An Azure virtual network enables Azure resources, such as VMs, web apps, and databases, to communicate with each other, with users on the internet, and with on-premises client computers. It can be thought of as an extension of an on-premises network with resources that link other Azure resources.

Subnets enable you to segment the virtual network into one or more sub-networks and allocate a portion of the virtual network's address space to each subnet. Just like in a traditional network, subnets allow you to segment your VNet address space into segments that are appropriate for the organization's internal network.

A VM in Azure can connect to the internet by default. You can enable incoming connections from the internet by assigning a public IP address to the VM or by putting the VM behind a public load balancer.

Azure virtual networks enable you to link resources together in your on-premises environment and within your Azure subscription. There are three mechanisms for you to achieve this connectivity: point-to-site VPNs, site-to-site VPNs, and Azure ExpressRoute.

Azure virtual networks enable you to filter traffic between subnets by using network security groups and network virtual appliances. Network security groups allow you to create and manage rules that define inbound and outbound traffic for Azure resources, and network virtual appliances enable you to filter traffic between subnets by using Azure Firewall or a third-party firewall.

Virtual network peering enables you to seamlessly connect two or more Virtual Networks in Azure, making them appear as one for connectivity purposes.

The two types of peering supported by Azure are Virtual network peering and Global virtual network peering.

The traffic between virtual machines in peered virtual networks uses the Microsoft backbone infrastructure and it is private. It is kept on the Microsoft backbone network and no public Internet, gateways, or encryption is required in the communication between the virtual networks.

Virtual network peering connects virtual networks within the same Azure region, while Global virtual network peering connects virtual networks across Azure regions.

Yes, for peered virtual networks, resources in either virtual network can directly connect with resources in the peered virtual network.

Azure DNS is a hosting service for DNS domains that provides name resolution by using Microsoft Azure infrastructure.

No, Azure DNS does not currently support DNSSEC. However, you can reduce the need for DNSSEC by consistently using HTTPS/TLS in your applications and use third-party DNS hosting providers if DNSSEC is a critical requirement for your DNS zones.

Billing for Azure DNS is based on the number of DNS zones hosted in Azure and on the number of DNS queries received.

You can manage your DNS records in Azure DNS using the Azure portal, Azure PowerShell cmdlets, and the cross-platform Azure CLI. You can also integrate with the service by using the REST API and SDKs.

Private DNS domains are custom domain names that can be used in private virtual networks rather than the Azure-provided names available today.

Alias records are used to refer to an Azure resource, such as an Azure public IP address, an Azure Traffic Manager profile, or an Azure Content Delivery Network (CDN) endpoint. If the IP address of the underlying resource changes, the alias record set seamlessly updates itself during DNS resolution.

Yes, you can point your apex or naked domain to a Traffic Manager profile or CDN endpoint using an alias record, for example contoso.com.

Azure DNS Private Resolver is a new service that enables you to query Azure DNS private zones from an on-premises environment and vice versa without deploying VM based DNS servers.

Yes, Azure DNS Private Resolver is fully managed service, it provides built-in high availability and zone redundancy.

A VPN (Virtual Private Network) uses an encrypted tunnel within another network to connect two or more trusted private networks to one another over an untrusted network, typically the public internet. The purpose of a VPN is to prevent eavesdropping or other attacks by encrypting traffic while traveling over the untrusted network.

VPNs can enable branch offices to share sensitive information by connecting the private networks of different locations. For example, a VPN can connect an office on the East coast of North America to a company's private data stored on servers in Azure, allowing the company to securely access that data.

A VPN gateway is a type of virtual network gateway that is deployed in a dedicated subnet of a virtual network. It enables connectivity by connecting on-premises datacenters to virtual networks through site-to-site connections, individual devices to virtual networks through point-to-site connections, and virtual networks to other virtual networks through network-to-network connections.

The different types of VPN gateways in Azure include policy-based and route-based.

The capabilities of a VPN gateway, such as its performance and capacity, are determined by the SKU or size that you deploy. The larger the SKU, the more capabilities the VPN gateway will have.

ExpressRoute is a service that allows you to extend your on-premises networks into the Microsoft cloud over a private connection with the help of a connectivity provider.

Microsoft Office 365, Microsoft Dynamics 365, Azure compute services (such as Azure Virtual Machines), and Azure cloud services (such as Azure Cosmos DB and Azure Storage)

Because Microsoft 365 is designed to be accessed securely and reliably via the internet, and ExpressRoute provides more reliability, faster speeds, consistent latencies, and higher security than typical connections over the internet.

CloudExchange colocation, point-to-point Ethernet connection, any-to-any connection, and directly from ExpressRoute sites.

ExpressRoute is a private connection from your on-premises infrastructure to your Azure infrastructure and data doesn't travel over the public internet, so it's not exposed to the potential risks associated with internet communications.

Azure Private Link enables you to access Azure PaaS Services (such as Azure Storage and SQL Database) and Azure hosted customer-owned/partner services over a private endpoint in your virtual network.

A private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service that's powered by Azure Private Link.

The service you connect to via a private endpoint could be an Azure service such as Azure Storage, Azure Cosmos DB, Azure SQL Database, or it can be your own service, using the Private Link service.

Traffic between your virtual network and the Azure service you are connecting to travels the Microsoft backbone network.

No, exposing your service to the public internet is no longer necessary when using Azure Private Link.

Yes, you can create your own private link service in your virtual network and deliver it to your customers using Azure Private Link.