Welcome back to our Azure infrastructure design series. This installment lands during a busy stretch for Azure networking. Specifically, default outbound access has now retired for virtual networks created with the newer API versions. In addition, Microsoft is rolling out AI-optimized fabrics like 400G ExpressRoute Direct alongside Cobalt 200 ARM compute. Therefore, exam candidates need to reason about egress paths and workload-specific VM families more carefully than ever.
Questions 51-60 in this set focus on Domain 4 of the AZ-305 blueprint — designing compute and networking. Specifically, these scenarios ask “which service best fits this constraint?” rather than “what does this service do?” As a result, you will practice ruling out plausible options based on subtle wording about RTO, blast radius, throughput, or cost. However, the pattern is always the same: identify the one hard constraint, then eliminate.
You are halfway through the series now, so treat this set as a checkpoint. In addition, if any topic feels shaky, revisit our earlier posts on cost optimization and business continuity before moving on. For example, Question 52 assumes you already know how NAT Gateway differs from a Standard Load Balancer outbound rule.
Question 51: Choosing a VM Family for a New AI Inference Workload
Contoso plans to deploy a real-time image classification API that needs sustained GPU throughput and predictable latency for European users. The architecture team wants the lowest cost-per-inference while keeping regional availability in West Europe and North Europe. Which VM family best fits this Azure infrastructure design decision?
A) Dv5-series general-purpose VMs behind Azure Load Balancer
B) NCads H100 v5-series VMs in a proximity placement group
C) Bsv2-series burstable VMs with autoscale rules
D) Fsv2-series compute-optimized VMs
👁 Reveal Answer
Correct Answer: B
Explanation: Real-time inference on images demands GPUs, therefore only the NCads H100 v5 family qualifies. Dv5 and Fsv2 lack accelerators. As a result, they cannot meet the sustained throughput requirement. Bsv2 burstable VMs are explicitly designed for spiky, low-baseline workloads. Consequently, they would throttle under continuous inference load. In addition, placing NCads H100 v5 instances in a proximity placement group keeps GPU-to-network latency tight, which matters for classification APIs serving user traffic.
Question 52: Restoring Outbound Internet After the March 2026 API Change
Fabrikam recently deployed a new production virtual network through the Azure portal. Their VMs cannot reach public package registries, even though no NSG rule blocks outbound traffic. What is the recommended fix for this Azure infrastructure design pattern going forward?
A) Assign a public IP address directly to every VM
B) Enable default outbound access on the subnet
C) Attach an Azure NAT Gateway to the subnet
D) Add a service endpoint for Microsoft.Web
👁 Reveal Answer
Correct Answer: C
Explanation: Virtual networks created with API version 2025-07-01 and later default to private subnets, so implicit outbound is gone. Azure NAT Gateway is Microsoft’s recommended explicit egress path. Specifically, it scales SNAT ports and simplifies management at any subnet size. Public IPs on every VM work but hurt security posture and cost. In addition, default outbound access cannot be “enabled” on new subnets — that is precisely the behavior being retired. Service endpoints only cover specific Azure PaaS destinations, not general internet egress. Therefore, NAT Gateway is the exam-correct answer for greenfield subnets.
Question 53: Selecting a Global Load Balancing Layer
Woodgrove Bank runs a customer portal in three Azure regions and needs low-latency routing, TLS offload, and Web Application Firewall protection at the edge. Compliance rules require path-based routing between marketing and account-management backends. Which service should the design team select?
A) Azure Standard Load Balancer with cross-region frontend
B) Azure Application Gateway with WAF v2
C) Azure Front Door Premium
D) Azure Traffic Manager (performance profile)
👁 Reveal Answer
Correct Answer: C
Explanation: Front Door Premium delivers global anycast routing, TLS termination, WAF, and Layer-7 path rules from Microsoft’s edge network. Application Gateway offers path routing and WAF, however, it operates regionally. As a result, it fails the global-latency requirement. Standard Load Balancer is Layer 4 and cannot do path-based routing. In addition, Traffic Manager uses DNS-based steering only and provides no TLS offload or WAF. For example, if the scenario said “single region,” Application Gateway with WAF v2 would be the better fit.
