Design infrastructure solutions practice questions

Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet

Why wrong: Incorrect. This routes all outbound traffic to the internet, not through the hub NVA, and does not enforce inspection for inter-spoke traffic.

Configure Azure Firewall in the hub with forced tunneling to on-premises

Why wrong: Incorrect. Forced tunneling sends outbound traffic to on-premises, but it does not route inter-spoke traffic through the hub NVA.

Use VNet peering with gateway transit enabled

Why wrong: Incorrect. Gateway transit allows spokes to use the hub's VPN/ExpressRoute gateway, but it does not force inter-spoke traffic through the NVA without additional UDRs.

Azure Front Door with WAF policy.

Why wrong: Azure Front Door is a global load balancer and application delivery network. It includes WAF, but it is designed for multi-region deployments and can be more expensive for a single-region application. Application Gateway is more appropriate here.

Azure Firewall with application rules.

Why wrong: Azure Firewall is a stateful firewall that can filter traffic based on FQDN (application rules), but it does not include a Web Application Firewall (WAF) to protect against OWASP top 10 vulnerabilities. It is not a substitute for a WAF.

Azure Traffic Manager.

Why wrong: Azure Traffic Manager is a DNS-based traffic load balancer. It does not have WAF capabilities and cannot inspect HTTP traffic. It simply routes DNS requests to different endpoints.

Use a single virtual network for all resources with a network virtual appliance.

Why wrong: A single VNet for multiple subscriptions is not possible because VNets are scoped to a subscription. Also, a single VNet may exceed limits (e.g., 65,536 resources). This approach does not scale and mixes resources.

Use an Azure Virtual WAN with security virtual WAN hub.

Why wrong: Virtual WAN can centralize security (using Azure Firewall in the hub) and supports multiple subscriptions, but it is a more complex and expensive solution when you only have a few on-premises sites. Standard hub-spoke is simpler if you don't need global connectivity features like VPN site-to-site to many branches.

Use Azure Traffic Manager with Azure Firewall.

Why wrong: Azure Traffic Manager is a DNS-based load balancer for distributing traffic across endpoints. It cannot enforce outbound traffic policies. Azure Firewall is a security service, but without proper routing (UDRs) and VNet architecture, it cannot control outbound traffic from multiple VNets.

Azure Virtual Network

Why wrong: Azure Virtual Network provides isolated networks but requires manual peering and routing configuration for multi-site connectivity. It is not a managed solution for branch offices.

Azure ExpressRoute

Why wrong: ExpressRoute provides a private dedicated connection to Azure but does not itself support branch-to-branch connectivity or automatic routing.

Azure VPN Gateway

Why wrong: VPN Gateway enables site-to-site VPN connections but requires manual setup for multiple branches and does not provide an automated hub architecture.

Azure Availability Sets

Why wrong: Availability Sets spread VMs across multiple fault domains and update domains, compromising co-location and increasing latency beyond the requirement.

Azure Virtual Machine Scale Sets across Availability Zones

Why wrong: Availability Zones place VMs in separate physical locations, which adds network latency that exceeds the sub-10 microsecond requirement.

Azure Kubernetes Service (AKS)

Why wrong: AKS adds orchestration overhead and does not guarantee the low-latency placement needed for tightly coupled HPC workloads.

A

Why wrong: Azure Front Door is a global load balancer that operates at the edge. It requires public endpoints and is designed for multi-region traffic, not for a single region internal deployment.

B

Why wrong: Azure Traffic Manager is DNS-based and does not provide SSL offloading, session stickiness, or URL-based routing at the application layer.

D

Why wrong: Azure Load Balancer works at Layer 4 (TCP/UDP) and cannot make routing decisions based on URL paths. It also does not provide SSL offloading.

A

Why wrong: Azure Kubernetes Service (AKS) is a managed Kubernetes cluster but still requires monitoring and management of the cluster itself, adding operational overhead for a simple microservices app.

