Get Your CertAZ-305PlayCompete
‹ All AZ-305 questions

AZ-305 Practice Question 40: Global Branch Connectivity

Microsoft Azure Solutions Architect Expert (AZ-305) · Test 4 · question 10 of 10

Infrastructure Solutionshard

A retailer is connecting 900 stores to Azure. Each store already has an SD-WAN appliance from a vendor that participates in Microsoft's connectivity automation program. The retailer also runs virtual networks in four Azure regions and terminates two ExpressRoute circuits for its distribution centers. The design must deliver:

- any-to-any connectivity: store to store, store to virtual network, and ExpressRoute site to virtual network, including across regions, - branch onboarding driven from the SD-WAN vendor's controller rather than configured by hand, - Microsoft-managed hub infrastructure, with a central firewall inspecting traffic in each hub, - a single operational view of the whole network.

Which design should you recommend?

Select one answer
Show answer and explanation

Answer:

  • B. Deploy a Standard Virtual WAN with one virtual hub per region, onboard the stores through the vendor's connectivity automation, attach the virtual networks as hub virtual network connections and the ExpressRoute circuits to the hubs, and convert each hub to a secured hub with Azure Firewall

Virtual WAN brings branch connectivity, site-to-site and point-to-site VPN, ExpressRoute, and transitive virtual network connectivity together behind a single operational interface. In a Standard Virtual WAN all hubs are connected in full mesh over the Microsoft backbone, which gives the any-to-any transit the retailer needs across four regions, and Standard hubs support transit between VPN and ExpressRoute as well as between virtual networks. The hub itself is a Microsoft-managed virtual network, so there is no hub infrastructure to build, and Azure Firewall can be deployed into each hub. Partners in the connectivity automation program can export device information and download the Azure configuration, which is exactly the vendor-driven onboarding of 900 branches the design calls for.

Option A is the customer-managed alternative and it is the wrong end of the trade-off at this scale. The retailer would build and operate four hubs, their gateways, and their firewalls; branch onboarding stays manual; and cross-region transit becomes a growing set of hand-maintained route tables, precisely the operational burden Virtual WAN removes.

Option C creates a single point of failure and a routing dead end. All store traffic would hairpin through one region regardless of where the store is, peering is non-transitive so stores could not reach the other three regions' virtual networks without further routing work, and the design ignores the SD-WAN automation the stores already have.

Option D is disproportionate. ExpressRoute is a private circuit sized and priced for datacenter-class connectivity with provisioning lead times measured in weeks; ordering 900 of them for retail stores costs orders of magnitude more than VPN or SD-WAN attachment and still leaves the transit topology to design.

Reference: Azure Virtual WAN overview

Practice Test 4 ›

Study guides for AZ-305

Azure certification path 2026: AZ-900, AZ-104, AZ-305The Azure certification path for 2026 - AZ-900, AZ-104 and AZ-305 in order, what each covers, the AZ-305 prerequisite, renewal and what to skip.
Azure RBAC vs Azure Policy vs Entra roles vs resource locksHow Azure RBAC, Azure Policy, Microsoft Entra roles and resource locks differ, how scope inheritance works, and when deny beats audit.
Azure Storage redundancy - LRS, ZRS, GRS, GZRS and failoverHow LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS differ, what failover does to your account, and how access tiers interact with redundancy.