The AZ-305 compute and networking domain has never mattered more than it does this month. Microsoft just made 400G ExpressRoute direct ports generally available. The high-throughput VPN Gateway also hit GA at 20 Gbps aggregate. Most importantly for exam candidates, AKS turned off default outbound access on March 31, 2026. If you sat the exam a year ago, several “right” answers have quietly shifted. Therefore, this set updates your thinking with current guidance and current service names.
Welcome to Questions 51-60 in our AZ-305 practice series. This installment lives entirely in Domain 4, “Design infrastructure solutions.” Domain 4 is the heaviest-weighted objective at 30–35% of the scored exam. Specifically, we drill into compute choice, hybrid connectivity, load balancing selection, container orchestration, and modern network segmentation. In addition, we lean on the April 17, 2026 refresh of the official objectives. As a result, no scenario in this set references deprecated features or renamed services.
Every question here follows the real AZ-305 pattern. A single constraint — RTO, cost, latency, blast radius, or compliance — forces one clear service choice over a very plausible alternative. Work each scenario before revealing the answer. Then read the full explanation, because the “why the other three are wrong” reasoning is the muscle the exam actually rewards. In other words, this is trade-off analysis practice, not memorization drill.
Grab a notebook, block twenty minutes, and treat this as a mini simulation. For example, give yourself roughly two minutes per question, and only reveal an answer after you have committed to a choice out loud or on paper. This mirrors the pacing you will need on exam day.
Question 51: Regional Web App Behind a Layer 7 Load Balancer
Contoso runs a customer portal for a single Azure region. The security team requires WAF rules, path-based routing to two backend App Service instances, and end-to-end TLS. However, users are all located in the same country and there is no CDN requirement. The architect must choose the most cost-appropriate Layer 7 entry point.
A) Azure Front Door Premium
B) Azure Application Gateway v2 with WAF_v2 SKU
C) Azure Standard Load Balancer with outbound rules
D) Azure Traffic Manager with performance routing
👁 Reveal Answer
Correct Answer: B
Explanation: Application Gateway v2 is a regional Layer 7 service. It natively supports WAF_v2, path-based routing, and end-to-end TLS. For a single-region workload, however, Front Door adds global edge capacity and a premium price you do not need. Standard Load Balancer works at Layer 4 only, so it cannot inspect URL paths. Traffic Manager is DNS-based. Therefore it performs no HTTP inspection at all and cannot enforce WAF rules.
Question 52: AKS Network Plugin for Large Pod Counts (AZ-305 Compute and Networking)
Fabrikam plans an AKS cluster that will host 8,000 pods across 200 nodes. The networking team can allocate only a small /24 subnet for the cluster because IP addresses in the corporate VNet are scarce. Pods still need direct network policy enforcement and observability. Which network plugin design meets these constraints?
A) Azure CNI (traditional) with pod IPs from the node subnet
B) Kubenet with user-defined routes
C) Azure CNI Overlay with Cilium data plane
D) BYO CNI with static route tables
👁 Reveal Answer
Correct Answer: C
Explanation: Azure CNI Overlay assigns pod IPs from a separate overlay CIDR. Therefore the node subnet stays small even at 8,000 pods. In addition, the Cilium data plane provides eBPF-based network policy and rich observability. Kubenet cannot match those features. Traditional Azure CNI would exhaust the /24 immediately because every pod consumes a VNet IP. Kubenet is being deprecated for new clusters. Finally, BYO CNI shifts operational burden onto the team with no offsetting benefit here.
Question 53: High Availability for a Stateful VM Workload
Woodgrove Bank must run a licensed trading application on Azure VMs with a 99.99% SLA. The vendor supports only Windows Server VMs, not PaaS. Regional zone infrastructure exists in the target region. Which design meets the SLA with the least operational overhead?
A) Two VMs in a single Availability Set
B) Two VMs spread across two Availability Zones with a zone-redundant Standard Load Balancer
C) One large VM with Premium SSD v2 disks
D) Two VMs in different regions fronted by Traffic Manager
👁 Reveal Answer
Correct Answer: B
Explanation: Two VMs deployed to different Availability Zones qualify for the 99.99% VM SLA and are protected against datacenter failure. Availability Sets deliver only 99.95%, therefore they miss the target by design. A single VM cannot meet 99.99% regardless of disk tier. Multi-region deployment exceeds the requirement, adds latency, and increases cost with no additional exam-relevant benefit.
Question 54: Hybrid Connectivity for Predictable Bandwidth
Northwind Traders must connect an on-premises datacenter to Azure with 5 Gbps of predictable, low-latency throughput for SAP workloads. The company already has a Microsoft-partner exchange provider on site. Which connection type fits best?
