AZ-305 Design infrastructure solutions — Timed 20 Questions

Question 1

A company is designing a hub-spoke network topology in Azure. The hub contains a third-party network virtual appliance (NVA) for inspection. Spokes need to communicate with each other, and all inter-spoke traffic must be routed through the NVA in the hub. Which configuration should they use?

Accepted Answer

Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA. Option C is correct because user-defined routes (UDRs) allow you to explicitly override Azure's default system routes. By adding a route in each spoke subnet with the hub NVA's private IP as the next hop for inter-spoke traffic (e.g., 10.1.0.0/16 -> 10.0.0.4), all traffic between spokes is forced through the NVA for inspection. This ensures the hub-spoke topology meets the requirement without relying on Azure Firewall or Internet routing.

Answer

Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet

Answer

Configure Azure Firewall in the hub with forced tunneling to on-premises

Answer

Use VNet peering with gateway transit enabled

Question 2

A company is deploying a web application on Azure App Service. They need to guarantee that all traffic from the internet goes through a Web Application Firewall (WAF) before reaching the app. The solution must be cost-effective for a single application. Which Azure service should they place in front of the App Service?

Accepted Answer

Azure Application Gateway with WAF.. Azure Application Gateway with WAF is the correct choice because it provides a regional, layer-7 load balancer with built-in Web Application Firewall capabilities, designed to protect web applications from common exploits and vulnerabilities. For a single application, it is more cost-effective than Azure Front Door, which is a global service with higher minimum costs and additional features not required here. Application Gateway can be deployed directly in front of App Service to inspect and filter all internet traffic before it reaches the app.

Answer

Azure Front Door with WAF policy.

Answer

Azure Firewall with application rules.

Answer

Azure Traffic Manager.

Question 3

A company has multiple Azure subscriptions and on-premises data centers connected via ExpressRoute. They want to centralize connectivity to the internet and enforce a single web filtering and security policy for all outbound internet traffic from Azure VMs. Which Azure networking architecture should they implement?

Accepted Answer

Use a hub-spoke topology with Azure Firewall in the hub for all outbound traffic.. Option A is correct because a hub-spoke topology with Azure Firewall in the hub provides a centralized point for routing all outbound internet traffic from Azure VMs. By using user-defined routes (UDRs) on the spoke subnets that point to the Azure Firewall as the default gateway (0.0.0.0/0 next hop), all outbound traffic is forced through the firewall, enabling consistent web filtering and security policy enforcement. This architecture also integrates seamlessly with ExpressRoute for on-premises connectivity, ensuring a single egress point for internet-bound traffic.

Answer

Use a single virtual network for all resources with a network virtual appliance.

Answer

Use an Azure Virtual WAN with security virtual WAN hub.

Answer

Use Azure Traffic Manager with Azure Firewall.

Question 4

A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is a managed networking service that aggregates branch, VPN, and ExpressRoute connectivity into a single hub-and-spoke architecture. It automatically handles routing between branches and Azure, supports any-to-any connectivity, and integrates natively with ExpressRoute and VPN gateways, making it the correct choice for a scalable, managed solution that simplifies network architecture.

Answer

Azure Virtual Network

Answer

Azure ExpressRoute

Answer

Azure VPN Gateway

Question 5

A company runs a high-performance computing (HPC) workload on Azure that requires extremely low latency (under 10 microseconds) between multiple VMs for MPI communication. The VMs are part of a single job and must be placed together to minimize network latency. Which VM deployment option should they use?

Accepted Answer

Azure Virtual Machine Scale Sets with a Proximity Placement Group. A Proximity Placement Group (PPG) within a Virtual Machine Scale Set ensures that all VMs are physically located as close as possible within an Azure datacenter, reducing network latency to under 10 microseconds for MPI communication. This is the only option that guarantees co-location of VMs for a single HPC job, as PPGs minimize inter-VM latency by placing VMs in the same rack or cluster.

