Knowledge + Practice

CCNA Design infrastructure solutions Questions

50 questions · Design infrastructure solutions · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQhard

A multinational corporation is designing a disaster recovery strategy for a critical application running on Azure VMs. The application must have a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The primary region is East US, and the secondary region is West US. The solution must minimize costs while meeting the requirements. What should you recommend?

A.Deploy an active-passive configuration with Azure Front Door and Traffic Manager

B.Implement Azure Site Recovery for the VMs

C.Configure the VMs in an availability zone across East US and West US

D.Use Azure Backup with cross-region restore for the VMs

AnswerB

Azure Site Recovery is the native DR service for IaaS VMs, continuously replicating VM storage to a paired secondary region with an RPO as low as 15 seconds and RTO in minutes. It handles orchestrated failover, failback, and recovery drills, offering a cost-effective, fully managed solution that meets the stringent DR objectives without extra infrastructure. This directly satisfies the requirement for cross-region VM protection.

Why this answer

Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs from a primary to a secondary region with an RPO as low as 15 minutes (Premium SSD) and RTOs that can be met within 1 hour through planned failover. It is the native Azure service designed for disaster recovery of IaaS workloads, offering cost-effective replication without requiring always-on secondary VMs, as it only incurs storage costs for replicated disks until failover.

Exam trap

The trap here is that candidates confuse high-availability solutions (availability zones, load balancers) with disaster recovery solutions, or assume Azure Backup's cross-region restore can meet low RPOs, when in fact only Azure Site Recovery provides the sub-hour replication frequency required for a 15-minute RPO.

How to eliminate wrong answers

Option A is wrong because Azure Front Door and Traffic Manager are global load-balancing and traffic-routing services; they do not provide VM replication or failover orchestration, and an active-passive configuration alone cannot meet the RPO/RTO without a replication mechanism. Option C is wrong because availability zones are within a single Azure region (e.g., East US) and cannot span across East US and West US; they protect against datacenter failures within a region, not regional disasters. Option D is wrong because Azure Backup with cross-region restore has a default RPO of 24 hours (for daily backups) and cannot achieve a 15-minute RPO; it is designed for backup and long-term retention, not low-latency disaster recovery.

Practice this question →

2

MCQhard

You are a solutions architect for a financial services company. The company is deploying a new critical application on Azure that processes sensitive customer transactions. The application consists of an ASP.NET Core web app (Azure App Service), a REST API (Azure Kubernetes Service), and an Azure SQL Database. The requirements are: - All data at rest must be encrypted using customer-managed keys (CMK) stored in a managed HSM. - All network traffic between components must be encrypted and traverse the Microsoft backbone network. - The web app must be protected against common web attacks (SQL injection, XSS). - The solution must automatically scale the API based on CPU utilization. - All API calls must be authenticated using OAuth 2.0 with Microsoft Entra ID. - Logs from all components must be sent to a central Log Analytics workspace for analysis. - The solution must have a recovery time objective (RTO) of 1 hour and recovery point objective (RPO) of 5 minutes for the database. Which combination of Azure services should you recommend to meet ALL requirements?

A.Azure Front Door with WAF, Azure SQL Database point-in-time restore, Azure Key Vault Managed HSM, Azure App Service with private endpoint, AKS with HPA, Azure Log Analytics agent, Microsoft Entra ID

B.Azure Front Door with WAF, Azure SQL Database geo-replication, Azure Key Vault (Standard), Azure App Service with private endpoint, AKS with HPA, Azure Diagnostics extension, Microsoft Entra ID

C.Azure Application Gateway with WAF, Azure SQL Database active geo-replication, Azure Key Vault Managed HSM, Azure App Service with VNet integration, AKS with cluster autoscaler, Azure Monitor Agent, Microsoft Entra ID

D.Azure Application Gateway with WAF, Azure SQL Database failover groups, Azure Key Vault Managed HSM, Azure App Service with service endpoint, AKS with HPA, Azure Monitor Agent, Microsoft Entra ID

AnswerD

Correct. Failover groups meet RPO and RTO, Managed HSM meets key storage, service endpoint keeps traffic on Microsoft backbone, AKS with HPA scales based on CPU, Application Gateway WAF protects against attacks, Azure Monitor Agent collects logs, and Microsoft Entra ID authenticates API calls.

Why this answer

Meets all requirements: Azure Application Gateway with WAF protects against SQL injection and XSS; Azure SQL Database failover groups provide an RPO of 5 seconds and an RTO of 1 hour (auto-failover); Azure Key Vault Managed HSM stores customer-managed keys for encryption at rest; App Service with service endpoint ensures traffic to other Azure services stays on the Microsoft backbone network (combined with AKS in a VNet, internal traffic stays on backbone); AKS with Horizontal Pod Autoscaler (HPA) scales pods based on CPU utilization; Azure Monitor Agent sends logs to Log Analytics; Microsoft Entra ID authenticates API calls via OAuth 2.0. Option A uses point-in-time restore, which cannot guarantee RPO of 5 minutes and RTO of 1 hour. Option B uses Key Vault Standard instead of Managed HSM.

Option C uses cluster autoscaler, which scales nodes, not pods, failing the CPU-based scaling requirement.

Exam trap

The trap is confusing cluster autoscaler with Horizontal Pod Autoscaler (HPA). Cluster autoscaler scales the number of node VMs, not pod replicas, and does not respond to CPU utilization; it only responds to pending pods. HPA scales pod replicas based on CPU or memory metrics.

Also, service endpoints vs. private endpoints: both keep traffic on the Microsoft backbone, but private endpoints provide a private IP in the VNet for enhanced security.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database point-in-time restore has an RPO of up to 1 hour (not 5 minutes) and does not meet the RPO requirement; also, Azure Log Analytics agent is deprecated in favor of Azure Monitor Agent. Option B is wrong because Azure Key Vault (Standard) does not support customer-managed keys stored in a managed HSM (requires Premium tier or Managed HSM), and Azure Diagnostics extension is legacy and not the recommended agent for Log Analytics. Option D is wrong because Azure App Service with service endpoint does not ensure traffic traverses the Microsoft backbone network (it uses public IPs with ACLs, not private IPs); also, AKS with HPA (Horizontal Pod Autoscaler) scales pods, not nodes, and the requirement is to scale the API based on CPU utilization, which is better handled by cluster autoscaler for node-level scaling or HPA for pod-level scaling, but the key issue is service endpoint not meeting the private network requirement.

Practice this question →

3

MCQhard

A company runs a high-performance computing (HPC) workload on Azure that requires extremely low latency (under 10 microseconds) between multiple VMs for MPI communication. The VMs are part of a single job and must be placed together to minimize network latency. Which VM deployment option should they use?

A.Azure Virtual Machine Scale Sets with a Proximity Placement Group

B.Azure Availability Sets

C.Azure Virtual Machine Scale Sets across Availability Zones

D.Azure Kubernetes Service (AKS)

AnswerA

Azure Virtual Machine Scale Sets with a Proximity Placement Group (PPG) is the correct choice for tightly coupled HPC workloads because a PPG co-locates all VM instances within the same Azure datacenter, minimizing network latency to the sub-10 microseconds required by MPI applications. VMSS integrates with PPG by allowing you to scale the compute cluster out while ensuring every new instance remains within the placement group, preserving low-latency inter-node communication. This combination also enables the use of high-throughput, low-latency networking such as InfiniBand on supported HPC VM SKUs, which is essential for parallel jobs that need frequent, low-latency message passing.

Why this answer

A Proximity Placement Group (PPG) within a Virtual Machine Scale Set ensures that all VMs are physically located as close as possible within an Azure datacenter, reducing network latency to under 10 microseconds for MPI communication. This is the only option that guarantees co-location of VMs for a single HPC job, as PPGs minimize inter-VM latency by placing VMs in the same rack or cluster.

Exam trap

The trap here is that candidates often confuse Availability Sets (which provide high availability) with Proximity Placement Groups (which provide low latency), or assume that Availability Zones offer sufficient performance for HPC, ignoring the significant latency penalty of inter-zone communication.

How to eliminate wrong answers

Option B is wrong because Availability Sets only protect against failures by distributing VMs across fault and update domains, but they do not guarantee low latency or co-location; in fact, they may spread VMs across different racks, increasing latency. Option C is wrong because Virtual Machine Scale Sets across Availability Zones place VMs in physically separate datacenters within a region, which introduces network latency far exceeding the 10-microsecond requirement due to inter-zone communication. Option D is wrong because Azure Kubernetes Service (AKS) abstracts VM placement and does not provide native mechanisms to enforce co-location of pods for low-latency MPI communication; it relies on underlying node placement, which is not guaranteed to be within a single rack.

Practice this question →

4

MCQhard

You are designing a backup strategy for Azure virtual machines. The solution must support application-consistent backups for SQL Server databases running on the VMs. You need to ensure that backups are taken every 4 hours and retained for 30 days. What should you configure in Azure Backup?

A.Configure Azure SQL Backup for the SQL Server databases.

B.Configure a VM backup policy with 4-hour frequency and 30-day retention using the default backup extension.

C.Configure Azure Site Recovery replication policy with 4-hour frequency.

D.Configure Azure Backup for SAP HANA on the VM.

AnswerB

VM backup policy supports application-consistent backups and custom schedules.

Why this answer

Azure Backup's default VM backup extension (VMSnapshot) can achieve application-consistent backups for SQL Server by using Windows Volume Shadow Copy Service (VSS) to quiesce the database writes. You configure a VM backup policy with a 4-hour frequency and 30-day retention to meet the stated requirements, as this policy applies to the entire VM and ensures SQL Server databases are backed up consistently.

Exam trap

The trap here is that candidates often confuse Azure SQL Backup (PaaS) with VM backup for SQL Server on IaaS, or they mistakenly think Azure Site Recovery can serve as a backup solution with retention, when it is only for replication and failover.

How to eliminate wrong answers

Option A is wrong because Azure SQL Backup is a separate service for Azure SQL Database (PaaS), not for SQL Server running on Azure VMs (IaaS). Option C is wrong because Azure Site Recovery replication policy is designed for disaster recovery (replication and failover), not for scheduled backups with retention; it does not support 4-hour frequency for backup retention. Option D is wrong because Azure Backup for SAP HANA is a specialized solution for SAP HANA databases, not for SQL Server databases.

Practice this question →

5

MCQmedium

Refer to the exhibit. The JSON shows role assignments for user1. The role definition IDs are: b24988ac-6180-42a0-ab88-20f7382dd24c = Key Vault Secrets User, 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 = Reader. User1 reports being unable to list secrets in the key vault 'vault-prod' using Azure CLI. What is the most likely cause?

A.User1 does not have any role assignment on the key vault

B.The Key Vault Secrets User role does not include the ability to list secrets

C.User1 must have the Contributor role on the key vault

D.The Reader role at resource group scope overrides the vault role

AnswerB

The role only allows reading secret values, not listing.

Why this answer

The Key Vault Secrets User role (b24988ac-6180-42a0-ab88-20f7382dd24c) grants permissions only to read secret values and metadata, but it does not include the 'list' action on secrets. To list secrets in a key vault, a role such as Key Vault Secrets Officer or a custom role with Microsoft.KeyVault/vaults/secrets/read action is required. Since User1 only has the Key Vault Secrets User role on the vault, they cannot execute the 'az keyvault secret list' command.

Exam trap

The trap here is that candidates assume the Key Vault Secrets User role can list secrets because it can read secret values, but Azure RBAC distinguishes between reading a specific secret and enumerating all secrets in a vault.

How to eliminate wrong answers

Option A is wrong because User1 does have a role assignment on the key vault (Key Vault Secrets User at vault scope), as shown in the JSON exhibit. Option C is wrong because the Contributor role is not required; a role with the 'list' permission on secrets, such as Key Vault Secrets Officer, would suffice. Option D is wrong because the Reader role at resource group scope does not override the vault-specific role; Azure RBAC uses additive permissions, and the Reader role at a higher scope does not remove permissions granted at a lower scope.

Practice this question →

6

MCQhard

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center connected via ExpressRoute. They need to implement a hub-and-spoke topology where a hub VNet hosts shared network virtual appliances (NVAs) for traffic inspection. All traffic between spokes and between spokes and on-premises must be routed through the hub. The company wants to minimize the administrative overhead of configuring and maintaining routing. Which Azure solution should they implement?

A.Use Azure Virtual WAN with a secured virtual hub.

B.Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.

C.Create a single large VNet and use network security groups (NSGs) to isolate traffic.

D.Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.

