AZ-305 Design infrastructure solutions Practice Test 10 — 15 Questions

Question 1

You are designing a microservices architecture on Azure Kubernetes Service (AKS). The solution must handle traffic spikes by automatically scaling pods based on CPU utilization. Additionally, you need to minimize cost by scaling down nodes when not in use. Which two features should you implement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Horizontal Pod Autoscaler (HPA). Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU utilization (or custom metrics), directly addressing the requirement to handle traffic spikes by scaling pods. Cluster Autoscaler automatically adjusts the number of AKS nodes by scaling down unused nodes and scaling up when pods are unschedulable, which minimizes cost by reducing node count during low usage.

Answer

Azure Load Balancer

Answer

Vertical Pod Autoscaler (VPA)

Answer

Azure Container Instances (ACI)

Question 2

Your organization uses Microsoft Purview to govern data assets across Azure SQL Database, Azure Data Lake Storage, and on-premises SQL Server. You need to ensure that sensitive data such as credit card numbers are automatically detected and classified. What should you configure in Microsoft Purview?

Accepted Answer

Data classification rules. Microsoft Purview's data classification rules are specifically designed to automatically detect and classify sensitive data like credit card numbers across data sources. By configuring classification rules, you define patterns (e.g., regex for credit card numbers) that Purview scans against assets in Azure SQL Database, Azure Data Lake Storage, and on-premises SQL Server, applying sensitivity labels accordingly.

Answer

Data share

Answer

Data catalog

Answer

Data lineage mapping

Question 3

You need to design a solution to store log data from multiple Azure services. The data must be retained for 7 years for compliance purposes and should be queryable for analysis. Which Azure service should you use as the primary storage for these logs?

Accepted Answer

Azure Log Analytics workspace. Azure Log Analytics workspace is the correct choice because it is purpose-built for ingesting, storing, and querying log data from Azure services. It supports long-term retention up to 7 years (via the Basic Logs tier or data archiving with Azure Data Explorer) and provides Kusto Query Language (KQL) for interactive analysis, meeting both compliance and queryability requirements.

Answer

Azure Data Lake Storage

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 4

You are designing a network architecture for a multi-tier application. The front-end tier is an Azure Application Gateway that routes traffic to a web app on Azure App Service. The back-end tier is an Azure SQL Database. You need to ensure that all traffic between the Application Gateway and the web app remains within the Azure backbone network, and that the web app can only be accessed through the Application Gateway. What should you configure?

Accepted Answer

Enable Service Endpoints for the web app and configure the Application Gateway with a private IP.. Enabling Service Endpoints for the web app allows traffic from the Application Gateway to reach the App Service over the Azure backbone network, bypassing the public internet. Configuring the Application Gateway with a private IP and restricting the web app's access to only that private IP ensures the web app can only be accessed through the gateway, meeting both requirements.

Answer

Use Azure Private Link for the web app and disable public access.

Answer

Deploy Azure Firewall in front of the Application Gateway.

Answer

Use a site-to-site VPN between the App Service and Application Gateway.

Question 5

Your company plans to migrate on-premises file servers to Azure. The solution must support SMB protocol and integrate with Microsoft Entra ID for authentication. You need to choose a service that provides fully managed file shares accessible from multiple Azure regions. Which Azure service should you use?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB file shares that can be accessed from multiple Azure regions using the SMB 3.0 protocol. It integrates natively with Microsoft Entra ID (formerly Azure AD) for Kerberos-based authentication, allowing on-premises identities to access shares without additional domain controllers. This makes it the correct choice for migrating on-premises file servers to a multi-region, identity-aware managed file service.

Answer

Azure Disk Storage

Answer

Azure NetApp Files

Answer

Azure Blob Storage

Question 6

You are designing a solution to grant external partners access to specific Azure resources. The partners must authenticate using their own corporate credentials. You need to manage their access centrally. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra ID B2B collaboration. Microsoft Entra ID B2B collaboration is the correct choice because it allows external partners to authenticate using their own corporate credentials (via their home tenant or identity provider) while enabling centralized management of their access to Azure resources. B2B collaboration supports features like cross-tenant synchronization, conditional access policies, and entitlement management, making it ideal for granting granular, centrally managed access to external users without requiring them to create new accounts.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Connect

Question 7

Your organization is deploying a critical application on Azure virtual machines. You need to ensure that the VMs are distributed across multiple fault domains and update domains within an availability set. You create an availability set with 3 fault domains and 5 update domains. How many VMs can you add to this availability set to maximize fault tolerance?

Accepted Answer

Unlimited. B is correct because Azure availability sets do not limit the number of VMs you can place into them; you can add an unlimited number of VMs. The fault domains (3) and update domains (5) define the maximum distribution groups, but Azure will place VMs across these domains as evenly as possible. Adding more VMs beyond the number of fault or update domains does not reduce fault tolerance—it simply means multiple VMs will share the same fault or update domain, but the set still provides the best possible distribution given the defined domain counts.

Answer

5 VMs

Answer

15 VMs

Answer

3 VMs

Question 8

Your company is designing a multi-region disaster recovery solution for a mission-critical application using Azure SQL Database. The application requires read-scale in the secondary region and must support automatic failover with no data loss. Which Azure SQL Database offering should you recommend?

Accepted Answer

Azure SQL Database Failover group. Azure SQL Database Failover groups provide automatic failover with no data loss by using synchronous replication within a paired region, and they support readable secondary replicas in the secondary region. This meets all requirements: read-scale in the secondary region, automatic failover, and zero data loss (RPO=0).

