AZ-305 Design infrastructure solutions Practice Test 10 — 15 Questions

Question 1

Your organization has a hybrid identity environment with Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to access cloud applications using their on-premises credentials, and also enables single sign-on (SSO) for legacy on-premises applications that do not support modern authentication protocols. What should you recommend?

Accepted Answer

Implement Azure AD Connect with password hash synchronization and Azure AD Application Proxy.. Option A is correct because Azure AD Application Proxy provides SSO to legacy on-premises apps without modifying them. Azure AD Connect with PHS enables cloud authentication. Option B (Azure AD DS) is for domain-joined VMs. Option C (Azure AD B2B) is for external users. Option D (Azure AD Seamless SSO) only works for browser-based apps.

Answer

Deploy Azure Active Directory Domain Services and domain-join the legacy application servers.

Answer

Use Azure Active Directory B2B collaboration for internal users.

Answer

Configure Azure AD Seamless SSO and use Azure AD Connect with pass-through authentication.

Question 2

You need to design a monitoring solution for a set of Azure virtual machines running a business-critical application. The solution must provide centralized log management, enable real-time analysis of security events, and support custom alerts for anomalous behavior. Which Azure service should you use?

Accepted Answer

Microsoft Sentinel. Option C is correct because Microsoft Sentinel provides SIEM capabilities for centralized log management, real-time analysis, and custom alerts. Option A (Azure Monitor) is for metrics and logs but lacks SIEM. Option B (Log Analytics) is a component of Azure Monitor. Option D (Microsoft Defender for Cloud) focuses on security posture and threat protection.

Answer

Azure Log Analytics

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 3

Your company is planning to migrate a large number of on-premises servers to Azure. The migration must be completed within 3 months. You need to assess the current on-premises environment and recommend the most appropriate Azure VM sizes and costs. What should you do?

Accepted Answer

Use Azure Migrate to discover and assess the on-premises environment, and generate sizing and cost recommendations.. Option A is correct because Azure Migrate provides assessment, sizing recommendations, and cost estimates. Option B (Azure Advisor) is for optimization of existing resources. Option C (Azure Cost Management) is for cost analysis. Option D (manual inventory) is time-consuming and error-prone.

Answer

Create a manual inventory of all servers and use Azure Pricing Calculator to estimate costs.

Answer

Use Azure Advisor to analyze on-premises server usage and recommend Azure VM sizes.

Answer

Use Azure Cost Management to estimate costs based on manual input of server specifications.

Question 4

You are reviewing a network security group (NSG) rule for a subnet that hosts web servers. The subnet's address space is 10.0.1.0/24. What is the effect of this rule?

Accepted Answer

The rule allows inbound TCP traffic on ports 80 and 443 from the same subnet.. Option A is correct because the rule allows inbound TCP traffic on ports 80 and 443 from any source (SourceAddressPrefixes is missing, but by default it means any; however, the JSON shows SourceAddressPrefixes with 10.0.1.0/24, so it only allows from that subnet). Wait, the exhibit shows SourceAddressPrefixes: ["10.0.1.0/24"], so the rule allows inbound traffic from the same subnet. Option A is incorrect because it says 'from any source'. Actually, the rule allows from 10.0.1.0/24 only. So Option D is correct: The rule allows inbound traffic from the same subnet. Option B (deny) is false. Option C (allow from internet) is false. Option D is correct.

Answer

The rule allows inbound TCP traffic on ports 80 and 443 from any source.

Answer

The rule denies inbound TCP traffic on ports 80 and 443 from any source.

Answer

The rule allows inbound TCP traffic on ports 80 and 443 from the internet.

Question 5

You are an Azure administrator. The above Azure Policy definition is assigned to a subscription. A developer tries to deploy a Virtual Machine with SKU Standard_DS2_v2. What will happen?

Accepted Answer

The deployment is denied and an error message is returned.. Option C is correct because the policy denies any VM with SKU name starting with 'Standard_DS*' (like match). Option A (allowed) is false. Option B (audited) is false. Option D (modified) is false.

Answer

The deployment succeeds with a warning logged.

Answer

The VM is created but the SKU is changed to a different series.

Answer

The deployment succeeds because the policy only audits.

