VPC Endpoint practice questions

Azure Cosmos DB

Why wrong: Cosmos DB is a multi-model NoSQL service built for globally distributed document, key-value, column-family, and graph workloads. It exposes SQL/MongoDB/Cassandra-compatible APIs and stores data in partitions, but it has no concept of static files, no web server endpoint, and cannot serve HTML/JS/CSS to browsers as a hosted website.

Azure NetApp Files

Why wrong: Azure NetApp Files is an enterprise-grade file service backed by NetApp ONTAP, providing high-performance NFS and SMB shares for HPC, SAP, and VDI workloads. It operates at the file-system protocol layer over the network and has no HTTP-based content serving, no `$web` container, and no static website hosting capability.

Azure Files

Why wrong: Azure Files provides managed SMB and NFS file shares for lift-and-shift migrations, shared application data, and Azure File Sync scenarios. It presents a standard file share path (e.g., UNC or mount point) and has no HTTP/S static content engine, so it cannot translate a directory of HTML files into a browsable, publicly accessible website.

Use an Azure Load Balancer and configure NSGs on each subnet.

Why wrong: Azure Load Balancer operates at Layer 4 (TCP/UDP) and only distributes traffic based on IP address and port rules. It cannot provide SSL termination, web application firewall (WAF) capabilities, or path-based routing, all of which are essential for protecting and properly routing HTTP(S) requests in a multi-tier web application. Configuring NSGs on each subnet adds basic network-level filtering, but NSGs alone cannot inspect or sanitize application-layer traffic, leaving the web tier vulnerable to SQL injection, XSS, and other OWASP threats. Therefore, this option is incorrect because it lacks the required Layer 7 features.

Use Azure Firewall to inspect all traffic and allow internet traffic to the web tier.

Why wrong: Azure Firewall is a stateful firewall that operates at layers 3-4 with some layer 7 capabilities, but it is not optimized for inbound web traffic with SSL offloading and URL routing like a WAF-enabled service.

Use Azure Front Door to expose the web tier and NSGs for internal isolation.

Why wrong: Azure Front Door is incorrect because it is a global service designed for distributing traffic across multiple regions or public endpoints, whereas this scenario describes a multi-tier application primarily within a single virtual network. While Front Door offers SSL termination, WAF, and URL-based routing, its global scope is not the primary requirement for exposing a web tier residing regionally within a VNet. It would be appropriate for a globally distributed application requiring cross-region traffic management and acceleration.

Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet

Why wrong: Setting a 0.0.0.0/0 user-defined route on spoke subnets with next hop Internet only affects default outbound traffic, sending it directly to the internet. It does nothing to route spoke-to-spoke traffic through the hub NVA, because inter-spoke traffic targets the peer address space, not the default route. Such a route would actually bypass the hub for any outbound internet traffic and still fail to inspect east-west traffic. Thus this configuration does not enforce centralized inspection for inter-spoke communications.

Configure Azure Firewall in the hub with forced tunneling to on-premises

Why wrong: Forced tunneling with Azure Firewall sends internet-bound traffic to on-premises via a VPN/ExpressRoute connection, typically by adding a default route to the hub's gateway. It does not influence routing between spoke virtual networks, which requires explicit routes to the hub NVA for the destination spoke prefix. Azure Firewall can inspect inter-spoke traffic only when UDRs are applied to spokes with the Firewall's private IP as next hop; forced tunneling alone doesn't set that up. This option confuses internet egress control with east-west traffic inspection.

Use VNet peering with gateway transit enabled

Why wrong: Enabling gateway transit on the hub peering only allows spoke virtual networks to use the hub's VPN/ExpressRoute gateway for connectivity to on-premises networks. It does not create any routes that send spoke-to-spoke traffic through the hub NVA, nor does it make peering transitive. Without UDRs on the spokes, traffic from one spoke to another is dropped at the hub because the spoke has no route to its peer's address space. Gateway transit is a distinct feature for remote gateway access, not a routing mechanism for east-west inspection.

Azure Traffic Manager

Why wrong: Traffic Manager is a DNS-based traffic router that only resolves domain names to endpoint IPs at the DNS level. It cannot terminate SSL, inspect HTTP content, or apply WAF rules, and it lacks URL path-based routing because it never sees the actual traffic. While it can route users globally, it cannot make application-layer decisions or protect the application, so it does not meet the full requirements.

