AZ-300 Azure Networking 2 — Questions and Answers
Question 1: Which Azure routing feature allows you to override default system routes and direct traffic through a network virtual appliance (NVA)?
- BGP
- User-Defined Routes (UDR) (Correct answer)
- Service Endpoints
- VNet Peering
Correct answer: User-Defined Routes (UDR)
User-Defined Routes let you create custom routes in a route table to force traffic through an NVA or override Azure default routing.
Question 2: What does Azure DDoS Protection Standard provide beyond the Basic tier?
- Only logging
- Adaptive tuning, attack analytics, rapid response support, and cost guarantees (Correct answer)
- Firewall rules only
- SSL offloading
Correct answer: Adaptive tuning, attack analytics, rapid response support, and cost guarantees
DDoS Protection Standard adds adaptive real-time tuning, detailed attack telemetry, a rapid response team, and cost protection beyond the free Basic tier.
Question 3: Which Azure service provides a managed, cloud-native firewall with threat intelligence filtering and application FQDN rules?
- NSG
- Azure Firewall (Correct answer)
- Application Gateway WAF
- Azure Bastion
Correct answer: Azure Firewall
Azure Firewall is a stateful, managed network security service with built-in high availability, threat intelligence, and FQDN filtering.
Question 4: What is the role of Azure Bastion in a network architecture?
- Encrypts VNet traffic
- Provides secure RDP/SSH to VMs without exposing public IPs (Correct answer)
- Routes traffic between regions
- Filters DNS queries
Correct answer: Provides secure RDP/SSH to VMs without exposing public IPs
Azure Bastion is a fully managed PaaS service that provides secure RDP and SSH access to VMs directly through the Azure portal, without requiring public IP addresses.
Question 5: Which BGP attribute does Azure use when advertising routes to an on-premises network over ExpressRoute to influence path selection?
- Local Preference
- MED (Multi-Exit Discriminator)
- AS Path Prepending
- Community Tags (Correct answer)
Correct answer: Community Tags
Azure uses BGP community tags to let customers control route preferences and apply policies for ExpressRoute path selection.
Question 6: What is the minimum subnet size required for an Azure Application Gateway v2 deployment?
- /24
- /26 (Correct answer)
- /28
- /29
Correct answer: /26
Azure Application Gateway v2 requires a dedicated subnet with at least a /26 CIDR block to accommodate scaling and management addresses.
AZ-300 Azure Networking 2
Which Azure routing feature allows you to override default system routes and direct traffic through a network virtual appliance (NVA)?