I85PREP
⌘ K
CloudNetX study materials
CloudNetX study resources

CloudNetX practice questions

One question at a time. Build your CloudNetX understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network architecture design

An enterprise wants a cloud network design that keeps each business unit's traffic isolated while allowing shared services to be reached from all units. Which design pattern best fits this requirement?

  1. A single flat VNet with all business units in one subnet and network security groups applied per VM
  2. A full mesh of VNet peerings between every business unit with no central shared services VNet
  3. A design where each business unit uses a separate region with no cross-region connectivity
  4. A hub-and-spoke topology with shared services in the hub VNet and business-unit workloads in peered spoke VNets Correct answer.

Explanation

A hub-and-spoke design centralizes shared services such as firewalls, DNS, and identity proxies in a hub VNet while giving each business unit its own spoke VNet. Peering connects spokes to the hub, so isolation is preserved between units and shared services remain reachable. A flat VNet loses isolation, and a full mesh multiplies peering count and management overhead.

Question 2Network architecture design

In a cloud network architecture, what is the primary purpose of a transit gateway or virtual WAN hub?

  1. To replace network security groups with identity-based access control
  2. To encrypt all traffic between availability zones
  3. To assign public IP addresses to outbound traffic
  4. To provide a central routing point that connects many VNets, on-premises links, and branch sites Correct answer.

Explanation

A transit hub aggregates connectivity so that many VNets, VPN or ExpressRoute links, and branch sites can reach each other through one routing domain. This avoids full-mesh peering and centralizes route policy and inspection. It does not itself encrypt zone traffic, assign public IPs, or replace security groups.

Question 3Network architecture design

A design must let an on-premises data center reach workloads in three peered VNets without advertising every VNet prefix over the VPN. Which approach reduces route complexity?

  1. Assign public IP addresses to every workload and use DNS-based routing
  2. Disable peering and route all traffic through public internet endpoints
  3. Create a separate VPN gateway in each spoke VNet and advertise each spoke prefix individually
  4. Enable useRemoteGateways on all spoke VNets and place the VPN gateway in the hub, advertising summarized prefixes Correct answer.

Explanation

Placing the gateway in the hub and enabling remote gateway use on spokes lets on-premises routes reach all spokes through one gateway. Summarizing the address space into a small number of prefixes keeps the on-premises route table small. Per-spoke gateways multiply cost and route entries, and internet endpoints undermine the private design.

Question 4Network architecture design

Which Azure construct enforces a security boundary between subnets within the same VNet?

  1. A service endpoint on the subnet
  2. A network security group associated with each subnet Correct answer.
  3. A route table associated with the VNet
  4. A private DNS zone linked to the VNet

Explanation

Network security groups contain allow and deny rules evaluated on traffic entering and leaving a subnet or network interface, which creates the intra-VNet boundary. Route tables steer traffic but do not filter it. Private DNS zones and service endpoints change name resolution or service reachability, not the security boundary.

Question 5Network architecture design

A company needs private, dedicated connectivity from its on-premises network to a cloud region with predictable latency and no internet traversal. Which service should the design specify?

  1. Azure Bastion for management access
  2. A public load balancer with DDoS protection
  3. Azure ExpressRoute or an equivalent dedicated private circuit Correct answer.
  4. Site-to-site VPN over the public internet

Explanation

A dedicated private circuit such as ExpressRoute provides a private path that bypasses the public internet and offers committed bandwidth and more predictable latency. A site-to-site VPN still traverses the internet. Bastion and public load balancers solve access and distribution problems, not dedicated WAN connectivity.

Question 6Network architecture design

When designing IP address space for a multi-region cloud deployment, which practice avoids future re-addressing?

  1. Allocate small /24 ranges and expand later as needed
  2. Plan a non-overlapping, summarized address plan sized for growth across regions and on-premises Correct answer.
  3. Assign addresses dynamically from the cloud provider's default pool
  4. Use overlapping RFC 1918 ranges in each region to simplify routing

Explanation

A non-overlapping plan that is summarized by region allows peering, VPN, and ExpressRoute routes to stay stable as the estate grows. Overlapping ranges break routing and peering, and small ranges force painful re-addressing. The provider's default pool is not a controlled design choice.

Question 7Network architecture design

What is the role of a user-defined route in a cloud VNet design?

