Designing Microsoft Azure Infrastructure Solutions (AZ-305) — All Questions
3 questions
An architect needs to provide private, high-bandwidth connectivity from an on-premises datacenter to Azure that does not traverse the public internet. Which service should be designed in?
- a.Azure ExpressRoute✓
- b.A site-to-site VPN over the internet
- c.Azure Front Door
- d.A public IP on each VM
ExpressRoute provides a private, dedicated, high-bandwidth connection to Azure that bypasses the public internet, meeting reliability and throughput requirements. A site-to-site VPN traverses the internet, Front Door accelerates public HTTP traffic, and public IPs expose resources.
A global web application needs HTTP(S) acceleration, path-based routing, and a web application firewall at the edge across regions. Which service should the architect choose?
- a.Azure Load Balancer
- b.Azure Traffic Manager
- c.Azure Front Door✓
- d.Azure Bastion
Azure Front Door provides global layer-7 HTTP(S) acceleration, path-based routing, and an integrated Web Application Firewall at the edge. Azure Load Balancer is regional layer-4, Traffic Manager is DNS-based routing without acceleration or WAF, and Bastion is for secure VM access.
To let application VMs reach Azure SQL Database over a private IP inside the virtual network, keeping traffic off the public internet, what should the architect design?
- a.A public endpoint with firewall rules
- b.A private endpoint for Azure SQL Database✓
- c.A NAT gateway
- d.A Traffic Manager profile
A private endpoint projects the Azure SQL Database into the VNet with a private IP so traffic stays on the Microsoft backbone and off the public internet. A public endpoint still exposes the service publicly, a NAT gateway handles outbound egress, and Traffic Manager does DNS routing.