Design infrastructure solutions
Compute selection
Choose VMs when you need OS-level control; VM scale sets for stateless autoscaling; App Service for web apps and APIs with minimal operations; AKS when you need container orchestration and scheduling control; Container Instances for burst or isolated short-lived containers; Functions on the Consumption plan for spiky event-driven work and on the Premium plan when you need VNet integration or no cold start; Logic Apps for integration workflows across SaaS systems. Move up the abstraction ladder only as far as the requirement forces you.
Networking core
Peering is non-transitive - this single fact drives most hub-and-spoke designs: spokes need a firewall or gateway in the hub, gateway transit, and user-defined routes. NSGs are evaluated at the subnet and the NIC; an allow at one does not guarantee traffic flows if the other denies it. Know the difference between service endpoints (the service keeps its public IP, access is restricted by VNet identity, free) and private endpoints (a private IP in your subnet plus a private DNS zone, which also protects against data exfiltration). Connectivity: VPN Gateway for site-to-site and point-to-site over the internet; ExpressRoute for private, higher-bandwidth, SLA-backed circuits - ExpressRoute does not provide internet egress by default.
Load balancing and edge
Traffic Manager is global, DNS-based, protocol-agnostic. Front Door is global HTTP/HTTPS with WAF, CDN, and path-based routing. Application Gateway is regional layer 7 with WAF and path-based routing. Load Balancer is regional layer 4. Azure Firewall for centralized egress control; Bastion for browser-based RDP/SSH without public IPs; DDoS Protection Standard for VNet-level protection.
Worked example: "Global web app, HTTPS only, WAF, route /api to a different backend." Answer: Front Door with a WAF policy and path-based routing - not Application Gateway, because the requirement says global.
Trap: offering Application Gateway for a global requirement, or Traffic Manager for a requirement that needs layer 7 path routing.