Quick Note — Recommend a Connectivity Solution that Connects Azure Resources to the Internet
AZ-305 › Unit 4: Design infrastructure solutions › Design network solutions › Recommend a connectivity solution that connects Azure resources to the internet
Quick Note — Recommend a Connectivity Solution that Connects Azure Resources to the Internet
A SaaS team in Amsterdam launches a global API serving customers across five continents. Their default architecture exposes each region's Application Gateway directly to the public internet with a regional public IP per region. Within just the first two weeks, three problems emerge: outbound calls from internal VMs hit SNAT-port exhaustion under load; the public-facing service receives a DDoS volumetric attack that floods the regional egress; remote operators struggle to access VMs without exposing RDP.…
Retrieval target
- Recommend a Connectivity Solution that Connects Azure Resources to the Internet
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Public IP — Basic vs Standard SKU | Basic (legacy) — single-region, no SLA, open by default (any port reachable unless an NSG blocks). Deprecated for new designs. Standard — 99.99% SLA, closed by default (must explicitly open ports in NSG), zone-redundant option, required for Standard Load Balancer / many newer services. The default for prod. Picking Standard is essentially required since Basic is being retired. |
NAT Gateway | A managed outbound-only internet gateway for a VNet subnet. Provides deterministic outbound IPs (you bring or are allocated 1–16 public IPs), much larger SNAT port pool than load-balancer-based SNAT, and zone-resilient deployment. Solves SNAT port exhaustion at scale; preferred outbound pattern for production workloads. |
Azure Bastion | A managed PaaS service that gives RDP / SSH access to Azure VMs through the portal (or via a native client in Standard tier), without assigning public IPs to the VMs. Browser-based session, supports MFA + Entra ID auth. Two tiers: Basic (browser only) and Standard (native client, session recording, host pools). Replaces self-hosted jumpbox VMs. |
Azure Front Door | Microsoft's global anycast edge — L7 reverse proxy at POPs. TLS termination, WAF, URL-path-based routing, geo-failover, session affinity, edge caching. Tiers: Standard (CDN + ingress), Premium (adds Private Link to origin, managed rule sets, bot protection). Replaces the older Front Door (Classic) and CDN as Microsoft's unified edge offering. |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.