  1. It overrides system routes to send subnet traffic to a firewall or virtual appliance Correct answer.
  2. It assigns DNS names to virtual machines
  3. It encrypts traffic between subnets
  4. It automatically peers the VNet with another VNet

Explanation

User-defined routes add or override system routes so traffic from a subnet can be forced through a network virtual appliance or firewall for inspection. They do not encrypt traffic, provide naming, or create peerings. Forced tunneling to an inspection point is the classic use case.

Question 8Network architecture design

A design requires that traffic between two spoke VNets be inspected by a central firewall in the hub. Which configuration achieves this?

  1. Peer each spoke to the hub, enable gateway transit, and use user-defined routes to send spoke-to-spoke traffic to the firewall Correct answer.
  2. Place all spokes in the same subnet and use network security groups
  3. Peer each spoke directly to the other spoke and rely on default system routes
  4. Disable peering between spokes and allow only public endpoint access

Explanation

Spoke-to-hub peering plus user-defined routes on each spoke subnet forces inter-spoke traffic through the hub firewall. Gateway transit lets spokes use the hub gateway for hybrid traffic. Direct spoke-to-spoke peering would bypass the firewall, and collapsing subnets removes the segmentation the design needs.

Question 9Network architecture design

Which statement accurately describes VNet peering behavior?

  1. Peering requires a VPN gateway in each VNet
  2. Peering is non-transitive, so a spoke peered to a hub cannot reach another spoke through the hub without additional configuration Correct answer.
  3. Peering automatically encrypts traffic with IPsec between the VNets
  4. Peered VNets share a single address space and can reuse the same prefixes

Explanation

Peering links two VNets directly and is non-transitive, so spoke A cannot reach spoke B through the hub unless routing and a transit mechanism such as a firewall or gateway are configured. Peered VNets must not overlap, and peering itself does not add IPsec or require gateways.

Question 10Network architecture design

A workload must reach a PaaS storage account over the private backbone without exposing the account to the public internet. Which design element is required?

  1. A site-to-site VPN to the storage region
  2. An application gateway with a public frontend
  3. A service endpoint or private endpoint on the VNet, with public network access disabled on the storage account Correct answer.
  4. A public IP address on each VM and a NAT gateway

Explanation

A private endpoint places the PaaS service on a private IP inside the VNet, and a service endpoint extends the VNet identity to the service. Either way, disabling public network access removes internet exposure. Public IPs, public frontends, and VPN links do not by themselves make the storage account private.

Question 11Network architecture design

In a hub-and-spoke design, which component typically provides centralized DNS resolution for both cloud and on-premises names?

  1. Forwarding resolvers in the hub VNet linked to private zones and to on-premises DNS Correct answer.
  2. Each spoke running its own isolated DNS server with no forwarding
  3. The default provider-provided resolver with no custom configuration
  4. A public DNS zone hosted by the provider

Explanation

Central DNS resolvers in the hub can host or link private zones and forward queries to on-premises DNS, giving consistent name resolution across hybrid environments. Public zones do not resolve private names, isolated spoke servers fragment the namespace, and the default resolver cannot resolve on-premises names.

Question 12Network architecture design

Which load-balancing choice is appropriate for a design that must distribute non-HTTP TCP traffic across backend VMs in a single region with ultra-low latency?

  1. Azure Front Door
  2. A regional layer-4 load balancer such as Azure Load Balancer Correct answer.
  3. Azure Application Gateway with path-based routing
  4. A Traffic Manager priority profile

Explanation

A regional layer-4 load balancer distributes arbitrary TCP or UDP flows across backends with very low latency and no HTTP awareness. Front Door and Application Gateway are layer-7 HTTP-focused services, and Traffic Manager is DNS-based and does not proxy the flow.

Question 13Network architecture design

A design must protect a public-facing web application from common web exploits and volumetric attacks. Which combination fits?

  1. Network security groups alone on the backend subnet
  2. An ExpressRoute circuit to the web tier
  3. A web application firewall plus DDoS protection on the public edge Correct answer.
  4. A private endpoint on the web subnet

Explanation

A web application firewall filters layer-7 attacks such as injection and cross-site scripting, while DDoS protection absorbs volumetric floods at the edge. Security groups are layer-3/4 and do not inspect HTTP payloads. Private endpoints and ExpressRoute address private connectivity, not public attack surface.

