Virtual Networks and Subnets
😟 THE PROBLEM
Cloud servers need to talk privately, and the database must not be reachable from everywhere.
😊 THE SOLUTION
Put resources in a virtual network and separate them with subnets.
- Servers exposed to the whole internet✓ Private addresses inside a VNet
- Web and database mixed together✓ Separate subnets per tier
- Cloud cannot reach the office✓ Connect with VPN or ExpressRoute
Quick answer
An Azure virtual network (VNet) is your own private network in Azure. It lets Azure resources, such as VMs, talk securely to each other, to the internet and to your on-premises network. A VNet has an address space (for example 10.0.0.0/16) that you divide into subnets to group and isolate resources, such as a web subnet and a database subnet.
Exam objective: 2.2.5 Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute. (Skills measured as of July 20, 2026)
Start with a question
How do your cloud servers talk to each other without everyone on the internet listening in?
They join a virtual network: a private network inside Azure that only your resources can use.
Explain it like I’m 10
The technical explanation
A VNet is defined by a private address space and divided into subnets. Resources in the same VNet can communicate by default; you control everything else.
| Capability | How |
|---|---|
| Isolation and segmentation | Separate VNets and subnets |
| Internet communication | Public IPs, load balancers, NAT |
| Communicate between Azure resources | Same VNet, or peering, or service endpoints |
| Communicate with on-premises | VPN Gateway or ExpressRoute |
| Route traffic | System routes, route tables (UDRs) |
| Filter traffic | Network security groups, Azure Firewall |
Real-world business scenario
An online shop
- The problem
- Web servers and the database were on one flat network, so a compromised web server could reach the database directly.
- What they used
- Created a VNet with a web subnet and a data subnet, and NSG rules allowing only the web subnet to reach the database port.
- Why that choice
- Segmentation limits how far an attacker can move.
- The result
- The database is reachable only from the web tier, closing a major risk.
When to use it and when not to
✓ Use it when…
- Every IaaS deployment, plus PaaS services that need private connectivity.
- Separate tiers with subnets and NSGs.
✕ Think twice when…
- Overlapping address spaces with networks you will need to connect.
Interview preparation
Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.
Beginner What is an Azure virtual network?
Model answer
It is my private network in Azure. My VMs and other resources inside it can talk to each other privately, and I control whether they can reach the internet or my office network.
Interviewer follows up
Why use subnets?
You
To divide the network into sections, like keeping web servers and databases apart, and apply different security rules to each section.
Intermediate What capabilities does an Azure virtual network provide?
Model answer
Isolation and segmentation, communication with the internet, communication between Azure resources, communication with on-premises resources through VPN or ExpressRoute, routing of network traffic, filtering with network security groups, and connecting virtual networks with peering.
Experienced developer What would you watch out for when planning VNet address spaces?
Model answer
Avoid overlapping ranges with on-premises networks and other VNets you may peer with, because overlapping address spaces cannot be connected. Leave room to grow, remember Azure reserves five IP addresses in every subnet, and plan dedicated subnets for services that need them, such as VPN gateways (GatewaySubnet) or Azure Bastion.
Test yourself with exercises
3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.
Quick revision
Key points
- A VNet is a private, isolated network in Azure, scoped to one region.
- Address space is defined in CIDR, such as 10.0.0.0/16.
- Subnets segment the VNet to group and secure resources.
- VNets connect to the internet, other VNets (peering) and on-premises (VPN, ExpressRoute).
Important terminology
- Virtual network (VNet)
- A logically isolated private network in Azure, scoped to one region.
- Address space
- The private IP range of a VNet, written in CIDR notation such as 10.0.0.0/16.
- Subnet
- A segment of a VNet's address space used to group and isolate resources.
- CIDR
- Classless Inter-Domain Routing notation for IP ranges, such as /16 or /24.
Common mistakes
- Thinking one VNet automatically spans multiple regions.
- Using overlapping address ranges you later need to connect.
Exam tips
- "Isolate and segment Azure resources" = virtual network and subnets.
Five quick revision questions
-
1.What is a VNet?Show
A private, isolated network for Azure resources.
-
2.What is a subnet?Show
A segment of a VNet's address space.
-
3.Is a VNet regional or global?Show
Regional.
-
4.How do you filter traffic between subnets?Show
With network security groups.
-
5.How many IP addresses does Azure reserve in each subnet?Show
Five.
Official references
Finished this lesson? Tick it off. Your progress is saved in this browser.
Next up: Virtual Network Peering