Microsoft recently announced 400 Gbps ExpressRoute Direct ports for 2026 to feed AI supercomputing clusters, and Azure Virtual Network Manager (AVNM) now orchestrates hub-and-spoke topologies at a fraction of Virtual WAN pricing. These shifts change how architects approach Azure networking design on the AZ-305 exam. As a result, questions now hinge on choosing the right connectivity fabric for the workload rather than reciting a single “best” pattern.
This is the sixth post in our AZ-305 practice series, covering Questions 51-60. Previous posts tackled cost optimization, identity and governance, storage, business continuity, and a mixed-domain review. Today’s set dives into Domain 4 of the exam blueprint, where infrastructure decisions carry the highest weight (30-35%).
Each scenario below tests a specific constraint — throughput, latency, blast radius, or cost — and the correct answer eliminates the plausible-but-wrong options for that constraint. Therefore, focus on why one service beats the others, not on what each service does. Ready? Let’s practice ten realistic Azure networking design scenarios.
Question 51: Choosing a Connectivity Fabric for a Mid-Size Enterprise
Contoso operates fifteen Azure virtual networks across two regions. The team already runs a hub-and-spoke topology with an Azure Firewall in the hub. Leadership wants centralized management as new spokes come online each quarter, but the budget cannot absorb a 300% premium. Which option satisfies this Azure networking design requirement most cost-effectively?
A) Migrate everything to Azure Virtual WAN with Secure Virtual Hubs.
B) Deploy Azure Virtual Network Manager (AVNM) on top of the existing hub-and-spoke topology.
C) Replace the hub-spoke with fully meshed VNet peering between all fifteen spokes.
D) Move all workloads into a single flat virtual network.
👁 Reveal Answer
Correct Answer: B
Explanation: AVNM adds an overlay management layer that automates VNet grouping, connectivity, and security admin rules without discarding the existing hub-spoke investment. Consequently, Contoso keeps its Azure Firewall and routing choices while gaining dynamic membership and centralized policy. Virtual WAN (A) works well for global SD-WAN scenarios but adds significant cost for purely intra-Azure traffic. A full mesh (C) does not scale past a handful of VNets and multiplies peering charges. Collapsing into one VNet (D) destroys blast-radius isolation and violates landing-zone guidance.
Question 52: Private Endpoint versus Service Endpoint for Cross-Region Access
The security team at Fabrikam requires that a spoke VNet in East US 2 reach an Azure Storage account in West Europe over the Microsoft backbone, without exposing a public endpoint. On-premises users must also reach the same storage account through an existing ExpressRoute private peering. Which service best fits the requirement?
A) Service Endpoint on the East US 2 subnet with a storage firewall rule.
B) Private Endpoint in the East US 2 spoke, plus DNS forwarding from on-premises.
C) Storage account public endpoint with an IP allow-list of on-prem NAT addresses.
D) Peering both VNets and using a Service Endpoint policy across the peering.
👁 Reveal Answer
Correct Answer: B
Explanation: Private Endpoint assigns a private IP inside the spoke and works across regions, whereas Service Endpoints are region-scoped and do not extend over ExpressRoute. Because Private Endpoints resolve through Azure Private DNS zones, on-premises resolvers can conditional-forward to a DNS resolver in Azure and reach the same private IP. Option A fails the cross-region and on-prem requirements. Option C exposes a public endpoint, which the security team disallowed. Option D misunderstands Service Endpoint scope — Service Endpoints cannot traverse peering to another region.
Question 53: Boosting Throughput to PaaS over ExpressRoute (Azure Networking Design)
Your team supports a bandwidth-hungry analytics pipeline running on-premises that pulls terabytes daily from an Azure SQL Managed Instance through Private Link. Users complain the ExpressRoute gateway becomes a bottleneck. The gateway is currently ErGw2AZ. What single change delivers the largest throughput gain?
A) Add a second ExpressRoute circuit at the same peering location.
B) Upgrade the gateway to ErGw3AZ and enable FastPath with Private Link connectivity.
C) Switch from Private Link to a Service Endpoint over the same circuit.
D) Increase the ExpressRoute circuit bandwidth from 1 Gbps to 5 Gbps.
👁 Reveal Answer
Correct Answer: B
Explanation: FastPath sends data-plane traffic directly to the destination VM or Private Endpoint and bypasses the ExpressRoute virtual network gateway entirely. However, FastPath requires an Ultra Performance or ErGw3AZ SKU, so the upgrade is mandatory. Adding a second circuit (A) helps resilience, not per-flow throughput. Service Endpoints (C) do not work over ExpressRoute private peering. Simply raising circuit bandwidth (D) still funnels every packet through the gateway bottleneck, which caps out well below the circuit rate.
Question 54: Choosing Between NSG and Azure Firewall Premium
Woodgrove Bank must inspect TLS-encrypted traffic between two spoke VNets to detect data exfiltration, log every allowed flow to a SIEM, and enforce FQDN-based egress rules. The compliance officer specifically calls out signature-based intrusion detection. Which control plane meets all requirements with one product?
