Microsoft AZ-305: Networking and Connectivity — Study Guide

By Laurynas Brazys · 11 August 2026 · #microsoft #az-305 #certification #exam-prep #study-guide

Part of the Microsoft Azure Solutions Architect Expert AZ-305 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Networking and connectivity designs in Azure must balance address-space hygiene, secure access to PaaS services, hybrid connectivity at scale, name resolution, threat protection, and deep observability. A robust architecture usually centers on a hub-and-spoke virtual network pattern or a managed hub in Azure Virtual WAN, with clear route control, private access to services, and standardized firewalling. The following sections detail the services and capabilities most frequently combined in enterprise designs.

Virtual Networks, IP Strategy, and Private Access to PaaS

Robust address planning prevents rework and unlocks hybrid scale. Use RFC1918 ranges with clear boundaries per environment and region. Avoid overlapping prefixes across VNets and on-prem networks; if mergers or partner connectivity are likely, leave summarization headroom (for example, allocate /16 per region and carve /20 spokes). Consider dual-stack IPv4/IPv6 for internet-facing apps and regulatory regions. Keep GatewaySubnet as /27 or larger if you plan VPN/ExpressRoute coexistence and future scale.

Subnet design segments traffic by function and trust. Subnets should carry one security intent each, gated with NSGs and UDRs. Right-size prefixes (for example /26 to /24) to avoid renumbering; reserve distinct subnets for Azure Firewall, Application Gateway, Bastion, and Private Endpoints. Disable default outbound internet for sensitive subnets via UDR to a firewall.

Service endpoints and private endpoints both secure PaaS traffic, but with different blast radius and routing:

Service endpoints extend your VNet’s identity to Azure services over the Microsoft backbone while traffic still targets the service’s public IP. You can lock the service to specified VNets/subnets and use service endpoint policies for granular storage account allow-lists. They are simple to enable but control access at the resource type or account-scope rather than per-instance NIC.
Private Endpoints create a NIC with a private IP in your subnet mapped to a specific PaaS resource via Private Link. This provides instance-level isolation and the strongest data exfiltration protection, because the service is reachable only via the private IP bound to your endpoint(s). Plan DNS carefully: override public zones (for example, privatelink.blob.core.windows.net, privatelink.database.windows.net) with Azure Private DNS zones linked to your VNets; on-prem resolvers must forward to Azure for split-horizon resolution. Private Link also supports cross-tenant consumer/provider scenarios with approval workflows, allowing secure access for partners without exposing public endpoints.

Hybrid Connectivity: VPN, ExpressRoute, Virtual WAN, and Route Control

Azure VPN Gateway SKUs define throughput and scale. Use route-based gateways (VpnGw1–VpnGw5 and their zone-redundant VpnGwXAZ variants) for site-to-site, VNet-to-VNet, and BGP; avoid the legacy Basic SKU for production. Active-active mode deploys two instances with two public IPs, increasing resiliency and aggregate throughput. BGP with private ASNs provides dynamic route exchange, convergence, and per-tunnel path control (AS Path, MED) across multiple links. Azure defaults to ASN 65515 on the gateway; customize when multihoming to multiple providers.

ExpressRoute delivers private connectivity to Microsoft’s backbone with predictable latency and high throughput. Circuit SKUs determine scope and limits:

Local: egress only to the same metro, lower cost, no VNet any-to-any beyond the metro.
Standard: connectivity to Azure regions within the same geopolitical region of the peering location, standard route limits.
Premium: global VNet connectivity across geopolitical boundaries and higher route/connection limits. Peering types include Private peering (to VNets) and Microsoft peering (to Microsoft SaaS/PaaS via route filters). Public peering is retired. ExpressRoute Global Reach lets you connect on-premises sites through different ExpressRoute circuits over Microsoft’s backbone. FastPath reduces data-plane latency by bypassing the ExpressRoute gateway for packets between your edge and VMs; it’s enabled per VNet connection and supported with UltraPerformance or ErGw3AZ ExpressRoute gateways on Private peering, with the VNet directly attached to the circuit (no gateway transit).

Coexistence of ExpressRoute and VPN provides failover or split-traffic. Deploy both gateways into a sufficiently sized GatewaySubnet and use BGP to prefer ExpressRoute for overlapping prefixes (ExpressRoute has higher preference than S2S VPN when route attributes are equal). Use AS Path prepending or MEDs on VPN to ensure deterministic fallback.

