AZ-304 Azure Network Infrastructure Design 2

Question 1

Which Azure feature enables you to access Azure PaaS services (like Azure Storage and SQL) from a VNet using a private IP address, keeping traffic off the public internet?

Accepted Answer

Azure Private Link / Private Endpoints

Answer

Azure Private Endpoints assign a private IP from your VNet to a PaaS service, ensuring all traffic to that service traverses the Azure backbone network rather than the public internet.

Question 2

Which Network Security Group (NSG) rule property determines the order in which rules are evaluated?

Accepted Answer

Priority

Answer

NSG rules are evaluated in order of their Priority value (100–4096), with lower numbers processed first; the first matching rule is applied and subsequent rules are not evaluated.

Question 3

An architect wants to inspect all outbound internet traffic from Azure VMs through a centralized appliance. Which routing technique must be configured?

Accepted Answer

User-Defined Routes (UDR) with a next hop to the appliance

Answer

User-Defined Routes (UDRs) override Azure system routes, allowing you to redirect traffic (e.g., 0.0.0.0/0) through a specific next hop such as a Network Virtual Appliance (NVA) or Azure Firewall.

Question 4

Which Azure VPN Gateway SKU supports active-active configuration for higher availability and redundancy?

Accepted Answer

All SKUs above Basic

Answer

Active-active VPN Gateway configuration is supported on all non-Basic SKUs (VpnGw1 and above), allowing both gateway instances to carry traffic simultaneously for higher throughput and resilience.

Question 5

What is the primary difference between Azure Front Door and Azure Traffic Manager for global load balancing?

Accepted Answer

Front Door operates at Layer 7 with TCP anycast; Traffic Manager is DNS-based Layer 4

Answer

Azure Front Door uses Anycast at the application layer (Layer 7) to proxy and optimize HTTP/HTTPS traffic globally, while Traffic Manager is a DNS-based load balancer that redirects clients without proxying traffic.

AZ-304 - Microsoft Azure Architect Design Practice Test

AZ-304 - Microsoft Azure Architect Design Practice Test

AZ-304 Azure Network Infrastructure Design 2