Design network solutions

1. Many spoke VNets share a firewall, VPN gateway and DNS. Which topology?

A. The hub hosts shared services; spokes peer to the hub.

2. A global company wants Microsoft to manage the hub routing for many branches, VPNs and VNets across regions. Which service?

C. Virtual WAN provides managed hubs with any-to-any connectivity.

3. Spoke A and spoke B are both peered to the hub. Can they talk to each other by default?

C. Spoke-to-spoke traffic needs a UDR to a hub firewall or Virtual WAN, or direct peering.

4. Why plan VNet address spaces carefully before deployment?

B. Plan non-overlapping ranges for all VNets and on-premises networks.

5. PaaS services (SQL, Storage) must be reached via a private IP from the VNet and on-premises. What do you use?

C. Private endpoints give the service a private IP; service endpoints keep the public endpoint.

6. VMs without public IPs need reliable outbound internet access with a static public IP and no SNAT port exhaustion. What do you use?

C. NAT Gateway is the recommended outbound option; default outbound access is being retired.

7. All internet-bound traffic from spokes must be inspected by Azure Firewall in the hub. What do you configure?

B. UDRs override system routes to force traffic through the firewall.

8. Which Azure Firewall SKU adds TLS inspection and IDPS?

C. Firewall Premium adds TLS inspection, IDPS, URL filtering and web categories.

9. A branch office needs encrypted connectivity to Azure over the internet, quickly and cheaply. Which option?

A. S2S VPN uses IPsec over the internet via a VPN gateway.

10. The company needs a private connection to Azure that doesn't traverse the internet, with predictable latency and up to 10 Gbps. Which service?

C. ExpressRoute is a private circuit through a connectivity provider.

11. How do you make an ExpressRoute connection resilient against a circuit or provider failure?

B. VPN backup or dual circuits at different locations protect against provider failure.

12. Remote developers on laptops need access to a VNet. Which option?

A. P2S connects individual clients.

13. Which ExpressRoute feature connects on-premises sites to each other through Microsoft's backbone?

A. Global Reach links ExpressRoute circuits so sites can communicate via Microsoft's network.

14. A global HTTP(S) app needs a single entry point with CDN caching, WAF and fast failover between regions. Which service?

C. Front Door is a global layer-7 load balancer with CDN and WAF.

15. A non-HTTP (TCP) app in two regions needs DNS-based global routing. Which service?

B. Traffic Manager works at the DNS level for any protocol.

16. A regional web app needs path-based routing (/images to one pool, /api to another), TLS termination and WAF. Which service?

C. Application Gateway is a regional layer-7 load balancer.

17. A regional TCP/UDP service needs very high throughput and low latency load balancing. Which service?

D. Load Balancer is a layer-4 pass-through load balancer.

18. Public IPs of an app must be protected against volumetric attacks with cost protection and rapid response support. What do you enable?

D. DDoS Protection adds adaptive tuning, telemetry, cost protection and DDoS rapid response.

19. Where do you apply a WAF policy to protect a globally distributed web app at the edge?

A. WAF runs on Front Door (global), Application Gateway (regional) and Azure CDN.

20. Which tool filters traffic between subnets at layer 3/4 and is applied on subnets or NICs?

D. NSGs are stateful allow/deny rules on IP, port and protocol; use ASGs to group VMs.