A) Network Security Groups with augmented service tags on both spokes.
B) Azure Firewall Standard in the hub with application rules.
C) Azure Firewall Premium in the hub with TLS inspection and IDPS enabled.
D) A third-party NVA cluster with per-spoke User Defined Routes.
👁 Reveal Answer
Correct Answer: C
Explanation: Azure Firewall Premium is the only first-party service that combines TLS inspection, signature-based IDPS, and FQDN filtering in one product. Furthermore, running it in the hub keeps a single audit surface for the SIEM. NSGs (A) operate at Layer 4 and cannot inspect encrypted payloads. Firewall Standard (B) supports FQDN filtering but lacks TLS inspection and IDPS. A third-party NVA (D) can technically meet the requirement, however it doubles the operational burden and licensing spend without adding capability the question demands.
Question 55: Global Anycast Delivery for a Multi-Region Web App
The architecture team at Northwind Traders runs a web app in three Azure regions and wants users routed to the closest healthy region with sub-second failover. In addition, marketing insists on a WAF that blocks OWASP Top 10 at the edge before traffic reaches any region. Which service best fits this Azure networking design need?
A) Azure Application Gateway v2 with WAF, one per region, fronted by Traffic Manager.
B) Azure Front Door Premium with the WAF policy attached.
C) Cross-region Load Balancer with NSG rules on the frontend subnet.
D) Azure Firewall Premium in each region with DNAT rules.
👁 Reveal Answer
Correct Answer: B
Explanation: Front Door Premium terminates TLS at more than 190 edge points of presence, provides anycast routing with fast failover, and integrates a managed WAF. As a result, a single global resource satisfies both the latency and the security constraint. Option A works but adds regional Application Gateways behind Traffic Manager, which relies on DNS TTL for failover — measurably slower than anycast. Cross-region Load Balancer (C) has no WAF. Azure Firewall (D) is a network security appliance, not an HTTP load balancer, so it lacks Layer 7 features like path-based routing and OWASP rulesets.
Question 56: Forcing East-West Traffic Through a Network Virtual Appliance
Litware must inspect all traffic between two spoke VNets through a partner NVA cluster deployed in the hub. Peering already exists in a hub-and-spoke pattern. Which combination correctly steers spoke-to-spoke traffic through the NVA?
A) Enable Global VNet Peering between the two spokes.
B) Add a User Defined Route on each spoke pointing 0.0.0.0/0 and the peer prefix to the NVA, and enable ‘Allow gateway transit’ on the hub.
C) Configure BGP on the spokes to advertise a default route.
D) Attach an NSG to each spoke subnet allowing only NVA source IPs.
👁 Reveal Answer
Correct Answer: B
Explanation: VNet peering is non-transitive, so spoke traffic never passes through the hub unless a User Defined Route (UDR) explicitly forwards it. The UDR on each spoke must include both a default route and the peer prefix pointing to the NVA’s internal load balancer. Additionally, enabling gateway and route transit on the hub peering keeps hybrid routing intact. Direct spoke-to-spoke peering (A) bypasses the NVA entirely. Spokes cannot run BGP on their own peering (C). NSGs (D) filter but do not redirect traffic paths.
Question 57: Picking a DDoS Protection Tier for a Single Public IP
Tailwind Traders exposes exactly one public IP on an Application Gateway. Management wants Microsoft-backed DDoS mitigation with cost visibility, but they do not want to protect all 200 unrelated public IPs in the subscription. Which tier fits the budget and scope?
A) DDoS Network Protection at the virtual network level.
B) DDoS IP Protection applied to the single public IP resource.
C) Basic DDoS protection only (default).
D) A third-party scrubbing service in front of the App Gateway.
👁 Reveal Answer
Correct Answer: B
Explanation: DDoS IP Protection is billed per protected public IP, which is ideal when only one address needs coverage. It provides the same mitigation stack as Network Protection, including telemetry and attack analytics. Network Protection (A) applies to every eligible public IP in a virtual network and carries a flat monthly fee suited to broader coverage. Basic protection (C) is always on but lacks the SLA, telemetry, and rapid response the question calls for. A third-party service (D) adds cost and integration overhead without offering more than Azure-native mitigation for this narrow scope.
Question 58: Transitive Routing Across Many Regions
Adventure Works has expanded from three to twelve Azure regions and needs any-to-any connectivity between all VNets, plus on-premises via three ExpressRoute circuits in different geographies. Manually maintaining Global VNet Peering between every pair has become unmanageable. Which topology reduces operational overhead the most?
A) Continue with Global VNet Peering and script the peerings with Bicep.
B) Deploy Azure Virtual WAN with a virtual hub in each region.
C) Deploy a single hub VNet in one region and peer every spoke to it globally.
D) Use Site-to-Site VPNs between the regional hubs.