Question 14Network architecture design

What is the effect of enabling accelerated networking on a virtual machine?

  1. It encrypts all traffic leaving the VM
  2. It automatically peers the VM's VNet with a hub
  3. It offloads packet processing to the network interface hardware, reducing latency and CPU load Correct answer.
  4. It assigns a public IP address to the VM

Explanation

Accelerated networking uses SR-IOV to move packet processing to the NIC, which lowers latency and jitter and frees CPU for the workload. It does not encrypt traffic, assign public addresses, or change VNet topology. It is a performance feature for supported VM sizes.

Question 15Network architecture design

A design must let branch offices with dynamic public IPs connect to a cloud hub securely without dedicated circuits. Which option fits best?

  1. ExpressRoute with a private peering
  2. A VNet peering to each branch office
  3. A site-to-site VPN with a route-based gateway and dynamic routing Correct answer.
  4. Azure Bastion in each branch

Explanation

A route-based site-to-site VPN supports dynamic public IPs and dynamic routing protocols, making it suitable for branches without dedicated circuits. ExpressRoute requires a provider circuit, peering is a cloud-to-cloud construct, and Bastion is a management jump service.

Question 16Network architecture design

Which design decision best limits lateral movement if one subnet is compromised?

  1. Allow all internal traffic by default and rely on endpoint antivirus
  2. Segment workloads into subnets by tier and apply least-privilege security rules between them Correct answer.
  3. Place all workloads in one large subnet to simplify rule management
  4. Use a single shared service account across all tiers

Explanation

Tier-based subnet segmentation with least-privilege rules restricts which flows are possible, so a compromised host cannot freely reach other tiers. A flat subnet and default-allow internal traffic both enable lateral movement, and shared credentials widen the blast radius.

Question 17Network architecture design

A workload requires a stable private IP address that survives VM recreation and is used by an internal load balancer. Which design element should be specified?

  1. A dynamic private IP assigned by the platform at boot
  2. A public IP with a DNS label
  3. A static private IP configured on the load balancer frontend and backend pool Correct answer.
  4. A NAT gateway with a dynamic public prefix

Explanation

A static private IP on the internal load balancer frontend keeps the address stable across backend changes, and backend pool membership is managed independently of VM lifecycle. Dynamic addresses can change on recreation, and public IPs or NAT gateways serve outbound or external scenarios.

Question 18Network architecture design

Which statement about private endpoints and service endpoints is accurate?

  1. A private endpoint assigns a private IP in the VNet, while a service endpoint keeps traffic on the provider backbone but the service keeps its public endpoint Correct answer.
  2. Private endpoints work only for storage accounts
  3. A service endpoint requires disabling all public access to the service
  4. Both place the PaaS service on an IP address inside the VNet subnet

Explanation

A private endpoint maps the service to a private IP inside the VNet, whereas a service endpoint routes traffic over the backbone while the service still has a public endpoint that must be restricted. Service endpoints do not automatically disable public access, and private endpoints support many services beyond storage.

Question 19Network architecture design

A design spans two regions and must survive the loss of a region while keeping a single writable database endpoint. Which architecture element is most critical?

  1. Two independent single-region deployments with no replication
  2. A hub-and-spoke topology confined to one region
  3. Active-passive with a global load balancer and a replicated database with automated failover Correct answer.
  4. A single-region deployment with a larger VM size

Explanation

Cross-region resilience requires a global traffic distribution layer plus replicated data with automated failover so the surviving region can take over writes. A single-region deployment and unreplicated independent deployments both lose data or availability on regional failure. Topology confined to one region cannot survive region loss.

Question 20Network architecture design

When designing network segmentation for a PCI-scoped workload, which approach best satisfies the isolation intent?

  1. Placing the workload in the shared application subnet with the same rules as other apps
  2. Relying on the provider's default network controls with no custom rules
  3. Dedicated subnets with restrictive security rules, private connectivity only, and logging of all flows to and from the scope Correct answer.
  4. Using public endpoints with IP allowlists as the only control

Explanation

A dedicated, tightly controlled segment with private-only connectivity and comprehensive flow logging limits the scope and provides evidence for audits. Sharing a subnet with other applications expands scope, and default controls or public allowlists alone do not demonstrate isolation.

