Azure Network Infrastructure Design Flashcards

Which Azure networking feature allows you to connect two VNets in different Azure regions so they communicate over the Microsoft backbone network?

Answer: Global VNet Peering

Global VNet Peering connects VNets in different Azure regions over the Microsoft global backbone, providing low-latency connectivity without the overhead of a VPN gateway.

A DDoS protection plan is required for all production virtual networks in an enterprise. Which DDoS Protection tier provides adaptive tuning and attack analytics?

Answer: DDoS Network Protection

DDoS Network Protection provides adaptive real-time tuning, attack telemetry, diagnostics, and rapid response support — going beyond the baseline platform protection available to all Azure resources.

Which Azure service provides centralized, scalable management of routing and security for a large number of branch offices connecting to Azure?

Answer: Azure Virtual WAN

Azure Virtual WAN is a networking service that provides optimized, automated branch-to-branch and branch-to-Azure connectivity with integrated routing, security, and SD-WAN integration.

An architect must ensure that a web application is protected against SQL injection and cross-site scripting attacks. Which Azure service provides this at the network layer?

Answer: Azure Web Application Firewall (WAF)

Azure WAF (available on Application Gateway, Front Door, and CDN) inspects HTTP/HTTPS traffic and blocks OWASP Top 10 threats like SQL injection and XSS at Layer 7.

What is the purpose of Azure Route Server in a hub-and-spoke network design?

Answer: It enables dynamic BGP route exchange between NVAs and Azure VNets

Azure Route Server allows Network Virtual Appliances (NVAs) to exchange routes dynamically with Azure VNets via BGP, eliminating the need to manually manage UDRs.

Which subnet delegation concept in Azure allows a specific Azure service to inject network interfaces directly into a VNet subnet?

Answer: Subnet Delegation

Subnet Delegation grants a specific Azure service (e.g., Azure SQL Managed Instance, App Service) the permission to create service-managed resources within a designated subnet.