AZ-305 · Domain 4: Design infrastructure solutions · 33% of the exam
Task 4.4: Design network solutions
Internet ingress and egress, VPN, ExpressRoute and Virtual WAN, hub-and-spoke routing, private endpoints and DNS, Azure Firewall, NSGs and DDoS Protection, and Load Balancer, Application Gateway, Front Door and Traffic Manager.
Study it
Internet connectivity and hybrid connectivity: NAT Gateway, VPN, ExpressRoute and Virtual WAN
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
200 VMs in a new virtual network must call a partner API that allowlists caller IP addresses. Outbound connections are bursty and have run out of SNAT ports elsewhere. The VMs must not be reachable from the internet, and the subnets were created as private subnets. What should you recommend?
AA public IP address on every VM's network interface
BA NAT gateway with a static public IP prefix on the subnets
CDefault outbound access, left to assign outbound IP addresses automatically
DAzure Bastion deployed in the virtual network
Show the answer and why
AA public IP address on every VM's network interface
Incorrect
Instance-level public IPs make each VM reachable from the internet and give the partner 200 addresses to allowlist.
BA NAT gateway with a static public IP prefix on the subnets
Correct
NAT Gateway provides outbound-only connectivity from static IPs with plenty of SNAT ports, and it's the recommended outbound method.
CDefault outbound access, left to assign outbound IP addresses automatically
Incorrect
Private subnets have no default outbound access, and default outbound IPs aren't static or customer-owned.
DAzure Bastion deployed in the virtual network
Incorrect
Bastion doesn't carry the VMs' own outbound connections to the internet.
NAT Gateway gives subnets outbound-only internet access through static public IPs or prefixes and scales SNAT ports on demand. With API versions released after March 31, 2026, new virtual networks default to private subnets, so VMs need an explicit outbound method, and Microsoft recommends NAT Gateway for most scenarios.
A manufacturer needs private connectivity from its main datacenter to Azure with predictable latency that doesn't traverse the public internet. If the private circuit fails, connectivity must continue automatically over an encrypted path, even with lower performance. What should you recommend?
ATwo site-to-site VPN tunnels over the internet from different on-premises devices
BOne ExpressRoute circuit with no other path
CPoint-to-site VPN from each server in the datacenter
DExpressRoute private peering, with a site-to-site VPN as the backup path
Show the answer and why
ATwo site-to-site VPN tunnels over the internet from different on-premises devices
Incorrect
VPN tunnels run over the internet, so latency isn't predictable for the primary path.
BOne ExpressRoute circuit with no other path
Incorrect
With no second path, a circuit or provider failure stops connectivity.
CPoint-to-site VPN from each server in the datacenter
Incorrect
Per-server VPN clients don't give the datacenter a private link with predictable latency.
DExpressRoute private peering, with a site-to-site VPN as the backup path
Correct
ExpressRoute gives private, predictable connectivity, and a site-to-site VPN can be the failover path for private peering.
ExpressRoute provides private connections that don't go over the public internet, with consistent latency. A site-to-site VPN can be configured as a secure failover path for ExpressRoute private peering.
On-premises servers reach Azure over ExpressRoute private peering. They must read a storage account whose public network access will be disabled, using the account's normal blob host name, and the on-premises DNS servers must resolve it to a private IP. No DNS VMs may run in Azure. Which two components should you recommend? (Choose TWO.)
AA service endpoint for Microsoft.Storage on the gateway subnet
BA private endpoint for the storage account's blob service
CAn Azure DNS Private Resolver inbound endpoint as the target of on-premises conditional forwarders
DA storage firewall rule for the on-premises NAT public IP
EMicrosoft peering on the ExpressRoute circuit
Show the answer and why
AA service endpoint for Microsoft.Storage on the gateway subnet
Incorrect
Service endpoints serve traffic from Azure subnets and keep the public endpoint; on-premises traffic doesn't use them.
BA private endpoint for the storage account's blob service
Correct
A private endpoint gives the account a private IP in the virtual network that on-premises clients reach over private peering.
CAn Azure DNS Private Resolver inbound endpoint as the target of on-premises conditional forwarders
Correct
The inbound endpoint lets on-premises DNS resolve the private DNS zone without DNS servers in Azure.
DA storage firewall rule for the on-premises NAT public IP
Incorrect
A public IP rule keeps traffic on the public endpoint, which is being disabled.
EMicrosoft peering on the ExpressRoute circuit
Incorrect
Microsoft peering reaches public endpoints, not a private IP in the virtual network.