Answer

Azure Availability Sets

Answer

Azure Virtual Machine Scale Sets across Availability Zones

Answer

Azure Kubernetes Service (AKS)

Question 6

A company is deploying an internal web application on Azure VMs. The application requires SSL offloading, session stickiness, and URL-based routing (e.g., /api/* to one backend, /app/* to another). The solution must operate within a single Azure region and must not be exposed to the public internet. Which Azure load balancing solution should they use?

Accepted Answer

C. Azure Application Gateway v2 is the correct choice because it provides SSL offloading (SSL termination at the gateway), session stickiness (cookie-based affinity), and URL-based routing (path-based routing rules) within a single Azure region. It can be deployed with a private IP address only, ensuring it is not exposed to the public internet, meeting all requirements.

Answer

A

Answer

B

Answer

D

Question 7

A company is developing a containerized microservices application. They want to minimize operational overhead for managing orchestration. The application has a low-to-medium traffic pattern that can spike unpredictably. They need fast scaling and pay-per-second billing. Which Azure compute service should they use?

Accepted Answer

B. Azure Container Instances (ACI) is the correct choice because it provides serverless container orchestration with per-second billing and rapid scaling, ideal for low-to-medium traffic with unpredictable spikes. Unlike Azure Kubernetes Service (AKS), ACI eliminates the need to manage a control plane or node pools, minimizing operational overhead while supporting fast scaling for containerized microservices.

Answer

A

Answer

C

Answer

D

Question 8

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

Accepted Answer

A. Azure ExpressRoute provides a private, high-bandwidth, and reliable connection from on-premises data centers to Azure, bypassing the public internet. To meet the low-cost backup requirement, Azure VPN Gateway (Site-to-Site VPN) offers a secure, encrypted connection over the internet as a failover path, which is significantly cheaper than a second ExpressRoute circuit. This combination ensures primary connectivity via ExpressRoute and cost-effective redundancy via VPN.

Answer

B

Answer

C

Answer

D

Question 9

A company is designing a hub-spoke network topology across multiple Azure regions. They plan to deploy a third-party network virtual appliance (NVA) in the hub for traffic inspection. They require that all traffic between spokes in different regions must be routed through the hub NVA, and they want to minimize the number of peered connections. Which solution should they implement?

Accepted Answer

VNet peering with user-defined routes (UDRs) in each spoke pointing to the NVA IP in the hub. Option A is correct because VNet peering combined with user-defined routes (UDRs) allows traffic between spokes in different regions to be forced through the NVA in the hub for inspection. By configuring UDRs in each spoke with the next hop set to the NVA's private IP, you ensure inter-spoke traffic traverses the hub without requiring a full mesh of peering connections. This minimizes the number of peered connections (only hub-to-spoke peering is needed) while meeting the routing requirement.

Answer

Azure Virtual WAN with a secured hub using Azure Firewall

Answer

Azure VNet-to-VNet VPN gateways between all spokes

Answer

Azure ExpressRoute with private peering

Question 10

A company is deploying a multi-tier web application on Azure. The web tier must be accessible from the internet. The application tier and database tier must be isolated within the virtual network and not directly accessible from the internet. The solution must provide SSL termination, URL-based routing, and Web Application Firewall (WAF) capabilities. Which Azure service should they use to expose the web tier?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer-7 load balancer that provides SSL termination, URL-based routing, and a built-in Web Application Firewall (WAF). It can expose the web tier to the internet while keeping the application and database tiers isolated within the virtual network, as it routes traffic to backend pools using HTTP/HTTPS rules without exposing those backends directly.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 11

A company is deploying a multi-tier web application on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must be isolated within the virtual network. The solution must provide SSL termination, web application firewall (WAF) capabilities, and URL-based routing. Which Azure service should they use to expose the web tier?

