AZ-104 Domain 4: Implement and manage virtual networking (15-20%) - Complete Study Guide 2026

What Domain 4 Actually Covers

Domain 4-Implement and manage virtual networking (15-20%)-is the section of the AZ-104 skills outline that turns abstract cloud knowledge into real operational competence. It tests whether a candidate can design, deploy, secure, and troubleshoot the network layer that everything else in Azure depends on. Compute instances, storage endpoints, and identity flows all ride on top of networking constructs, which is precisely why Microsoft weights this domain alongside storage in the 15-20% band.

Unlike Domain 1's identity and governance focus, which leans heavily on policy and role configuration, Domain 4 demands both conceptual clarity and hands-on fluency. A candidate who understands why a subnet is segmented but cannot configure a route table in the portal or via CLI will struggle with the interactive item types this domain generates.

The current skills measured as of April 17, 2026 group Domain 4 content into several major capability buckets: virtual network configuration, network security, load balancing and routing, hybrid connectivity, and monitoring. Each bucket maps to real-world Azure administrator tasks, and the exam tests them through scenario-driven questions rather than trivia recall.

Weight, Format, and What to Expect on Exam Day

The AZ-104 is administered through Pearson VUE, costs $165 USD in the United States (regional pricing varies), and allocates 100 minutes for the scored assessment itself. The full appointment block includes check-in, tutorial, and survey time on top of that. Candidates commonly encounter 40-60 questions, and the item types for Domain 4 specifically tend toward hot-area diagrams of network topologies, drag-and-drop rule ordering, build-list configurations, and case studies that ask you to recommend a connectivity solution across multiple constraints.

Performance-based lab tasks may also appear on your delivery. If they do, you could be asked to create a virtual network with specific address spaces, configure peering between two VNets in different regions, or apply an NSG rule to a subnet and verify connectivity-all inside a live Azure environment with no additional time added. This makes hands-on portal and CLI practice non-negotiable for Domain 4.

Because the passing score is 700 on Microsoft's scaled model-not a straight percentage-there is no reliable way to calculate exactly how many Domain 4 questions you can miss. What matters is performing strongly across all five domains. If you want a broader picture of overall difficulty and score distribution, the complete AZ-104 difficulty guide covers how candidates experience the exam across domains.

Virtual Networks and Subnetting Deep Dive

An Azure Virtual Network (VNet) is the foundational isolation boundary for resources in Azure. Understanding how address spaces work-CIDR notation, allowable ranges, reserved IP addresses per subnet-is table-stakes knowledge. The exam tests whether you know that Azure reserves five IP addresses in every subnet (network address, gateway, DNS x2, broadcast) and expects you to correctly size subnets given a requirements scenario.

VNet Peering and Global Peering

VNet peering connects two VNets so that resources communicate using Microsoft's backbone network without traffic traversing the public internet. Regional peering connects VNets in the same Azure region; global peering connects VNets across regions. The exam frequently presents topology diagrams and asks which resources can communicate and why-often introducing a hub-spoke architecture where the hub VNet contains shared services and spokes cannot communicate with each other directly without additional route configuration.

Key peering facts that generate exam questions: peering is non-transitive by default, each side of a peering link must be configured independently, and the Allow forwarded traffic and Use remote gateways settings control more advanced behaviors that appear in scenario questions.

Route Tables and User-Defined Routes

System routes exist automatically in every VNet. User-defined routes (UDRs) override system routes and are attached at the subnet level. The exam tests scenarios where traffic must be forced through a network virtual appliance (NVA) or Azure Firewall, requiring you to create a route table with a next-hop type of Virtual appliance and the NVA's private IP address.

Name Resolution and DNS in Azure

Azure provides built-in DNS resolution for resources within a VNet, but production environments almost always require custom DNS configuration. Domain 4 tests three distinct DNS scenarios: Azure-provided DNS, custom DNS servers, and Azure Private DNS zones.

An Azure Private DNS zone is a managed DNS service that allows you to use custom domain names within your VNet without managing DNS infrastructure. You link a private zone to a VNet with or without auto-registration enabled. When auto-registration is on, VMs in that VNet automatically get A records in the zone when they are created. The exam distinguishes between private DNS zones (internal resolution) and public DNS zones (internet-facing records managed in Azure DNS).

Private Endpoints introduce a critical DNS dependency: when you deploy a Private Endpoint for a storage account or key vault, you must configure a private DNS zone for the appropriate service (e.g., privatelink.blob.core.windows.net) to ensure that FQDN resolution returns the private IP rather than the public IP. This integration between Private Endpoints and Private DNS zones is a high-frequency exam topic tested in case-study format.