A private endpoint maps the storage account to a private IP, with a privatelink DNS zone holding the record. On-premises DNS forwards the zone to an Azure DNS Private Resolver inbound endpoint, so clients resolve the normal host name to the private IP.
A web app runs in three regions. Users must be routed to the closest healthy region, failover must not depend on DNS caches expiring, and the design needs a web application firewall at the edge and path-based routing for /api and /static. Which service should you recommend?
AAzure Traffic Manager with performance routing
BAzure Application Gateway v2 with WAF in one region
CThe global tier of Azure Load Balancer
DAzure Front Door Premium
Show the answer and why
AAzure Traffic Manager with performance routing
Incorrect
Traffic Manager works through DNS, so failover waits on DNS caching, and it has no WAF.
BAzure Application Gateway v2 with WAF in one region
Incorrect
Application Gateway doesn't route users across regions at the edge.
CThe global tier of Azure Load Balancer
Incorrect
The global load balancer works at layer 4, so it can't route by path or run a WAF.
DAzure Front Door Premium
Correct
Front Door is a global layer 7 entry point that routes to the nearest healthy origin, with WAF and path-based rules at the edge.
Front Door uses Microsoft's edge network to route HTTP traffic to the fastest healthy origin, fails over without relying on DNS, and supports WAF policies and rule-based routing. Traffic Manager is DNS-based, and Application Gateway is regional.
All outbound web traffic from spoke networks passes through a firewall in the hub. Security now requires decrypting outbound HTTPS to inspect it, and signature-based intrusion detection and prevention on that traffic. Which firewall should you recommend?
AAzure Firewall Premium
BAzure Firewall Standard with threat intelligence filtering
CNetwork security groups on every spoke subnet
DAzure DDoS Network Protection on the hub
Show the answer and why
AAzure Firewall Premium
Correct
Premium adds TLS inspection and signature-based IDPS on top of the Standard features.
BAzure Firewall Standard with threat intelligence filtering
Incorrect
Threat intelligence blocks known malicious IPs and domains, but Standard can't decrypt TLS or run IDPS signatures.
CNetwork security groups on every spoke subnet
Incorrect
NSGs filter by address, port and protocol; they can't decrypt or inspect traffic contents.
DAzure DDoS Network Protection on the hub
Incorrect
DDoS Protection doesn't inspect outbound HTTPS.
Azure Firewall Premium includes TLS inspection, which decrypts outbound traffic, and a signature-based IDPS that detects attacks by known patterns, plus URL filtering and web categories. Standard and Basic lack these features.
A retailer has 60 branch offices with VPN devices and virtual networks in three regions. It needs any-to-any connectivity between branches and virtual networks, all private and internet traffic inspected by a firewall, and minimal manual route management. Which two elements should the design include? (Choose TWO.)
AA Basic Azure Virtual WAN with site-to-site VPN in each hub
BGlobal virtual network peering between every pair of virtual networks
CUser-defined routes on every spoke subnet pointing to a firewall VM
DA Standard Azure Virtual WAN with a virtual hub in each region
ERouting intent with private and internet traffic policies sent to Azure Firewall in each hub
Show the answer and why
AA Basic Azure Virtual WAN with site-to-site VPN in each hub
Incorrect
Basic Virtual WAN supports only site-to-site VPN and lacks the transit and firewall routing the design needs.
BGlobal virtual network peering between every pair of virtual networks
Incorrect
A full mesh of peerings doesn't connect the branches and needs manual routing for inspection.
CUser-defined routes on every spoke subnet pointing to a firewall VM
Incorrect
Hand-maintained route tables are the manual route management the design avoids.
DA Standard Azure Virtual WAN with a virtual hub in each region
Correct
Standard Virtual WAN hubs provide transit between branches, virtual networks and hubs with managed routing.
ERouting intent with private and internet traffic policies sent to Azure Firewall in each hub
Correct
Routing intent sends both traffic types through the hub firewall without hand-built route tables.
Virtual WAN Standard hubs give any-to-any transit across branches, virtual networks and regions. Routing intent with private and internet traffic routing policies sends traffic through Azure Firewall or a supported NVA in the hub with no custom route tables.
Forty remote developers on laptops need access to VMs and private endpoints in an Azure virtual network from home. They must sign in with their Microsoft Entra accounts and MFA, and no certificates should be issued to each laptop. What should you recommend?