AnswerA

Azure Virtual WAN provides a managed hub-and-spoke architecture with automatic routing. A secured virtual hub can integrate NVAs or Azure Firewall, and it handles transitive routing between spokes and on-premises without manual route tables or UDRs.

Why this answer

Azure Virtual WAN with a secured virtual hub is the correct choice because it provides a managed hub-and-spoke topology with built-in routing, eliminating the need for manual user-defined routes (UDRs) and route tables. The secured virtual hub includes Azure Firewall for traffic inspection, and all inter-spoke and on-premises traffic is automatically routed through the hub via the Virtual WAN routing engine, which uses the Border Gateway Protocol (BGP) to propagate routes dynamically. This minimizes administrative overhead by centralizing routing and security management.

Exam trap

The trap here is that candidates often choose VNet peering with UDRs (Option B) because it is a familiar pattern for hub-and-spoke, but they overlook that Azure Virtual WAN is the managed service designed to eliminate the administrative overhead of manual routing, especially when multiple regions and on-premises connectivity are involved.

How to eliminate wrong answers

Option B is wrong because using VNet peering with UDRs in each spoke and Azure Route Server still requires manual configuration and maintenance of UDRs for each spoke to force traffic through the hub NVAs, which increases administrative overhead and does not provide a fully managed routing solution. Option C is wrong because creating a single large VNet and using NSGs to isolate traffic violates the hub-and-spoke requirement for traffic inspection through NVAs; NSGs are stateless or stateful filters that do not route traffic through a central inspection point, and a single VNet cannot span multiple regions natively without additional complexity. Option D is wrong because using Azure Firewall in the hub VNet with forced tunneling via custom routes still requires manual UDR configuration on each spoke subnet to direct traffic to the firewall, and it does not provide the automated, scalable routing that Azure Virtual WAN offers for multi-region and on-premises connectivity.

Practice this question →

7

MCQmedium

A global e-commerce company runs a web application in multiple Azure regions. They need to distribute incoming HTTPS traffic across regional deployments to provide low latency and high availability. The solution must support SSL offloading, Web Application Firewall (WAF) policies, and content caching to reduce backend load. They also need to route users to the nearest healthy backend region. Which Azure service should they use?

A.Azure Traffic Manager

B.Azure Front Door

C.Azure Application Gateway

D.Azure Content Delivery Network (CDN)

AnswerB

Azure Front Door is the correct choice because it is a true global layer 7 load balancer that terminates TLS at its edge points of presence, offloading encryption processing from the origin web servers. It includes an integrated web application firewall (WAF) capable of inspecting requests before they reach backend applications, and it offers edge caching for static and dynamic content. Additionally, Front Door uses Anycast and intelligent routing to direct each user's request to the nearest available and healthy regional backend, providing automatic global failover and path-based routing that satisfy all requirements of a multi-region e-commerce deployment.

Why this answer

Azure Front Door is the correct choice because it is a global, scalable entry point that provides HTTPS traffic distribution across multiple Azure regions with low latency, SSL offloading, WAF policies, and content caching. It uses Anycast-based routing to direct users to the nearest healthy backend region, meeting all the requirements for high availability and performance.

Exam trap

The trap here is that candidates often confuse Azure Traffic Manager (DNS-level routing) with Azure Front Door (HTTP/HTTPS-level routing), overlooking the need for SSL offloading, WAF, and content caching, which Traffic Manager cannot provide.

How to eliminate wrong answers

Option A (Azure Traffic Manager) is wrong because it operates at the DNS level and does not support SSL offloading, WAF policies, or content caching; it only routes traffic based on DNS responses without inspecting the HTTP/HTTPS payload. Option C (Azure Application Gateway) is wrong because it is a regional load balancer that provides SSL offloading and WAF, but it cannot distribute traffic across multiple regions or route users to the nearest healthy backend region globally. Option D (Azure Content Delivery Network (CDN)) is wrong because it focuses on caching static content at edge locations and does not provide SSL offloading, WAF, or intelligent routing to the nearest healthy backend region for dynamic traffic.

Practice this question →

8

MCQhard

You are designing a disaster recovery strategy for an Azure virtual machine running a SQL Server Always On availability group. The primary region is East US, and the secondary region is West US. You need to ensure minimal data loss and automatic failover. Which Azure service should you use for cross-region replication of the managed disks?

A.Azure Traffic Manager

B.Azure Site Recovery

C.Azure Backup

D.Azure Storage Geo-Redundant Storage (GRS)

AnswerB

Azure Site Recovery replicates Azure VMs and supports automatic failover with low RPO.

Why this answer

Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs across regions. For a SQL Server Always On availability group, ASR can replicate the managed disks at the VM level, enabling automatic failover to the West US region with minimal data loss by using crash-consistent or app-consistent recovery points. This meets the requirement for cross-region replication with automatic failover, unlike storage-level replication which does not provide orchestrated failover.

Exam trap

The trap here is that candidates often confuse Azure Site Recovery with Azure Backup or geo-redundant storage, assuming that storage-level replication (GRS) provides automatic VM failover, when in fact GRS only replicates blobs asynchronously and does not orchestrate compute or application failover.

How to eliminate wrong answers

Option A is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming traffic based on routing methods (e.g., priority, performance), but it does not replicate data or disks; it cannot provide disaster recovery for managed disks. Option C is wrong because Azure Backup provides backup and restore capabilities for VMs and disks, but it is not designed for continuous replication or automatic failover; it requires manual restore and does not meet the minimal data loss and automatic failover requirements. Option D is wrong because Azure Storage Geo-Redundant Storage (GRS) replicates storage accounts to a paired region asynchronously, but it operates at the storage account level, not at the managed disk level for a VM, and it does not provide orchestrated failover of the VM or the SQL Server availability group.

Practice this question →

9

MCQmedium

A company has multiple on-premises sites and Azure VNets in different regions. They need to connect all networks with a single mesh topology, ensuring that any network can communicate with any other network directly. They also want to minimize administrative overhead. Which Azure service should they use?

A.Azure Virtual WAN

B.Azure VPN Gateway

C.Azure ExpressRoute

D.Azure Peering Service

AnswerA

Azure Virtual WAN is the correct choice because it provides a cloud-native mesh connectivity solution built on a hub-and-spoke architecture with regional hubs. It automates the creation of any-to-any connections between branch offices, remote users, and VNets, with integrated routing that eliminates the need to manually configure individual VPN tunnels or peer each VNet. Virtual WAN uses the Microsoft backbone for transit, ensuring consistent low-latency routing across regions and on-premises sites, and supports both Site-to-Site VPN and ExpressRoute in a single managed topology.

Why this answer

Azure Virtual WAN is the correct choice because it provides a managed, global mesh network that automatically connects on-premises sites and Azure VNets across regions using a hub-and-spoke architecture with built-in transitive routing. This eliminates the need to manually configure individual VPN gateways or ExpressRoute circuits for each pair of networks, directly supporting the requirement for any-to-any direct communication with minimal administrative overhead.

Exam trap

The trap here is that candidates often confuse Azure VPN Gateway's ability to create multiple site-to-site connections with a true mesh topology, overlooking that VPN Gateway lacks automatic transitive routing and requires manual configuration for any-to-any connectivity, whereas Virtual WAN provides this natively.

How to eliminate wrong answers

Option B (Azure VPN Gateway) is wrong because it only creates point-to-site or site-to-site connections between individual networks; it does not natively support a full mesh topology without complex, manual configuration of multiple VPN tunnels and route tables, which increases administrative overhead. Option C (Azure ExpressRoute) is wrong because it provides private, dedicated connectivity between on-premises sites and Azure, but it does not inherently create a mesh between multiple on-premises sites or VNets; additional routing and gateway configurations are required to achieve transitive connectivity. Option D (Azure Peering Service) is wrong because it is designed to optimize connectivity to Microsoft cloud services over the internet, not to create a mesh network between customer-owned on-premises sites and Azure VNets.

Practice this question →

10

MCQeasy

A company deploys a web application on multiple Azure VMs. They need to distribute incoming HTTP traffic across the VMs, offload SSL/TLS termination, and maintain session persistence (sticky sessions) so that all requests from a user session go to the same backend VM. Which Azure load balancing solution should they use?

A.Azure Application Gateway

B.Azure Load Balancer

C.Azure Traffic Manager

D.Azure Front Door

AnswerA

Azure Application Gateway is a dedicated layer-7 (HTTP/HTTPS) load balancer that offers SSL offloading by terminating client SSL connections and re-encrypting traffic to backends if needed. It provides cookie-based session affinity, which ensures a user's requests are consistently routed to the same backend VM—a critical requirement for stateful web applications. Additionally, it supports URL path-based routing and an integrated Web Application Firewall, making it the correct choice for a web application deployed on multiple VMs within a single Azure region.

Why this answer

Azure Application Gateway is a Layer 7 load balancer that can route HTTP/HTTPS traffic, offload SSL/TLS termination, and support session persistence using cookie-based affinity. This makes it the correct choice for distributing incoming HTTP traffic across multiple VMs while maintaining sticky sessions and handling SSL termination at the gateway.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), forgetting that SSL termination and cookie-based sticky sessions require Layer 7 capabilities, not just Layer 4 load balancing.

How to eliminate wrong answers

Option B is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot perform SSL/TLS termination or HTTP-level session persistence; it only supports source IP affinity, which is not cookie-based sticky sessions. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not handle SSL termination or session persistence; it directs traffic at the DNS level, not at the application layer. Option D is wrong because Azure Front Door is a global Layer 7 load balancer and CDN that can offload SSL and provide session affinity, but it is designed for global distribution across regions, not for distributing traffic within a single region to multiple VMs; using it for regional load balancing would introduce unnecessary latency and complexity.

Practice this question →

11

MCQeasy

A company deploys a web application across multiple Azure VMs in a single region. They want to distribute incoming HTTP traffic evenly across the VMs, offload SSL encryption, and provide a fixed public IP address for clients. Which Azure load balancing solution should they use?

A.Azure Application Gateway

B.Azure Load Balancer

C.Azure Traffic Manager

D.Azure Front Door

AnswerA

Azure Application Gateway is a regional, layer 7 (HTTP/HTTPS) load balancer that terminates client SSL/TLS connections at the gateway, eliminating backend SSL overhead and enabling centralized certificate management. It exposes a single, fixed public VIP for all incoming web traffic, supports cookie-based session affinity, URL-path-based routing, and WebSocket forwarding, making it the natural choice for an HTTP workload spread across multiple VMs in one Azure region. Unlike layer 4 devices, it inspects HTTP headers and can redirect traffic based on host names or paths, so it fully satisfies the requirement for SSL offloading and a stable public IP for the web application.

Why this answer

Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports HTTP/HTTPS traffic, SSL termination, and cookie-based session affinity. It can distribute incoming HTTP traffic evenly across VMs, offload SSL encryption to reduce backend processing, and provide a fixed public IP address (VIP) for client access. This aligns with all three requirements: load balancing, SSL offload, and a static public IP.

Exam trap

The trap here is confusing Layer 4 (Azure Load Balancer) with Layer 7 (Application Gateway) capabilities, leading candidates to pick Azure Load Balancer because it is the default choice for distributing traffic across VMs, but it cannot offload SSL or handle HTTP-specific features like session affinity.

How to eliminate wrong answers

Option B (Azure Load Balancer) is wrong because it operates at Layer 4 (TCP/UDP) and cannot perform SSL termination or inspect HTTP traffic; it only forwards packets without understanding application-layer protocols. Option C (Azure Traffic Manager) is wrong because it is a DNS-based traffic router that distributes traffic across regions, not within a single region, and it does not provide a fixed public IP for clients (it uses DNS names) nor offloads SSL. Option D (Azure Front Door) is wrong because it is a global Layer 7 service designed for multi-region scenarios with advanced WAF and acceleration features; it does not provide a fixed public IP for clients (it uses a dynamic anycast IP) and is overkill for a single-region deployment.

Practice this question →

12

MCQmedium

A company is designing a disaster recovery solution for a critical application that runs on Azure VMs in a single region. The RTO is 4 hours, and the RPO is 1 hour. The application uses Azure SQL Database. The company wants to minimize the cost of the disaster recovery solution while meeting the RTO and RPO. You need to recommend a solution. What should you recommend?

A.Use Azure SQL Database active geo-replication for the database and Azure Backup for VMs.

B.Use Azure Backup to back up VMs and Azure SQL Database to a secondary region.

C.Use Azure Traffic Manager to distribute traffic to VMs in multiple regions and Azure SQL Database failover groups.

D.Use Azure Site Recovery to replicate VMs to a secondary region and Azure SQL Database geo-replication for the database.

