AZ-304 Azure Network Infrastructure Design 2 — Questions and Answers
Question 1: Which Azure feature enables you to access Azure PaaS services (like Azure Storage and SQL) from a VNet using a private IP address, keeping traffic off the public internet?
- VNet Service Endpoints
- Azure Private Link / Private Endpoints (Correct answer)
- VNet Peering
- Azure NAT Gateway
Correct answer: Azure Private Link / Private Endpoints
Azure Private Endpoints assign a private IP from your VNet to a PaaS service, ensuring all traffic to that service traverses the Azure backbone network rather than the public internet.
Question 2: Which Network Security Group (NSG) rule property determines the order in which rules are evaluated?
- Rule name
- Priority (Correct answer)
- Direction
- Protocol
Correct answer: Priority
NSG rules are evaluated in order of their Priority value (100–4096), with lower numbers processed first; the first matching rule is applied and subsequent rules are not evaluated.
Question 3: An architect wants to inspect all outbound internet traffic from Azure VMs through a centralized appliance. Which routing technique must be configured?
- BGP route advertisement
- User-Defined Routes (UDR) with a next hop to the appliance (Correct answer)
- VNet Peering with gateway transit
- Azure Traffic Manager policy
Correct answer: User-Defined Routes (UDR) with a next hop to the appliance
User-Defined Routes (UDRs) override Azure system routes, allowing you to redirect traffic (e.g., 0.0.0.0/0) through a specific next hop such as a Network Virtual Appliance (NVA) or Azure Firewall.
Question 4: Which Azure VPN Gateway SKU supports active-active configuration for higher availability and redundancy?
- Basic
- VpnGw1
- VpnGw2
- All SKUs above Basic (Correct answer)
Correct answer: All SKUs above Basic
Active-active VPN Gateway configuration is supported on all non-Basic SKUs (VpnGw1 and above), allowing both gateway instances to carry traffic simultaneously for higher throughput and resilience.
Question 5: What is the primary difference between Azure Front Door and Azure Traffic Manager for global load balancing?
- Front Door uses BGP routing; Traffic Manager uses Anycast
- Front Door operates at Layer 7 with TCP anycast; Traffic Manager is DNS-based Layer 4 (Correct answer)
- Front Door is only for internal traffic; Traffic Manager is for public traffic
- Front Door requires ExpressRoute; Traffic Manager uses VPN
Correct answer: Front Door operates at Layer 7 with TCP anycast; Traffic Manager is DNS-based Layer 4
Azure Front Door uses Anycast at the application layer (Layer 7) to proxy and optimize HTTP/HTTPS traffic globally, while Traffic Manager is a DNS-based load balancer that redirects clients without proxying traffic.
Question 6: An architect needs to provide outbound internet connectivity for VMs in a subnet without assigning public IP addresses to each VM. Which service should be used?
- Azure Bastion
- Azure NAT Gateway (Correct answer)
- Azure Load Balancer outbound rules
- Azure VPN Gateway
Correct answer: Azure NAT Gateway
Azure NAT Gateway provides scalable, highly available outbound internet connectivity for VMs in a subnet using a managed set of public IP addresses without requiring per-VM public IPs.
AZ-304 Azure Network Infrastructure Design 2
Which Azure feature enables you to access Azure PaaS services (like Azure Storage and SQL) from a VNet using a private IP address, keeping traffic off the public internet?