Azure Application Gateway

Why wrong: Application Gateway is a regional Layer 7 load balancer that provides SSL offloading, WAF, and URL path-based routing, but its scope is limited to a single Azure region. It can route traffic among backends within that region but cannot distribute or intelligently route users across multiple geographic regions. For global e-commerce scale and redundancy, you need a multi-region front-end, which Application Gateway alone cannot provide.

Azure Load Balancer

Why wrong: Azure Load Balancer is a Layer 4 network load balancer that forwards TCP/UDP traffic without any awareness of HTTP content. It does not perform SSL termination, cannot inspect URLs for path-based routing, and does not integrate a WAF. Additionally, it is a regional service, so it lacks the global anycast-based edge routing that Front Door offers for worldwide traffic distribution.

Azure Load Balancer (Standard)

Why wrong: Azure Load Balancer (Standard) operates at layer 4 of the OSI model, forwarding TCP and UDP traffic to backend pool members without inspecting HTTP payloads. It cannot offload SSL/TLS termination, so encrypted traffic reaches the VMs unchanged, and it does not inject X-Forwarded-For headers or support URL-path-based routing. Health probes are limited to port availability and simple TCP/HTTP checks, not application-level status, making it inadequate for a modern web application that needs centralized certificate management and session affinity.

Azure Traffic Manager

Why wrong: Azure Traffic Manager is a DNS-based global traffic router, not a proxy; it resolves client requests to an endpoint IP but does not sit in the data path, so it cannot inspect or forward HTTP requests. Because it never handles the actual connection, it cannot perform SSL termination, insert X-Forwarded-For headers, or make routing decisions based on URL paths. It relies on DNS polling and health probes to choose among endpoints, but even an HTTP probe only verifies an endpoint is reachable from Azure's perspective, not the application's health—making it unsuitable for a migration where the gateway must manage HTTPS.

Azure Front Door

Why wrong: Azure Front Door is a global layer-7 load balancer and CDN that does offer SSL termination and a WAF, but it is architected for scenarios requiring edge acceleration across multiple Azure regions via anycast. For a single-region deployment, it introduces unnecessary latency and additional cost because traffic is routed through its global edge network even when all back-ends reside in one region. Front Door also has a different feature set and session-affinity model compared to Application Gateway, so choosing it over a regional gateway complicates troubleshooting and increases operational overhead without corresponding benefit.

Azure Virtual Network with a single subnet and application security groups.

Why wrong: A single subnet offers no Layer-3 separation between tiers; all virtual machines remain in the same broadcast domain and share the same route table and subnet-level policies. Application Security Groups (ASGs) only group VM NICs by workload attributes (for example, 'Web' or 'App') and require explicit NSG rules referencing those ASGs to filter traffic between them, which is essentially logical tag-based control rather than a physical or network boundary. Additionally, ASGs cannot replace subnet segregation for capabilities like service endpoints, route tables, or VNet peering filters, and misconfigurations can leave unexpected traffic flows. This makes the solution less secure and harder to manage at scale, which is why it is incorrect for a three-tier architecture.

Azure Virtual Network with subnets and Azure Firewall.

Why wrong: Azure Virtual Network with subnets provides logical segmentation, but Azure Firewall primarily offers centralised network security policy enforcement and traffic filtering for perimeter security or across virtual network boundaries. While it can filter inter-subnet traffic with User Defined Routes, it is not the most direct mechanism for granular network isolation *between tiers* within a single virtual network. This is typically achieved more precisely using Network Security Groups (NSGs) on each subnet to control ingress and egress traffic flows. Azure Firewall is highly effective for securing internet access and managing outbound traffic from the application.

Azure Virtual Network with subnets and a network virtual appliance (NVA).

Why wrong: While subnets provide basic isolation, an NVA requires complex routing and manual management to enforce granular traffic filtering between tiers. This approach is typically utilised when organisations require third-party security features or deep packet inspection that native Azure Network Security Groups do not offer. In this scenario, the requirement for tier isolation and internet access control is satisfied by using subnets combined with Network Security Groups (NSGs) rather than external appliances.

Azure Application Gateway

Why wrong: Azure Application Gateway is a regional Layer 7 load balancer, so it can only balance traffic inside a single Azure region and cannot direct users to the healthiest endpoint in another region or continent. It does include WAF and URL path-based routing, but those capabilities are scoped to the gateway's own region, meaning each region would need its own separate gateway, introducing per-region management and DNS complexity. Because the company's requirement is a global AKS deployment, a single Application Gateway would fail to provide cross-region failover or latency-based routing.