Question 6

You executed the above Azure CLI commands. The remote VNet (yourVNet) has address space 10.1.0.0/16. What is the result?

Accepted Answer

A VNet with two subnets is created, and a VNet peering is established.. Option B is correct because the commands create a VNet with two subnets and then create a VNet peering to a remote VNet. Option A (only one subnet) is false because two subnets are created. Option C (peering fails) is false because the command succeeds. Option D (no peering) is false.

Answer

The peering command fails because the remote VNet does not exist.

Answer

A VNet with one subnet is created, and no peering is established.

Answer

Only the first subnet is created, and the peering is established.

Question 7

You are designing a highly available architecture for a stateful application running on Azure Virtual Machines. The application requires a shared storage solution that supports concurrent read/write access from multiple VMs, and must be resilient to zone failures. Which TWO Azure solutions meet these requirements? (Choose TWO.)

Accepted Answer

Azure NetApp Files with cross-zone replication. Option A (Azure Files premium shares) supports SMB multichannel and concurrent access, and can be zone-redundant. Option C (Azure NetApp Files) supports NFS/SMB and cross-zone replication. Option B (Azure Blob Storage) does not support concurrent access as a file share. Option D (Azure Managed Disks) cannot be shared without special clustering. Option E (Azure Disk Storage with shared disks) is limited to 2-3 nodes and not zone-redundant.

Answer

Azure Disk Storage with shared disks enabled

Answer

Azure Managed Disks with Standard SSD

Answer

Azure Blob Storage with hot access tier and geo-redundant storage (GRS)

Question 8

Your organization is designing a data platform for real-time analytics on streaming data from IoT devices. The solution must ingest millions of events per second, process the data with low latency, and store results in a format optimized for analytical queries. Which THREE Azure services should you include in the design? (Choose THREE.)

Accepted Answer

Azure Event Hubs. Option A (Azure Event Hubs) is for high-throughput ingestion. Option C (Azure Stream Analytics) for real-time processing. Option E (Azure Synapse Analytics) for analytical storage. Option B (Azure IoT Hub) is for device management, not high-throughput ingestion. Option D (Azure Functions) is for serverless compute, not stream processing at scale.

Answer

Azure Functions

Answer

Azure IoT Hub

Question 9

You need to design a solution to securely connect an on-premises data center to Azure for hybrid workloads. The connection must be private, use the internet for transport, and provide high availability. Which TWO Azure services should you consider? (Choose TWO.)

Accepted Answer

Azure VPN Gateway (Site-to-Site VPN). Option A (Site-to-Site VPN) uses internet and can be made highly available with active-active configuration. Option D (Azure VPN Gateway supports active-active). Option B (Azure ExpressRoute) is private but not over internet. Option C (Azure Virtual WAN) is a managed hub but still uses VPN or ExpressRoute. Option E (Azure Bastion) is for RDP/SSH access to VMs.

Answer

Azure Virtual WAN

Answer

Azure ExpressRoute

Answer

Azure Bastion

Question 10

A multinational company plans to deploy a new application on Azure. The application must comply with GDPR and requires data residency in the EU. The solution should minimize latency for users in Europe and provide disaster recovery across regions. Which Azure architecture should the company implement?

Accepted Answer

Deploy the application in two EU regions with Azure Traffic Manager and Azure Cosmos DB multi-region writes.. Option C is correct because an active-active multi-region deployment with Azure Traffic Manager and Cosmos DB provides low latency and data residency control. Option A is wrong because a single-region deployment does not provide disaster recovery across regions. Option B is wrong because Azure Front Door is for global load balancing but does not enforce data residency. Option D is wrong because Azure Site Recovery provides DR but does not minimize latency for active traffic.

Answer

Deploy the application in two EU regions with Azure Front Door and Azure SQL Database geo-replication.

Answer

Deploy the application in a single Azure region in Ireland with Azure Site Recovery for DR.

Answer

Deploy the application in a single EU region with Azure Site Recovery and Azure Redis Cache.

Question 11

You need to design a virtual network architecture for a three-tier application in Azure. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of Azure services should you use?