Azure Virtual WAN (vWAN) centralizes large-scale branch, user, and site connectivity with managed hubs. Choose the Standard tier for any-to-any inter-hub routing and ExpressRoute; enable a secured virtual hub when you need Azure Firewall integration. Routing intents in secured hubs steer traffic classes—Internet, Private, and Microsoft—to security services (for example, all Internet-bound and Private traffic to Azure Firewall Premium). vWAN simplifies SD-WAN integration, partner automation, and large-scale P2S/S2S VPN while providing consistent policies globally.

Azure Route Server (ARS) injects dynamic routing into a classic hub-spoke VNet without deploying NVAs as route reflectors. ARS establishes BGP peering with NVAs, shares learned routes with the VNet, and, with route exchange enabled, can propagate routes between NVAs and the VPN/ExpressRoute gateway. This removes manual UDR maintenance for prefixes learned from on-prem or advertised by NVAs. ARS uses ASN 65515 by default and supports route filtering via route maps to control advertisement and prevent route leaks.

Name Resolution, Firewalling, and DDoS Protection

Azure DNS provides authoritative hosting for public and private zones. Public zones publish to the internet with Azure’s global anycast. Private DNS zones offer split-horizon naming for resources reachable only within linked VNets. Enable auto-registration on a Private DNS zone link to dynamically register and update A records for Azure VMs in that VNet, simplifying lifecycle operations.

Azure DNS Private Resolver provides managed inbound and outbound DNS forwarding. Deploy inbound endpoints to receive queries from on-prem resolvers over private IP, and outbound endpoints plus rulesets to forward Azure VM queries to on-prem DNS for corp zones. Link rulesets to multiple VNets to standardize resolution in hub-spoke. This is the anchor for Private Endpoint name resolution from on-prem, allowing conditional forwarders on-prem to reach Azure Private DNS zones through the resolver.

Azure Firewall centralizes egress, ingress (DNAT), and east-west filtering. The Standard SKU delivers L3–L4 filtering, FQDN tags, and threat intelligence-based filtering. The Premium SKU adds TLS inspection (outbound and inbound with Key Vault–backed certificates), IDPS with signature-based detection/prevention, and URL filtering with categories and path-level policies. Deploy in a secured virtual hub for vWAN or as a firewall instance in a hub VNet. Use firewall policies managed in Azure Firewall Manager with a hierarchy of parent/child policies to enforce global baselines and apply regional or application-specific rules; rule collection group priorities determine evaluation order. Plan SNAT ports with multiple public IPs on high-throughput hubs to avoid port exhaustion when many ephemeral connections are expected.

Azure DDoS Protection shields public IP resources. The Basic tier is always on and platform-managed. The Standard tier is a plan you enable per VNet; it automatically tunes mitigation policies per protected public IP (Load Balancer, Application Gateway, VM NICs), provides cost protection during attacks, and exposes telemetry. Configure alerting and streaming to Log Analytics to receive mitigation reports, attack metrics (pps/bps, vectors), and rapid support via DDoS Rapid Response. Combine with WAF and rate-limiting for L7 resilience.

Observability and Traffic Analytics

Azure Network Watcher gives deep visibility into network health and traffic. Connection Monitor continuously tests reachability and performance between sources and destinations (Azure VMs, on-prem endpoints, URLs) over ICMP, TCP, or HTTP/S, correlating topology state changes with failures. NSG Flow Logs record 5-tuple flows and decision (allow/deny) at NSG interfaces; export them to a storage account and enable Traffic Analytics in Log Analytics for insights into top talkers, open ports, and threat detections. Packet Capture captures packets on a VM NIC using an extension, on demand or scheduled, with filters for BPF-like expressions and output to storage; use it to troubleshoot MTU, handshake, or asymmetric routing issues. Pair these with Azure Monitor metrics for gateways, ExpressRoute circuits, and vWAN hubs to detect saturation, BGP flap, or loss of resilience.

Private Link Cross-Tenant Scenarios and DNS Nuances

Private Link enables secure consumer-provider patterns across tenants. The provider exposes a Private Link service or PaaS resource; the consumer creates a Private Endpoint and requests approval. For PaaS, approval is at the resource instance, providing tight blast-radius control. DNS must resolve the service’s public FQDN to the consumer’s Private Endpoint IP. In the consumer tenant, create or use the appropriate privatelink.<zone> and link to the consuming VNet; for on-prem users, forward those zones to Azure DNS Private Resolver inbound endpoints. When providers require vanity domains, use CNAMEs to the public endpoint name so split-horizon overrides work transparently. Validate that no overlapping Private Endpoints for the same FQDN exist in different VNets without intended scoping, as clients resolve to the closest linked zone based on DNS query path.

