Design Lab — Put the entry point, the private path, and the SKU in the right places
AZ-305 › Unit 4 › Design network solutions
Design Lab — Put the entry point, the private path, and the SKU in the right places
Lab brief
- 4 — Design infrastructure solutions
- 30–35%
- 25 minutes
- $0 — no subscription needed
- Hard
Networking is where this exam hides its sharpest distractors, because most wrong answers are products that exist and would work somewhere else. Three separate decisions get conflated: where traffic enters, how a service is reached privately, and whether the size or mode you picked actually supports the feature you assumed. This lab drills all three, and the last one is where current documentation has moved under people.
Commit before you reveal. This one is harder than the earlier labs; expect to get at least one wrong, and that is the point.
The brief
Northwind Retail — public edge and private core
A storefront serves customers in Europe, North America and Australia. Requirements: one global entry point, TLS termination close to the user, a web application firewall, and failover between regional backends when a region degrades.
Commit before you reveal
▶How the hard questions differ — open after committing
In the easier labs, the wrong options were weaker. Here, at least one wrong option in each question is a product that is genuinely excellent — at something the scenario did not ask for. Scope is the discriminator: global versus regional, private versus merely filtered, supported on this size versus supported by the family.
Question 1 — where traffic enters
One global entry point, TLS termination near the user, a WAF, and failover across regional backends. Which service belongs at the edge?
Question 2 — what 'private' has to mean here
The API must reach SQL Database and Storage with no public-internet path, and the services must be addressable from inside the VNet address space. Which statements are true and decide the design? Select all that apply.
Select all that apply
Question 3 — the SKU that quietly lacks the feature
The engineer wants Accelerated Networking enabled 'on the B-series fleet'. What should the design tell them?
Question 4 — the mode with an expiry date
The AKS cluster uses kubenet. What should the design say about keeping it?
Why the runner-up loses
Four things at the edge, and what each one actually sees
| Attribute | Recommended | |||
|---|---|---|---|---|
| Scope | Global | Regional | Regional | Global, but DNS only |
| Sees the request? | Yes — terminates TLS at the edge | Yes — terminates TLS in its region | No — layer | No — answers a DNS query |
| WAF | Yes, at the edge | Yes, with WAF_v2 | No | No |
| Failover feel | Stops routing to an unhealthy backend | Within its region only | Within its region only | Waits for DNS TTL to expire |
| Buy it for | A global storefront | Regional L7 with path rules | Regional L4 throughput | Steering non-HTTP or legacy endpoints |
The row that settles this scenario is scope. Application Gateway and Front Door both do L7 and both do WAF, so a capability list makes them look interchangeable; one is regional and one is global, and the requirement said global. When two options share a capability, the discriminator is almost always where they sit, not what they can do.
The shape of the answer
The traps that catch people
The method, for any question of this shape
How to attack a networking question in 90 seconds
Split entry from reach
Public ingress and private egress are separate decisions with separate products. Answering one with the other is the most common structural error here.
Before you move on
This is the lab worth repeating most. Come back cold and, for each question, say which single word in the requirement eliminated the strongest wrong option — "global", "addressable", "B-series", "kubenet". Those words are how the exam tells you the answer.