AZ-305 Azure Networking Architecture Design

Question 1

You need to design connectivity between 10 Azure virtual networks so that any VNet can communicate with any other VNet with minimal management overhead. Which design is recommended?

Accepted Answer

Use a hub-and-spoke topology with Azure Virtual WAN

Answer

Peer every VNet to every other VNet in a full mesh

Answer

Deploy VPN gateways in each VNet

Answer

Use Azure ExpressRoute for all VNet connections

Question 2

A workload requires that all outbound internet traffic from Azure VMs be inspected by a firewall before leaving Azure. Which service should you deploy in the hub VNet?

Accepted Answer

Azure Firewall

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Network Security Groups

Question 3

Your application requires that Azure PaaS services like Azure SQL Database be accessible only from within your VNet and not over the public internet. Which feature should you use?

Accepted Answer

Private Endpoints

Answer

Service endpoints

Answer

VNet Integration

Answer

Azure Private Link service

Question 4

You need to connect an on-premises datacenter to Azure with a guaranteed bandwidth SLA, low latency, and private connectivity not traversing the internet. Which option should you recommend?

Accepted Answer

Azure ExpressRoute

Answer

Site-to-Site VPN over IPsec

Answer

Point-to-Site VPN

Answer

Azure Virtual WAN over internet

Question 5

A global application needs to route users to the nearest healthy Azure region and perform SSL offloading. Which Azure service is best suited?

Accepted Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 6

You need to inspect and control traffic flowing between spoke VNets in a hub-and-spoke architecture. What must you configure in addition to deploying Azure Firewall in the hub?

Accepted Answer

User-Defined Routes (UDRs) to redirect spoke traffic through the firewall

Answer

Network Security Groups on each spoke subnet

Answer

Azure Policy network deny rules

Answer

ExpressRoute gateway in the hub