AnswerD

Azure Site Recovery continuously replicates managed disks of Azure VMs to the paired region with an RPO typically measured in seconds to a few minutes, and it supports automated, testable failover, so the compute tier comfortably meets the 1-hour RPO. Azure SQL Database geo-replication (or failover groups) asynchronously replays committed transactions to a secondary database, providing an RPO of seconds and enabling simple failover for the data tier. This combination covers both compute and data with continuous replication rather than backup or traffic routing, making it the correct DR architecture.

Why this answer

Azure Site Recovery provides orchestrated replication and failover for Azure VMs, meeting the 4-hour RTO with automated recovery plans. Azure SQL Database active geo-replication (or failover groups) enables continuous data synchronization with an RPO of 1 hour. This combination minimizes cost by using only the necessary replication services without over-provisioning resources.

Exam trap

The trap here is that candidates often confuse Azure Backup (long-term backup) with Azure Site Recovery (disaster recovery replication), leading them to choose a backup-only solution that cannot meet the RTO/RPO for rapid failover.

How to eliminate wrong answers

Option A is wrong because Azure Backup for VMs is designed for long-term retention and point-in-time restore, not for rapid failover to a secondary region; its RTO typically exceeds 4 hours for full VM recovery. Option B is wrong because Azure Backup for Azure SQL Database backs up to a secondary region as a backup copy, not as a continuously synchronized replica, so it cannot achieve a 1-hour RPO for disaster recovery failover. Option C is wrong because Azure Traffic Manager handles DNS-level traffic distribution but does not replicate VMs or databases; it requires pre-existing multi-region deployments, which contradicts the single-region design and would increase costs unnecessarily.

Practice this question →

13

MCQhard

A company has multiple Azure virtual networks (VNets) spread across three Azure regions (West US, East US, and West Europe). They also have an on-premises network connected to East US via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. They require centralized management of routing and the ability to enforce security policies such as forcing all internet-bound traffic from any VNet to pass through a central firewall in East US. Which Azure solution should they implement?

A.VNet peering between all VNets and use route tables for forced tunneling.

B.Azure Virtual WAN with a secured hub in East US.

C.ExpressRoute Global Reach with VNet peering to connect all VNets.

D.VPN gateways with BGP to connect all VNets.

AnswerB

Azure Virtual WAN provides a scalable hub-and-spoke architecture with centralized routing. A secured hub can include a firewall to enforce forced tunneling and security policies. All VNets and on-premises connect to the hub(s), simplifying management.

Why this answer

Azure Virtual WAN with a secured hub in East US provides a centralized hub-and-spoke architecture that connects all VNets and the on-premises network via ExpressRoute. The secured hub includes Azure Firewall, enabling forced tunneling of all internet-bound traffic from any VNet through the central firewall in East US, while Virtual WAN automatically manages routing between all spokes and the on-premises network.

Exam trap

The trap here is that candidates often assume VNet peering with route tables (Option A) is sufficient for centralized security, but they overlook the operational complexity and lack of built-in forced tunneling enforcement across multiple regions, which Virtual WAN's secured hub solves natively.

How to eliminate wrong answers

Option A is wrong because VNet peering alone creates a full mesh that lacks centralized routing management and cannot enforce forced tunneling through a single firewall without complex route table configurations that become unmanageable across multiple regions. Option C is wrong because ExpressRoute Global Reach only connects on-premises networks to Azure and does not provide inter-VNet connectivity or centralized security policy enforcement; VNet peering would still be needed but without centralized routing. Option D is wrong because VPN gateways with BGP can connect VNets but require a full mesh of VPN tunnels and do not natively support forced tunneling of all internet traffic through a central firewall without additional complex routing and gateway configurations.

Practice this question →

14

MCQmedium

You are designing a connectivity solution for a hybrid network. The company has an on-premises network connected to an Azure virtual network via ExpressRoute. They also have a site-to-site VPN to the same Azure virtual network as a backup. When the ExpressRoute connection fails, traffic should automatically fail over to the VPN. How should you configure the routes to ensure automatic failover?

A.Configure Azure Traffic Manager with a priority routing method to direct traffic to ExpressRoute first.

B.Ensure the ExpressRoute connection has a lower BGP metric than the VPN connection; Azure automatically prefers lower metric.

C.Set the BGP metrics (local preference) on the ExpressRoute connection to be higher than the VPN connection.

D.Configure Azure Route Server to propagate routes with a lower metric for the VPN connection.

AnswerB

ExpressRoute and VPN gateway BGP peering allow Azure to choose between the two paths by comparing BGP attributes; a lower BGP metric (such as MED) on the ExpressRoute connection makes it the preferred route because Azure selects the path with the lowest metric. When the ExpressRoute circuit fails, its route is withdrawn and the VPN route with the higher metric becomes the only available path, enabling automatic failover. This is the standard, supported coexistence design for resilient hybrid networking, and no additional traffic-management or routing services are required.

Why this answer

B is correct because when both ExpressRoute and VPN connections use BGP to advertise routes to Azure, Azure automatically selects the route with the lowest BGP metric (MED). By configuring the ExpressRoute connection with a lower BGP metric than the VPN connection, Azure will prefer the ExpressRoute path under normal conditions. If the ExpressRoute fails, its routes are withdrawn, and Azure falls back to the VPN routes, providing automatic failover.

Exam trap

The trap here is confusing BGP metrics (MED) with local preference; local preference is used for outbound path selection within an AS, while MED influences inbound path selection from a neighbor AS, and Azure uses MED for route preference in hybrid connectivity.

How to eliminate wrong answers

Option A is wrong because Azure Traffic Manager operates at the DNS level and cannot influence routing within a hybrid network; it directs user traffic to endpoints based on DNS resolution, not IP-level path selection for existing connections. Option C is wrong because setting a higher BGP local preference on the ExpressRoute connection would make it less preferred (Azure prefers higher local preference), which would cause the VPN to be used as the primary path, not the backup. Option D is wrong because Azure Route Server is used to exchange routes between virtual network gateways and network virtual appliances (NVAs), not to set metrics for failover between ExpressRoute and VPN; lowering the metric for the VPN connection would make it preferred over ExpressRoute, defeating the failover purpose.

Practice this question →

15

Multi-Selectmedium

Your company is designing a hybrid network architecture that connects multiple on-premises sites to Azure. You need to ensure high availability and redundancy for the connection. Which TWO solutions should you recommend? (Choose two.)

Select 2 answers

A.Deploy two ExpressRoute circuits in active-passive mode

B.Implement Azure DNS Private Resolver for resolution

C.Use Azure VPN Gateway in active-active mode

D.Use a single VPN gateway with active-standby mode

E.Use a single ExpressRoute circuit with a VPN gateway as failover

AnswersA, C

Deploying two ExpressRoute circuits in active-passive mode is correct because each circuit represents a physically distinct path, ideally from different providers and peering locations, to Microsoft's edge, eliminating a single point of failure in the private network. BGP determines the primary path through route preference mechanisms such as local preference or AS path prepend, and on failure the secondary circuit automatically takes over without any configuration change. This architecture satisfies a high-availability hybrid networking requirement and enables the ExpressRoute service-level agreement.

Why this answer

Deploying two ExpressRoute circuits in active-passive mode provides redundancy for the on-premises-to-Azure connection. If the primary circuit fails, traffic automatically fails over to the passive circuit, ensuring high availability. Option C is correct because an Azure VPN Gateway in active-active mode uses two active tunnels to provide redundancy and load balancing, which is essential for a highly available hybrid network.

Exam trap

The trap here is that candidates often confuse redundancy at the gateway level (active-active vs. active-standby) with redundancy at the circuit level, and may incorrectly select a single ExpressRoute circuit with a VPN failover, which still has a single point of failure for the circuit itself.

Practice this question →

16

MCQmedium

A company deploys a web application across multiple Azure VMs in a single region. They need to distribute incoming HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools (e.g., /images to one pool, /api to another). Which Azure load balancing solution should they use?

A.Azure Application Gateway

B.Azure Load Balancer

C.Azure Traffic Manager

D.Azure Front Door

AnswerA

Azure Application Gateway is the correct choice because it operates at Layer 7 (HTTP/HTTPS), enabling URL path-based routing to distribute traffic to backend Azure VM pools based on request paths. It also provides SSL termination at the gateway, reducing the backend VMs' TLS processing overhead, and supports features like cookie-based session affinity, Web Application Firewall (WAF), and autoscaling—all within a single Azure region, which directly matches the deployment architecture.

Why this answer

Azure Application Gateway is a Layer 7 load balancer that can distribute HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools. This directly matches the requirements for routing /images and /api traffic to separate pools while handling SSL termination at the gateway.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming all load balancers can handle HTTP routing and SSL termination, but only Layer 7 solutions like Application Gateway or Front Door can perform URL-based routing and SSL offloading.

How to eliminate wrong answers

Option B is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot perform SSL termination or URL-based routing, which are Layer 7 features. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that directs traffic based on DNS resolution, not HTTP-level routing or SSL termination. Option D is wrong because Azure Front Door is a global Layer 7 service designed for multi-region scenarios with CDN capabilities, but the question specifies a single-region deployment, making Application Gateway the more appropriate and cost-effective choice.

Practice this question →

17

Multi-Selectmedium

A company is designing a network architecture for a three-tier application hosted on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must not have direct internet access. They also need to encrypt traffic between tiers. Which TWO solutions should they implement?

Select 2 answers

A.Use Azure Application Gateway with WAF

B.Deploy a network virtual appliance (NVA) as a reverse proxy for the web tier

C.Use Azure Private Link for the database tier

D.Use Azure Front Door

E.Use VNet peering to connect the tiers

AnswersB, C

NVA can restrict access and encrypt traffic.

Why this answer

Deploying a network virtual appliance (NVA) as a reverse proxy for the web tier allows the web tier to be exposed to the internet while the application and database tiers remain isolated without direct internet access. The NVA can terminate inbound traffic and forward it to the web tier, and it can also enforce encryption (e.g., TLS) between tiers by acting as a secure gateway, meeting the requirement to encrypt traffic between tiers.

Exam trap

The trap here is that candidates often assume Azure Application Gateway or Front Door can handle inter-tier encryption, but these services are designed for inbound internet traffic and do not natively encrypt traffic between internal tiers without additional configuration or third-party tools.

Practice this question →

18

MCQhard

A company is designing a solution to store and analyze petabytes of IoT sensor data. The data is written once, rarely accessed, and must be retained for 10 years for compliance. The data must be queryable using SQL. Which combination of Azure services would be MOST cost-effective?

A.Azure Cosmos DB with analytical store

B.Azure SQL Database with Hyperscale tier

C.Azure Data Lake Storage Gen2 with Azure Synapse Serverless SQL

D.Azure Databricks with Delta Lake

AnswerC

Cost-effective storage and SQL querying.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) provides cost-effective, scalable storage for petabytes of data at low cost, while Azure Synapse Serverless SQL enables on-demand SQL querying directly over the data in ADLS Gen2 without provisioning dedicated compute. This combination meets the write-once, rare-access, 10-year retention, and SQL queryability requirements at the lowest cost because storage is cheap and compute is only billed per query executed.

Exam trap

The trap here is that candidates often choose Azure SQL Database or Cosmos DB because they associate SQL queryability with traditional databases, overlooking that serverless SQL engines over cheap blob storage can provide the same query capability at a fraction of the cost for cold data.

How to eliminate wrong answers

Option A is wrong because Azure Cosmos DB with analytical store is designed for globally distributed, low-latency transactional workloads with high throughput, not for petabyte-scale archival data; its storage cost is significantly higher than ADLS Gen2 for rarely accessed data. Option B is wrong because Azure SQL Database Hyperscale tier is optimized for high-performance OLTP and large databases but incurs ongoing compute and storage costs that are prohibitive for petabytes of write-once, rarely accessed data retained for 10 years. Option D is wrong because Azure Databricks with Delta Lake is a powerful analytics and machine learning platform, but it requires provisioned clusters and incurs continuous compute costs even when idle, making it far more expensive than serverless SQL for occasional querying of archival data.

Practice this question →

19

MCQhard

A company has multiple Azure VNets deployed in a hub-spoke topology. They want to inspect all outbound internet traffic from spoke VMs using a central firewall and ensure that traffic from all VNets goes through the firewall before reaching the internet. They also need to log all outbound connections. Which architecture should they implement?

