AZ-305 Azure Networking Architecture Design 3

Question 1

Your company wants to enforce that no virtual network in any subscription can have a peering connection to an unauthorized VNet. Which Azure service enforces this?

Accepted Answer

Azure Policy with deny effects

Answer

Azure Firewall policies

Answer

Network Security Groups

Answer

Azure Virtual WAN routing policies

Question 2

You need to route traffic from Azure to on-premises through a network virtual appliance (NVA) in the hub VNet. What must the NVA have enabled to forward traffic between interfaces?

Accepted Answer

IP Forwarding

Answer

Accelerated Networking

Answer

Azure Firewall DNAT

Answer

BGP route propagation

Question 3

A workload spans two Azure regions and needs fast, low-latency failover routing for TCP/UDP traffic. Which Azure service provides this?

Accepted Answer

Azure Cross-Region Load Balancer

Answer

Azure Traffic Manager (DNS-based routing)

Answer

Azure Front Door (HTTP/S only)

Answer

Azure Application Gateway v2

Question 4

You need to segment a subnet so that VMs within the same subnet cannot communicate with each other unless explicitly allowed. Which feature enables intra-subnet traffic control?

Accepted Answer

Application Security Groups with NSG rules

Answer

Azure Firewall subnet policies

Answer

VNet peering with gateway transit disabled

Answer

Private Link service

Question 5

Which Azure Firewall feature allows it to perform deep packet inspection and decrypt TLS traffic to detect and block hidden threats?

Accepted Answer

Azure Firewall Premium with TLS inspection and IDPS

Answer

Azure Firewall Standard with application rules

Answer

Azure WAF with custom rules

Answer

Azure DDoS Protection Standard

Question 6

You need to design a network that segments Azure resources into isolated tiers (web, app, data) with controlled traffic flow between tiers. What is the foundational design pattern?

Accepted Answer

Use separate subnets with NSGs and UDRs between each tier

Answer

Deploy all tiers in separate Azure subscriptions

Answer

Use separate Azure regions for each tier

Answer

Use VNet peering between each tier's dedicated VNet