Network Security Groups and Application Security Groups

NSGs are the primary traffic filtering mechanism in Azure networking. An NSG contains inbound and outbound security rules evaluated in priority order, with lower numbers processed first. Default rules exist at priority 65000-65500 and cannot be deleted, only overridden with higher-priority custom rules.

NSG Association and Effective Security Rules

NSGs can be associated with subnets and with individual network interfaces (NICs). When both are present, inbound traffic is processed by the subnet NSG first, then the NIC NSG. Outbound traffic reverses this: NIC NSG is evaluated first, then subnet NSG. The exam tests scenarios where a VM is not reachable and asks you to identify the blocking rule-requiring you to trace inbound flow through both NSG layers correctly.

The Effective security rules blade in the Azure portal is the operational tool for this troubleshooting scenario, and knowing how to navigate to it and interpret its output is a practical skill the exam may test in a lab task.

Application Security Groups

ASGs allow you to group VMs logically and reference those groups in NSG rules, removing the need to maintain lists of IP addresses. An NSG rule can specify an ASG as the source or destination, making it possible to write rules like "allow WebServers to talk to DatabaseServers on port 1433." The exam tests ASG configuration in scenarios involving tiered application architectures.

Load Balancing and Traffic Routing

Azure offers several load-balancing services, and knowing which to choose for a given scenario is a core Domain 4 skill. The exam frequently presents a requirement and asks you to select the correct service-making the distinctions between them critical to learn.

A common exam question pattern presents a multi-region application requirement and asks you to select Traffic Manager versus Front Door. Traffic Manager works at the DNS level and supports non-HTTP protocols; Front Door is HTTP/S-specific and provides additional features like caching and WAF at the edge. Knowing this distinction resolves a category of questions that trap candidates who try to generalize "global load balancing" without differentiating the services.

Hybrid and Cross-Network Connectivity

Connecting on-premises networks to Azure is a significant portion of Domain 4. The exam tests three primary mechanisms: VPN Gateway, ExpressRoute, and Azure Virtual WAN.

A VPN Gateway creates an encrypted IPsec/IKE tunnel over the public internet. Gateway SKUs determine throughput and the number of supported site-to-site connections. Point-to-site VPN enables individual clients to connect to an Azure VNet. The exam tests gateway SKU selection, active-active configurations for redundancy, and the difference between policy-based and route-based VPN types.

ExpressRoute provides a private, dedicated connection to Azure through a connectivity provider-no public internet traffic. ExpressRoute circuits are purchased in bandwidth tiers and can be configured with private peering (access to Azure VNets), Microsoft peering (access to Microsoft 365 and Azure public services), or both. The exam distinguishes between ExpressRoute and VPN Gateway in scenarios where compliance, latency, or bandwidth requirements make one preferable.

For candidates preparing for the full five-domain picture, the complete guide to all five AZ-104 exam domains provides context on how Domain 4 networking knowledge integrates with compute (Domain 3) and storage (Domain 2) topics.

Network Monitoring and Diagnostics

Azure Network Watcher is the primary toolset for diagnosing and monitoring network issues. Domain 4 expects candidates to know which Network Watcher feature to use for a given diagnostic scenario.

NSG flow logs feed into Traffic Analytics when integrated with a Log Analytics workspace, enabling pattern analysis and threat detection. The exam may test the configuration steps for enabling flow logs-specifically, that a storage account must exist in the same region as the NSG-as well as the distinction between flow logs (raw data) and Traffic Analytics (aggregated insights).

Building a Domain 4 Study Block

Given Domain 4's 15-20% weight relative to the higher-weighted domains (Domains 1 and 3 each at 20-25%), allocating proportional study time is practical. If your overall preparation spans four weeks, Domain 4 warrants approximately four to five days of focused work-but those days must include hands-on lab time, not just video or reading.

One area where methodology genuinely matters for Domain 4: spaced repetition works best when applied to the conceptual distinctions-Traffic Manager vs. Front Door, NSG inbound vs. outbound flow, peering transitivity rules-rather than to procedural steps. Use your practice question results to identify which distinctions are slipping, then revisit those specific items at increasing intervals.

When you want to see how Domain 4 fits alongside all other exam areas before building your full schedule, reading through the AZ-104 Study Guide 2026 provides a sequenced approach to the complete certification. For understanding how Domain 4 compares in difficulty to Domain 3's compute topics, the Domain 3 complete study guide is a useful companion read.

Targeted domain-level practice is one of the most reliable ways to identify gaps before exam day. Running practice tests filtered to networking questions at az104exam.com lets you see which sub-topics within Domain 4 need additional review without re-covering ground you already understand well.

Frequently Asked Questions