👁 Reveal Answer
Correct Answer: B
Explanation: Virtual WAN provides fully transitive routing across regional hubs automatically, so any VNet, VPN, or ExpressRoute connection can talk to any other without manually managing peering pairs. Additionally, Virtual WAN handles branch and remote-user connectivity in the same fabric. Scripting Global VNet Peering (A) still produces a full mesh with N×(N-1)/2 relationships — twelve regions means 66 peerings. A single global hub (C) creates a single point of failure and a long backbone hairpin. Site-to-Site VPNs (D) cap throughput and add encryption overhead the ExpressRoute circuits already avoid.
Question 59: Private DNS Zones for Private Endpoints at Scale
The platform team at Contoso is deploying Private Endpoints for Storage, Key Vault, and SQL across ten spoke VNets in two regions. On-premises servers must also resolve these private FQDNs. Which DNS design meets the requirement with the least duplication?
A) Create one Azure Private DNS zone per Private Endpoint and link it to that spoke.
B) Create one Private DNS zone per service (for example, privatelink.blob.core.windows.net), link each zone to all VNets, and forward DNS from on-premises to an Azure DNS Private Resolver.
C) Add A records manually to each spoke’s DNS server for every Private Endpoint.
D) Publish a wildcard A record on the corporate public DNS pointing to the Private Endpoint IPs.
👁 Reveal Answer
Correct Answer: B
Explanation: Each Azure PaaS service uses a fixed privatelink.* zone, and one zone per service linked to every VNet is the Microsoft-recommended pattern. For on-premises resolution, DNS Private Resolver provides an inbound endpoint that corporate resolvers can conditional-forward to. Option A explodes into hundreds of zones. Manual A records (C) drift out of sync as endpoints scale. Public DNS (D) leaks internal IPs and violates the private-only design intent of Private Endpoints.
Question 60: 400 Gbps Connectivity for an AI Training Cluster
Fabrikam’s AI research division is building a GPU training cluster in an on-premises colocation facility that must sync petabyte-scale checkpoints to Azure Blob Storage during nightly training windows. Standard 10 Gbps ExpressRoute maxes out and delays the next epoch. Which 2026 Azure networking design option addresses the bandwidth ceiling?
A) Aggregate ten 10 Gbps ExpressRoute circuits with equal-cost multi-path routing.
B) Provision ExpressRoute Direct with 400 Gbps ports and enable FastPath.
C) Switch to Site-to-Site VPN over the public Internet with IPsec offload.
D) Use AzCopy over the public Blob endpoint with parallel streams.
👁 Reveal Answer
Correct Answer: B
Explanation: ExpressRoute Direct with 400 Gbps ports became available in 2026 specifically for AI supercomputing and massive data movement, and pairing it with FastPath bypasses the gateway to reach line rate. Aggregating ten 10 Gbps circuits (A) is possible but costs more, adds operational complexity, and still tops out at the underlying gateway. VPN over the Internet (C) introduces variable latency and encryption overhead that cannot approach 400 Gbps. Public Blob transfer (D) sacrifices the private path the research division needs and remains capped by the Internet uplink.
Study Tips for Azure Networking Design Success
Domain 4 rewards architects who can eliminate wrong answers quickly. Therefore, do not memorize service brochures — practice reading a scenario, spotting the single hard constraint, and mapping it to one service. Use these habits when you sit the exam:
- Anchor on the constraint. Every question hides one requirement (throughput, latency, isolation, cost). Circle it before reading the options.
- Know service scope. Service Endpoints are region-bound, Private Endpoints are not, and neither traverses peering the same way. Memorize the scope table so it becomes reflexive.
- Practice the peering rules. VNet peering is non-transitive, so any spoke-to-spoke question probably needs UDRs or Virtual WAN. Draw the traffic path before choosing.
- Track SKU dependencies. FastPath needs ErGw3AZ or Ultra, WAF requires Application Gateway v2 or Front Door Premium, and IDPS needs Firewall Premium. Many wrong answers are the right service on the wrong SKU.
- Watch for cost traps. Virtual WAN, Global VNet Peering egress, and cross-region Private Link data-processing charges are common distractors. When two designs meet the requirement, pick the cheaper one.
- Read the Azure Networking Design Guide on Microsoft Learn. Its topology diagrams show up almost verbatim on the exam.
Keep Practicing Your Azure Networking Design Skills
Ten questions is a warm-up, not a full mock exam. Consequently, treat each explanation as a mini-lesson — rewrite the scenario in your own words, then diagram the correct answer on paper. This habit turns memorized facts into architectural intuition, which is exactly what AZ-305 rewards.
Next up in this series: Questions 61-70 will dig into hybrid connectivity and migrations, including Azure Arc and Azure Migrate wave planning. In the meantime, revisit related sets to sharpen your Azure networking design reflexes:
- AZ-305 Questions 11-20: Identity Governance and Monitoring
- AZ-305 Questions 31-40: Business Continuity
- AZ-305 Questions 41-50: Mixed Domain Review
Bookmark cloudtech.how and return tomorrow for the next batch. Good luck on your certification journey!
