AZ-305 Design infrastructure solutions Practice Question
A hub-and-spoke Azure network must centralize outbound inspection and still allow spokes to resolve private endpoint DNS names. Which two components are commonly required? (Choose 2.)
⚠ Common exam trap
Test-takers frequently assume private endpoints require public IPs for DNS resolution, but Azure Private DNS zones resolve FQDNs to private IPs, and UDRs handle traffic routing without needing public exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User-defined routes from spoke subnets to the firewall or NVA.
User-defined routes (UDRs) on spoke subnets force all outbound traffic (including internet-bound traffic) to the central firewall or network virtual appliance (NVA) in the hub, enabling centralized inspection. Without UDRs, spoke VMs would bypass the firewall and use default outbound internet access, breaking the inspection requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
User-defined routes from spoke subnets to the firewall or NVA.
Why this is correct
User-defined routes (UDRs) are essential in a hub-and-spoke topology because they force all outbound traffic from spoke subnets to traverse the central firewall or NVA by specifying the inspection appliance as the next hop. Without a UDR, spoke traffic follows Azure's default system routes and reaches the internet directly, bypassing the hub's security controls. Associating a route table with each spoke subnet—and setting the next hop type to Virtual Appliance—is the mechanism that makes centralized outbound inspection and egress traffic deterministic.
- ✓
Private DNS zones linked to the VNets or resolved through a central DNS design.
Why this is correct
Private DNS zones linked to the spoke VNets (or a central DNS strategy) ensure that Azure Private Endpoints—which use private IPs—are resolvable via the private IP rather than their public FQDN. In a hub-and-spoke network, a private endpoint in a spoke will not be reachable by name from other spokes unless the appropriate private DNS zone is linked and a virtual network link is established. Centralizing DNS forwarding in the hub allows consistent resolution of Private Endpoint FQDNs across all spokes, preventing resolution failures and unintended leakage of traffic to the public internet.
- ✗
A public IP address on every private endpoint.
Why it's wrong here
Assigning a public IP address to a private endpoint defeats the foundational purpose of Azure Private Link, because private endpoints are designed to expose a service with a NIC using only a private IP from a virtual network. A public IP on a private endpoint would bypass the private connectivity model, introduce an internet-facing attack surface, and still does nothing to route outbound traffic through a central firewall or NVA. Moreover, Azure does not support attaching a public IP to a private endpoint; the service is explicitly meant to be accessed over the private network path.
- ✗
Basic SKU load balancers in each spoke.
Why it's wrong here
Basic SKU load balancers in each spoke are unrelated to centralized outbound inspection and would not help route traffic to a central firewall; they are primarily for distributing inbound traffic to VMs within a single region or fault domain. Additionally, Basic load balancers lack critical features such as availability zones, HA ports, and scaling, making them unsuitable as a control point in a hub-and-spoke architecture. Centralizing outbound egress requires route table manipulation and inspection appliances, not per-spoke load balancers, so using them would add complexity without solving DNS resolution or outbound control.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.