Azure Network Infrastructure Design Flashcards

Which Azure feature enables you to access Azure PaaS services (like Azure Storage and SQL) from a VNet using a private IP address, keeping traffic off the public internet?

Answer: Azure Private Link / Private Endpoints

Azure Private Endpoints assign a private IP from your VNet to a PaaS service, ensuring all traffic to that service traverses the Azure backbone network rather than the public internet.

Which Network Security Group (NSG) rule property determines the order in which rules are evaluated?

Answer: Priority

NSG rules are evaluated in order of their Priority value (100–4096), with lower numbers processed first; the first matching rule is applied and subsequent rules are not evaluated.

An architect wants to inspect all outbound internet traffic from Azure VMs through a centralized appliance. Which routing technique must be configured?

Answer: User-Defined Routes (UDR) with a next hop to the appliance

User-Defined Routes (UDRs) override Azure system routes, allowing you to redirect traffic (e.g., 0.0.0.0/0) through a specific next hop such as a Network Virtual Appliance (NVA) or Azure Firewall.

Which Azure VPN Gateway SKU supports active-active configuration for higher availability and redundancy?

Answer: All SKUs above Basic

Active-active VPN Gateway configuration is supported on all non-Basic SKUs (VpnGw1 and above), allowing both gateway instances to carry traffic simultaneously for higher throughput and resilience.

What is the primary difference between Azure Front Door and Azure Traffic Manager for global load balancing?

Answer: Front Door operates at Layer 7 with TCP anycast; Traffic Manager is DNS-based Layer 4

Azure Front Door uses Anycast at the application layer (Layer 7) to proxy and optimize HTTP/HTTPS traffic globally, while Traffic Manager is a DNS-based load balancer that redirects clients without proxying traffic.

An architect needs to provide outbound internet connectivity for VMs in a subnet without assigning public IP addresses to each VM. Which service should be used?

Answer: Azure NAT Gateway

Azure NAT Gateway provides scalable, highly available outbound internet connectivity for VMs in a subnet using a managed set of public IP addresses without requiring per-VM public IPs.