AA site-to-site VPN to each developer's home router
BPublic IP addresses on the VMs restricted by NSG to the developers' home IPs
CPoint-to-site VPN with certificate authentication
DA point-to-site VPN on the VPN gateway with Microsoft Entra ID authentication
Show the answer and why
AA site-to-site VPN to each developer's home router
Incorrect
Site-to-site VPN links networks through VPN devices, not individual laptops on home connections.
BPublic IP addresses on the VMs restricted by NSG to the developers' home IPs
Incorrect
That exposes the VMs to the internet and doesn't reach private endpoints.
CPoint-to-site VPN with certificate authentication
Incorrect
Certificate authentication needs a client certificate on every laptop, which the requirement rules out.
DA point-to-site VPN on the VPN gateway with Microsoft Entra ID authentication
Correct
Point-to-site VPN connects individual clients, and Entra ID authentication supports MFA through Conditional Access without client certificates.
A point-to-site VPN creates a secure connection from an individual client to a virtual network. With Microsoft Entra ID authentication, users sign in with their Entra accounts, and Conditional Access can require MFA.
An online retailer has 30 public IP addresses in one virtual network. The security team requires DDoS mitigation tuned to its traffic, access to the DDoS rapid response team during an attack, and credits for scale-out costs caused by an attack. Which tier should you recommend?
ADDoS IP Protection on each public IP address
BThe default infrastructure protection with no plan
CA WAF policy on Application Gateway
DDDoS Network Protection on the virtual network
Show the answer and why
ADDoS IP Protection on each public IP address
Incorrect
IP Protection has the same core mitigation but no rapid response support or cost protection.
BThe default infrastructure protection with no plan
Incorrect
Default protection isn't tuned to the customer's traffic and offers none of the extra services.
CA WAF policy on Application Gateway
Incorrect
A WAF filters layer 7 attacks for web apps; it doesn't provide DDoS rapid response or cost protection.
DDDoS Network Protection on the virtual network
Correct
Network Protection includes DDoS rapid response support and cost protection, which IP Protection doesn't.
Azure DDoS Protection comes in two tiers. DDoS IP Protection is billed per protected IP; DDoS Network Protection covers a virtual network's public IPs and adds DDoS rapid response support, cost protection and a WAF discount.
A central security team must block inbound RDP and SSH from the internet across 300 virtual networks in many subscriptions. Application teams manage their own NSGs and must not be able to override this rule, and new virtual networks must be covered automatically. What should you recommend?
AAn NSG rule added to every subnet by a script that runs after each deployment
BAn Azure Firewall in each virtual network
CVirtual Network Manager security admin rules on a dynamic network group
DApplication security groups for all VMs that allow RDP
Show the answer and why
AAn NSG rule added to every subnet by a script that runs after each deployment
Incorrect
App teams control their NSGs and could change or remove the rule, and new networks need the script again.
BAn Azure Firewall in each virtual network
Incorrect
Hundreds of firewalls add cost and don't stop teams from adding other paths around them.
CVirtual Network Manager security admin rules on a dynamic network group
Correct
Security admin rules are evaluated before NSG rules, so a deny can't be overridden, and network groups can include new networks.
DApplication security groups for all VMs that allow RDP
Incorrect
Application security groups don't enforce anything above the teams' NSGs.
Azure Virtual Network Manager applies security admin rules to network groups across subscriptions. They have higher priority than NSGs and are evaluated first, so deny rules hold regardless of NSG rules, and dynamic membership adds new networks.
A SaaS provider runs its API on VMs behind an internal Standard load balancer. Customers in their own Azure tenants must reach the API from their virtual networks over private IPs, without peering or overlapping address concerns, and the provider must approve each connection. What should you recommend?
AVirtual network peering between the provider's network and every customer's network
BA Private Link service on the load balancer, used through private endpoints
CA public load balancer with an IP allowlist for each customer
DSite-to-site VPN connections from each customer network
Show the answer and why
AVirtual network peering between the provider's network and every customer's network
Incorrect
Peering needs non-overlapping address spaces and opens wider network access than one API.
BA Private Link service on the load balancer, used through private endpoints
Correct
Private Link service exposes a service behind a Standard load balancer to private endpoints in other tenants, with approval.
CA public load balancer with an IP allowlist for each customer
Incorrect
Traffic would cross the public internet instead of private IPs.
DSite-to-site VPN connections from each customer network
Incorrect
VPNs per customer are heavy to operate and still need routable, non-overlapping addresses.
Private Link service lets a provider expose a service that runs behind a Standard Load Balancer. Consumers create private endpoints in their own virtual networks, even in other tenants, and the provider approves each connection; NAT avoids address overlap.