2.3 - Networking and storage services (VNet, Blob, redundancy)
AZ-900 objective 2.3 covers Azure networking and storage services. A virtual network gives a private, isolated space where resources communicate securely, network security groups allow same-VNet inbound and internet outbound traffic by default, and global VNet peering privately connects two VNets in different regions over the Microsoft backbone. Azure Blob Storage holds millions of unstructured objects and serves them over HTTP, static website hosting or App Service can publish a site without managing a VM OS, and lifecycle management policies move blobs from hot to cool then to archive on a schedule. The archive tier is offline and must be rehydrated at standard or high priority before reading. For durability, geo-zone-redundant storage (GZRS) survives both the loss of an availability zone and a full regional disaster, which is what disaster recovery in another region protects against. Azure Event Hubs ingests millions of streaming events per second. Expect scenarios that describe a storage, redundancy or connectivity need and ask which service or setting fits.
Survives both a zone loss and a full regional disaster = geo-zone-redundant storage (GZRS). Connect two VNets in different regions privately = global VNet peering. Millions of unstructured objects over HTTP = Blob Storage; archive tier is offline until rehydrated.
Practice questions
1. Compliance archives must be kept in Blob Storage for ten years, are almost never read, and retrieval can wait several hours. Which access tier costs the least to store them?
- The Hot tier optimized for frequent access to the data
- The Cool tier for data accessed roughly once a month
- The Archive tier (correct answer)
- The Premium tier backed by high-performance SSD storage
The Archive tier has the lowest storage price and accepts retrieval latency of hours, matching rarely read long-term compliance data. Hot and Cool cost more to store (they trade storage price for faster access), and Premium is the most expensive, aimed at latency-sensitive workloads.
2. Which TWO storage redundancy options keep a copy of your data in a secondary region, protecting it if the primary region suffers a complete outage? (Choose TWO.)
- Locally redundant storage (LRS)
- Zone-redundant storage (ZRS)
- Geo-redundant storage (GRS) (correct answer)
- Geo-zone-redundant storage (GZRS) (correct answer)
- Premium locally redundant SSD storage
GRS copies data synchronously in the primary region then asynchronously to a paired secondary region, and GZRS does the same while also spreading the primary copies across availability zones. LRS and ZRS keep every copy inside the primary region, so a full regional outage could make the data unavailable.
3. A gaming company needs a fully managed NoSQL database that replicates data across several regions worldwide and answers reads in single-digit milliseconds. Which service fits?
- Azure SQL Database deployed with a single primary region
- Azure Cosmos DB (correct answer)
- Azure Database for MySQL flexible server with read replicas
- Azure Cache for Redis used as the only permanent data store
Cosmos DB is Azure's globally distributed, multi-model NoSQL database with turnkey replication to any region and single-digit millisecond reads backed by SLAs. Azure SQL and MySQL are relational services without that global NoSQL profile, and Redis is a cache, not a durable primary database.
4. What is the primary purpose of an Azure virtual network (VNet)?
- To automatically distribute incoming web requests between several identical application servers
- To provide a private, isolated network in Azure where resources can communicate securely (correct answer)
- To translate friendly domain names into IP addresses for internet clients
- To stream desktop sessions from Azure to remote user devices
A VNet is the fundamental private network building block in Azure: an isolated address space where VMs and other resources communicate with each other, the internet, and on-premises networks under your control. Distributing requests is load balancing, name translation is DNS, and desktop streaming is Azure Virtual Desktop.
5. Within a virtual network, what is the role of subnets?
- They encrypt all traffic that leaves the virtual network toward the public internet
- They replace network security groups as the only way of filtering traffic between virtual machines
- They divide the VNet address space into segments to organize and isolate groups of resources (correct answer)
- They connect the virtual network to the on-premises datacenter through a dedicated private circuit
Subnets carve the VNet address range into smaller segments so you can group resources (web tier, database tier) and apply different rules to each. They do not encrypt internet traffic, they complement rather than replace NSGs, and connecting to on-premises through a private circuit is ExpressRoute's role.
6. Which TWO statements about Azure VNet peering are correct? (Choose TWO.)
- It lets resources in two virtual networks communicate as if they were on the same network (correct answer)
- It requires a VPN device to be deployed and maintained in each of the two peered virtual networks
- It routes the traffic between the peered networks through the public internet with encryption
- Traffic between peered VNets travels over the Microsoft private backbone (correct answer)
- It can only be configured between networks that belong to the same subscription and resource group
Peering joins two VNets so their resources communicate directly, and that traffic stays on Microsoft's private backbone - it never crosses the public internet. No VPN device is involved (that is VPN Gateway), and peering works across subscriptions and resource groups, not just within one.