Question 54: Enterprise Landing Zone Topology at Scale
Northwind Traders operates in six Azure regions with 40 spoke virtual networks, and they want Microsoft-managed transitive routing plus branch VPN termination. Their small pilot last year used a single hub-and-spoke design. Which topology best supports the new scale for Azure infrastructure design?
A) Continue with regional hub-and-spoke and mesh peering between hubs
B) Migrate to Azure Virtual WAN with secured virtual hubs
C) Deploy a single hub in one primary region with global peering
D) Use VNet peering with user-defined routes only
👁 Reveal Answer
Correct Answer: B
Explanation: Virtual WAN wins above roughly three regions and fifteen spokes. Specifically, Microsoft manages hub peerings, transitive routing intent, and branch onboarding. Manual hub meshes multiply UDRs and become brittle. In addition, a single centralized hub adds latency and creates a blast-radius problem at this footprint. Peering-only designs cannot provide transitive connectivity without extra NVAs. Therefore, Virtual WAN is the correct enterprise-scale answer for this Azure infrastructure design.
Question 55: Choosing Between ExpressRoute and Site-to-Site VPN
Litware needs a 2 Gbps connection between an on-premises data center and Azure with an SLA-backed uptime of 99.95% for financial transactions. Cost matters, but reliability comes first. Which connectivity option should the design recommend?
A) Site-to-Site VPN over the public internet
B) Point-to-Site VPN for each application server
C) ExpressRoute with a Standard SKU circuit
D) Azure Bastion with private endpoints
👁 Reveal Answer
Correct Answer: C
Explanation: ExpressRoute provides a private connection with a 99.95% SLA and predictable throughput. Specifically, that is what the financial workload requires. Site-to-Site VPN traverses the public internet. As a result, it offers only a 99.9% SLA in a single tunnel configuration. Point-to-Site is designed for individual clients, not server-to-server bulk transfer. In addition, Azure Bastion is a management plane for RDP/SSH, not a data path. Consequently, ExpressRoute is the only fit for this Azure infrastructure design constraint.
Question 56: Migration Assessment for a Legacy Estate
Adventure Works owns 300 on-premises Windows and Linux VMs across two data centers and wants a rightsized Azure IaaS proposal with cost estimates. Leadership expects a report within four weeks. Which service starts the assessment?
A) Azure Site Recovery
B) Azure Migrate: Discovery and assessment
C) Database Migration Service
D) Azure Arc-enabled servers
👁 Reveal Answer
Correct Answer: B
Explanation: Azure Migrate’s Discovery and assessment tool inventories VMs, measures performance, and produces rightsized SKU recommendations with monthly cost estimates. Site Recovery is a replication and DR service, not an assessment tool. In addition, Database Migration Service targets databases only. Azure Arc-enabled servers project on-premises machines into Azure for management, however, they do not generate migration cost reports. Therefore, only Azure Migrate meets the requirement. Specifically, the four-week deadline pushes you toward the tool that delivers a rightsizing report out of the box.
Question 57: Extending Azure Management to On-Premises Kubernetes
Tailwind Traders runs Rancher-managed Kubernetes clusters in three factories and wants a unified Azure Policy, Defender, and GitOps deployment experience across the fleet. Their compute cannot move to Azure due to data residency rules. What should the architect propose?
A) Rebuild the clusters on Azure Stack HCI
B) Onboard the clusters with Azure Arc-enabled Kubernetes
C) Migrate the workloads to AKS in the nearest region
D) Use Azure Automanage for the underlying nodes
👁 Reveal Answer
Correct Answer: B
Explanation: Azure Arc-enabled Kubernetes projects any CNCF-conformant cluster into Azure Resource Manager. As a result, teams get Policy, Defender for Containers, and Flux-based GitOps without moving workloads. Azure Stack HCI would force a hardware refresh. In addition, migrating to AKS violates the residency constraint outright. Automanage targets Windows/Linux VMs, not Kubernetes control planes. Consequently, Arc is the purpose-built answer for hybrid Kubernetes governance.
Question 58: Private Connectivity Between an App and a Storage Account
Wingtip Toys wants their App Service in a VNet-integrated subnet to reach an Azure Storage account only over the Microsoft backbone. In addition, the storage account must reject all public traffic, and traffic must appear as a private IP from the consumer’s side. Which pattern fits?