Azure Traffic Manager

Why wrong: Azure Traffic Manager operates at the DNS level, answering a client's DNS query with one of the configured endpoints based on a routing method such as priority, weighted, or performance. It cannot terminate SSL, cannot inspect URL paths, and does not provide a WAF, so it is fundamentally incapable of making application-layer decisions or offloading certificate management to the edge. While it can route traffic globally, its reliance on DNS TTL and client caching makes it slower to react to endpoint failures, and it has no concept of path-based routing.

Azure Load Balancer

Why wrong: Azure Load Balancer is a Layer 4 construct that forwards raw TCP/UDP packets to backends based on five-tuple hashing, never looking at HTTP headers or URL paths. It is always scoped to the region where it is deployed and offers no SSL offloading, no WAF integration, and no content-based routing, making it unsuitable for a microservices gateway that needs to inspect requests. Even with multiple regional load balancers, they would not provide a single global control plane or route users to a different region based on latency.

Azure Disk Storage with shared disks

Why wrong: Azure Disk Storage with shared disks relies on SCSI-3 Persistent Reservations to let multiple VMs attach to the same managed disk, but this is intended for clustered workloads like SQL Server Failover Cluster Instances or Windows Server Failover Clustering, not for general-purpose file sharing. Shared disks do not provide an SMB/NFS protocol layer, require premium SSD tiers with specific caching and availability-zone constraints, and lack the access-control and auditing features of a file service. Even if attached to multiple VMs, the shared disk is a raw block device that each VM must format and manage independently, and it cannot be exposed securely to a network without additional infrastructure.

Azure NetApp Files with network security groups

Why wrong: Azure NetApp Files is a fully managed, high-performance NFS/SMB file service, but when paired only with network security groups, it does not guarantee protection from internet exposure because NSGs are applied to subnets or NICs, not to the managed service endpoint itself. The service's public endpoint may still be reachable unless you disable public access and implement a private endpoint or a service endpoint combined with a deny-all NSG rule. Additionally, Azure NetApp Files is significantly more expensive and operationally complex than Azure Files for typical multi-VM file sharing, making it a poor fit for this cost-sensitive migration scenario.

Azure Blob Storage with a service endpoint

Why wrong: Azure Blob Storage is object storage, not a file-sharing protocol; although it can be accessed from VMs via REST or SDKs, it does not natively provide SMB or NFS file semantics like file locking, hierarchical directories, or ACLs that legacy applications expect. A service endpoint routes traffic from a virtual network to the blob service over the Azure backbone, but it does not block internet access by default — the service's public endpoint remains active unless you also disable public access or implement a private endpoint. Even if access is restricted, the application would require extensive code changes to use blob storage instead of a file share, making it an impractical migration path.

Azure Front Door with WAF, Azure SQL Database point-in-time restore, Azure Key Vault Managed HSM, Azure App Service with private endpoint, AKS with HPA, Azure Log Analytics agent, Microsoft Entra ID

Why wrong: Point-in-time restore does not guarantee an RPO of 5 minutes or an RTO of 1 hour; it is a backup restore solution, not a high-availability failover. Although it uses private endpoint and HPA, the database requirement is not met.

Azure Front Door with WAF, Azure SQL Database geo-replication, Azure Key Vault (Standard), Azure App Service with private endpoint, AKS with HPA, Azure Diagnostics extension, Microsoft Entra ID

Why wrong: This design fails the requirement for customer-managed keys stored in a managed HSM because Azure Key Vault (Standard) only supports software-protected keys, not the FIPS 140-2 Level 3 validated hardware security modules provided by Azure Key Vault Managed HSM. While the option correctly uses AKS with HPA for CPU-based scaling and SQL Database geo-replication, the key vault type is the critical compliance blocker for a financial services workload. Azure Front Door with WAF and private endpoint are acceptable, but the key management deficiency cannot be mitigated by the other components.

Azure Application Gateway with WAF, Azure SQL Database active geo-replication, Azure Key Vault Managed HSM, Azure App Service with VNet integration, AKS with cluster autoscaler, Azure Monitor Agent, Microsoft Entra ID

Why wrong: Cluster autoscaler scales the number of node VMs, not pod replicas, and does not respond to CPU utilization of pods, failing the requirement for automatic scaling based on CPU utilization. Although it meets other requirements, the scaling requirement is critical.

Azure Front Door

Why wrong: Azure Front Door is tempting as it provides a single global DNS endpoint, automatically routes traffic to the nearest healthy region based on latency, and offers failover for high availability, which aligns with several requirements for a global web application. However, it fails to meet the specific requirement for routing traffic based on "available capacity". Front Door primarily uses latency-based routing and health probes, not dynamic load-based distribution across regions to account for current capacity constraints, which is a key distinction for this scenario.

