Unit 4 capstone — A hub-and-spoke that has to actually work
AZ-104 › Unit 4 › Capstone
Unit 4 capstone — A hub-and-spoke that has to actually work
Woodgrove Bank builds its landing zone
- AZ104-U4
- 3
- 13
- 5
- 25 minutes
The brief
Woodgrove Bank has a hub virtual network peered to three spokes, one per business line. A shared logging appliance sits in the hub. The spokes must reach it, and must not reach each other. Administrators currently connect to virtual machines over public IP addresses, which the security team has told them to stop. The application tier in one spoke reads from a storage account whose firewall is configured with Woodgrove's public IP ranges, and that arrangement must not break. Machines across the hub and spokes need to resolve one another by name. A public load balancer distributes traffic to four backend machines, and one of them has been receiving nothing since Tuesday although it is running and healthy at the OS.
What they need
- Spokes reach the shared appliance in the hub, and do not reach each other.
- Administrators reach virtual machines without any of them holding a public IP address.
- The application tier reaches storage privately, without breaking the storage firewall's existing public-IP rules.
- Machines across the hub and spokes resolve one another by name.
- Find out why one backend machine receives no traffic.
Commit before you read on
Write down your answer to each of the 5 numbered requirements above — the mechanism, and the scope you would apply it at. Then open the working below and compare. Reading the reasoning beside the question is the one way to feel like you knew it without having known it.
▶Show the working
1. Spokes reach the hub, not each other
Peer each spoke to the hub only — and rely on peering not being transitive.
This one is solved by doing less. Peering carries traffic between the two peered networks and no further, so spokes peered only to the hub already cannot reach each other. If they later need to, that requires routing through the hub — a user-defined route — not a spoke-to-spoke peering, which would undo the isolation. Remember gateway transit bills the spoke if the hub's gateway is used.
2. Administrative access with no public IPs
Azure Bastion.
Connecting via Bastion means the virtual machines need no public IP address, no agent and no special client software. The deployment detail that gets asked: Basic, Standard and Premium require a dedicated subnet named AzureBastionSubnet and a public IP address — the public IP is Bastion's, not the machines'. Premium can be deployed private-only.
3. Private storage access without breaking public-IP rules
A private endpoint. Not a service endpoint.
Both reach storage privately, and only one satisfies the constraint. With service endpoints, source addresses switch from public to private, and existing service firewall rules using public IP addresses stop working — exactly what Woodgrove said must not happen. A private endpoint instead puts a network interface with a private IP from the subnet into the network; it must be in the same region and subscription as the virtual network, and its read-only interface is created automatically.
4. Name resolution across hub and spokes
An Azure Private DNS zone, with a virtual network link to each network.
The zone alone resolves nothing: to resolve a private zone's records from a virtual network you must link the virtual network with the zone. Enable autoregistration on the links you want machines registered from — VMs are registered as A records pointing to their private IP addresses. ⚠ One constraint to design around: a virtual network can be linked to only one private zone with autoregistration enabled, though many networks may link to a single zone.
5. One backend machine receives nothing
Check the health probe first.
Flows are distributed according to configured load-balancing rules and health probes, so a failing probe takes an instance out of rotation while the machine itself looks perfectly healthy — which is precisely the symptom described. Only after the probe would you look at the rule and at the security rules on the path. And if anything in this design still names Basic Load Balancer, that was retired on 30 September 2025.
The reasoning this unit rewards
Check yourself
Where these figures come from
Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.
| Document | sha1 |
|---|---|
| Virtual network peering | 9fc3965ab424 |
| What is Azure Bastion? | 4dfbd29a9cb4 |
| Virtual network service endpoints | 62733fb4a7e8 |
| What is a private endpoint? | 9da2884d1925 |
| What is Azure Private DNS? | 5d91779b3c89 |
| What is Azure Load Balancer? | 0809223ef2a0 |