A.Deploy network virtual appliances (NVAs) in each spoke VNet and configure user-defined routes (UDRs) to route internet traffic to the NVAs

B.Deploy Azure Firewall in the hub VNet and configure a default route (0.0.0.0/0) in each spoke's route table pointing to Azure Firewall as the next hop

C.Use Azure Application Gateway with Web Application Firewall (WAF) in the hub VNet to inspect all traffic

D.Deploy Azure Firewall in each spoke VNet and use Azure Monitor to aggregate logs

AnswerB

In this design, Azure Firewall is deployed into a dedicated AzureFirewallSubnet in the hub, and each spoke's route table contains a 0.0.0.0/0 UDR with the firewall's private IP as the next hop. Because Azure Firewall performs destination NAT and source network address translation (SNAT), all spoke egress emerges from the hub with a single public IP while every connection is logged and inspectable. This creates a true central enforcement point for outbound traffic, supports policy consistency, and is the standard hub-spoke egress pattern.

Why this answer

Azure Firewall is a managed, stateful firewall-as-a-service that can centrally inspect and log outbound internet traffic. By deploying Azure Firewall in the hub VNet and configuring a default route (0.0.0.0/0) in each spoke's route table with the Azure Firewall private IP as the next hop, all outbound traffic from spoke VMs is forced through the firewall before reaching the internet. This satisfies both the inspection and logging requirements, as Azure Firewall provides built-in outbound connection logging via diagnostic settings.

Exam trap

The trap here is that candidates often confuse Azure Firewall with Azure Application Gateway, mistakenly thinking WAF can inspect outbound traffic, or they assume deploying NVAs per spoke is acceptable for central inspection, missing the requirement for a single central firewall in the hub.

How to eliminate wrong answers

Option A is wrong because deploying NVAs in each spoke VNet violates the central inspection requirement and introduces management overhead; it also does not ensure traffic from all VNets goes through a single central firewall. Option C is wrong because Azure Application Gateway with WAF is a Layer 7 load balancer designed for inbound HTTP/S traffic inspection, not for routing or inspecting all outbound internet traffic (including non-HTTP protocols). Option D is wrong because deploying Azure Firewall in each spoke VNet creates a decentralized model that fails the central inspection requirement, and Azure Monitor alone does not enforce routing—it only aggregates logs without controlling traffic flow.

Practice this question →

20

MCQmedium

A company is deploying a web application on Azure App Service. They need to guarantee that all traffic from the internet goes through a Web Application Firewall (WAF) before reaching the app. The solution must be cost-effective for a single application. Which Azure service should they place in front of the App Service?

A.Azure Application Gateway with WAF.

B.Azure Front Door with WAF policy.

C.Azure Firewall with application rules.

D.Azure Traffic Manager.

AnswerA

Application Gateway is a regional Layer 7 load balancer that integrates WAF. It can be placed directly in front of App Service to inspect all incoming traffic. This is a cost-effective solution for a single-region application.

Why this answer

Azure Application Gateway with WAF is the correct choice because it provides a regional, layer-7 load balancer with built-in Web Application Firewall capabilities, designed to protect web applications from common exploits and vulnerabilities. For a single application, it is more cost-effective than Azure Front Door, which is a global service with higher minimum costs and additional features not required here. Application Gateway can be deployed directly in front of App Service to inspect and filter all internet traffic before it reaches the app.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Application Gateway, assuming Front Door is always the better choice for WAF, but the question's emphasis on cost-effectiveness for a single application points to the regional, lower-cost Application Gateway instead.

How to eliminate wrong answers

Option B is wrong because Azure Front Door is a global, multi-region load balancer and application delivery network; while it supports WAF policies, it is designed for multi-region deployments and incurs higher costs, making it less cost-effective for a single application. Option C is wrong because Azure Firewall is a network-layer firewall that filters traffic based on IP addresses, ports, and protocols, not at the application layer (HTTP/HTTPS), so it cannot provide Web Application Firewall capabilities to inspect and block web application attacks like SQL injection or cross-site scripting. Option D is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes traffic based on routing methods (e.g., performance, priority) but does not include any WAF or application-layer inspection capabilities.

Practice this question →

21

MCQmedium

Your company is migrating a legacy on-premises application to Azure. The application requires persistent storage for configuration files that must be accessible from multiple virtual machines in a virtual network. The storage must be accessible only from within the virtual network and should not be exposed to the internet. Which Azure storage solution should you use?

A.Azure Disk Storage with shared disks

B.Azure NetApp Files with network security groups

C.Azure Blob Storage with a service endpoint

D.Azure Files with a private endpoint

AnswerD

Azure Files provides fully managed SMB file shares (also supports NFS for premium tiers) that can be mounted concurrently by multiple VMs, making it the most direct migration target for a legacy on-premises file-based application. By configuring a private endpoint, the file share is assigned a private IP address within your Azure virtual network, eliminating exposure to the public internet and ensuring traffic stays on the Microsoft backbone. Private endpoints also integrate with NSGs, private DNS zones, and Azure Active Directory authentication, giving you fine-grained access control and meeting security requirements without sacrificing the native file-protocol compatibility that legacy applications rely on.

Why this answer

Azure Files with a private endpoint is the correct choice because it provides fully managed file shares accessible via SMB or NFS protocols, supports persistent storage for configuration files, and ensures the storage is accessible only from within the virtual network by assigning a private IP address from the VNet, eliminating internet exposure. This meets the requirement for multi-VM access with network isolation.

Exam trap

The trap here is that candidates often confuse service endpoints (which still expose the storage to the internet at the endpoint level) with private endpoints (which fully isolate the resource within the VNet), and they may overlook that Azure Files supports SMB for shared file access while Blob Storage does not.

How to eliminate wrong answers

Option A is wrong because Azure Disk Storage with shared disks is a block-level storage solution designed for clustered applications (e.g., SQL Server FCI) and does not natively support file-level access or SMB/NFS protocols required for configuration files; it also cannot be easily accessed from multiple VMs without complex clustering. Option B is wrong because Azure NetApp Files is a high-performance file service that can use network security groups, but it is overkill for simple configuration files and incurs higher cost and complexity; more critically, NSGs alone do not guarantee complete internet isolation—a private endpoint is the proper method for VNet-only access. Option C is wrong because Azure Blob Storage with a service endpoint still exposes the storage account to the public internet (though restricted to the VNet), and Blob Storage is object storage not designed for file-sharing protocols like SMB, making it unsuitable for configuration files that need to be mounted as a drive.

Practice this question →

22

MCQhard

Your company has a hybrid identity environment using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to authenticate to Azure services using their on-premises credentials and enforce conditional access policies for sensitive applications. The solution must support multi-factor authentication (MFA) using the Microsoft Authenticator app. Which components should you include?

A.Microsoft Entra Connect Health, Microsoft Entra ID with cloud sync, and Azure AD Identity Protection.

B.Microsoft Entra Connect Sync, Microsoft Entra ID, and Conditional Access policies with MFA.

C.Active Directory Federation Services (AD FS), Web Application Proxy, and Azure AD Conditional Access.

D.Azure AD Pass-through Authentication, Azure AD Application Proxy, and Azure AD Identity Protection.

AnswerB

Connect Sync syncs identities; Entra ID provides authentication and conditional access can require MFA via Authenticator.

Why this answer

Microsoft Entra Connect Sync synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials. Conditional Access policies in Microsoft Entra ID can then enforce MFA using the Microsoft Authenticator app for sensitive applications, meeting all requirements without additional infrastructure.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing on-premises federation (AD FS) or pass-through authentication, not realizing that Microsoft Entra Connect Sync with Conditional Access is the simplest and most scalable approach for hybrid identity with MFA enforcement.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Connect Health is a monitoring tool, not an authentication component, and cloud sync does not support the full identity synchronization needed for seamless on-premises credential authentication; it also lacks the Conditional Access enforcement required. Option C is wrong because AD FS and Web Application Proxy introduce an unnecessary on-premises federation server, adding complexity and single points of failure, while the requirement can be met with cloud-native Microsoft Entra ID and Conditional Access. Option D is wrong because Azure AD Pass-through Authentication requires on-premises agents and does not natively support Conditional Access policies with MFA enforcement in the same integrated way as Microsoft Entra ID; Azure AD Application Proxy is for publishing on-premises apps, not for authentication, and Identity Protection is a risk-detection service, not an authentication component.

Practice this question →

23

MCQhard

A global e-commerce company deploys its web application on Azure Kubernetes Service (AKS) clusters in multiple Azure regions. They need a single global endpoint for users, with SSL offloading, web application firewall (WAF) protection, and URL path-based routing to the nearest healthy AKS cluster. Which Azure service should they use?

A.Azure Front Door

B.Azure Traffic Manager

C.Azure Application Gateway

D.Azure Load Balancer

AnswerA

Azure Front Door is correct because it operates at Layer 7 as a global entry point using Microsoft's edge network. It supports SSL offloading, web application firewall (WAF), and URL path-based routing, and it uses anycast to route users to the nearest healthy backend based on global health probes. This uniquely combines global distribution with HTTP-layer intelligence and security, making it ideal for a globally distributed e-commerce web application.

Why this answer

Azure Front Door is the correct choice because it provides a single global endpoint with SSL offloading, WAF protection, and URL path-based routing. It uses Anycast-based routing to direct traffic to the nearest healthy AKS cluster, ensuring low latency and high availability across multiple regions.

Exam trap

The trap here is that candidates often confuse Azure Traffic Manager (DNS-level) with Azure Front Door (application-layer), overlooking the need for SSL offloading, WAF, and path-based routing that only Front Door provides.

How to eliminate wrong answers

Option B (Azure Traffic Manager) is wrong because it operates at the DNS level and does not support SSL offloading, WAF, or URL path-based routing; it only provides DNS-based traffic distribution. Option C (Azure Application Gateway) is wrong because it is a regional load balancer that cannot provide a single global endpoint across multiple Azure regions; it lacks global Anycast routing. Option D (Azure Load Balancer) is wrong because it operates at Layer 4 (TCP/UDP) and does not support SSL offloading, WAF, or URL path-based routing; it is designed for regional traffic distribution within a single region.

Practice this question →

24

MCQeasy

A company deploys a stateless web application on Azure VMs in a single region. They need to distribute incoming HTTP traffic across multiple VMs and perform health checks. The solution should be highly available within the region. Which Azure load balancing solution should they use?

A.Azure Load Balancer (Standard) with HTTP health probe.

B.Azure Application Gateway v2.

C.Azure Traffic Manager.

D.Azure Front Door.

AnswerA

The Standard Load Balancer is a regional Layer 4 load balancer that distributes TCP/UDP traffic across backend VM instances. Its HTTP health probe periodically sends HTTP GET requests to the configured path and removes any VM that does not return a 2xx status, enabling automatic failover. Being zone-redundant, it provides high availability within a region, and because the app is stateless, no session persistence or Layer 7 routing is needed. This makes it the simplest, most cost-effective choice.

Why this answer

Azure Load Balancer (Standard) operates at Layer 4 (TCP/UDP) and can distribute HTTP traffic across VMs in a single region while performing health checks via HTTP health probes. It provides high availability within a region by distributing traffic across availability zones or availability sets, meeting the requirement for a stateless web application without needing Layer 7 features.

Exam trap

The trap here is that candidates often choose Azure Application Gateway v2 because they assume HTTP traffic requires a Layer 7 load balancer, but Azure Load Balancer can handle HTTP traffic at Layer 4 with HTTP health probes, making it the simpler and more cost-effective choice for a stateless web application within a single region.

How to eliminate wrong answers

Option B is wrong because Azure Application Gateway v2 is a Layer 7 load balancer with features like SSL termination, URL-based routing, and WAF, which are unnecessary for a stateless web application that only needs basic HTTP traffic distribution and health checks, adding cost and complexity. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic routing solution that operates across regions, not within a single region, and does not perform health checks on individual VMs or distribute incoming HTTP traffic directly. Option D is wrong because Azure Front Door is a global Layer 7 load balancer and CDN that routes traffic across regions, not within a single region, and includes features like SSL offload and WAF that are not required for this scenario.

Practice this question →

25

Multi-Selecthard

Your company plans to migrate a large number of on-premises virtual machines to Azure. You need to assess the current environment and migrate the workloads with minimal downtime. Which THREE Azure services or tools should you use? (Choose three.)

Select 3 answers

A.Azure App Service

B.Azure Import/Export Service

C.Azure Data Box

D.Azure Site Recovery

E.Azure Migrate

AnswersC, D, E

Azure Data Box is a physical appliance that Microsoft ships to your site, enabling secure, offline bulk transfer of up to 80 TB of data over a high-speed local copy path when network bandwidth is limited or non-existent. After you copy data onto the device, you return it, and Microsoft uploads the data to an Azure storage account. This makes Data Box ideal for large initial data loads, but it is not itself a continuous replication or live migration tool; it facilitates lifting and shifting data, which can then be attached to newly deployed VMs. For a migration involving a huge volume of on-premises data with constrained connectivity, Data Box provides the fastest and most cost-effective way to move the raw data into Azure.

