AZ-304 Azure Network Infrastructure Design 1 — Questions and Answers
Question 1: Which Azure networking service provides private connectivity from an on-premises network to Azure services over a dedicated private connection, bypassing the public internet?
- Azure VPN Gateway
- Azure ExpressRoute (Correct answer)
- Azure Virtual WAN
- Azure Bastion
Correct answer: Azure ExpressRoute
ExpressRoute creates dedicated private connections between on-premises infrastructure and Azure data centers through a connectivity provider, offering predictable latency and higher security than VPN.
Question 2: An architect needs to design a hub-and-spoke network topology in Azure. What is the primary benefit of this design?
- It eliminates the need for network security groups
- It centralizes shared services and network appliances in the hub VNet (Correct answer)
- It automatically routes traffic between all spoke VNets
- It removes the need for VNet peering
Correct answer: It centralizes shared services and network appliances in the hub VNet
Hub-and-spoke topology centralizes shared resources like firewalls, DNS, and VPN gateways in the hub VNet, reducing cost and management overhead across multiple spoke VNets.
Question 3: Which Azure service allows you to deploy a managed network virtual appliance to inspect and filter all traffic between VNets and on-premises networks?
- Azure Load Balancer
- Azure Firewall (Correct answer)
- Azure Application Gateway
- Network Security Groups
Correct answer: Azure Firewall
Azure Firewall is a managed, cloud-native network security service that provides threat intelligence-based filtering and FQDN-based application rules across VNet traffic.
Question 4: You need to expose a multi-tier web application to the internet with SSL termination and Web Application Firewall (WAF) capabilities. Which Azure service should you use?
- Azure Load Balancer (Standard)
- Azure Traffic Manager
- Azure Application Gateway with WAF (Correct answer)
- Azure Front Door
Correct answer: Azure Application Gateway with WAF
Azure Application Gateway with WAF provides Layer 7 load balancing, SSL/TLS termination, and OWASP-based web application firewall protection for web applications.
Question 5: Which Azure Private DNS Zone feature allows VMs in a VNet to automatically register their DNS records without manual configuration?
- DNS delegation
- Auto-registration (Correct answer)
- DNS forwarder
- Conditional forwarding
Correct answer: Auto-registration
Auto-registration in Azure Private DNS Zones automatically creates and removes DNS A records when VMs in a linked VNet are created or deleted.
Question 6: An organization needs to route traffic globally to the nearest healthy endpoint with failover capability using DNS-based routing. Which Azure service should be used?
- Azure Application Gateway
- Azure Load Balancer
- Azure Traffic Manager (Correct answer)
- Azure Front Door
Correct answer: Azure Traffic Manager
Azure Traffic Manager uses DNS-based routing policies (performance, geographic, priority, weighted) to direct clients to the nearest or healthiest endpoint globally.
AZ-304 Azure Network Infrastructure Design 1
Which Azure networking service provides private connectivity from an on-premises network to Azure services over a dedicated private connection, bypassing the public internet?