Question 21Network architecture design

Which factor most directly determines whether two VNets can be peered?

  1. Whether their address spaces overlap Correct answer.
  2. Whether the VNets are in the same subscription
  3. Whether both VNets have VPN gateways
  4. Whether both VNets use the same DNS zone

Explanation

Peering requires that the address spaces of the two VNets do not overlap; overlapping prefixes make routing ambiguous. Peering works across subscriptions and regions, does not require gateways, and is independent of DNS zone configuration.

Question 22Network architecture design

A design must provide outbound internet access for many VMs without assigning public IPs to each one. Which component should be specified?

  1. A private endpoint to a storage account
  2. An internal load balancer
  3. A public IP on every VM
  4. A NAT gateway attached to the subnet Correct answer.

Explanation

A NAT gateway translates outbound traffic from the subnet to a stable public address, so individual VMs do not need public IPs. Public IPs per VM increase exposure, an internal load balancer has no public frontend, and private endpoints serve inbound private access to PaaS.

Question 23Network architecture design

What is the main architectural benefit of using a hub-and-spoke model with a central firewall over a flat network?

  1. It removes the need for IP address planning
  2. It centralizes policy enforcement and inspection while keeping workload segments isolated Correct answer.
  3. It eliminates the need for route tables
  4. It guarantees lower latency between all workloads

Explanation

A central firewall in the hub gives one place to enforce and audit policy, while spokes keep workloads separated. Address planning is still required, latency depends on path and appliance placement, and user-defined routes are typically needed to steer traffic through the hub.

Question 24Network architecture design

A team wants to expose an internal API to partners over HTTPS with mutual TLS and centralized certificate management, without publishing the backend directly. Which service fits?

  1. A layer-4 load balancer with a public frontend
  2. A NAT gateway on the API subnet
  3. An application gateway or API gateway with mTLS termination and a private backend pool Correct answer.
  4. A site-to-site VPN to each partner

Explanation

A layer-7 gateway can terminate mutual TLS, manage certificates centrally, and forward to a private backend, keeping the API unpublished. A layer-4 load balancer lacks mTLS and HTTP policy, NAT gateways handle outbound traffic, and per-partner VPNs are heavy and do not provide API policy.

Question 25Network architecture design

Which monitoring design best supports troubleshooting a complex hybrid network?

  1. Collect only billing data per subscription
  2. Enable flow logs on network security groups and VNets, and export them to a central log analytics workspace Correct answer.
  3. Rely on VM guest event logs only
  4. Enable verbose logging on a single hub firewall and discard other telemetry

Explanation

Flow logs record allowed and denied flows across subnets and interfaces, and centralizing them enables correlation across hybrid paths. Guest logs alone miss network-level drops, billing data has no diagnostic value, and discarding telemetry prevents end-to-end analysis.

Question 26Network architecture design

In a cloud network architecture, which element defines the address range from which the platform allocates private IPs to resources in a virtual network?

  1. The DNS zone linked to the virtual network
  2. The address space and its associated subnets defined at deployment Correct answer.
  3. The route table attached to each network interface
  4. The public IP prefix reserved by the platform per region

Explanation

A virtual network's address space is the pool of private addresses the platform can allocate, and subnets carve that space into segments tied to workloads. Public IP prefixes, route tables, and DNS zones do not determine private address allocation.

Question 27Network architecture design

A network architect needs to place a stateful inspection appliance between two subnets in the same virtual network. Which design keeps traffic symmetric so the appliance sees both directions of each flow?

  1. Peer the two subnets as if they were separate virtual networks
  2. Assign the appliance a public IP and rely on platform default routing
  3. Enable service endpoints on both subnets and disable the appliance
  4. Define user-defined routes sending both subnets' default traffic to the appliance's private IP Correct answer.

Explanation

User-defined routes on each subnet can force forward and return traffic through the appliance's private interface, preserving flow symmetry. Without symmetric routing, return traffic bypasses the appliance and stateful inspection breaks.

Question 28Network architecture design

Which capability distinguishes a private endpoint from a service endpoint when a workload must consume a platform PaaS service?