C

Why wrong: Azure App Service supports containers but is designed for web applications and may not provide the same per-second billing and simplicity as ACI for generic container workloads.

D

Why wrong: Azure Virtual Machines with Docker require full OS and container management, which is high overhead and not recommended for minimizing operations.

B

Why wrong: Using site-to-site VPNs as primary connections may not provide the required high bandwidth and reliability. ExpressRoute circuits as backup would be expensive and not commonly used as a backup due to cost.

C

Why wrong: A single Azure VPN Gateway with active-passive configuration is not designed for primary connections from two data centers; it also does not provide the low latency or reliability of ExpressRoute.

D

Why wrong: Sharing a single ExpressRoute circuit and a single VPN connection between two data centers is not practical as each data center needs its own connection to Azure.

Azure Virtual WAN with a secured hub using Azure Firewall

Why wrong: Virtual WAN uses Azure Firewall, not a third-party NVA, and requires a different deployment model not aligned with the requirement.

Azure VNet-to-VNet VPN gateways between all spokes

Why wrong: This creates a full mesh of VPN connections, increasing complexity and cost, and does not route through the hub NVA.

Azure ExpressRoute with private peering

Why wrong: ExpressRoute is designed for on-premises to Azure connectivity, not for inter-spoke traffic within Azure.

Azure Load Balancer

Why wrong: Load Balancer is layer-4 and cannot perform SSL termination, URL routing, or WAF.

Azure Traffic Manager

Why wrong: Traffic Manager is a DNS-level traffic router across endpoints, not a load balancer for a single region's web tier.

Azure Front Door

Why wrong: Front Door is a global application delivery network with WAF, but for a single-region deployment, Application Gateway is the more appropriate regional service.

Use an Azure Load Balancer and configure NSGs on each subnet.

Why wrong: Azure Load Balancer is a layer 4 service and does not provide SSL termination, WAF, or URL-based routing. NSGs alone cannot provide those capabilities.

Use Azure Firewall to inspect all traffic and allow internet traffic to the web tier.

Why wrong: Azure Firewall is a stateful firewall that operates at layers 3-4 with some layer 7 capabilities, but it is not optimized for inbound web traffic with SSL offloading and URL routing like a WAF-enabled service.

Use Azure Front Door to expose the web tier and NSGs for internal isolation.

Why wrong: Azure Front Door is a global load balancer, suitable for multi-region scenarios. For a single-region deployment, Application Gateway is more appropriate and cost-effective, and Front Door does not inherently provide isolation between tiers.

Azure Application Gateway

Why wrong: Application Gateway is a regional service. While it includes WAF and URL routing, it cannot provide global load balancing across multiple regions or anycast-based routing.

Azure Traffic Manager

Why wrong: Traffic Manager is a DNS-based load balancer. It does not offer SSL offloading, WAF, or URL path-based routing. It can only direct traffic based on DNS resolution, not at the application layer.

Azure Load Balancer

Why wrong: Load Balancer operates at layer 4 and is regional. It does not provide SSL offloading, WAF, or URL routing, and cannot distribute traffic globally.

Configure spoke VNets with a default route to the NVA IP, and deploy a NAT gateway in the hub for outbound traffic.

Why wrong: A default route would send all traffic to the NVA, including internet traffic, but NAT gateway is not the correct way to route internet traffic through the NVA. Also, east-west traffic routing requires specific UDRs for other spoke address ranges.

Configure a route table in each spoke with a route to the hub NVA for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet traffic.

Why wrong: This is partially correct but missing the need to enable 'Allow forwarded traffic' on peering. Without that, the NVA cannot forward packets between spokes even with UDRs. However, this is still a plausible but incomplete answer. Option D is more complete.

Enable 'Allow gateway transit' on the hub VNet and 'Use remote gateways' on the spoke VNets for the NVA.

