Sample questions
Azure Networking VnetDifficulty 1
In Azure, what is the regional scope of a Virtual Network (VNet) resource?
- aA VNet automatically spans every Azure region in a subscription
- bA VNet is created in exactly one region; its subnets all live inside that same region✓
- cA VNet spans exactly one Availability Zone and cannot cross zones, since zones are the true isolation boundary for VNets
- dA VNet has no regional association until a subnet is added to it
Explanation:A VNet in Azure is a regional resource: it is created and lives inside a single Azure region, and every subnet carved out of it also lives in that same region. To span multiple regions you need separate VNets connected via peering or a gateway, not a single VNet.
Azure Networking VnetDifficulty 1
By default, if a subnet in Azure has no explicit Network Security Group (NSG) rules for outbound traffic to the internet, what happens to that traffic?
- aIt is blocked, because Azure denies all traffic without an explicit allow rule, mirroring the inbound-deny posture
- bIt is blocked unless a public IP is attached to the resource sending it
- cIt is allowed, because every NSG comes with a default rule permitting outbound internet traffic✓
- dIt depends entirely on the region's default firewall policy
Explanation:Every NSG in Azure comes with a set of default rules that cannot be deleted, including one that allows all outbound traffic to the internet unless overridden by a custom rule with a lower priority number (higher precedence). So outbound internet access works out of the box unless someone explicitly blocks it.
Azure Networking VnetDifficulty 2
In Azure NSG rules, a lower priority number means what, relative to a higher priority number?
- aIt is evaluated first and takes precedence if it matches the traffic✓
- bIt is evaluated last, since Azure processes rules from highest number to lowest
- cPriority number only affects billing order, not rule evaluation order
- dLower and higher priority numbers are evaluated simultaneously and Azure picks the most restrictive one
Explanation:NSG rules are evaluated in order of priority number, from lowest to highest (e.g. 100 before 200), and processing stops at the first rule that matches the traffic. So a rule with priority 100 takes precedence over a rule with priority 200 if both could match the same traffic.
Azure Networking VnetDifficulty 2
A team creates a Basic SKU Azure Load Balancer for a set of VMs that are NOT part of an Availability Set or Virtual Machine Scale Set. What limitation applies here compared to Standard SKU?
- aBasic SKU load balancers cannot be used with any VM at all, regardless of grouping
- bBasic SKU is fully feature-equivalent to Standard SKU except for price
- cBasic SKU requires the VMs to be spread across at least 3 Availability Zones for the pool to be considered valid
- dBasic SKU backend pool VMs must belong to a single Availability Set or a single Scale Set.✓
Explanation:Basic Load Balancer has a real structural constraint: all VMs in its backend pool must belong to a single Availability Set (or a single VM Scale Set) — you cannot mix standalone VMs or VMs from different Availability Sets into one Basic backend pool. Standard SKU removes this constraint and supports zone redundancy, which Basic does not.
Azure Networking VnetDifficulty 2
What is the main architectural difference between Azure Load Balancer and Azure Application Gateway?
- aThere is no difference; Application Gateway is just an older name for Load Balancer
- bLoad Balancer operates at layer 4 (TCP/UDP) routing by IP and port, while Application Gateway operates at layer 7 (HTTP/HTTPS) and can route based on URL path or host header✓
- cLoad Balancer only works within a single VNet, while Application Gateway can only route traffic between VNets
- dApplication Gateway does not support HTTPS traffic; only Load Balancer supports TLS termination
Explanation:Azure Load Balancer is a layer 4 (transport layer) load balancer that distributes TCP/UDP traffic based on IP address and port, with no visibility into HTTP content. Application Gateway is a layer 7 (application layer) load balancer that understands HTTP/HTTPS and can make routing decisions based on URL path, host header, or other HTTP attributes, and also offers a Web Application Firewall (WAF) option.
Azure Networking VnetDifficulty 1
What is the primary purpose of Azure Front Door?
- aIt is a regional-only load balancer used strictly within a single VNet
- bIt replaces NSGs as the main way to filter traffic by IP address
- cIt is a global, anycast-based entry point that routes HTTP/HTTPS traffic to the closest healthy backend across regions, with built-in CDN and WAF capability✓
- dIt is used only for routing traffic between on-premises networks and Azure via VPN
Explanation:Azure Front Door is a global service that uses anycast networking to route incoming HTTP/HTTPS requests to the nearest healthy backend across multiple Azure regions or even non-Azure origins, and it bundles CDN and Web Application Firewall functionality — unlike Application Gateway or Load Balancer, which operate within or scoped to a single region.