  1. A private endpoint injects a private IP from the consumer's subnet into the service, while a service endpoint keeps the service's public address and restricts access by subnet identity Correct answer.
  2. A private endpoint can only be used with IaaS virtual machines, while a service endpoint supports all PaaS services
  3. A service endpoint injects a private IP into the service, while a private endpoint relies on public addressing with firewall rules
  4. Both replace the service's public address with a private IP, but only the service endpoint requires a private DNS zone

Explanation

A private endpoint places a network interface with a private IP in the consumer's subnet so the PaaS service is reached over the private backbone. A service endpoint instead keeps the service's public IP and allows traffic from a subnet based on its identity and routing.

Question 29Network architecture design

Which peering constraint most often prevents two virtual networks from being connected directly?

  1. The two networks have overlapping address spaces Correct answer.
  2. The two networks use different DNS suffixes
  3. The two networks have different resource group owners
  4. The two networks are in different subscriptions

Explanation

Peering requires non-overlapping IP address spaces because the platform must route between them without ambiguity. Different subscriptions, resource groups, and DNS suffixes do not inherently block peering.

Question 30Network architecture design

A design must give many virtual machines outbound internet access while avoiding per-VM public IPs and preserving a single egress point for logging. Which component fits best?

  1. An internal load balancer with a public frontend
  2. A private endpoint for each destination
  3. A NAT gateway attached to the egress subnet Correct answer.
  4. A public IP assigned to each network interface

Explanation

A NAT gateway provides source network address translation for a subnet, giving many VMs a shared, predictable egress address that can be logged and allow-listed. Per-VM public IPs and internal load balancers do not provide this consolidated egress.

Question 31Network architecture design

A workload must survive the loss of a single availability zone while keeping its frontend reachable. Which design choice satisfies this requirement?

  1. Deploy all frontend instances in one zone behind a zonal load balancer
  2. Deploy a single frontend instance with a static public IP
  3. Deploy frontend instances across multiple zones behind a zone-redundant load balancer Correct answer.
  4. Deploy frontend instances across regions behind a single zonal load balancer

Explanation

Spreading instances across zones and fronting them with a zone-redundant load balancer keeps the service available when one zone fails. A zonal deployment concentrates risk in the zone that could be lost.

Question 32Network architecture design

Which statement best describes the architectural purpose of a hub virtual network in a hub-and-spoke topology?

  1. It isolates each spoke from all other spokes by default
  2. It replaces the need for any routing configuration between spokes
  3. It provides a writable database endpoint shared by all spokes
  4. It hosts shared services such as firewalls, gateways, and DNS that spokes consume Correct answer.

Explanation

The hub centralizes shared connectivity and security services so spokes can remain small and focused on workloads. Spokes still need routing and peering configuration to reach shared services and each other.

Question 33Network architecture design

A design requires that a partner reach an internal API over HTTPS with mutual TLS while certificates are managed centrally. Which component best satisfies this?

  1. A NAT gateway translating the partner's source addresses
  2. A network security group allowing port 443 from the partner's address range
  3. A private endpoint exposing the API to the partner's virtual network
  4. An application gateway configured with mutual authentication and certificate management Correct answer.

Explanation

An application gateway can terminate TLS, require client certificates for mutual authentication, and centralize certificate handling. A network security group only filters traffic and provides no TLS or certificate capability.

Question 34Network architecture design

What is the primary effect of associating a network security group with a subnet rather than only with individual network interfaces?

  1. It automatically creates peering to any subnet it protects
  2. Rules are evaluated against traffic entering and leaving resources in that subnet, giving a subnet-level control boundary Correct answer.
  3. It disables platform default rules for the entire virtual network
  4. It converts the subnet into a private endpoint

Explanation

A subnet-level network security group applies its rules to traffic for resources within that subnet, establishing a control boundary at the subnet level. It does not remove platform default rules or create peering or endpoints.

Question 35Network architecture design

A design must limit lateral movement if one subnet is compromised. Which combination best achieves this?

  1. A flat network with a single large subnet and permissive internal rules
  2. A shared public IP for all workloads to simplify addressing
  3. Subnet-level network security groups plus a central firewall that inspects east-west traffic Correct answer.
  4. Disabling logging to reduce noise from internal traffic

Explanation

Layered subnet-level filtering and inspected east-west traffic reduce the reachable surface from a compromised host. Flat, permissive networks allow an attacker to move freely between workloads.