A) Service endpoint for Microsoft.Storage on the subnet
B) Private endpoint plus disabled public network access on storage
C) Storage firewall rule allowing the App Service outbound IPs
D) VNet peering between App Service and the storage region
👁 Reveal Answer
Correct Answer: B
Explanation: A private endpoint gives the storage account a NIC in the customer’s VNet with a private IP. In addition, disabling public network access enforces backbone-only reach. Service endpoints still traverse the storage public endpoint. As a result, they expose a public IP to the consumer. Firewall IP rules leave the storage account internet-facing. However, VNet peering does not apply to PaaS storage, which is not deployed into a VNet. Therefore, the private endpoint is the correct design.
Question 59: Availability Zones Versus Availability Sets
The architecture team at Contoso needs a 99.99% SLA for a stateful transaction service on Azure VMs. Their target region supports three physical zones. What should they deploy?
A) Two VMs in an availability set with managed disks
B) Three VMs spread across availability zones behind a zone-redundant Standard Load Balancer
C) A single VM in a proximity placement group
D) Two VM Scale Sets in different resource groups
👁 Reveal Answer
Correct Answer: B
Explanation: Distributing VMs across availability zones with a zone-redundant Standard Load Balancer meets the 99.99% VM SLA. Availability sets only reach 99.95%. Specifically, they protect against rack failures inside a single datacenter, not full datacenter outages. A single VM caps at 99.9% with Premium SSD. In addition, placing scale sets in different resource groups does nothing for availability, because resource groups are a management boundary. Consequently, zonal spread is the only correct answer for this Azure infrastructure design SLA target.
Question 60: Centralized Egress Filtering Across Many Spokes
Fabrikam operates 25 spoke VNets that all need FQDN filtering, IDPS, and centralized logging on outbound internet traffic. The security team wants a single policy plane and minimal operational overhead. Which design should the architect recommend?
A) Deploy a third-party NVA cluster per spoke
B) Route spoke traffic through Azure Firewall Premium in a hub, managed by Firewall Manager
C) Attach a NAT Gateway to each spoke and rely on NSGs
D) Enable service tags on each subnet and disable outbound rules
👁 Reveal Answer
Correct Answer: B
Explanation: Azure Firewall Premium delivers FQDN filtering, TLS inspection, and IDPS. In addition, Firewall Manager centralizes policy across hubs. Deploying NVAs per spoke multiplies cost and operational load. NAT Gateway handles egress, however, it performs no L7 filtering or IDPS. Service tags only control what NSGs match — specifically, they do not inspect payloads. Therefore, hub-based Azure Firewall Premium with Firewall Manager is the recommended Azure infrastructure design pattern for centralized egress.
Study Tips for This Azure Infrastructure Design Set
Use these habits to lock in the material before exam day:
- Learn the egress ladder. Memorize the order NAT Gateway → Load Balancer outbound rules → public IP → Azure Firewall, and when each wins.
- Anchor SLAs to numbers. Single VM 99.9%, availability set 99.95%, availability zones 99.99% — the exam loves these thresholds.
- Compare load balancers by layer. Layer 4 for regional TCP/UDP, Layer 7 regional with WAF for Application Gateway, Layer 7 global with WAF for Front Door.
- Draw the topology. When a question mentions three or more regions or fifteen-plus spokes, Virtual WAN almost always beats manual hub-and-spoke.
- Ask “public or private?” Private endpoints plus disabled public access is the default answer when the scenario says “backbone only” or “private IP.”
Keep Practicing Your Azure Infrastructure Design Skills
You now have 60 AZ-305 practice questions in your rotation. The next set will explore hybrid identity and workload governance, so review your notes and give yourself a short break before diving in. For the full official domain breakdown, see the Microsoft Learn AZ-305 exam page.
Continue building your Azure infrastructure design intuition with our earlier sets: AZ-305 Questions 41-50: Mixed Domain Review, AZ-305 Questions 31-40: Business Continuity, and AZ-305 Questions 11-20: Identity Governance Monitoring. Consistent daily practice, therefore, is the fastest path to a confident exam sitting.