Accepted Answer

Use Azure Application Gateway with WAF, network security groups (NSGs) on subnets, and Azure Private Endpoints for the database.. Option A is correct because it uses Azure Application Gateway for inbound internet traffic with WAF, NSGs to restrict traffic between tiers, and Private Endpoints for database access. Option B is wrong because Azure Load Balancer does not provide WAF or path-based routing. Option C is wrong because Azure Front Door is a global service, not for internal VNet traffic. Option D is wrong because placing all VMs in same subnet violates security.

Answer

Use Azure Front Door, service endpoints, and Azure SQL Database with firewall rules.

Answer

Use Azure Load Balancer, Azure Firewall, and Azure SQL Database with public endpoint.

Answer

Use a single virtual network with three subnets, no NSGs, and Azure SQL Database with VNet injection.

Question 12

A company runs a critical application on Azure VMs in a single region. They need to improve availability to meet an SLA of 99.99% while minimizing costs. The application is stateless and can run on multiple VMs. Which solution should you recommend?

Accepted Answer

Deploy a virtual machine scale set across multiple availability zones in a single region.. Option C is correct because a virtual machine scale set (VMSS) with zones across three availability zones provides 99.99% SLA and allows scaling. Option A is wrong because two VMs in an availability set provide only 99.95% SLA. Option B is wrong because two VMs in different regions adds cost and complexity. Option D is wrong because a single VM in a single zone offers no high availability.

Answer

Deploy two VMs in the same availability set in a single region.

Answer

Deploy a single VM with Azure Site Recovery to another region.

Answer

Deploy two VMs in two different Azure regions with Azure Traffic Manager.

Question 13

Your company has an Azure subscription with multiple virtual networks connected via VNet peering. You need to design a solution to allow VMs in different peered VNets to resolve each other's private IP addresses using custom DNS suffixes. The solution must minimize administrative overhead. What should you implement?

Accepted Answer

Create an Azure Private DNS Zone linked to each VNet with auto-registration enabled.. Option D is correct because Azure Private DNS Zones with auto-registration automatically register and resolve VMs across peered VNets. Option A is wrong because Azure DNS does not support custom DNS suffixes for private IPs. Option B is wrong because custom DNS servers require manual configuration and maintenance. Option C is wrong because Azure Firewall is not a DNS resolver.

Answer

Deploy custom DNS servers on Azure VMs and configure VNets to use those servers.

Answer

Configure Azure DNS to use a custom domain name and update each VM's DNS suffix.

Answer

Use Azure Firewall as a DNS proxy with custom DNS settings.

Question 14

A company plans to migrate on-premises SQL Server databases to Azure. They need to minimize changes to existing applications and want to use the latest features of SQL Server. Which Azure data service should they use?

Accepted Answer

Azure SQL Managed Instance. Option A is correct because Azure SQL Managed Instance provides near 100% compatibility with SQL Server, minimizing application changes, and supports the latest SQL Server features. Option B is wrong because Azure SQL Database requires application changes for database-level compatibility. Option C is wrong because SQL Server on Azure VMs requires management of OS and SQL Server. Option D is wrong because Azure Cosmos DB is NoSQL, not compatible with SQL Server.

Answer

SQL Server on Azure Virtual Machines

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Question 15

Your company has a hybrid identity environment using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to authenticate to Azure services using their on-premises credentials and enforce conditional access policies for sensitive applications. The solution must support multi-factor authentication (MFA) using the Microsoft Authenticator app. Which components should you include?

Accepted Answer

Microsoft Entra Connect Sync, Microsoft Entra ID, and Conditional Access policies with MFA.. Option C is correct because Microsoft Entra Connect Sync synchronizes identities, Entra ID provides authentication, and conditional access policies enforce MFA. Option A is wrong because Pass-through Authentication does not support MFA via Authenticator app. Option B is wrong because AD FS is an additional component that adds complexity. Option D is wrong because Microsoft Entra Connect Health is for monitoring, not authentication.

Answer

Microsoft Entra Connect Health, Microsoft Entra ID with cloud sync, and Azure AD Identity Protection.

Answer

Active Directory Federation Services (AD FS), Web Application Proxy, and Azure AD Conditional Access.

Answer

Azure AD Pass-through Authentication, Azure AD Application Proxy, and Azure AD Identity Protection.