Question 36Network architecture design

Which DNS design consideration matters most when private endpoints are used across multiple virtual networks?

  1. All virtual networks must share the same address space
  2. DNS resolution must be disabled for private endpoints
  3. Each virtual network must resolve the service name to the injected private IP through linked private DNS zones Correct answer.
  4. Each virtual network must use a unique public DNS suffix

Explanation

Private endpoints depend on name resolution returning the injected private IP, so private DNS zones must be linked to every virtual network that consumes the service. Without proper links, clients may resolve the public address instead.

Question 37Network architecture design

When planning a hybrid connection between on-premises networks and a cloud hub, which design decision most affects predictable latency for latency-sensitive workloads?

  1. Choosing a dedicated private circuit over internet-based tunnels Correct answer.
  2. Increasing the number of subnets in the hub
  3. Assigning public IPs to all on-premises servers
  4. Using a larger address space for the hub

Explanation

A dedicated private circuit avoids the variable path and congestion of internet-based tunnels, giving more predictable latency. Address space size and subnet count do not change the underlying transport characteristics.

Question 38Network architecture design

Which load-balancing option is appropriate for distributing non-HTTP TCP traffic across backend virtual machines within one region?

  1. An application gateway with URL path-based routing
  2. A traffic manager profile using geographic routing
  3. A private DNS zone with round-robin records
  4. A Layer 4 network load balancer with a frontend IP and health probes Correct answer.

Explanation

A Layer 4 network load balancer forwards TCP flows to backends using health probes and is suited to non-HTTP protocols. Application gateways are HTTP-focused, and DNS-based options do not provide flow-level distribution.

Question 39Network architecture design

A design must protect a public web application from common web exploits and volumetric attacks. Which combination best meets this?

  1. A NAT gateway for outbound filtering plus a private endpoint
  2. A web application firewall for application-layer attacks plus a DDoS protection capability for volumetric floods Correct answer.
  3. A network security group alone for both layers of protection
  4. A VPN gateway plus a route table

Explanation

Application-layer exploits and volumetric floods are distinct threats addressed by a web application firewall and DDoS protection respectively. A network security group filters by address and port but cannot inspect HTTP payloads or absorb large-scale floods.

Question 40Network architecture design

What is the primary reason to enable accelerated networking on a virtual machine?

  1. To encrypt traffic between the virtual machine and its subnet
  2. To offload packet processing to the network interface hardware and reduce latency and CPU overhead Correct answer.
  3. To automatically attach a public IP to the virtual machine
  4. To increase the virtual machine's private IP address count

Explanation

Accelerated networking uses hardware capabilities such as single-root I/O virtualization to reduce host CPU involvement in packet processing, lowering latency and jitter. It does not change addressing or provide encryption.

Question 41Network architecture design

A branch office has a dynamic public IP and needs a secure connection to a cloud hub without a dedicated circuit. Which design fits best?

  1. A private endpoint placed in the branch office subnet
  2. A site-to-site VPN gateway that authenticates the branch by pre-shared key or certificate Correct answer.
  3. An express route circuit provisioned to the branch
  4. A public load balancer fronting the branch's servers

Explanation

A site-to-site VPN over the internet tolerates dynamic branch addresses and establishes an encrypted tunnel using pre-shared keys or certificates. Dedicated circuits require provider provisioning and are not suited to a small branch without one.

Question 42Network architecture design

Which design practice best prevents address exhaustion and re-addressing when a cloud network will grow across regions?

  1. Allocating a non-overlapping address plan sized for future growth per region before deployment Correct answer.
  2. Relying on the platform to reassign addresses automatically
  3. Using the same address range in every region to simplify routing
  4. Assigning small subnets and expanding them later as needed

Explanation

A planned, non-overlapping address hierarchy sized for growth avoids collisions and painful re-addressing as regions are added. Overlapping ranges and undersized subnets create conflicts that are costly to unwind later.

Question 43Network architecture design

In a hub-and-spoke design, which component typically provides centralized name resolution for both cloud and on-premises clients?

