Skip to content
Compiled Thoughts
Browse

AZ-305 Network Solutions

May 6, 2025•1799 words•9 min read•
certification
azure
AI summarised

AZ-305 Azure Solutions Architect Expert

Azure Recommendations to Design Network Solutions

Below are the recommended Azure solutions to design network solutions as aligned with the AZ-305 exam objectives.

Azure Network Solutions Design Recommendations (AZ-305)

1. Recommend a Connectivity Solution for Azure-to-Internet

Azure NAT Gateway is the preferred solution for outbound internet connectivity:

  • Key Features:
    • Scalable SNAT: Handles dynamic workloads with up to 16 public IPs or a /28 prefix.
    • Cost-Effective: Avoids SNAT port exhaustion issues common with Load Balancer or Azure Firewall.
    • Static IPs: Assign predictable IPs for audit/compliance needs12.

Azure Firewall for secure outbound traffic:

  • Governs non-HTTP/S traffic, integrates with Azure Monitor for logging, and supports threat intelligence-based filtering31.

Best Practices:

  • Use NAT Gateway for high-volume outbound traffic (e.g., batch processing).
  • Combine with Azure Firewall for advanced security (e.g., FQDN filtering, IDPS)31.

2. Recommend a Connectivity Solution for Azure-to-On-Premises

ExpressRoute for private, high-throughput connections:

  • Benefits:
    • Low Latency: Bypasses public internet with SLA-backed 99.95% uptime.
    • Hybrid Scenarios: Extends on-premises networks to Azure with speeds up to 100 Gbps456.

VPN Gateway for cost-sensitive or backup scenarios:

  • Site-to-site VPN over public internet (max 1.25 Gbps). Use with Virtual WAN for automated branch connectivity785.

Hybrid Architectures:

  • ExpressRoute + VPN Failover: Ensure continuity during ExpressRoute outages5.
  • Azure Virtual WAN: Centralizes VPN, ExpressRoute, and SD-WAN connections into a hub-spoke model78.

Best Practices:

  • Terminate ExpressRoute inside on-premises firewalls for centralized security4.
  • Use Azure Arc for unified management of hybrid servers76.

3. Recommend a Solution to Optimize Network Performance

Accelerated Networking:

  • Reduces VM CPU overhead by offloading packet processing to SmartNICs (FPGA). Ideal for latency-sensitive apps (e.g., HPC, real-time analytics)9.

Azure Front Door/CDN:

  • Global HTTP load balancing with caching and Anycast routing for 50% lower latency vs. Traffic Manager101112.

Proximity Placement Groups:

  • Co-locate VMs in the same Azure zone to minimize latency139.

Best Practices:

  • Enable TCP/IP tuning (e.g., increasing RWIN size) for high-throughput VMs139.
  • Use Zonal Redundancy (Availability Zones) for critical workloads2.

4. Recommend a Solution to Optimize Network Security

Layered Security Approach:

  • Network Security Groups (NSGs): Basic Layer 3/4 filtering for subnets/VMs (e.g., allow/deny by IP/port)32.
  • Azure Firewall: Stateful Layer 7 inspection with threat intelligence, IDPS, and FQDN filtering31.
  • Web Application Firewall (WAF): Protects web apps from OWASP Top 10 vulnerabilities (integrated with Front Door/App Gateway)1012.

DDoS Protection:

  • Standard Tier: Auto-mitigates volumetric attacks (e.g., SYN floods) with cost guarantees during attacks14.

Best Practices:

  • Apply Zero Trust principles: Micro-segment subnets, enforce least-privilege NSG rules43.
  • Use Azure Policy to enforce NSG rules and firewall configurations across subscriptions1.

5. Recommend a Load-Balancing and Routing Solution

Azure Load Balancer (Layer 4):

  • Distributes TCP/UDP traffic across VMs with ultra-low latency. Use for non-HTTP workloads (e.g., databases)10122.

Application Gateway (Layer 7):

  • Routes HTTP/HTTPS traffic with SSL offloading, path-based routing, and WAF integration101512.

Azure Front Door:

  • Global HTTP load balancer with DDoS protection, caching, and Anycast routing. Ideal for multi-region web apps101112.

Traffic Manager (DNS-Based):

  • Directs users to the closest healthy endpoint via DNS. Use for non-latency-sensitive global apps1112.

Routing:

  • User-Defined Routes (UDRs): Override default system routes (e.g., direct traffic through NVAs)16.
  • Service Tags: Simplify UDRs by grouping IP ranges (e.g., Storage or AzureCloud)16.

Best Practices:

  • Chain Application Gateway (frontend) with Internal Load Balancer (backend) for multi-tier apps15.
  • Use Azure Monitor to track load balancer metrics (e.g., SNAT port usage, health probes)2.

Summary Table

RequirementAzure RecommendationKey Tools/Features
Azure-to-InternetNAT Gateway (SNAT) + Azure Firewall (security)Scalable SNAT, FQDN filtering, threat intelligence
Azure-to-On-PremisesExpressRoute (primary) + VPN Gateway (failover)100 Gbps private link, SLA-backed uptime
Network PerformanceAccelerated Networking + Front Door/CDNSmartNIC offloading, global caching, Anycast
Network SecurityNSGs + Azure Firewall + DDoS Protection StandardLayer 7 inspection, Zero Trust, volumetric attack mitigation
Load-Balancing/RoutingLoad Balancer (L4) + Application Gateway (L7) + Front Door (global)SSL offloading, WAF, UDRs with service tags

By aligning with these recommendations, you ensure a secure, high-performance, and resilient network architecture in Azure, meeting AZ-305 exam objectives and Microsoft best practices.

