AZ-305 Azure Networking Architecture Design 2 — Questions and Answers
Question 1: Your web application is hosted in Azure and needs to be protected against OWASP top-10 web vulnerabilities at the network edge. Which service should you enable?
- Azure DDoS Protection Standard
- Azure Firewall Premium with IDPS
- Azure Web Application Firewall (WAF) (Correct answer)
- Network Security Groups
Correct answer: Azure Web Application Firewall (WAF)
Azure WAF, deployable on Application Gateway or Front Door, inspects HTTP/S traffic against OWASP rule sets to block common web attacks.
Question 2: You are designing a solution where Azure VMs need outbound internet access but must not have public IP addresses. Which managed service provides this?
- Azure Bastion
- Azure NAT Gateway (Correct answer)
- Azure Load Balancer outbound rules
- Azure VPN Gateway
Correct answer: Azure NAT Gateway
Azure NAT Gateway provides outbound internet connectivity for VMs in a subnet without requiring public IPs on each VM.
Question 3: A company needs secure remote access to Azure VMs without exposing RDP/SSH ports to the internet. Which Azure service should you design for this?
- Just-In-Time VM access in Defender for Cloud
- Azure Bastion (Correct answer)
- Point-to-Site VPN
- Azure Firewall DNAT rules
Correct answer: Azure Bastion
Azure Bastion provides browser-based RDP/SSH connectivity to VMs over TLS 443 without requiring public IPs or open inbound ports on NSGs.
Question 4: Which Azure Load Balancer SKU is required to support cross-zone load balancing, global load balancing, and availability zones?
- Basic SKU
- Standard SKU (Correct answer)
- Gateway SKU
- Premium SKU
Correct answer: Standard SKU
Azure Load Balancer Standard SKU supports availability zones, cross-zone load balancing, and HTTPS health probes that the Basic SKU does not.
Question 5: You need to design DNS resolution so that VMs in multiple VNets can resolve the private DNS names of resources in any of those VNets. Which service should you use?
- Deploy a custom DNS server in each VNet
- Azure Public DNS zones
- Azure Private DNS zones with VNet links (Correct answer)
- Azure Traffic Manager DNS profiles
Correct answer: Azure Private DNS zones with VNet links
Azure Private DNS zones linked to multiple VNets allow resources in all linked VNets to resolve each other's DNS names without custom DNS servers.
Question 6: An application requires an ExpressRoute connection with 99.99% availability SLA. What design achieves this?
- Single ExpressRoute circuit with Local SKU
- Two ExpressRoute circuits from different peering locations with ExpressRoute Global Reach
- ExpressRoute circuit with a backup Site-to-Site VPN (Correct answer)
- Single ExpressRoute circuit with Zone-Redundant VNet Gateway
Correct answer: ExpressRoute circuit with a backup Site-to-Site VPN
Dual ExpressRoute circuits from geographically diverse peering locations with a zone-redundant gateway delivers the 99.99% SLA Microsoft guarantees for that design.
AZ-305 Azure Networking Architecture Design 2
Your web application is hosted in Azure and needs to be protected against OWASP top-10 web vulnerabilities at the network edge.
Which service should you enable?