  1. A DNS forwarder hosted in the hub that forwards queries to authoritative on-premises servers Correct answer.
  2. A public DNS zone registered with an external registrar
  3. A separate DNS server deployed in every spoke with no forwarding
  4. The default platform-provided resolver with no custom configuration

Explanation

A hub-based DNS forwarder lets spokes and on-premises clients resolve both cloud and on-premises names through a single controlled path. Per-spoke servers without forwarding fragment resolution and create inconsistent answers.

Question 44Network architecture design

A team wants a stable private IP for an internal service that survives backend virtual machine recreation and is used by an internal load balancer. Which design fits best?

  1. A public IP assigned to one backend virtual machine
  2. A NAT gateway with a fixed outbound address
  3. A dynamic private IP on each backend with DNS round-robin
  4. An internal load balancer with a static private frontend IP and backends referenced by instance or address pool Correct answer.

Explanation

An internal load balancer with a static private frontend IP gives consumers a stable address while backends can be recreated behind the pool. Addressing a single VM or relying on dynamic backend addresses breaks stability.

Question 45Network architecture design

Which attribute of a user-defined route determines where matching traffic is sent?

  1. The subnet's network security group priority
  2. The virtual network's DNS suffix
  3. The peering state of the remote network
  4. The next hop type and address specified in the route Correct answer.

Explanation

A user-defined route matches an address prefix and forwards traffic to a specified next hop such as a virtual appliance or gateway. Security group priority and DNS settings do not determine forwarding targets.

Question 46Network architecture design

An architect must expose several internal APIs to different partners with per-partner rate limits and path-based routing over HTTPS. Which design element is most appropriate?

  1. An application gateway with listeners, path-based rules, and per-listener policies Correct answer.
  2. A VPN gateway with one tunnel per partner
  3. A route table directing partner traffic to a firewall
  4. A Layer 4 network load balancer with a single frontend

Explanation

An application gateway operates at Layer 7 and supports host and path-based routing plus per-listener policies such as rate limiting. A Layer 4 balancer cannot inspect paths, and VPN or route constructs do not perform application routing.

Question 47Network architecture design

Which consideration makes a single writable database endpoint across two regions difficult to achieve with active-active application tiers?

  1. Data replication latency and conflict resolution constrain a single writable endpoint Correct answer.
  2. Load balancers cannot front database traffic across regions
  3. Virtual networks cannot be peered across regions
  4. Private DNS zones cannot span regions

Explanation

Keeping one writable endpoint while replicating across regions forces tradeoffs in replication latency and write conflict handling. Cross-region peering and private DNS links are supported and are not the limiting factor.

Question 48Network architecture design

A regulated workload requires strict isolation from other workloads in the same virtual network. Which approach best satisfies the isolation intent?

  1. A single shared subnet with permissive rules to simplify operations
  2. Assigning public IPs to regulated resources for direct management
  3. Dedicated subnets with restrictive network security groups, a central firewall for east-west inspection, and no broad peering Correct answer.
  4. Peering the regulated workload to every other virtual network

Explanation

Dedicated subnets, tight security groups, and inspected east-west traffic create enforceable boundaries around regulated data. Shared permissive subnets and broad peering dissolve the isolation the regulation requires.

Question 49Network architecture design

Which design choice best reduces the blast radius of a compromised shared services component in a hub?

  1. Disabling flow logs to reduce storage cost
  2. Granting every spoke direct peering to every shared service subnet
  3. Consolidating all shared services into one large subnet with open internal rules
  4. Splitting shared services into separate subnets with least-privilege rules and monitored flows Correct answer.

Explanation

Separating shared services into distinct subnets with least-privilege rules and flow monitoring limits how far a compromise can spread. Consolidation and open internal rules enlarge the blast radius.

Question 50Network architecture design

A design must let on-premises clients reach a private endpoint in a spoke virtual network without exposing the service publicly. Which combination is required?

  1. Private endpoint in the spoke, private DNS resolution for on-premises clients, and hybrid connectivity from on-premises to the hub Correct answer.
  2. A NAT gateway in the spoke for inbound translation
  3. Public IP on the service and a network security group allowing the internet
  4. Service endpoint on the spoke subnet with no DNS changes

Explanation

On-premises clients need a private path into the hub and spoke plus DNS that resolves the service name to the injected private IP. Without both, clients either cannot route to the endpoint or cannot resolve it correctly.