13.1 Internet Connectivity Design

Why This Topic Matters

"Recommend a connectivity solution that connects Azure resources to the internet" is one of the 21 official Domain 4 (Design Infrastructure Solutions) bullets, and Domain 4 is the single heaviest domain on the exam at 30-35% weight. Every AZ-305 candidate will see at least one scenario asking them to pick between a Public IP address, Azure Application Gateway, and Azure Front Door for a given internet-facing workload — and the exam rewards knowing why one wins over the others, not just that all three technically "work."

Core Concepts

Public IP Addresses

A Public IP address is the most basic way to expose an Azure resource (VM NIC, load balancer frontend, Application Gateway) to the internet. Azure Public IPs come in two SKUs:

• Basic SKU — no Availability Zone support, no SLA, open by default (relies on NSGs for filtering). Basic Load Balancer (and its Basic Public IP dependency) was retired on September 30, 2025; existing Basic resources keep running but are unsupported and carry no SLA. Do not recommend Basic SKU for any new design.
• Standard SKU — secure by default (must be explicitly allowed via NSG), supports zonal and zone-redundant deployment, and carries the Azure SLA. Standard is the only SKU Microsoft recommends for new deployments and the only one AZ-305 answers should select.

A Standard Public IP can be zone-redundant (one IP address, spread across all zones in the region, survives a single zone failure) or zonal (pinned to one specific zone — useful only when you need the IP to move with a zonal resource). For most architecture answers, zone-redundant is correct unless the scenario explicitly pins a resource to a single zone.

Azure Application Gateway

Application Gateway is a regional, Layer 7 (HTTP/HTTPS) reverse proxy and load balancer. Its v2 SKU (Standard_v2 / WAF_v2) adds autoscaling, zone redundancy, and header rewrite. Design-relevant capabilities:

• Path-based routing — route /images/* to one backend pool and /api/* to another from a single gateway.
• Multi-site hosting — host multiple domains on one gateway using host headers.
• WAF_v2 — OWASP Core Rule Set–based Web Application Firewall, scoped to this application's traffic.
• SSL/TLS offload and end-to-end SSL — terminate or re-encrypt to the backend.

Because it is regional, Application Gateway alone cannot provide global failover or edge caching — that is Front Door's job.

Azure Front Door

Azure Front Door is a global, Anycast-based Layer 7 entry point that combines a global HTTP(S) load balancer, a CDN, and (in Premium) an edge WAF. It comes in two tiers:

The decisive design question is almost always: does the origin need to stay off the public internet? If yes — regulated data, zero-trust mandates, an internal Application Gateway origin — Premium is the only tier with Private Link to origin, which is the feature that eliminated the old requirement that every Front Door backend be publicly reachable. If the backend can remain public and you don't need bot management or edge WAF, Standard is the cheaper, correct answer.

Decision Table

Exam Scenario

A global retailer runs an e-commerce site from App Service deployments in three regions (US East, West Europe, Southeast Asia). Compliance requires that App Service origins never be reachable from the public internet, and the security team wants both edge-level bot mitigation and application-specific WAF rules tuned per region. The correct design: Azure Front Door Premium as the global entry point (custom domain, edge WAF, bot protection, Private Link to each region's origin) with a regional Application Gateway WAF_v2 in each region providing origin-specific rule sets and path-based routing to backend App Service instances — connected to Front Door via Private Link so no origin ever exposes a public IP.

A contrasting scenario: a single-region internal line-of-business web app used only by corporate VPN-connected employees, no compliance mandate, needs simple path-based routing between two APIs. Front Door would be unnecessary complexity and cost here — Application Gateway Standard_v2 alone (or even just a Standard Load Balancer if no Layer 7 routing is needed) is the right-sized answer. AZ-305 frequently tests this restraint: picking the simplest service that meets stated requirements, not the most feature-rich one.