Practical Problem Scenario

Siemens AG is building a global manufacturing platform in Azure with regional plants connecting via MPLS and internet. Requirements include private access to Azure SQL and Storage, resilient hybrid connectivity that prefers private backbone, centralized security inspection with TLS decryption and IDPS, standardized DNS resolution from plants to Azure Private Endpoints, and deep connectivity monitoring. Partners in a separate Azure tenant must privately consume selected Siemens-hosted APIs.

Implement hub-and-spoke per region with a secured virtual hub in Azure Virtual WAN Standard.

Why: vWAN provides managed, scalable S2S/P2S/ER connectivity and inter-hub any-to-any routing. A secured hub integrates Azure Firewall Premium with routing intents to steer Internet and Private traffic through inspection globally.

Establish ExpressRoute circuits with Premium SKU in Europe and North America; enable Global Reach between them. Deploy UltraPerformance or ErGw3AZ ExpressRoute gateways and enable FastPath for VNets directly connected to the circuits.

Why: Premium enables cross-geopolitical connectivity for VNets and higher route limits; Global Reach provides private on-prem to on-prem connectivity over Microsoft’s backbone. FastPath reduces latency and gateway bottlenecks for data-plane traffic.

Add active-active Azure VPN Gateways (VpnGw5AZ) in each region as backup to ExpressRoute; configure BGP with AS Path prepending on VPN to prefer ExpressRoute.

Why: Active-active plus BGP delivers resilient failover. Path attributes enforce deterministic routing so ExpressRoute is always primary.

Deploy Azure Firewall Premium in each secured hub with parent/child firewall policies via Azure Firewall Manager; enable TLS inspection and IDPS; allocate multiple public IPs for SNAT scale.

Why: Centralized, uniform security with decryption and signature-based threat prevention meets inspection requirements at scale. Policy hierarchy enforces a global baseline while allowing regional variation.

Use Private Endpoints for Azure SQL Database and Storage; create Azure Private DNS zones for privatelink.database.windows.net and privatelink.blob.core.windows.net, link to spokes, and enable Azure DNS Private Resolver in the hub with inbound and outbound endpoints and forwarding rulesets.

Why: Private Endpoints provide instance-level isolation and eliminate data exfiltration risk. DNS Private Resolver standardizes split-horizon name resolution for both Azure and plant networks without custom DNS appliances.

On-prem DNS servers forward Azure Private Link zones to the resolver’s inbound endpoint; for corporate zones needed in Azure, create outbound rules to on-prem DNS.

Why: This bi-directional forwarding ensures consistent name resolution across boundaries with minimal administration.

For partner access, expose Siemens APIs behind an internal load balancer and publish them via a Private Link service; partners in their own tenant create Private Endpoints and get approved. Provide partner-specific DNS guidance to override public names to their Private Endpoint IPs.

Why: Cross-tenant Private Link provides private, instance-scoped access without exposing public endpoints or managing guest identities.

Deploy Azure Route Server in hub VNets that host NVAs for specialized routing, and enable route exchange with the ExpressRoute gateway.

Why: Route Server orchestrates dynamic route sharing between NVAs and gateways, removing brittle UDR updates and ensuring rapid convergence.

Enable Azure DDoS Protection Standard on the hub VNets protecting public IPs (Azure Firewall and inbound endpoints); configure alerts and integrate with Log Analytics.

Why: Automatic, tuned L3/L4 mitigation with telemetry and support reduces risk and provides attack visibility with cost protection.

Enable Azure Network Watcher Connection Monitor for key paths (plant to Azure SQL via ER, Azure VM to Storage via Private Endpoint), NSG Flow Logs with Traffic Analytics on spoke subnets, and on-demand Packet Capture on critical VMs.

Why: Continuous reachability testing, traffic baselining, and packet-level forensics give operations the visibility needed to diagnose performance and routing anomalies quickly.

← Compute and Application Architecture · All domains · High Availability →

Practice these questions → · Timed practice on ExamRoll.io →