Why this answer

Azure Data Box is correct because it enables large-scale offline data transfer for environments with limited network bandwidth, allowing you to migrate terabytes of VM data to Azure without relying on slow or unstable connections. This service is ideal for the initial bulk copy of on-premises VM disks, which can then be used with Azure Migrate for assessment and Azure Site Recovery for ongoing replication with minimal downtime.

Exam trap

The trap here is that candidates often confuse Azure Data Box with Azure Import/Export Service, but Data Box is the modern, recommended service for large-scale offline migration, while Import/Export is outdated and less integrated with Azure Migrate and Site Recovery.

Practice this question →

26

MCQmedium

A company plans to deploy multiple virtual machines (VMs) across two Azure regions for high availability. The VMs will host a stateless web application that must be accessible via a single DNS endpoint. The solution must automatically route traffic to the nearest region with available capacity and provide failover if a region becomes unhealthy. Which Azure service should they use to meet these requirements?

A.Azure Traffic Manager

B.Azure Front Door

C.Azure Load Balancer

D.Azure Application Gateway

AnswerA

Azure Traffic Manager is a DNS-based global load balancer that routes incoming DNS requests to the most appropriate regional endpoint based on routing methods such as performance, geographic, weighted, or priority. It continuously monitors endpoint health and can automatically redirect traffic away from failed or overloaded regions, ensuring high availability and capacity-aware distribution across multiple VMs in different regions.

Why this answer

Azure Traffic Manager is a DNS-based traffic load balancer that distributes traffic to the nearest region with available capacity using the Performance traffic-routing method, and it automatically fails over to the next healthy endpoint when a region becomes unhealthy. It operates at the DNS level, returning the appropriate endpoint IP based on the client's DNS resolver location and endpoint health probes, making it ideal for stateless web applications requiring a single DNS endpoint across regions.

Exam trap

The trap here is that candidates often confuse Azure Front Door (Layer 7, HTTP/HTTPS) with Traffic Manager (DNS-based, any protocol), but the requirement for a single DNS endpoint and region-level failover without specifying HTTP makes Traffic Manager the correct choice.

How to eliminate wrong answers

Option B (Azure Front Door) is wrong because it is an HTTP/HTTPS application delivery controller that provides global load balancing with SSL offload and path-based routing, but it operates at Layer 7 and requires HTTP traffic, whereas the question does not specify HTTP-only traffic and Traffic Manager works at DNS level for any protocol. Option C (Azure Load Balancer) is wrong because it operates at Layer 4 and distributes traffic only within a single region, not across multiple Azure regions. Option D (Azure Application Gateway) is wrong because it is a regional Layer 7 load balancer with HTTP/HTTPS features and cannot route traffic across multiple regions or provide global failover.

Practice this question →

27

MCQeasy

A company is deploying a multi-tier web application on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must be isolated within the virtual network. The solution must provide SSL termination, web application firewall (WAF) capabilities, and URL-based routing. Which Azure service should they use to expose the web tier?

A.Use an Azure Load Balancer and configure NSGs on each subnet.

B.Use Azure Firewall to inspect all traffic and allow internet traffic to the web tier.

C.Use Azure Application Gateway with WAF, and configure NSGs to restrict traffic between tiers.

D.Use Azure Front Door to expose the web tier and NSGs for internal isolation.

AnswerC

Azure Application Gateway is a Layer 7 regional load balancer that provides SSL termination, WAF, URL-based routing, and cookie-based session affinity, making it the appropriate entry point for the web tier. By enabling WAF, it actively blocks common web vulnerabilities such as SQL injection and cross-site scripting before they reach the backend. Complementing this with NSGs on each subnet enforces network-level isolation, ensuring that only the web tier can communicate with the app tier on specific ports (e.g., 8080/tcp) and that the app tier cannot initiate outbound connections to the internet. This combination of application-layer protection and subnet-level access control exactly matches the requirement to restrict traffic between tiers while securely exposing the web tier.

Why this answer

Azure Application Gateway is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL-based routing, making it ideal for exposing a web tier to the internet. By placing the gateway in front of the web tier and configuring network security groups (NSGs) on the application and database subnets, you can isolate internal tiers while meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming a basic load balancer can handle SSL termination and WAF, when in fact those features require Layer 7 capabilities.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 and cannot perform SSL termination, WAF inspection, or URL-based routing; it only distributes traffic based on IP and port. Option B is wrong because Azure Firewall is a stateful Layer 3/4 firewall that does not provide SSL termination or URL-based routing, and it is not designed to act as a reverse proxy for web tiers. Option D is wrong because Azure Front Door is a global Layer 7 service that excels at CDN and cross-region routing but does not natively support URL-based routing within a single virtual network; it is typically used for global load balancing, not for internal tier isolation with NSGs.

Practice this question →

28

MCQmedium

A company has Azure virtual networks (VNets) in three different Azure regions and an on-premises data center connected via ExpressRoute. They need to connect all VNets to each other and to on-premises over the Microsoft global backbone. They also require centralized management of routing and the ability to enforce security policies such as forced tunneling for internet-bound traffic. Which Azure service should they use?

A.Azure Virtual Network Manager

B.Azure Virtual WAN

C.Azure Firewall

D.Azure Route Server

AnswerB

Azure Virtual WAN is Microsoft's global transit networking service that builds a hub-and-spoke architecture with virtual hubs deployed in each region. Each virtual hub contains integrated VPN, ExpressRoute, and (optionally) Azure Firewall components, and the hubs are interconnected via Microsoft's high-speed backbone, enabling VNet-to-VNet, branch-to-VNet, and remote-user-to-VNet connectivity. It automatically manages routing tables, supports forced tunneling, and provides centralized policy management, making it the correct choice when you need reliable global transit between VNets in three different regions and on-premises connectivity.

Why this answer

Azure Virtual WAN is the correct choice because it provides a hub-and-spoke architecture that connects VNets across regions and on-premises via the Microsoft global backbone, with built-in centralized routing management and the ability to enforce security policies like forced tunneling through integrated Azure Firewall or third-party NVAs. It meets all requirements: multi-region VNet connectivity, ExpressRoute integration, and centralized policy control.

Exam trap

The trap here is that candidates often confuse Azure Virtual Network Manager (a connectivity configuration tool) with Azure Virtual WAN (a full SD-WAN solution), overlooking that Virtual WAN provides the actual routing, global transit, and integrated security enforcement required for multi-region and hybrid connectivity.

How to eliminate wrong answers

Option A is wrong because Azure Virtual Network Manager manages network group membership and connectivity configurations (like mesh or hub-and-spoke) but does not provide built-in routing management, forced tunneling, or direct integration with ExpressRoute for global backbone connectivity. Option C is wrong because Azure Firewall is a stateful firewall service that enforces security policies and forced tunneling, but it does not provide the underlying connectivity between VNets and on-premises or centralized routing management across regions. Option D is wrong because Azure Route Server enables dynamic route exchange between NVAs and Azure VNets but does not provide the global connectivity fabric, centralized routing management, or forced tunneling enforcement required for multi-region and on-premises integration.

Practice this question →

29

MCQmedium

A company deploys a web application on Azure VMs across multiple availability zones in the East US region. They need to distribute incoming HTTPS traffic across the VMs, offload SSL termination, and ensure that client requests from the same user session are sent to the same backend VM (session persistence). Which Azure load balancing solution should they choose?

A.Azure Application Gateway v2 with cookie-based affinity

B.Azure Load Balancer Standard with source IP affinity

C.Azure Traffic Manager with performance routing

D.Azure Front Door with session affinity

AnswerA

Azure Application Gateway v2 is the correct choice because it operates at Layer 7, allowing it to terminate SSL/TLS and inspect HTTP headers and cookies. With cookie-based affinity, the gateway sets a session cookie to bind a client to the same backend VM for the duration of the session, which is essential for stateful web applications. Additionally, v2 supports zone-redundant deployment, enabling automatic distribution of traffic across VMs placed in different availability zones.

Why this answer

Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that can offload SSL termination, distribute HTTPS traffic, and support cookie-based session affinity (also known as sticky sessions). Cookie-based affinity ensures that all requests from the same user session are routed to the same backend VM by injecting an Application Gateway-managed cookie into the client's response. This meets all three requirements: HTTPS traffic distribution, SSL offloading, and session persistence.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming that 'session persistence' alone is enough, but they overlook the explicit requirement for SSL termination, which only a Layer 7 solution like Application Gateway can provide.

How to eliminate wrong answers

Option B is wrong because Azure Load Balancer Standard operates at Layer 4 (TCP/UDP) and cannot offload SSL termination; it also supports source IP affinity for session persistence, but that is not cookie-based and does not handle HTTPS termination. Option C is wrong because Azure Traffic Manager is a DNS-level traffic router that does not perform SSL termination or session persistence; it only directs traffic based on routing methods like performance, priority, or geographic, and does not inspect HTTP/HTTPS payloads. Option D is wrong because Azure Front Door does support session affinity and SSL offloading, but it is a global load balancer and CDN service designed for multi-region distribution, not for distributing traffic across VMs within a single Azure region (East US) across availability zones; it adds unnecessary latency and complexity for a regional-only deployment.

Practice this question →

30

MCQeasy

A company deploys a web application on Azure VMs. They need to distribute incoming HTTP and HTTPS traffic based on the URL path: requests to /api/* go to one VM pool, requests to /images/* go to another pool. They also need to offload SSL/TLS termination. Which Azure load balancing solution should they use?

A.Azure Load Balancer

B.Azure Application Gateway

C.Azure Traffic Manager

D.Azure Front Door

AnswerB

Azure Application Gateway is a Layer 7 web traffic load balancer that provides advanced application-level features, including URL path-based routing, SSL/TLS termination, cookie-based session affinity, and an optional Web Application Firewall (WAF). It allows traffic to be routed to different backend pools based on URL patterns, which directly meets the stated requirement. This makes it the correct choice for regional Azure VM web applications needing path-based routing and SSL offload.

Why this answer

Azure Application Gateway is a layer-7 load balancer that can route traffic based on URL path (e.g., /api/* vs /images/*) and provides SSL/TLS termination at the gateway, offloading the decryption from the backend VMs. This matches both requirements exactly, whereas other solutions either lack layer-7 path-based routing or are designed for global traffic distribution.

Exam trap

The trap here is that candidates often confuse Azure Application Gateway (regional layer-7 routing) with Azure Front Door (global layer-7 routing) or Azure Load Balancer (layer-4), failing to recognize that only Application Gateway provides both URL path-based routing and SSL termination for a single-region deployment.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at layer 4 (TCP/UDP) and cannot route based on URL path or perform SSL/TLS termination; it only distributes traffic by IP and port. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic load balancer that routes based on DNS queries, not URL paths, and does not offload SSL/TLS termination. Option D is wrong because Azure Front Door is a global layer-7 service that can route by URL path and offload SSL, but it is designed for global distribution across regions, not for routing within a single region to VM pools; Application Gateway is the correct regional solution for this scenario.

Practice this question →

31

MCQeasy

A company plans to deploy a web application on Azure virtual machines. They want to protect against a datacenter failure within a region. The VMs must be distributed across multiple physically separate locations with independent power, cooling, and networking. Which deployment option should they use?

A.Availability Set

B.Availability Zones

C.Virtual Machine Scale Set

D.Proximity Placement Group

AnswerB

Availability Zones are physically separate locations inside an Azure region, each with its own independent power, cooling, and networking, and each containing at least one datacenter. By placing VMs in different zones, you ensure that no single datacenter failure can bring down all instances, because the zones are designed as isolated failure domains with no shared infrastructure. This is why zone-redundant deployment is the direct answer to protecting against a full datacenter outage.

Why this answer

Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application is protected against a single datacenter failure, meeting the requirement for fault isolation at the datacenter level.

Exam trap

The trap here is that candidates often confuse Availability Sets (which protect against rack-level failures within a single datacenter) with Availability Zones (which protect against entire datacenter failures), leading them to select the wrong option when the question explicitly requires physically separate locations with independent infrastructure.

How to eliminate wrong answers

Option A is wrong because an Availability Set protects against failures within a single datacenter (rack-level faults) by distributing VMs across update and fault domains, not across physically separate datacenters. Option C is wrong because a Virtual Machine Scale Set is primarily for auto-scaling and managing identical VMs; while it can use Availability Zones, the scale set itself is not a deployment option that guarantees distribution across physically separate locations without explicit zone configuration. Option D is wrong because a Proximity Placement Group is designed to reduce network latency by co-locating VMs close together, which is the opposite of distributing them across physically separate locations.

