AZ-305 Azure Networking Architecture Design 1 ā Questions and Answers
Question 1: You need to design connectivity between 10 Azure virtual networks so that any VNet can communicate with any other VNet with minimal management overhead. Which design is recommended?
- Peer every VNet to every other VNet in a full mesh
- Use a hub-and-spoke topology with Azure Virtual WAN (Correct answer)
- Deploy VPN gateways in each VNet
- Use Azure ExpressRoute for all VNet connections
Correct answer: Use a hub-and-spoke topology with Azure Virtual WAN
Azure Virtual WAN provides a hub-and-spoke managed network that supports any-to-any connectivity without requiring full-mesh VNet peering.
Question 2: A workload requires that all outbound internet traffic from Azure VMs be inspected by a firewall before leaving Azure. Which service should you deploy in the hub VNet?
- Azure Application Gateway
- Azure Front Door
- Azure Firewall (Correct answer)
- Network Security Groups
Correct answer: Azure Firewall
Azure Firewall is a managed, stateful network security service that can inspect and filter all outbound traffic using FQDN-based and network rules.
Question 3: Your application requires that Azure PaaS services like Azure SQL Database be accessible only from within your VNet and not over the public internet. Which feature should you use?
- Service endpoints
- Private Endpoints (Correct answer)
- VNet Integration
- Azure Private Link service
Correct answer: Private Endpoints
Private Endpoints assign a private IP from your VNet to a PaaS service, making it accessible only from your VNet while the public endpoint can be disabled.
Question 4: You need to connect an on-premises datacenter to Azure with a guaranteed bandwidth SLA, low latency, and private connectivity not traversing the internet. Which option should you recommend?
- Site-to-Site VPN over IPsec
- Point-to-Site VPN
- Azure ExpressRoute (Correct answer)
- Azure Virtual WAN over internet
Correct answer: Azure ExpressRoute
ExpressRoute provides dedicated private connectivity between on-premises and Azure through a connectivity provider with an SLA-backed bandwidth guarantee.
Question 5: A global application needs to route users to the nearest healthy Azure region and perform SSL offloading. Which Azure service is best suited?
- Azure Traffic Manager
- Azure Load Balancer
- Azure Application Gateway
- Azure Front Door (Correct answer)
Correct answer: Azure Front Door
Azure Front Door is a global anycast CDN and load balancer that provides SSL offloading, WAF, and latency-based routing to the nearest healthy origin.
Question 6: You need to inspect and control traffic flowing between spoke VNets in a hub-and-spoke architecture. What must you configure in addition to deploying Azure Firewall in the hub?
- Network Security Groups on each spoke subnet
- User-Defined Routes (UDRs) to redirect spoke traffic through the firewall (Correct answer)
- Azure Policy network deny rules
- ExpressRoute gateway in the hub
Correct answer: User-Defined Routes (UDRs) to redirect spoke traffic through the firewall
UDRs (custom route tables) on spoke subnets must point the next hop to the Azure Firewall private IP to force traffic through inspection.
AZ-305 Azure Networking Architecture Design 1
You need to design connectivity between 10 Azure virtual networks so that any VNet can communicate with any other VNet with minimal management overhead.
Which design is recommended?