For IndividualsFor Educators
ExpertMinds LogoExpertMinds
ExpertMinds

Ace your certifications with Practice Exams and AI assistance.

  • Browse Exams
  • For Educators
  • Blog
  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Support
  • AWS SAA Exam Prep
  • PMI PMP Exam Prep
  • CPA Exam Prep
  • GCP PCA Exam Prep

© 2026 TinyHive Labs. Company number 16262776.

    PracticeAzure Solutions Architect Expert (AZ-305)Azure Solutions Architect Expert AZ-305 Practice Exam 3Question 55
    Hard1 markMultiple Choice
    Domain 4.4: Design network solutionsDomain 4Network SolutionsRoutingCase Study
    This question is part of a case study — click to read the full scenario(Case 51)

    CASE STUDY (Questions 51-55)

    Contoso Financial is a global investment bank.

    Current Infrastructure:

    • On-premises datacenters in New York, London, and Tokyo.
    • Azure regions used: US East, Europe West, Japan East.
    • Each on-premises datacenter is connected to its local Azure region via a 10 Gbps ExpressRoute circuit.
    • Azure architecture uses a Hub-and-Spoke topology in each region.

    Business Requirements:

    • The network architecture must support global failover. If the US East region fails, the New York datacenter must be able to route traffic to the Europe West Azure region.
    • All outbound internet traffic from Azure VMs must be inspected by a centralized firewall.
    • Azure PaaS services (SQL, Storage) must not be accessible from the public internet.
    • Network management overhead must be minimized as the company plans to add 50 more spoke VNets per region next year.

    Question 1 of 5:
    To meet the global failover requirement, the New York datacenter must be able to communicate with the Europe West Azure region if US East fails.

    Which ExpressRoute feature or architecture should you implement?

    View full case study page →

    AZ-305 · Question 55 · Domain 4.4: Design network solutions

    CASE STUDY (Questions 51-55)

    Contoso Financial is a global investment bank.

    Current Infrastructure:

    • On-premises datacenters in New York, London, and Tokyo.
    • Azure regions used: US East, Europe West, Japan East.
    • Each on-premises datacenter is connected to its local Azure region via a 10 Gbps ExpressRoute circuit.
    • Azure architecture uses a Hub-and-Spoke topology in each region.

    Business Requirements:

    • The network architecture must support global failover. If the US East region fails, the New York datacenter must be able to route traffic to the Europe West Azure region.
    • All outbound internet traffic from Azure VMs must be inspected by a centralized firewall.
    • Azure PaaS services (SQL, Storage) must not be accessible from the public internet.
    • Network management overhead must be minimized as the company plans to add 50 more spoke VNets per region next year.

    Question 5 of 5:
    Assuming the company stays with a traditional Hub-and-Spoke topology (not Virtual WAN), you must ensure that ALL outbound internet traffic from the Spoke VNets is forced through the Azure Firewall located in the Hub VNet.

    Which THREE actions must you perform to configure this forced tunneling? (Select THREE)

    Answer options:

    A.

    Create a User Defined Route (UDR) with a destination prefix of 0.0.0.0/0.

    B.

    Set the next hop type of the UDR to Internet.

    C.

    Set the next hop type of the UDR to Virtual Appliance and specify the Azure Firewall's private IP.

    D.

    Associate the Route Table containing the UDR to the subnets in the Spoke VNets.

    E.

    Enable BGP route propagation on the Spoke VNet subnets.

    F.

    Create a Network Security Group (NSG) rule denying outbound Internet.

    How to approach this question

    Recall the three steps for custom routing in Azure: 1) Define the destination (0.0.0.0/0). 2) Define the next hop (NVA/Firewall IP). 3) Apply it (Associate to Spoke subnets).

    Full Answer

    Create a User Defined Route (UDR) with a destination prefix of 0.0.0.0/0., Set the next hop type of the UDR to Virtual Appliance and specify the Azure Firewall's private IP., Associate the Route Table containing the UDR to the subnets in the Spoke VNets.
    In a traditional Hub-and-Spoke topology, Azure automatically routes 0.0.0.0/0 (internet) traffic directly out to the internet. To force this traffic through a centralized Azure Firewall, you must create a Route Table with a User Defined Route (UDR). The UDR must specify the destination as 0.0.0.0/0, the next hop type as 'Virtual Appliance', and the next hop IP address as the private IP of the Azure Firewall. Finally, this Route Table must be associated with the subnets in the Spoke VNets.

    Common mistakes

    Setting the next hop to 'Internet' (which bypasses the firewall) or forgetting to associate the Route Table to the subnet.
    Question 54All questions

    Practice the full Azure Solutions Architect Expert AZ-305 Practice Exam 3

    55 questions · hints · full answers · grading

    Sign up freeTake the exam

    More questions from this exam

    Q01Contoso Ltd is a global manufacturing company with 50,000 employees across 30 countries. They cur...MediumQ02Fabrikam Inc. is a Managed Service Provider (MSP) managing Azure environments for 50 different en...HardQ03A financial institution generates 5 TB of telemetry and audit logs daily across its Azure environ...MediumQ04A retail company has recently migrated several workloads to Azure. The IT Director wants a centra...EasyQ05A healthcare organization with 10,000 employees uses on-premises Active Directory. They are migra...Hard
    View all 55 questions →