Summarised with Perplexity.

Footnotes

  1. https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-inbound-and-outbound-internet-connectivity ↩ ↩2 ↩3 ↩4 ↩5
  2. https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-overview ↩ ↩2 ↩3 ↩4 ↩5
  3. https://www.knowledgehut.com/blog/cloud-computing/azure-firewall-vs-nsg ↩ ↩2 ↩3 ↩4 ↩5
  4. https://learn.microsoft.com/en-us/azure/security/fundamentals/network-best-practices ↩ ↩2 ↩3
  5. https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/expressroute-vpn-failover ↩ ↩2 ↩3
  6. https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/azure-vmware/on-premises-connectivity ↩ ↩2
  7. https://learn.microsoft.com/en-us/azure/networking/fundamentals/networking-overview ↩ ↩2 ↩3
  8. https://www.megaport.com/blog/comparing-ways-to-connect-to-microsoft-azure/ ↩ ↩2
  9. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning ↩ ↩2 ↩3
  10. https://learn.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview ↩ ↩2 ↩3 ↩4 ↩5
  11. https://stackoverflow.com/questions/67022265/it-is-azure-traffic-manager-or-azure-front-door-in-front-for-multi-region-system ↩ ↩2 ↩3
  12. https://azure.microsoft.com/en-us/solutions/load-balancing-with-azure ↩ ↩2 ↩3 ↩4 ↩5 ↩6
  13. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-optimize-network-bandwidth ↩ ↩2
  14. https://k21academy.com/microsoft-security/overview-of-azure-ddos-protection/ ↩
  15. https://learn.microsoft.com/en-us/answers/questions/1121824/app-gateway-load-balancer-when-to-use-them-togethe ↩ ↩2
  16. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview ↩ ↩2

If you want to get in touch and hear more about this topic, feel free to contact me on or via .

© 2026 Andrei Bodea

Privacy policy

Privacy Policy

Last Updated: 2026-08-11

Thank you for visiting Compiled Thoughts (the “Blog”). We value your privacy and want to clarify how we handle any information you may provide or that may be collected when you visit this Blog. By accessing or using the Blog, you agree to the terms of this Privacy Policy.

1. Information We Do Not Collect

  • No Analytics or Tracking — We do not run analytics software, tracking pixels, session recording, or any other tool intended to profile visitors or follow them across sites.

  • No Advertisements — Our Blog does not display third-party advertisements and, therefore, does not collect data for advertising or marketing purposes.

  • No Reader Accounts or Subscriptions — Readers cannot create an account or subscribe, so we do not collect or store reader account data. Sign-in exists only for the Blog’s own author, in order to publish content.

  • No Cookies Set By Us — We do not set cookies of our own for any purpose. Please see Section 2 for the third-party services your browser contacts when you visit.

2. Third-Party Services and Automatic Data Collection

The Blog is a static site with no database of readers. However, displaying a page does require your browser to make requests to the services listed below. Those services necessarily receive your IP address, your browser’s user agent, and the address of the page you requested. This happens automatically when you visit, and we ask that you take it into account when reading Section 1.

  • Web Hosting, Netlify — The Blog is hosted by Netlify, which serves every page and may retain standard server logs, including IP addresses, for operational and security purposes.

  • Typefaces, Google Fonts — Every page loads fonts from fonts.googleapis.com and fonts.gstatic.com. As a result, Google receives your IP address and user agent when you visit. We do not use Google Analytics or any other Google advertising or measurement product.

  • Netlify Identity — The home page loads a login widget from identity.netlify.com. It exists solely so the author can sign in to publish, it offers nothing to ordinary readers, and it is not used to identify you. Your browser requests it regardless, and the widget may use your browser’s local storage to hold a sign-in session.

We do not control what these providers log or how long they retain it. Please consult their own privacy policies if that matters to you.

3. Voluntary Information

If you choose to contact us directly (for example, through an email link or contact form, if provided), we may receive personal information such as your name or email address. In such cases:

  • We will use this information solely to respond to your inquiry.

4. No Third-Party Data Sharing

Beyond the automatic requests described in Section 2, we do not share, sell, rent, or otherwise disclose personal information to third parties, because we do not collect or store any personal information about readers. In the event you voluntarily submit personal data (e.g., via direct email), we do not disclose that to any external entity.

5. Children’s Privacy

Our Blog does not target or direct content specifically to children under the age of 13. We do not knowingly collect or maintain personal information from children under 13. If you believe we may have inadvertently received personal information from a child under 13, please contact us immediately so we can delete such information.

6. External Links

Our Blog may contain links to external websites about programming, interviewing, music, books, psychology, or other related content. We are not responsible for the content, privacy policies, or practices of any third-party sites. We encourage you to review the privacy policies of those websites before interacting with them or providing any personal information.

7. Security

Although we do not collect or store personal data on our servers, we still endeavor to use reasonable security measures to protect the Blog’s integrity. However, no data transmission or storage system can be guaranteed to be 100% secure. Your use of the Blog indicates you understand and accept any inherent risks.

8. Changes to This Privacy Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make any material changes, we will update the “Last Updated” date at the top of this document. Your continued use of the Blog after any changes signifies your acceptance of the revised Privacy Policy.

9. Contact Us

If you have any questions or concerns about this Privacy Policy, please reach out using the email address in the header of the page.

By using Compiled Thoughts, you acknowledge that you have read, understood, and agree to this Privacy Policy.