Practice this question →

32

MCQmedium

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

A.A

B.B

C.C

D.D

AnswerA

This is the correct design because each data center establishes its own dedicated ExpressRoute circuit as the primary path, ensuring predictable, high-bandwidth, and low-latency connectivity to Azure with an SLA-backed private link. The site-to-site VPN for each data center acts as an IPsec-based backup over the internet, providing a cost-effective failover path that automatically kicks in if the ExpressRoute circuit fails. This active/passive redundancy model is a best practice for hybrid networking, as it avoids a single point of failure while keeping operational costs reasonable.

Why this answer

Azure ExpressRoute provides a private, high-bandwidth, and reliable connection from on-premises data centers to Azure, bypassing the public internet. To meet the low-cost backup requirement, Azure VPN Gateway (Site-to-Site VPN) offers a secure, encrypted connection over the internet as a failover path, which is significantly cheaper than a second ExpressRoute circuit. This combination ensures primary connectivity via ExpressRoute and cost-effective redundancy via VPN.

Exam trap

The trap here is that candidates often assume two ExpressRoute circuits are needed for redundancy, overlooking the cost-effective VPN backup option that still meets the 'low-cost' requirement while providing private connectivity only for the primary link.

How to eliminate wrong answers

Option B is wrong because using two ExpressRoute circuits for primary and backup is not low-cost; it doubles the recurring expense and is unnecessary for a backup path. Option C is wrong because using two Site-to-Site VPN connections for both primary and backup does not provide the high-bandwidth, reliable, private connection required; VPNs are internet-based and subject to latency and bandwidth limitations. Option D is wrong because using a single ExpressRoute circuit without any backup fails the requirement for a backup connection in case of failure.

Practice this question →

33

MCQmedium

A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones. The application needs to automatically distribute incoming HTTPS traffic, offload SSL/TLS termination, and provide session persistence. Additionally, the solution must include a Web Application Firewall (WAF) to protect against common web vulnerabilities. Which Azure load balancing solution should they use?

A.Azure Load Balancer

B.Azure Traffic Manager

C.Azure Application Gateway

D.Azure Front Door

AnswerC

Azure Application Gateway is a regional Layer 7 load balancer that routes HTTP/S traffic intelligently using URL paths, host headers, or other HTTP attributes, and it terminates SSL/TLS connections at the gateway to offload encryption from backend VMs. It provides cookie-based session affinity so a user's session sticks to the same server, and its built-in Web Application Firewall (WAF) blocks common exploits such as SQL injection and cross-site scripting. Autoscaling and availability-zone support make it a robust choice for production web workloads, delivering all the needed features in one regional service.

Why this answer

Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that can route HTTPS traffic, offload SSL/TLS termination, and provide session persistence (cookie-based affinity). It also natively integrates a Web Application Firewall (WAF) to protect against common web vulnerabilities like SQL injection and cross-site scripting.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Application Gateway because both offer WAF and SSL offload, but Front Door is optimized for global multi-region traffic management, not for intra-region zone-resilient load balancing with session persistence, which is the specific requirement in this question.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot perform SSL/TLS termination, session persistence based on application cookies, or provide a WAF. Option B is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes traffic at the DNS level (Layer 3/4) and does not handle SSL/TLS termination, session persistence, or WAF capabilities. Option D is wrong because Azure Front Door is a global Layer 7 load balancer and CDN that can offload SSL and provide WAF, but it is designed for global HTTP(S) traffic distribution across regions, not for intra-region multi-zone distribution with session persistence; Application Gateway is the appropriate choice for regional, zone-resilient deployments.

Practice this question →

34

MCQeasy

A company deploys a web application on Azure VMs across availability zones. They need to distribute HTTPS traffic, offload SSL termination, and maintain session persistence. They do not require traffic inspection. Which Azure load balancing solution should they use?

A.Azure Application Gateway v2.

B.Azure Load Balancer (Standard).

C.Azure Traffic Manager.

D.Azure Front Door.

AnswerA

Azure Application Gateway v2 is the correct choice because it operates as a regional Layer 7 load balancer, directly supporting HTTPS termination, cookie-based session persistence (affinity), and HTTP health probes for backend VMs. Its v2 SKU is designed to span availability zones, enabling zone-redundant deployment across VM sets within a single region. Unlike global services, it stays in the region, minimizing latency while providing all required web-layer capabilities.

Why this answer

Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports HTTPS traffic distribution, SSL termination (offloading the decryption burden from backend VMs), and session persistence via cookie-based affinity. It meets all requirements without needing traffic inspection, which is optional and can be disabled.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming any load balancer can handle SSL termination, but only Layer 7 solutions like Application Gateway or Front Door can offload SSL and maintain session persistence at the application layer.

How to eliminate wrong answers

Option B (Azure Load Balancer Standard) is wrong because it operates at Layer 4 (TCP/UDP) and cannot perform SSL termination or application-layer session persistence; it only distributes traffic based on IP and port. Option C (Azure Traffic Manager) is wrong because it is a DNS-based global traffic router that does not handle HTTPS traffic directly, SSL termination, or session persistence at the application layer. Option D (Azure Front Door) is wrong because it is a global Layer 7 service with built-in WAF and traffic inspection capabilities, which is unnecessary here and adds complexity; it also requires a custom domain for SSL termination, whereas Application Gateway v2 is a regional solution better suited for this scenario.

Practice this question →

35

MCQmedium

You are designing a disaster recovery solution for an Azure IaaS workload. The application runs on Azure VMs in a single region and requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which of the following is the most cost-effective approach to meet these requirements?

A.Configure geo-redundant storage (GRS) for the VM disks and manually attach them to new VMs in the secondary region.

B.Use Azure Front Door with a back-end pool containing VMs in both regions, and configure health probes to route traffic on failure.

C.Deploy Azure Site Recovery to replicate VMs to the secondary region with a replication policy that meets the RPO and RTO.

D.Use Azure Backup to back up VMs to a Recovery Services vault in the secondary region and perform restore during failover.

AnswerC

Azure Site Recovery offers continuous replication with RPO as low as 30 seconds and automated failover minutes, meeting both requirements cost-effectively.

Why this answer

Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs to a secondary region with configurable RPO (as low as 30 seconds) and supports automated failover, meeting the 15-minute RPO and 4-hour RTO requirements. It is the most cost-effective because it replicates only changed blocks and does not require running standby VMs, unlike multi-region active deployments.

Exam trap

The trap here is that candidates confuse Azure Backup (which is for archival and long-term recovery) with Azure Site Recovery (which is for replication and rapid failover), leading them to choose Option D despite its inadequate RPO and RTO for disaster recovery scenarios.

How to eliminate wrong answers

Option A is wrong because manually attaching GRS-based disks to new VMs in the secondary region cannot guarantee a 15-minute RPO (GRS replication is asynchronous with a typical lag of hours) and the manual process would exceed the 4-hour RTO. Option B is wrong because Azure Front Door is a global load balancer for web traffic, not a disaster recovery replication tool; it does not replicate VM state or data, so it cannot meet RPO/RTO for IaaS workloads. Option D is wrong because Azure Backup is designed for long-term retention and point-in-time restores, with typical RPO of 24 hours for daily backups and restore times that can exceed 4 hours, making it unsuitable for the required 15-minute RPO and 4-hour RTO.

Practice this question →

36

MCQeasy

A company deploys a web application on multiple Azure virtual machines (VMs) in a single region. The application receives HTTP and HTTPS traffic. They need to distribute the traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Additionally, they need to route requests based on URL paths (e.g., /api/* to one pool, /images/* to another). Which Azure load balancing solution should they use?

A.Azure Load Balancer

B.Azure Application Gateway

C.Azure Front Door

D.Azure Traffic Manager

AnswerB

Azure Application Gateway is a layer-7 load balancer specifically designed for HTTP(S) traffic. It supports SSL termination (and end-to-end SSL), cookie-based session affinity, URL path-based routing to different backend pools, and integrates with the Web Application Firewall (WAF). This makes it the correct choice for the company's stated requirements, as it directly handles application-level routing and persistence without the complexity of a global service.

Why this answer

Azure Application Gateway is the correct choice because it is a layer-7 load balancer that supports SSL/TLS termination, URL path-based routing, and session persistence (sticky sessions) via cookies. These features directly match the requirements for distributing HTTP/HTTPS traffic, offloading SSL, routing requests based on URL paths, and maintaining user session affinity to the same backend VM.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (layer 4) with Application Gateway (layer 7), assuming any load balancer can handle SSL termination and URL routing, but only layer-7 solutions like Application Gateway provide these application-level features.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at layer 4 (TCP/UDP) and cannot perform SSL/TLS termination, URL path-based routing, or session persistence based on HTTP cookies. Option C is wrong because Azure Front Door is a global layer-7 load balancer and CDN designed for multi-region traffic distribution, not for routing within a single region, and it does not support URL path-based routing to separate backend pools in the same region. Option D is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that operates at layer 3/4 and cannot offload SSL/TLS, route based on URL paths, or provide session persistence.

Practice this question →

37

MCQeasy

A company has an on-premises data center and wants to connect it to Azure with a dedicated, private network connection that is not routed over the public internet. They also need a higher service-level agreement (SLA) compared to VPN-based connections. Which Azure service should they use?

A.Azure VPN Gateway

B.Azure ExpressRoute

C.Azure Bastion

D.Azure Virtual WAN

AnswerB

Azure ExpressRoute establishes a logical private connection to Azure through a connectivity provider or direct peering, with traffic that never traverses the public internet. It uses BGP sessions over dedicated or co-located circuits, offering enterprise-grade reliability, high bandwidth (up to 100 Gbps), and native geographic redundancy across peering locations. The 99.95% SLA for dedicated circuits plus predictable latency make it the correct choice for a dedicated, private hybrid connection.

Why this answer

Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that bypasses the public internet, ensuring lower latency, higher reliability, and a 99.95% SLA (for dedicated circuits) compared to VPN-based connections. This meets the requirement for a private network connection with a higher SLA than VPN Gateway, which relies on internet-based IPSec tunnels with a 99.9% SLA.

Exam trap

The trap here is that candidates often confuse Azure Virtual WAN as a direct replacement for ExpressRoute, but Virtual WAN is a management overlay that still requires ExpressRoute or VPN as the underlying transport, not a dedicated private connection itself.

How to eliminate wrong answers

Option A (Azure VPN Gateway) is wrong because it uses IPSec tunnels over the public internet, which does not provide a dedicated private connection and has a lower SLA (99.9%) than ExpressRoute. Option C (Azure Bastion) is wrong because it is a PaaS service for secure RDP/SSH access to Azure VMs via the browser, not a hybrid connectivity solution between on-premises and Azure. Option D (Azure Virtual WAN) is wrong because it is a networking service that aggregates branch connectivity, but it still requires an underlying connectivity method (VPN or ExpressRoute) to provide the dedicated private link; by itself, it does not offer a dedicated private connection or the higher SLA specified.

Practice this question →

38

MCQeasy

A company plans to deploy a stateless web application on Azure virtual machines. They want to ensure that the application remains available in the event of a hardware failure within a single Azure datacenter. The VMs must be placed in a way that ensures they are on different physical servers and racks, but are still within the same datacenter. Which deployment strategy should they use?

A.Deploy the VMs in an Availability Set.

B.Deploy the VMs in different Availability Zones.

C.Deploy the VMs in a single Virtual Machine Scale Set with a large instance count.

D.Deploy each VM in a separate resource group.

AnswerA

An Availability Set logically groups VMs so Azure distributes them across multiple fault domains (racks with independent power and network) and update domains (groups that are rebooted sequentially during planned maintenance). This contains hardware failures and maintenance events to a subset of the VMs, keeping your stateless web app reachable. It is the correct choice because the requirement is to protect against hardware failure within a single Azure datacenter.

Why this answer

An Availability Set ensures that VMs are distributed across multiple fault domains (different physical servers, racks, and network switches) and update domains within a single Azure datacenter. This protects against hardware failures in that datacenter by guaranteeing that not all VMs are affected by the same local failure, while keeping them in the same datacenter for low-latency communication.

Exam trap

The trap here is that candidates often confuse Availability Zones (which span multiple datacenters) with Availability Sets (which operate within a single datacenter), leading them to select the zone-based option when the question explicitly requires staying within the same datacenter.