Accepted Answer

Use Azure Application Gateway with WAF, and configure NSGs to restrict traffic between tiers.. Azure Application Gateway is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL-based routing, making it ideal for exposing a web tier to the internet. By placing the gateway in front of the web tier and configuring network security groups (NSGs) on the application and database subnets, you can isolate internal tiers while meeting all stated requirements.

Answer

Use an Azure Load Balancer and configure NSGs on each subnet.

Answer

Use Azure Firewall to inspect all traffic and allow internet traffic to the web tier.

Answer

Use Azure Front Door to expose the web tier and NSGs for internal isolation.

Question 12

A global company is deploying a microservices application on AKS clusters in multiple Azure regions. They need to provide a single endpoint for users worldwide with SSL offloading, web application firewall, and URL path-based routing to the nearest healthy AKS cluster. They also need global load balancing with automatic failover. Which Azure service should they use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides global HTTP/HTTPS load balancing with SSL offloading, web application firewall (WAF) integration, and URL path-based routing. It uses Anycast-based routing to direct users to the nearest healthy AKS cluster, ensuring low latency and automatic failover across regions.

Answer

Azure Application Gateway

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Question 13

A company has a hub-spoke network topology in Azure. They have multiple spoke VNets connected to a hub VNet via peering. They need to ensure that all east-west traffic between spoke VNets goes through a network virtual appliance (NVA) in the hub for inspection. Additionally, all outbound internet traffic from spoke VMs must use a single public IP address. What should they configure?

Accepted Answer

Configure VNet peering with 'Allow forwarded traffic' enabled, add user-defined routes in each spoke pointing to the NVA IP for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet with a default route in spokes.. Option D is correct because it combines two critical configurations: user-defined routes (UDRs) in each spoke VNet force inter-spoke traffic through the NVA in the hub by specifying the NVA's IP as the next hop, and 'Allow forwarded traffic' on the VNet peering enables the hub NVA to forward packets between spokes. For outbound internet traffic, Azure Firewall in the hub provides a single public IP, and a default route (0.0.0.0/0) in the spoke UDRs directs all internet-bound traffic to the Azure Firewall's private IP, ensuring centralized inspection and egress.

Answer

Configure spoke VNets with a default route to the NVA IP, and deploy a NAT gateway in the hub for outbound traffic.

Answer

Configure a route table in each spoke with a route to the hub NVA for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet traffic.

Answer

Enable 'Allow gateway transit' on the hub VNet and 'Use remote gateways' on the spoke VNets for the NVA.

Question 14

A company needs to provide secure remote administration access to Azure virtual machines for their IT team. The VMs are in a virtual network with no public IP addresses. The IT team uses browsers to connect. The solution should not require any custom software on the client machines. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure virtual machines directly in the Azure portal over TLS. Because the VMs have no public IP addresses, Bastion acts as a jump server that is deployed inside the virtual network, eliminating the need for any public exposure. Since the IT team uses browsers and cannot install custom software, Bastion's native browser-based HTML5 client meets the requirement perfectly.

Answer

Just-in-Time VM access

Answer

Azure VPN Gateway

Answer

Microsoft Entra ID Domain Services

Question 15

A company has an Azure SQL Database that they need to access from an on-premises data center over ExpressRoute. They want to use a private IP address to connect to the database, ensuring traffic never traverses the public internet. Which Azure service should they use?

Accepted Answer

Azure Private Link. Azure Private Link allows you to access Azure SQL Database over a private endpoint within your virtual network, using a private IP address. When combined with ExpressRoute, traffic from your on-premises data center to the database traverses the Microsoft backbone network and never touches the public internet, meeting the requirement for a private, secure connection.

Answer

Azure Service Endpoints

Answer

Azure VPN Gateway

Answer

Azure Front Door

Question 16

A company plans to deploy a stateless web application on Azure virtual machines. They want to ensure that the application remains available in the event of a hardware failure within a single Azure datacenter. The VMs must be placed in a way that ensures they are on different physical servers and racks, but are still within the same datacenter. Which deployment strategy should they use?