A) Site-to-site VPN with the basic SKU
B) Point-to-site VPN with OpenVPN protocol
C) ExpressRoute private peering through the provider
D) Azure Virtual WAN with SD-WAN NVA only
👁 Reveal Answer
Correct Answer: C
Explanation: ExpressRoute delivers a dedicated private circuit with committed bandwidth, low latency, and a financially backed SLA. This matches what SAP requires. Site-to-site VPN traverses the public internet, so latency and throughput vary. Point-to-site targets individual users, not datacenter interconnect. Virtual WAN with only an SD-WAN NVA still relies on internet transport. As a result, it lacks the guaranteed circuit that ExpressRoute provides for tier-1 workloads.
Question 55: Global Multi-Region Traffic with Session Affinity
Your team runs a web app in three Azure regions. Users must be routed to the closest healthy region, static assets should be cached at the edge, and a WAF should block layer 7 attacks before traffic reaches origins. Which single service satisfies all three requirements?
A) Traffic Manager with priority routing
B) Azure Front Door Premium
C) Application Gateway v2 in one region
D) Cross-region Standard Load Balancer
👁 Reveal Answer
Correct Answer: B
Explanation: Front Door Premium is a global Layer 7 service that combines edge caching, geo-routing, and an integrated WAF at Microsoft edge locations. Traffic Manager only does DNS-based routing and cannot cache or filter HTTP payloads. Application Gateway is regional, so it does not solve the global routing goal. Cross-region Standard Load Balancer works at Layer 4 and offers no WAF or caching capabilities.
Question 56: Choosing the Right Container Runtime
Litware is modernizing three workloads: a long-running microservice mesh, an event-driven HTTP API that scales from zero, and a short-lived batch job triggered by a queue. The team wants the least operational overhead for each. Which mapping is correct?
A) AKS for all three
B) Microservice mesh → AKS; event-driven API → Azure Container Apps; batch job → Azure Container Instances
C) Container Instances for all three
D) Microservice mesh → Container Apps; event-driven API → AKS; batch job → Service Fabric
👁 Reveal Answer
Correct Answer: B
Explanation: Each workload maps to the runtime that fits its shape. Specifically, AKS gives full Kubernetes control for a complex service mesh. Container Apps provides KEDA-driven scale-to-zero for event-driven APIs. Container Instances offers per-second billing for short jobs. Running AKS for all three raises cost and operator toil unnecessarily. Container Instances lacks the orchestration a mesh needs. Service Fabric is a legacy option and no longer the recommended default for new designs.
Question 57: Enterprise Landing Zone Connectivity at Scale
Tailwind Traders is standing up 200 spoke VNets across four regions, plus 30 branch offices with SD-WAN appliances. The platform team wants managed transit routing, integrated firewall, and any-to-any spoke reachability without hand-crafting hundreds of peerings. Which topology best matches these goals?
A) Classic hub-and-spoke with a single hub VNet per region
B) Full mesh via VNet peering across all spokes
C) Azure Virtual WAN with secured virtual hubs
D) Azure Route Server in each spoke
👁 Reveal Answer
Correct Answer: C
Explanation: Virtual WAN provides Microsoft-managed transit routing, native branch integration, and secured virtual hubs that embed Azure Firewall. As a result, it removes the manual peering matrix that would otherwise explode past 200 spokes. Classic hub-and-spoke works well at smaller scale, however operational cost grows quickly at this size. Full mesh multiplies peerings and complicates governance. Route Server distributes routes but does not provide the managed transit backbone the scenario requires.
Question 58: Private Endpoint Sprawl and Peering Limits
Contoso Health has grown to 3,800 private endpoints in a single VNet and is nearing peering limits across 800 peered VNets. The architect must plan for another year of growth without redesigning every workload. Which action best addresses the AZ-305 compute and networking scale constraint?
A) Move all private endpoints into a dedicated services VNet and use Private Link across peering
B) Convert every peered VNet into a Virtual WAN spoke immediately
C) Rely on service endpoints instead of private endpoints
D) Split the VNet by exceeding the 5,000 private endpoint limit
👁 Reveal Answer
Correct Answer: A
Explanation: Consolidating private endpoints in a dedicated services VNet works within current platform limits. Specifically, Azure now supports 5,000 endpoints per VNet and 20,000 cross-peered VNets. In contrast, forcing a Virtual WAN migration for peering alone is disruptive and unnecessary at this scale. Service endpoints are not equivalent to private endpoints for compliance or DNS behavior. Finally, deliberately exceeding limits is not a valid design because the platform will simply reject creation of new endpoints.