How to eliminate wrong answers

Option B is wrong because Availability Zones place VMs in physically separate datacenters within a region, not within the same datacenter, which adds cross-datacenter latency and is not required for the stated goal of surviving a single datacenter hardware failure. Option C is wrong because a single Virtual Machine Scale Set with a large instance count does not by itself enforce distribution across different physical servers and racks unless it is configured with an Availability Set or Availability Zones; a scale set without such placement constraints can place many VMs on the same physical host. Option D is wrong because deploying each VM in a separate resource group has no impact on physical placement or fault domain isolation; resource groups are logical containers for management and RBAC, not for infrastructure redundancy.

Practice this question →

39

MCQmedium

A company is designing a hybrid network solution connecting an on-premises data center to Azure. They require high availability with active-active routing and need to support up to 10 Gbps throughput. Which Azure service should they include in the design?

A.Site-to-Site VPN Gateway

B.Azure Virtual WAN

C.ExpressRoute FastPath

D.ExpressRoute Direct

AnswerD

ExpressRoute Direct provides a dedicated, private Layer-2 connection between your on-premises network and Microsoft's edge at a peering location, with port pairs available at 10 Gbps, 40 Gbps, or 100 Gbps. Since it delivers physical port-level bandwidth rather than a VPN gateway's aggregate limit, it easily satisfies the 10 Gbps throughput requirement. It also supports active-active routing by default through dual routers and BGP sessions, giving the required high availability with an SLA-backed redundant path.

Why this answer

ExpressRoute Direct provides dedicated, private connections from on-premises to Azure, supporting bandwidths up to 100 Gbps (10 Gbps easily). It enables active-active routing by using two circuits with BGP, meeting high availability and throughput requirements. ExpressRoute FastPath is a performance feature that reduces latency but is not a standalone service and does not itself provide active-active routing or guaranteed throughput; it requires an ExpressRoute circuit and does not replace the need for Direct when dedicated throughput is required.

Exam trap

A common mistake is assuming that ExpressRoute FastPath is a standalone service that can provide active-active routing and 10 Gbps throughput. In reality, FastPath is a feature that enhances performance but must be used with an existing ExpressRoute circuit. For dedicated bandwidth and native active-active routing, ExpressRoute Direct is the appropriate service.

How to eliminate wrong answers

Option A is wrong because Site-to-Site VPN Gateway is limited to a maximum throughput of approximately 1.25 Gbps per tunnel (aggregate up to 10 Gbps only with multiple tunnels and specific SKUs), and it relies on the public internet, which does not guarantee the consistent 10 Gbps throughput or the same SLA as a private connection. Option B is wrong because Azure Virtual WAN is a networking orchestration service that can aggregate multiple connection types, but it does not itself provide the high-throughput, dedicated private connectivity required; it would typically use ExpressRoute circuits underneath for such throughput, making it an architectural overlay rather than the direct service needed. Option D is wrong because ExpressRoute FastPath is a feature that improves network performance by bypassing the gateway for certain traffic flows, but it is not a standalone service; it must be enabled on an existing ExpressRoute circuit and does not itself provide the 10 Gbps throughput or active-active routing—it enhances performance after the circuit is in place.

Practice this question →

40

MCQmedium

A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones in the East US region. The application receives HTTPS traffic. They need to distribute incoming traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Which Azure load balancing solution should they choose?

A.Azure Load Balancer

B.Azure Application Gateway

C.Azure Traffic Manager

D.Azure Front Door

AnswerB

Azure Application Gateway is a regional Layer-7 load balancer that terminates SSL and decrypts incoming HTTPS requests, enabling it to inspect HTTP headers and route based on URL paths. It natively provides cookie-based session affinity using the Application Gateway Affinity cookie, which reliably pins a client session to the same backend VM across availability zones. With additional features like URL path-based routing, WebSocket support, and optional WAF integration, it is the appropriate choice for distributing HTTPS traffic to VMs within a single region.

Why this answer

Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports SSL/TLS termination, cookie-based session persistence (affinity), and can distribute HTTPS traffic across VMs in multiple availability zones. These features directly match all three requirements: SSL offloading, session persistence, and cross-zone traffic distribution.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming any load balancer can handle SSL termination and session persistence, but only Layer 7 solutions like Application Gateway or Front Door provide cookie-based affinity and SSL offload.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and does not support SSL/TLS termination or application-layer session persistence; it can only maintain session affinity using source IP hashing, which is not cookie-based and less reliable for HTTPS. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not perform SSL termination or session persistence; it directs clients to regional endpoints based on DNS resolution, not per-request load balancing. Option D is wrong because Azure Front Door is a global Layer 7 service that supports SSL termination and session affinity, but it is designed for global distribution across regions, not for distributing traffic within a single region across availability zones; it adds unnecessary latency and complexity for a regional-only workload.

Practice this question →

41

MCQhard

A company is designing a hub-spoke network topology in Azure. The hub contains a third-party network virtual appliance (NVA) for inspection. Spokes need to communicate with each other, and all inter-spoke traffic must be routed through the NVA in the hub. Which configuration should they use?

A.Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet

B.Configure Azure Firewall in the hub with forced tunneling to on-premises

C.Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA

D.Use VNet peering with gateway transit enabled

AnswerC

The correct approach is to create user-defined routes on each spoke subnet with a route for the other spoke's address space and the next hop set to the private IP address of the hub NVA. Because VNet peering is non-transitive, spoke-to-spoke traffic will not automatically flow through the hub; the UDR overrides the system route to force that path. You must also enable IP forwarding on the NVA network interface and ensure the NVA is in a hub subnet so return traffic takes a symmetric path. This gives precise, deterministic control of inter-spoke inspection and is the standard hub-spoke design pattern.

Why this answer

User-defined routes (UDRs) allow you to explicitly override Azure's default system routes. By adding a route in each spoke subnet with the hub NVA's private IP as the next hop for inter-spoke traffic (e.g., 10.1.0.0/16 -> 10.0.0.4), all traffic between spokes is forced through the NVA for inspection. This ensures the hub-spoke topology meets the requirement without relying on Azure Firewall or Internet routing.

Exam trap

The trap here is that candidates often confuse VNet peering's built-in transitive routing (which is disabled by default) with the ability to force traffic through an NVA, mistakenly thinking peering alone or gateway transit can achieve the required inspection without explicit UDRs.

How to eliminate wrong answers

Option A is wrong because a 0.0.0.0/0 route to the Internet would send all outbound traffic to the Internet, not through the hub NVA, and would not route inter-spoke traffic correctly. Option B is wrong because Azure Firewall with forced tunneling to on-premises would route traffic to on-premises, not through the hub NVA, and does not satisfy the requirement for inter-spoke inspection within Azure. Option D is wrong because VNet peering with gateway transit enables spokes to use a VPN gateway in the hub, but it does not force inter-spoke traffic through an NVA; it only provides transitive routing via the gateway, not custom inspection.

Practice this question →

42

MCQeasy

A company is designing a virtual network architecture for a three-tier application (web, application, database). They want network isolation between tiers and secure access from the internet to the web tier only. Which Azure networking solution should they use?

A.Azure Virtual Network with subnets for each tier and Network Security Groups.

B.Azure Virtual Network with a single subnet and application security groups.

C.Azure Virtual Network with subnets and Azure Firewall.

D.Azure Virtual Network with subnets and a network virtual appliance (NVA).

AnswerA

This approach uses separate subnets for the web, application, and data tiers, establishing Layer-3 network boundaries within the virtual network. Network Security Groups (NSGs) are stateful, built-in filters that you associate with each subnet to enforce inbound and outbound rules, such as allowing internet traffic only to the web tier on ports 80/443 and permitting the web subnet to talk to the app subnet on a specific application port. Because NSGs are natively supported and incur no extra cost, this is the most efficient and standard method for isolating tiers and controlling east-west traffic without introducing additional appliances or routing complexity.

Why this answer

Deploying each tier in its own subnet within an Azure Virtual Network and applying Network Security Groups (NSGs) allows granular inbound/outbound rule enforcement. NSGs can restrict traffic so that only the web tier is reachable from the internet (via a public IP or Azure Load Balancer), while the application and database tiers are isolated from direct internet access and can only communicate with the adjacent tier as defined by NSG rules.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing Azure Firewall or an NVA for basic isolation, not realizing that NSGs with subnets are the native, cost-effective, and fully supported method for network segmentation within a single Azure VNet.

How to eliminate wrong answers

Option B is wrong because a single subnet with Application Security Groups (ASGs) still places all VMs in the same broadcast domain and does not provide network-level isolation between tiers; ASGs only group VMs logically for NSG rule application, but they do not prevent lateral traffic within the subnet without explicit NSG rules, and a single subnet cannot enforce separate routing or address spaces. Option C is wrong because Azure Firewall is a managed, stateful firewall service used for centralized inspection and logging across VNets or hybrid networks, but it is overkill and not the simplest solution for basic tier isolation within a single VNet; NSGs alone provide sufficient subnet-level filtering without the cost and complexity of a firewall. Option D is wrong because a Network Virtual Appliance (NVA) is typically used for advanced traffic inspection, routing, or security functions (e.g., third-party firewalls, WAN optimization) and is unnecessary for simple tier isolation; it adds operational overhead and cost when NSGs can achieve the same isolation with less complexity.

Practice this question →

43

MCQhard

A global company is deploying a microservices application on AKS clusters in multiple Azure regions. They need to provide a single endpoint for users worldwide with SSL offloading, web application firewall, and URL path-based routing to the nearest healthy AKS cluster. They also need global load balancing with automatic failover. Which Azure service should they use?

A.Azure Front Door

B.Azure Application Gateway

C.Azure Traffic Manager

D.Azure Load Balancer

AnswerA

Azure Front Door is a global application delivery controller that operates at Layer 7, using Anycast to terminate connections at the nearest point of presence. It directly satisfies the multi-region AKS requirement by performing SSL offloading, applying a web application firewall, and routing requests to different AKS clusters based on URL paths. Its global health probes and failover are distinct from DNS-based or regional approaches, making it the only listed service that can steer user traffic across the globe while preserving HTTP semantics.

Why this answer

Azure Front Door is the correct choice because it provides global HTTP/HTTPS load balancing with SSL offloading, web application firewall (WAF) integration, and URL path-based routing. It uses Anycast-based routing to direct users to the nearest healthy AKS cluster, ensuring low latency and automatic failover across regions.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Azure Traffic Manager, but Traffic Manager only provides DNS-level routing without application-layer features like SSL offloading, WAF, or path-based routing.

How to eliminate wrong answers

Option B is wrong because Azure Application Gateway is a regional load balancer that operates within a single Azure region and cannot provide global load balancing or cross-region failover. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not support SSL offloading, WAF, or URL path-based routing at the application layer. Option D is wrong because Azure Load Balancer is a Layer 4 (TCP/UDP) load balancer that operates regionally and lacks application-layer features like SSL termination, WAF, and path-based routing.

Practice this question →

44

MCQmedium

A company wants to deploy a web application on Azure virtual machines (VMs). The application experiences variable traffic patterns, so the company needs to automatically add or remove VM instances based on CPU utilization. They also want the application to remain highly available even if an Azure datacenter fails. Which combination of Azure services should they use?

A.Virtual Machine Scale Sets configured with autoscale rules based on CPU and distributed across availability zones

B.Azure App Service with autoscale rules and deployment slots

C.Azure Load Balancer with a backend pool of VMs and autoscale rules applied to individual VMSS

D.Azure Traffic Manager with endpoints in separate regions and Manual scaling of VMs

AnswerA

Virtual Machine Scale Sets are the only compute option listed that runs your workload on IaaS VMs while natively supporting horizontal autoscale: you define a scale condition (e.g., scale out by one instance when CPU percentage exceeds 75%, scale in when below 25%) and Azure applies it to the entire set. Deploying the VMSS across multiple availability zones places instance replicas in physically separate datacenters within the region, so a zone outage does not take down the entire web tier. This combination directly satisfies both the CPU-based automatic scaling and the zone-failure protection requirement.

Why this answer

Virtual Machine Scale Sets (VMSS) with autoscale rules based on CPU utilization automatically add or remove VM instances to match variable traffic patterns. Distributing the VMSS across availability zones ensures the application remains highly available even if an entire Azure datacenter fails, because availability zones are physically separate datacenters within a region.

Exam trap

The trap here is that candidates often confuse Azure App Service (PaaS) with IaaS VM solutions, or assume that a load balancer alone can handle autoscaling, when in fact autoscale rules must be configured directly on the VMSS resource.

