where their virtual machines get private IP addresses and can talk to each other without going over the public internet. Which Azure resource gives them that private network boundary?

Answer: A — An Azure Virtual Network (VNet).

An Azure Virtual Network (VNet) is the private network you define in Azure — you give it an address space, place resources inside it, and they communicate privately over that network. Why not the others: a resource group is only a management container for organizing and deleting resources together, not a network. A subscription is a billing and access boundary, not a network boundary. An availability zone is a physically separate datacenter location inside a region for high availability — it does not, by itself, provide a private network. Pro tip: 'private network space in Azure' = Virtual Network; a resource group organizes, a VNet connects.

AZ-900 Question 2 of 7

Inside a single Azure Virtual Network, an administrator wants to split the address space into smaller sections — for example, one section for web servers and another for database servers — so each group sits in its own range. What are these smaller divisions of a VNet called?

Answer: A — Subnets.

A VNet's address space is divided into subnets — each subnet takes a slice of the VNet's IP range and lets you group and isolate resources (web tier, app tier, database tier). Why not the others: resource groups organize resources for management and billing, not IP ranges. Management groups sit above subscriptions to apply governance at scale — nothing to do with networking. A region is a geography where Azure resources live, not a division inside a VNet. Pro tip: VNet = the whole address space; subnets = the slices you carve it into.

AZ-900 Question 3 of 7

Two virtual machines are deployed in the same Azure Virtual Network but in different subnets. With no extra configuration, how do they reach each other?

Answer: A — Privately, by their private IP addresses — subnets in the same VNet are routed together by default.

Subnets within the same VNet are automatically connected — Azure routes traffic between them, so two VMs in different subnets of one VNet reach each other by private IP with no extra setup. Why not the others: they do not need public IPs or the public internet to talk within a VNet. VNet peering joins two separate VNets, not two subnets of the same VNet, so it is not required here. A VPN Gateway connects a VNet to an on-premises network or across regions — it is not needed for same-VNet traffic. Pro tip: same VNet, any subnet = private-IP reachable by default.

AZ-900 Question 4 of 7

A company has two separate Azure Virtual Networks and wants resources in each to communicate privately with each other, over Microsoft's backbone rather than the public internet, without standing up a VPN. Which feature connects the two VNets?

Answer: A — VNet peering.

VNet peering links two virtual networks so their resources communicate as if on one network, privately over the Microsoft backbone and with no gateway or VPN required. Why not the others: adding subnets divides a VNet internally — it does nothing to join two separate VNets. Public IPs would route traffic over the public internet, the opposite of the private requirement. Azure Policy governs which configurations are allowed; it is a governance tool, not a network connection. Pro tip: connect two VNets privately, no VPN = VNet peering.

AZ-900 Question 5 of 7

An application running on a VM inside your VNet needs to reach an Azure PaaS service, such as Azure Storage, but security requires that the traffic stay on the private network and never traverse the public internet. Which feature gives the PaaS service a private IP inside your VNet?

Answer: A — A private endpoint.

A private endpoint projects a supported PaaS service (like Azure Storage) into your VNet by giving it a private IP from your subnet, so your resources reach it over the private network instead of a public endpoint. Why not the others: a public IP does the reverse — it exposes traffic to the public internet. An availability zone is a datacenter location for resilience, unrelated to private connectivity. A resource group is a management container, not a network path. Pro tip: 'pull a PaaS service onto my VNet with a private IP' = private endpoint.

AZ-900 Question 6 of 7

During planning, an architect asks how far a single Azure Virtual Network reaches. Which statement about a VNet's scope is correct for the AZ-900?

Answer: A — A VNet exists in a single Azure region and a single subscription; to link VNets across regions you use peering.

A virtual network is scoped to one region and one subscription. It cannot stretch across regions on its own — you connect VNets in different regions (or subscriptions) using VNet peering. Why not the others: a VNet does not span every region, is not global, and does not cover all subscriptions automatically; those descriptions confuse a VNet with account-wide or global constructs. Pro tip: one VNet = one region, one subscription; cross-region reach comes from peering.

AZ-900 Question 7 of 7

A team wants their VNet's subnet to reach an Azure PaaS service over Azure's backbone using the service's public endpoint, but with traffic kept off the general internet by extending the VNet's identity to that service. Which VNet feature describes this approach?

Answer: A — A service endpoint.

A service endpoint extends your VNet's identity to a supported Azure service over the Microsoft backbone, so the subnet reaches the service's endpoint securely without traffic going over the public internet. (A private endpoint, by contrast, gives the service its own private IP inside your VNet — a related but distinct option.) Why not the others: a VPN Gateway connects a VNet to on-premises or across regions, not to a PaaS service. An NSG rule filters allow/deny traffic — it is about filtering, not reaching a service privately. An availability set spreads VMs across hardware for resilience, unrelated to networking to PaaS. Pro tip: service endpoint = secure the VNet's route to a service's endpoint; private endpoint = give the service a private IP in your VNet.

That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.

Continue with the 10 free questions →

Those 7 questions were the start.

The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 300 more questions built exactly like them.

Collecting questions yourself

Scattered across forums, of unknown age
Answer keys without reasoning
No idea which domain you are weak in

Practising with a system

300 questions in 6 full tests, AZ-900 (2026)
Every option explained — including the wrong ones
Readiness per exam domain, and drills for your weakest

Start free — 10 questions

Straight into the player. No account, no email.

Frequently asked questions

What is a subnet used for in an Azure Virtual Network?

A subnet is a slice of a VNet's address space. You use subnets to segment a virtual network — grouping resources by tier or role (for example a web subnet and a database subnet), organizing IP ranges, and giving each segment its own boundary. Resources in different subnets of the same VNet still talk to each other privately by default; the subnet is about structure and segmentation, not about cutting off communication.

What is the difference between VNet peering and a VPN?

VNet peering connects two Azure Virtual Networks so their resources communicate privately over the Microsoft backbone, with no gateway and no encryption overhead — it is Azure-to-Azure. A VPN (via a VPN Gateway) creates an encrypted tunnel over the public internet, typically to connect Azure to an on-premises network. In short: peering joins VNets inside Azure's own network; a VPN bridges Azure and outside networks across the internet.

Are these real exam questions?

No. They are our own questions, written in the style and difficulty of the AZ-900 — never copied from any question bank or the real exam. Reproducing live exam items violates Microsoft's certification agreement and can cost a candidate their certification, and a crammed answer teaches you nothing about the one you have not seen.

Updated for AZ-900 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.