Question 59: Burst Compute for a Scientific Workload
Adventure Works needs to run 5,000 parallel GPU jobs a few times per month with tolerance for interruption. Cost must be minimized because results can be re-run if a node is evicted. Which compute option fits best?
A) A Virtual Machine Scale Set in Uniform orchestration with reserved instances
B) Azure Batch with low-priority (spot) VM pools
C) An always-on AKS node pool with GPU SKUs
D) Azure Functions Premium plan
👁 Reveal Answer
Correct Answer: B
Explanation: Azure Batch with spot VMs was purpose-built for interruption-tolerant, parallel HPC workloads and delivers the deepest discount. Reserved instances make no sense for bursty demand because the capacity sits idle most of the month. An always-on AKS GPU pool pays full price around the clock. Functions Premium is not designed for large-scale GPU batch computation and imposes execution-time limits that break long jobs.
Question 60: Zero-Trust Segmentation for AZ-305 Compute and Networking
The security architect at Fabrikam must enforce a global “deny inbound RDP from the internet” rule across 300 spoke VNets that development teams own. Individual application NSGs must still allow team-specific inbound traffic on other ports. Which combination best implements this policy?
A) A single NSG assigned to every subnet manually
B) Azure Firewall in each spoke
C) Azure Virtual Network Manager Security Admin rules with an Allow-Always exception
D) Route tables blackholing TCP port 3389
👁 Reveal Answer
Correct Answer: C
Explanation: Virtual Network Manager Security Admin rules evaluate before NSGs. In addition, they apply centrally to network groups. Therefore the platform team can guarantee the deny rule without waiting on 300 workload owners. Application-owned NSGs still function for their own ports. Manually assigning one NSG per subnet is unenforceable at scale and easy to bypass. Deploying Azure Firewall in every spoke is cost-prohibitive for a single policy goal. Finally, route tables cannot filter by protocol or port.
Study Tips for AZ-305 Compute and Networking
Use these habits during the last week of prep. They map directly to how examiners write real questions on the AZ-305 compute and networking objective.
- Anchor every service on one differentiator. For example, Front Door equals global plus WAF, Application Gateway equals regional plus WAF, Traffic Manager equals DNS only, and Standard Load Balancer equals Layer 4. Therefore you can eliminate two wrong answers in seconds.
- Know the SLA ladder cold. Availability Zones deliver 99.99% for VMs. Availability Sets deliver 99.95%. A single VM with Premium SSD reaches 99.9%. Any question that names a specific SLA number is really asking you to choose zones.
- Practice the “scale wall” services. Virtual WAN, Virtual Network Manager, AKS CNI Overlay, and Private Link all appear once the scenario names three-digit spoke counts or four-digit pod counts. In addition, these are the services examiners reach for when they want to punish a classic hub-and-spoke design.
- Match compute to workload shape. Long-lived orchestration goes to AKS. Event-driven scale-to-zero goes to Container Apps. Short, one-off jobs go to Container Instances. Bursty, interruption-tolerant work goes to Batch with spot pools.
- Read the constraint first, not the options. The requirement (RTO, cost cap, latency, compliance) already picks the answer for you. In addition, this habit defuses the trap distractor that technically “does the job” but ignores one hard constraint in the scenario.
- Refresh on recent GA services. Specifically, note 400G ExpressRoute direct ports, the 20 Gbps high-throughput VPN Gateway, and the March 2026 change to AKS default outbound access. Old study material still names the previous defaults.
Keep Practicing Your AZ-305 Compute and Networking Skills
You have now worked ten more high-fidelity infrastructure design scenarios. Continue building depth on the AZ-305 compute and networking domain by pairing these questions with hands-on lab work in a free Azure sandbox. For example, spin up a two-VM zone-redundant deployment behind an Application Gateway. In addition, deploy a small AKS cluster with CNI Overlay and watch how pod IPs land outside the node subnet. Reading the docs is helpful, however building the design yourself is what makes the answer feel obvious on exam day.
Review Microsoft’s official AZ-305 study guide to align your revision with the April 2026 refresh. Specifically, pay attention to any bullet marked “new” or “updated” — those are the areas where fresh questions are most likely to appear.
When you are ready for the next set, jump into our earlier AZ-305 practice sessions to reinforce cross-domain skills. Start with AZ-305 Questions 41-50: Mixed Domain Review for a simulated exam feel. Then revisit AZ-305 Questions 11-20: Identity Governance Monitoring to lock in Domain 1. Finally, warm up with AZ-305 Questions 1-10: Cost Optimization before test day.
Good luck with your prep. Come back tomorrow for the next installment in the series, and keep training the “why this service, not that one” reflex — that reflex is what the AZ-305 compute and networking questions are really scoring.