How to eliminate wrong answers

Option B is wrong because Azure App Service is a Platform-as-a-Service (PaaS) offering, not a VM-based solution, and the question explicitly requires deployment on Azure virtual machines. Option C is wrong because Azure Load Balancer distributes traffic but does not itself perform autoscaling; autoscale rules must be applied directly to the VMSS, not to individual VMs, and the phrase 'applied to individual VMSS' is redundant and misstates the architecture. Option D is wrong because Traffic Manager provides global DNS-based traffic routing across regions, but manual scaling of VMs does not meet the requirement for automatic scaling based on CPU utilization.

Practice this question →

45

MCQeasy

A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?

A.Azure Virtual Network

B.Azure Virtual WAN

C.Azure ExpressRoute

D.Azure VPN Gateway

AnswerB

Azure Virtual WAN is a managed networking service that creates a hub-and-spoke architecture with integrated routing, automatically interconnecting branches, Azure VNets, and on-premises locations. It natively supports Site-to-Site VPN, Point-to-Site VPN, and ExpressRoute, and it performs automatic route table generation and propagation across all spokes. Virtual WAN also enables branch-to-branch connectivity without manual peering, making it the only option here that delivers a scalable, zero-touch global transit network.

Why this answer

Azure Virtual WAN is a managed networking service that aggregates branch, VPN, and ExpressRoute connectivity into a single hub-and-spoke architecture. It automatically handles routing between branches and Azure, supports any-to-any connectivity, and integrates natively with ExpressRoute and VPN gateways, making it the correct choice for a scalable, managed solution that simplifies network architecture.

Exam trap

The trap here is that candidates often confuse Azure Virtual WAN with Azure Virtual Network, thinking that a simple VNet with VPN gateways can scale to interconnect multiple branches, but they overlook the managed, automatic routing and aggregation capabilities that Virtual WAN provides for multi-site topologies.

How to eliminate wrong answers

Option A is wrong because Azure Virtual Network is a fundamental building block for creating isolated networks in Azure, but it does not provide managed, automatic routing between multiple branch offices or native integration with ExpressRoute and VPN at scale; it requires manual configuration of peering, gateways, and routing. Option C is wrong because Azure ExpressRoute is a dedicated private connection from on-premises to Azure, but it does not connect multiple branch offices to each other or provide automatic routing between them; it is a connectivity option, not a managed WAN service. Option D is wrong because Azure VPN Gateway provides site-to-site VPN connectivity from a single branch to Azure, but it does not offer a managed, scalable hub for interconnecting multiple branches or automatic routing between them; it requires additional configuration and does not aggregate multiple connections into a single managed topology.

Practice this question →

46

MCQmedium

A company wants to deploy containerized microservices on Azure without managing virtual machines. The solution must support automatic scaling based on demand, built-in load balancing, rolling updates for zero-downtime deployments, and a fully managed platform. Which Azure compute service should they choose?

A.Azure Container Apps

B.Azure Container Instances

C.Azure Batch

D.Azure Functions

AnswerA

Azure Container Apps is a serverless platform for running containers. It provides automatic scaling based on HTTP traffic or events, built-in load balancing, and supports rolling updates via revisions. It abstracts away underlying infrastructure, so no VMs to manage.

Why this answer

Azure Container Apps is the correct choice because it provides a fully managed, serverless platform for running containerized microservices without managing virtual machines. It supports automatic scaling based on HTTP traffic or events, built-in load balancing via Envoy, and rolling updates with revision management to ensure zero-downtime deployments. This aligns perfectly with the requirement for a fully managed platform that abstracts away infrastructure.

Exam trap

The trap here is that candidates often confuse Azure Container Instances (ACI) with a managed orchestration solution, but ACI lacks the automatic scaling, load balancing, and rolling update capabilities that Container Apps provides for microservices.

How to eliminate wrong answers

Option B (Azure Container Instances) is wrong because it is designed for running individual containers on demand without built-in orchestration, automatic scaling, or rolling update capabilities—it lacks the microservice management features required. Option C (Azure Batch) is wrong because it is a job-scheduling service for high-performance computing (HPC) and parallel workloads, not for deploying containerized microservices with load balancing and rolling updates. Option D (Azure Functions) is wrong because it is a serverless compute service for event-driven code (functions), not for running containerized microservices; it does not support container orchestration or rolling updates for containers.

Practice this question →

47

MCQeasy

A company is deploying a web application that must be accessible from the internet. The application is hosted on Azure virtual machines in a virtual network. The solution must provide SSL termination, web application firewall (WAF) protection, and URL path-based routing (e.g., /api/* to one backend pool, /app/* to another). The web tier must not be directly exposed to the internet. Which Azure load balancing solution should they use?

A.Azure Application Gateway v2

B.Azure Front Door

C.Azure Load Balancer

D.Azure Traffic Manager

AnswerA

Azure Application Gateway v2 is a regional Layer 7 reverse proxy that performs SSL termination, web application firewall (WAF) inspection, and URL path-based or multi-site routing. It can be configured with a public front-end IP and a backend pool containing VMs with only private IPs, making it ideal for protecting an internet-facing web tier. The v2 SKU adds auto-scaling and zone redundancy, with the WAF policy enforcing OWASP rule sets at the HTTP edge.

Why this answer

Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL path-based routing. It can route traffic to different backend pools based on URL paths (e.g., /api/* and /app/*) while keeping the web tier isolated within the virtual network, as the gateway itself is exposed to the internet.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Application Gateway, but Front Door is designed for global, multi-region scenarios and cannot provide direct VNet integration for a single-region app without exposing backend public IPs, whereas Application Gateway is the correct Layer 7 solution for a single-region VNet deployment.

How to eliminate wrong answers

Option B (Azure Front Door) is wrong because it is a global, multi-region load balancer and application delivery network that operates at the edge, not within a single virtual network; it cannot provide direct SSL termination and WAF for a single-region VNet-hosted app without exposing the backend to the internet via public endpoints. Option C (Azure Load Balancer) is wrong because it operates at Layer 4 (TCP/UDP) and cannot perform SSL termination, WAF inspection, or URL path-based routing. Option D (Azure Traffic Manager) is wrong because it is a DNS-based traffic router that only directs clients to endpoints based on DNS resolution, not a proxy that can terminate SSL, apply WAF rules, or route based on URL paths.

Practice this question →

48

MCQeasy

A company plans to migrate a legacy web application to Azure. The application runs on multiple Windows virtual machines (VMs) in an availability set. The VMs must be exposed to the internet via a single endpoint that performs SSL termination and health checks. The load-balancing solution must preserve the original client IP address for logging purposes. Which Azure service should the company use?

A.Azure Load Balancer (Standard)

B.Azure Application Gateway v2

C.Azure Traffic Manager

D.Azure Front Door

AnswerB

Azure Application Gateway v2 is the appropriate choice because it is a regional layer-7 reverse proxy that terminates SSL/TLS at the gateway, offloading certificate management from the web servers. It supports cookie-based session affinity, URL-based routing, and a built-in web application firewall (WAF), while preserving the original client IP via the X-Forwarded-For request header. The v2 SKU also provides autoscaling, high availability, and a resilient static VIP, aligning well with a single-region legacy web application migration.

Why this answer

Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports SSL termination, health probes, and provides a single public endpoint. It preserves the original client IP address by inserting the X-Forwarded-For header in the HTTP request, which the backend VMs can read for logging. This meets all requirements: single internet-facing endpoint, SSL offload, health checks, and client IP preservation.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming that any load balancer can terminate SSL and preserve client IP, but only Layer 7 services can inspect HTTP headers and perform SSL offload natively.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer (Standard) operates at Layer 4 (TCP/UDP) and does not support SSL termination or HTTP-level health checks; it also preserves client IP only via Direct Server Return (DSR) mode, which is not suitable for SSL termination and adds complexity. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not perform SSL termination or health checks at the application layer; it only directs traffic based on DNS resolution and cannot preserve the original client IP in the HTTP headers. Option D is wrong because Azure Front Door is a global Layer 7 service that does support SSL termination and health checks, but it is designed for global distribution and CDN scenarios, not for a single regional endpoint; it also modifies the client IP by default (inserting X-Forwarded-For but also adding its own IP), which can complicate logging if only a single regional endpoint is needed.

Practice this question →

49

MCQhard

A company has a hub-spoke network topology in Azure. They have multiple spoke VNets connected to a hub VNet via peering. They need to ensure that all east-west traffic between spoke VNets goes through a network virtual appliance (NVA) in the hub for inspection. Additionally, all outbound internet traffic from spoke VMs must use a single public IP address. What should they configure?

A.Configure spoke VNets with a default route to the NVA IP, and deploy a NAT gateway in the hub for outbound traffic.

B.Configure a route table in each spoke with a route to the hub NVA for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet traffic.

C.Enable 'Allow gateway transit' on the hub VNet and 'Use remote gateways' on the spoke VNets for the NVA.

D.Configure VNet peering with 'Allow forwarded traffic' enabled, add user-defined routes in each spoke pointing to the NVA IP for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet with a default route in spokes.

AnswerD

This is the correct design because the hub NVA is placed as a next-hop for inter-spoke traffic via user-defined routes (UDRs) in each spoke route table, and enabling 'Allow forwarded traffic' on the peering lets the NVA accept and route packets between the connected VNets. For outbound internet access, Azure Firewall in the hub provides centralized egress, and a default route (0.0.0.0/0) in the spoke UDRs sends internet-bound traffic to the firewall's private IP. This combination cleanly separates east-west (NVA) and north-south (firewall) traffic while meeting the requirement for a single public IP and controlled routing.

Why this answer

It combines two critical configurations: user-defined routes (UDRs) in each spoke VNet force inter-spoke traffic through the NVA in the hub by specifying the NVA's IP as the next hop, and 'Allow forwarded traffic' on the VNet peering enables the hub NVA to forward packets between spokes. For outbound internet traffic, Azure Firewall in the hub provides a single public IP, and a default route (0.0.0.0/0) in the spoke UDRs directs all internet-bound traffic to the Azure Firewall's private IP, ensuring centralized inspection and egress.

Exam trap

The trap here is that candidates often forget to enable 'Allow forwarded traffic' on the VNet peering, assuming UDRs alone are sufficient for transitive routing through an NVA, or they confuse 'Allow gateway transit' with NVA forwarding, which is a common misstep in hub-spoke design questions.

How to eliminate wrong answers

Option A is wrong because a NAT gateway in the hub does not inspect traffic; it only provides source network address translation (SNAT) for outbound connections, failing the inspection requirement. Option B is wrong because while it correctly uses Azure Firewall for outbound traffic, it omits the critical 'Allow forwarded traffic' setting on the VNet peering, without which the hub NVA cannot forward packets between spoke VNets even with UDRs in place. Option C is wrong because 'Allow gateway transit' and 'Use remote gateways' are used for VPN/ExpressRoute gateway sharing, not for routing traffic through an NVA; these settings do not force inter-spoke traffic through the NVA.

Practice this question →

50

MCQeasy

A company has Azure virtual networks (VNets) in three different Azure regions (West US, East US, and West Europe). They also have an on-premises data center connected to the East US region via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. The solution must support transitive routing between all sites and provide centralized management of connectivity and routing policies. Which Azure service should they use?

A.VNet peering

B.Azure Virtual WAN

C.VPN Gateway

D.ExpressRoute Direct

AnswerB

Azure Virtual WAN is the correct architectural solution because it creates regional hubs connected in an any-to-any mesh, and each hub contains a fully managed virtual router with built-in VPN/ExpressRoute gateways. It provides transitive routing between VNets attached to different hubs as well as between VNets and on-premises sites, using a single, centrally managed route table and route propagation via BGP. This eliminates the need to build a full mesh of VNet peerings and gives centralized monitoring, routing, and security policy management across all regions.

Why this answer

Azure Virtual WAN is correct because it provides a hub-and-spoke architecture with built-in transitive routing between all VNets and on-premises sites. It supports automatic connectivity through Virtual Hub routers, which use BGP to propagate routes across all spokes and branches, meeting the requirement for centralized management of connectivity and routing policies.

Exam trap

The trap here is that candidates often assume VNet peering can be chained to achieve transitive routing, but Azure explicitly blocks transitive routing through peered VNets unless a network virtual appliance or Azure Virtual WAN is used.

How to eliminate wrong answers

Option A is wrong because VNet peering does not support transitive routing; peered VNets cannot route traffic through each other to reach a third VNet or on-premises network without additional user-defined routes and network virtual appliances. Option C is wrong because a VPN Gateway only provides site-to-site or point-to-site connectivity to a single VNet and does not inherently enable transitive routing between multiple VNets or centralized policy management across regions. Option D is wrong because ExpressRoute Direct is a physical port offering for dedicated private connections to Azure, not a service that provides transitive routing or centralized connectivity management between multiple VNets and on-premises networks.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Design infrastructure solutions questions.

Start 20-question session