Azure Load Balancer

Why wrong: Azure Load Balancer is a regional, layer-4 network load balancer that distributes traffic within a single Azure region and a single virtual network. It cannot route or redirect traffic across multiple regions because it has no DNS-based or global endpoint capability, and its health probes only monitor VMs in its own backend pool. Therefore, it fails to provide the cross-region capacity-based routing required for a multi-region VM deployment.

Azure Application Gateway

Why wrong: Azure Application Gateway operates at Layer 7 (HTTP/HTTPS) and is deployed within one region, providing SSL termination, path-based routing, and WAF capabilities for regional web traffic. While it can perform sophisticated request routing based on URL and host headers, it lacks a global DNS-based traffic management layer and cannot direct users to the nearest or most available regional deployment. Its backend pools are confined to a single region, so it cannot satisfy the requirement for routing across multiple regional VM deployments based on available capacity.

Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.

Why wrong: VNet peering is non-transitive, so a hub-and-spoke design with peerings alone cannot route between spokes or from a spoke to on-premises. UDRs must be manually added to every spoke subnet to force traffic to an NVA, and Azure Route Server only advertises routes learned from its BGP peer (the NVA) to the hub — it does not automatically propagate connectivity to all spokes. As the number of spokes and regions grows, maintaining these UDRs and BGP peering for each NVA becomes a significant administrative burden and is prone to route misconfiguration.

Create a single large VNet and use network security groups (NSGs) to isolate traffic.

Why wrong: A single Azure VNet is scoped to one region and cannot span multiple regions, so it cannot directly interconnect spoke networks in different regions as the scenario requires. While NSGs can filter East-West traffic within a VNet, they do not route traffic, integrate with NVAs, or provide connectivity to on-premises sites; you would still need additional VPN/ExpressRoute tunnels and peering to extend outside the VNet. This approach also hits subscription and address space limits and is a poor architectural pattern for regional isolation, redundancy, or management separation.

Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.

Why wrong: Placing Azure Firewall in a conventional hub VNet only works if you manually create UDRs on every spoke subnet to send traffic to the firewall's private IP, and forced tunneling specifically influences internet-bound traffic, not transitive spoke-to-spoke or branch-to-spoke routing. The hub VNet still relies on non-transitive VNet peering and separate VPN/ExpressRoute gateways, so you must continually manage custom routes and ensure the firewall receives traffic from all regions and on-prem sites. Azure Firewall does not automatically exchange routing information between spokes or branches, and this configuration lacks the simplified routing tables and dynamic propagation that a secured Virtual WAN hub provides.

Assign Global Administrator role to all cloud architects

Why wrong: Global Admin is highly privileged, violates least privilege.

Store service principal passwords in Azure Key Vault and retrieve at runtime

Why wrong: Using certificates or managed identities is better.

Enable self-service password reset for all users

Why wrong: SSPR is about password management, not least privilege.

Deploy network virtual appliances (NVAs) in each spoke VNet and configure user-defined routes (UDRs) to route internet traffic to the NVAs

Why wrong: Placing NVAs in each spoke replicates the security stack per workload rather than centralizing it. Each spoke then needs its own HA pair or scale set, its own user-defined route table pointing 0.0.0.0/0 to the NVA's internal IP, and the operational burden of patching, licensing, and failover for every appliance. This also scatters outbound public IPs across spokes, defeating the requirement for a single, centrally controlled egress and inspection point.

Use Azure Application Gateway with Web Application Firewall (WAF) in the hub VNet to inspect all traffic

Why wrong: Application Gateway with WAF is a layer-7 reverse proxy designed for inbound HTTP/S traffic directed to backend pools, not a general-purpose firewall for outbound connections from VMs. It cannot intercept arbitrary protocols, raw TCP/UDP, or non-web egress, and its WAF rule set evaluates inbound request payloads rather than outbound traffic. Therefore, placing it in the hub does nothing to force or filter spoke internet egress; it would only front-end specific applications.

Deploy Azure Firewall in each spoke VNet and use Azure Monitor to aggregate logs

Why wrong: Deploying Azure Firewall separately in every spoke distributes the security boundary and creates per-spoke egress, eliminating the centralized hub inspection point and the single public outbound IP the requirement asks for. Azure Monitor can aggregate logs, but logging aggregation is not an enforcement mechanism and does not create a common routing path or consistent firewall policy. Management, upgrade, cost, and rule synchronization overhead are multiplied across every spoke.