Design Network Infrastructure
Architects design connectivity, traffic distribution, and secure network access. This domain covers virtual networks, hybrid connectivity, load balancing, and private access to services.
Virtual network and connectivity design
Design VNets and subnets with non-overlapping address spaces, connecting them with VNet peering or a hub-and-spoke topology centered on an Azure Virtual WAN or hub VNet. Connect to on-premises with VPN Gateway over the internet or ExpressRoute for private, high-bandwidth links. Plan IP addressing to allow growth.
Traffic distribution and global routing
Choose the right load balancer for the workload: Azure Load Balancer for layer-4 regional traffic, Application Gateway for layer-7 HTTP with a Web Application Firewall, Azure Front Door for global HTTP acceleration and routing, and Traffic Manager for DNS-based global routing across regions.
Securing the network
Filter traffic with network security groups and application security groups, centralize egress and inspection with Azure Firewall, and protect public endpoints with DDoS Protection and Web Application Firewall. Design a segmented, least-exposure topology that keeps sensitive tiers private.
Private access to PaaS services
Use private endpoints to bring services such as Azure SQL Database or Storage into your VNet with a private IP, keeping traffic off the public internet. Service endpoints are an alternative that secures service access to specific subnets. Private access reduces exposure and supports compliance.