Accepted Answer

Deploy the VMs in an Availability Set.. An Availability Set ensures that VMs are distributed across multiple fault domains (different physical servers, racks, and network switches) and update domains within a single Azure datacenter. This protects against hardware failures in that datacenter by guaranteeing that not all VMs are affected by the same local failure, while keeping them in the same datacenter for low-latency communication.

Answer

Deploy the VMs in different Availability Zones.

Answer

Deploy the VMs in a single Virtual Machine Scale Set with a large instance count.

Answer

Deploy each VM in a separate resource group.

Question 17

A company is deploying a web application that must be accessible from the internet. The application is hosted on Azure virtual machines in a virtual network. The solution must provide SSL termination, web application firewall (WAF) protection, and URL path-based routing (e.g., /api/* to one backend pool, /app/* to another). The web tier must not be directly exposed to the internet. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL path-based routing. It can route traffic to different backend pools based on URL paths (e.g., /api/* and /app/*) while keeping the web tier isolated within the virtual network, as the gateway itself is exposed to the internet.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 18

A company has an on-premises data center and wants to connect it to Azure to extend their network. They require a dedicated, private, high-bandwidth connection that is not routed over the public internet. They also want a lower-cost backup connection for redundancy in case the primary connection fails. Which combination of connectivity options should they implement?

Accepted Answer

ExpressRoute as the primary connection and a Site-to-Site VPN as the backup connection.. ExpressRoute provides a dedicated, private, high-bandwidth connection that bypasses the public internet, meeting the primary requirement. A Site-to-Site VPN over the internet serves as a cost-effective backup path for redundancy, as it uses encrypted tunnels over the public internet without the recurring costs of a second ExpressRoute circuit.

Answer

Two ExpressRoute circuits from different service providers, both active.

Answer

Site-to-Site VPN as the primary connection and Point-to-Site VPN as the backup.

Answer

Azure VPN Gateway with active-passive mode and a second VPN Gateway for failover.

Question 19

A company deploys a web application on Azure VMs across multiple availability zones in a region. They need to distribute incoming traffic across VMs in all zones, maintain session persistence, and support SSL offloading and URL-based routing (e.g., /api/* to one pool, /app/* to another). Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 (HTTP/HTTPS) load balancer that supports SSL offloading, URL-based routing (e.g., /api/* and /app/* to different backend pools), and session persistence (cookie-based affinity). It can distribute traffic across VMs in multiple availability zones within a region, meeting all stated requirements.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 20

A company has multiple Azure VNets deployed in a hub-spoke topology. They want to inspect all outbound internet traffic from spoke VMs using a central firewall and ensure that traffic from all VNets goes through the firewall before reaching the internet. They also need to log all outbound connections. Which architecture should they implement?

Accepted Answer

Deploy Azure Firewall in the hub VNet and configure a default route (0.0.0.0/0) in each spoke's route table pointing to Azure Firewall as the next hop. Option B is correct because Azure Firewall is a managed, stateful firewall-as-a-service that can centrally inspect and log outbound internet traffic. By deploying Azure Firewall in the hub VNet and configuring a default route (0.0.0.0/0) in each spoke's route table with the Azure Firewall private IP as the next hop, all outbound traffic from spoke VMs is forced through the firewall before reaching the internet. This satisfies both the inspection and logging requirements, as Azure Firewall provides built-in outbound connection logging via diagnostic settings.

Answer

Deploy network virtual appliances (NVAs) in each spoke VNet and configure user-defined routes (UDRs) to route internet traffic to the NVAs

Answer

Use Azure Application Gateway with Web Application Firewall (WAF) in the hub VNet to inspect all traffic

Answer

Deploy Azure Firewall in each spoke VNet and use Azure Monitor to aggregate logs