AZ-305 Design infrastructure solutions Practice Question
A company has multiple Azure virtual networks (VNets) spread across three Azure regions (West US, East US, and West Europe). They also have an on-premises network connected to East US via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. They require centralized management of routing and the ability to enforce security policies such as forcing all internet-bound traffic from any VNet to pass through a central firewall in East US. Which Azure solution should they implement?
⚠ Common exam trap
Watch out — candidates often assume VNet peering with route tables (Option A) is sufficient for centralized security, but they overlook the operational complexity and lack of built-in forced tunneling enforcement across multiple regions, which Virtual WAN's secured hub solves natively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Virtual WAN with a secured hub in East US.
Azure Virtual WAN with a secured hub in East US provides a centralized hub-and-spoke architecture that connects all VNets and the on-premises network via ExpressRoute. The secured hub includes Azure Firewall, enabling forced tunneling of all internet-bound traffic from any VNet through the central firewall in East US, while Virtual WAN automatically manages routing between all spokes and the on-premises network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VNet peering between all VNets and use route tables for forced tunneling.
Why it's wrong here
VNet peering alone delivers non-transitive connectivity, so connecting N VNets requires N(N-1)/2 peering relationships, and each spoke's route tables must be manually crafted to force internet-bound traffic through a central NVA or firewall. Forced tunneling via custom UDRs on every subnet becomes operationally heavy and fragile as policy changes ripple across multiple route tables. Azure Virtual WAN's secured hub centralizes routing and security policy instead of relying on this error-prone mesh of peering and UDRs.
- ✓
Azure Virtual WAN with a secured hub in East US.
Why this is correct
Azure Virtual WAN provides a scalable hub-and-spoke architecture with centralized routing. A secured hub can include a firewall to enforce forced tunneling and security policies. All VNets and on-premises connect to the hub(s), simplifying management.
- ✗
ExpressRoute Global Reach with VNet peering to connect all VNets.
Why it's wrong here
ExpressRoute Global Reach links on-premises networks to disparate ExpressRoute circuits over the Microsoft backbone; it does not connect Azure VNets to each other or attach VNets to a central firewall. Even after adding VNet peering for east-west traffic, you still need a separate network virtual appliance or firewall to enforce forced tunneling, and you lose the single-pane-of-glass routing that Virtual WAN provides. Global Reach also adds no transitive routing or policy enforcement, so it fails to solve the centralized connectivity requirement.
- ✗
VPN gateways with BGP to connect all VNets.
Why it's wrong here
Using VPN gateways with BGP across all VNets creates a full or partial mesh of IPsec tunnels, and Azure VPN gateways have documented limits on the number of connections and throughput that make this brittle at regional scale. BGP only advertises routes; it does not provide centralized forced tunneling or firewall policy, and every VNet must host or reach a separate NVA for security. Virtual WAN, in contrast, offers a managed hub with built-in routing decisions and a firewall in the secured hub, eliminating the need to operate this bespoke mesh.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.