Answer

Azure SQL Managed Instance

Answer

Azure SQL Database Hyperscale with named replicas

Answer

Azure SQL Database Single Database with active geo-replication

Question 9

A company is planning to migrate its on-premises Active Directory to Microsoft Entra ID. They have a complex on-premises infrastructure with multiple forests and over 50,000 users. They need to synchronize identities and enable single sign-on (SSO) for Office 365. What should you recommend?

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync (formerly Azure AD Connect) is the appropriate tool for synchronizing identities from a complex on-premises infrastructure with multiple forests and over 50,000 users to Microsoft Entra ID. It supports full identity synchronization, password hash synchronization, pass-through authentication, and federation for SSO to Office 365, and it can handle multi-forest environments with advanced configuration options.

Answer

Microsoft Entra Connect Cloud Sync

Answer

Microsoft Entra Connect

Answer

Microsoft Entra ID synchronization

Question 10

Your organization is designing a solution to capture and analyze IoT data from millions of devices. The solution must ingest data at high velocity, store the data for long-term analytics, and provide real-time dashboards. Which combination of Azure services should you recommend?

Accepted Answer

Azure Event Hubs, Azure Data Lake Storage, and Azure Stream Analytics. Azure Event Hubs is designed for high-velocity data ingestion from millions of devices, Azure Data Lake Storage provides scalable and cost-effective long-term storage for analytics, and Azure Stream Analytics enables real-time processing and dashboarding. This combination directly addresses the requirements of high-throughput ingestion, durable storage, and real-time analytics without unnecessary complexity.

Answer

Azure Service Bus, Azure SQL Database, and Power BI

Answer

Azure Cosmos DB, Azure Data Explorer, and Azure Logic Apps

Answer

Azure IoT Hub, Azure Blob Storage, and Azure Functions

Question 11

Your company is designing a hybrid network architecture to connect an on-premises data center to Azure. The requirements include: high availability, low latency, and cost optimization. Which TWO options should you recommend?

Accepted Answer

ExpressRoute Gateway. ExpressRoute Gateway is correct because it provides a dedicated, private connection from on-premises to Azure, bypassing the public internet for lower latency and more consistent performance. It supports high availability through active-active configurations and can be paired with multiple circuits for redundancy, meeting the hybrid network requirements.

Answer

Single ExpressRoute circuit

Answer

Site-to-Site VPN

Answer

ExpressRoute Direct

Question 12

A multinational corporation is designing a backup and disaster recovery strategy for Azure IaaS VMs. The solution must support cross-region failover, meet a recovery point objective (RPO) of 15 minutes, and a recovery time objective (RTO) of 1 hour. Which THREE options should you include in the design?

Accepted Answer

Azure Backup with geo-redundant storage (GRS). Azure Backup with geo-redundant storage (GRS) replicates backup data to a paired secondary region, enabling cross-region failover and meeting the RPO of 15 minutes via application-consistent snapshots. Azure Site Recovery orchestrates failover to the secondary region and ensures the RTO of 1 hour is met. Together, these two components satisfy all requirements. Azure Backup with zone-redundant storage (ZRS) does not provide cross-region failover, as ZRS only protects within a single region across availability zones, and thus cannot meet the cross-region failover requirement.

Answer

Azure Backup with locally redundant storage (LRS)

Answer

Managed disk snapshots

Answer

Azure Backup with zone-redundant storage (ZRS)

Question 13

Your organization is implementing a security strategy for Azure resources. You need to enforce consistent security policies across all subscriptions and ensure compliance with regulatory standards. Which TWO services should you use?

Accepted Answer

Microsoft Defender for Cloud. (Microsoft Defender for Cloud) is correct because it provides security posture management, compliance monitoring, and regulatory compliance tracking across all subscriptions. Option E (Azure Policy) is correct because it enforces consistent security policies and compliance rules at scale. Option A (Azure RBAC) is incorrect as it governs access control, not policy enforcement. Option C (Microsoft Sentinel) is a SIEM solution for threat detection, not policy enforcement. Option D (Azure Blueprints) is deprecated and was used for orchestration, not direct policy enforcement.

Answer

Azure RBAC

Answer

Microsoft Sentinel

Answer

Azure Blueprints

Question 14

Refer to the exhibit. You are an Azure administrator. You assign this policy definition to a subscription. A developer attempts to deploy a virtual machine with SKU Standard_DS1_v2. What is the outcome?

Accepted Answer

The deployment is denied because Standard_DS1_v2 is not in the allowed list.. The policy definition uses the 'deny' effect for the 'Microsoft.Compute/virtualMachines/sku' property, which explicitly denies any SKU not included in the 'allowedSkus' list. Since Standard_DS1_v2 is not in the allowed list, the deployment is denied at evaluation time. Option D correctly identifies this outcome.

Answer

The deployment succeeds because Standard_DS1_v2 is not explicitly denied.

Answer

The deployment is denied and a remediation task is created.

Answer

The deployment succeeds but is logged as non-compliant.

Question 15

Refer to the exhibit. You deploy this ARM template to a resource group in the East US region. You specify the parameter storageAccountType as 'Standard_GRS'. Which of the following is true about the deployed storage account?

Accepted Answer

The storage account is geo-redundant and replicates data to a paired region.. The parameter 'storageAccountType' is set to 'Standard_GRS', which specifies geo-redundant storage (GRS). GRS replicates your data synchronously three times within a single region using LRS, then asynchronously replicates to a paired secondary region, ensuring durability even during a regional outage.

Answer

The storage account name will be 'storage' followed by a random string.

Answer

The storage account will be deployed in the same region as specified by the parameter.

Answer

The storage account is zone-redundant and replicates data across availability zones.