AZ-305
Deep Dive
Connecting on-premises with Azure: VPN vs ExpressRoute based on bandwidth, SLA and compliance; private access to PaaS with Private Endpoints; and the piece that ties it all together: hybrid DNS.
Contents
Site-to-Site (S2S)
Point-to-Site (P2S)
A private, dedicated circuit via a connectivity provider — traffic does NOT cross the internet. Consistent latency, up to 10/100 Gbps (Direct), 99.95%+ SLA. Not encrypted by default (private ≠ encrypted): add MACsec (Direct) or IPsec over the circuit if encryption is required.
Concepts
VPN vs ExpressRoute — the decision
| Aspect | Service Endpoint | Private Endpoint |
|---|---|---|
| What it is | The subnet "identifies itself" to the PaaS service; traffic over the backbone | A NIC with a PRIVATE IP from your VNet representing the PaaS resource |
| The service still has a public IP | Yes — you only restrict WHO reaches it | Public access can be fully disabled |
| Accessible from on-prem/peered VNets | No — only from the enabled subnet | Yes — via VPN/ER and peering (it's a normal private IP) |
| Granularity | To the WHOLE service (every storage account) | To the INDIVIDUAL resource (that storage account, that blob endpoint) |
| Requires special DNS | No | Yes — privatelink.* Private DNS Zone |
| Cost | Free | Per hour + GB processed |
| Recommendation | Legacy/minimum cost | Today's security standard and the exam's answer for "private-only access" |
The pieces
DNS Private Resolver (the modern hybrid answer)
| Requirement | Design |
|---|---|
| Connect an office to Azure quickly and cheaply, encrypted | VPN S2S |
| Traffic to Azure with no internet crossing, consistent latency | ExpressRoute (private peering) |
| ExpressRoute + an encryption requirement | MACsec (Direct) or IPsec over the circuit |
| Continuity if the ER circuit fails | VPN S2S as backup (or a second circuit) |
| Remote users access the VNet | P2S VPN (or Bastion for administration) |
| SQL accessible ONLY by private IP, even from on-prem | Private Endpoint + privatelink DNS + disable public access |
| Restrict storage to a subnet without paying for a PE | Service Endpoint + account firewall |
| On-prem resolves Azure privatelink names | DNS Private Resolver (inbound) + on-prem forwarders |
| Azure resolves the on-prem corp.local AD domain | Private Resolver outbound + ruleset |
| Connect two of your own datacenters via Microsoft | ExpressRoute Global Reach |
Did you get this topic?
Test what you just learned
A bank migrates its core to Azure. Requirements: (1) the on-premises↔Azure connection must not cross the public internet and needs 5 Gbps sustained with predictable latency, (2) if the primary connection fails there must be a backup path even if degraded, (3) on-premises apps must resolve the private names of Azure databases (private endpoints). What combination do you design?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.