Why wrong: Gateway transit is a feature for VPN/ExpressRoute gateways, not for NVAs. NVAs require UDRs and forwarded traffic settings, not gateway transit.

Just-in-Time VM access

Why wrong: JIT access temporarily opens ports to public IPs, which the scenario does not want. It also requires client software.

Azure VPN Gateway

Why wrong: VPN Gateway requires a VPN client on the user's machine, which is not desired.

Microsoft Entra ID Domain Services

Why wrong: AD DS provides domain services but does not provide remote access to VMs.

Azure Service Endpoints

Why wrong: Service Endpoints extend the virtual network to the public endpoint of Azure SQL, but the connection still uses the public endpoint's IP.

Azure VPN Gateway

Why wrong: VPN Gateway connects on-premises to Azure over IPsec but does not provide a private IP for SQL Database.

Azure Front Door

Why wrong: Front Door is a global load balancer and application accelerator, not for private connectivity to databases.

Deploy the VMs in different Availability Zones.

Why wrong: Availability Zones are physically separate datacenters within a region. They protect against a datacenter failure, not just hardware failure within a single datacenter.

Deploy the VMs in a single Virtual Machine Scale Set with a large instance count.

Why wrong: A scale set distributes VMs across fault domains only if configured with a placement group. The primary purpose is auto-scaling, not guaranteed fault isolation for a small number of VMs.

Deploy each VM in a separate resource group.

Why wrong: Resource groups are logical containers and do not provide any physical fault isolation. VMs in different resource groups can still reside on the same physical host.

Azure Front Door

Why wrong: Azure Front Door is a global HTTP(S) load balancer with WAF, but it is designed for multi-region and internet-facing endpoints. It does not support exposing only private IP backends without using Private Link.

Azure Load Balancer

Why wrong: Azure Load Balancer operates at layer 4 and cannot perform SSL termination or URL path-based routing. It also does not include WAF capabilities.

Azure Traffic Manager

Why wrong: Azure Traffic Manager is a DNS-based traffic load balancer. It does not terminate SSL, does not provide WAF, and cannot route based on URL paths.

Two ExpressRoute circuits from different service providers, both active.

Why wrong: While this provides high availability, it is not a 'lower-cost' backup. Both circuits are premium and typically have similar costs.

Site-to-Site VPN as the primary connection and Point-to-Site VPN as the backup.

Why wrong: Point-to-Site VPN is client-to-Azure, not site-to-site. It would not connect the entire on-premises data center. Also, Site-to-Site VPN does not meet the requirement for high bandwidth and private connectivity.

Azure VPN Gateway with active-passive mode and a second VPN Gateway for failover.

Why wrong: A single VPN Gateway with active-passive mode provides redundancy within Azure, but it still uses the public internet and does not meet the 'private, dedicated' requirement.

Azure Load Balancer

Why wrong: Azure Load Balancer works at layer-4 (TCP/UDP) and does not support URL-based routing or SSL offloading.

Azure Traffic Manager

Why wrong: Traffic Manager is a DNS-based global load balancer for distributing traffic across regions, not for intra-region load balancing with URL routing.

Azure Front Door

Why wrong: Front Door is a global layer-7 load balancer and CDN, designed for multi-region scenarios and not intended for routing within a single Azure region.

Deploy network virtual appliances (NVAs) in each spoke VNet and configure user-defined routes (UDRs) to route internet traffic to the NVAs

Why wrong: This approach is decentralized and creates management overhead. It does not provide a single inspection point or a single outbound public IP.

Use Azure Application Gateway with Web Application Firewall (WAF) in the hub VNet to inspect all traffic

Why wrong: Application Gateway is a layer-7 load balancer for inbound HTTP/S traffic, not a firewall for outbound traffic. It does not handle general internet egress.

Deploy Azure Firewall in each spoke VNet and use Azure Monitor to aggregate logs

Why wrong: This is a distributed approach that complicates management and does not provide a centralized egress point. The requirement is to use a central firewall.