AZ-305 Design infrastructure solutions Practice Test 11 — 15 Questions

Question 1

You are designing a storage solution for a media company that needs to store large video files (up to 50 GB each) and serve them to a global audience with low latency. The solution must be cost-effective and support resumable uploads. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage with Azure CDN and Azure Files for resumable uploads using AzCopy.. Option B is correct because Azure Blob Storage with CDN and Azure Files with AzCopy provides cost-effective storage for large files, CDN for low latency global delivery, and resumable uploads via AzCopy. Option A is wrong because Azure Files alone does not provide global CDN. Option C is wrong because Azure NetApp Files is enterprise-grade and expensive. Option D is wrong because Azure Disk Storage is for VM disks, not for serving files.

Answer

Azure Files with Azure File Sync and Azure CDN.

Answer

Azure Disk Storage with Azure Load Balancer.

Answer

Azure NetApp Files with Azure Front Door.

Question 2

A company wants to implement a backup strategy for their Azure virtual machines. They need to retain backups for 7 years for compliance and ensure backups are encrypted at rest. Which solution should you recommend?

Accepted Answer

Azure Backup with a vault configured for 7-year retention and encryption at rest.. Option C is correct because Azure Backup supports long-term retention (up to 99 years) and encryption at rest using Azure Storage Service Encryption. Option A is wrong because Azure Site Recovery is for disaster recovery, not long-term backup. Option B is wrong because Azure Disk Snapshot does not support 7-year retention natively. Option D is wrong because Azure Files Backup is for file shares, not VMs.

Answer

Azure Disk Snapshot with a lifecycle management policy.

Answer

Azure Files Backup to a Recovery Services vault.

Answer

Azure Site Recovery with custom retention policies.

Question 3

You need to design a network topology for a global e-commerce platform on Azure. The solution must provide low-latency access to static content and protect the backend APIs from DDoS attacks. The backend APIs are deployed in multiple regions behind an internal load balancer. Which services should you use?

Accepted Answer

Azure Front Door with WAF and Azure API Management.. Option D is correct because Azure Front Door provides global load balancing, SSL offload, WAF, and DDoS protection; Azure API Management provides API gateway functionality. Option A is wrong because Azure Application Gateway is regional, not global. Option B is wrong because Azure Traffic Manager is DNS-based and does not provide WAF. Option C is wrong because Azure CDN does not provide API management.

Answer

Azure Traffic Manager and Azure Firewall.

Answer

Azure Content Delivery Network (CDN) and Azure Load Balancer.

Answer

Azure Application Gateway with WAF and Azure API Management.

Question 4

Which TWO services should you use to design a highly available and scalable web application on Azure that runs on Linux containers and requires automatic scaling based on HTTP traffic? (Choose two.)

Accepted Answer

Azure Application Gateway. A and D are correct. Azure Kubernetes Service (AKS) orchestrates containers and supports horizontal pod autoscaling based on HTTP traffic. Azure Application Gateway acts as a load balancer and can route traffic to AKS. B is wrong because Azure Container Instances is for simple container deployments without orchestration. C is wrong because Azure Load Balancer is for TCP/UDP traffic, not HTTP-specific scaling. E is wrong because Azure Web App for Containers does not support automatic scaling based on HTTP traffic as granularly as AKS.

Answer

Azure Load Balancer

Answer

Azure Web App for Containers

Answer

Azure Container Instances (ACI)

Question 5

Which THREE components are required to implement a hybrid cloud solution that extends on-premises Active Directory to Azure and provides single sign-on (SSO) to cloud applications? (Choose three.)

Accepted Answer

Microsoft Entra Connect Sync. A, B, and C are correct. Microsoft Entra Connect Sync synchronizes identities; Microsoft Entra ID provides the cloud identity platform; Active Directory Federation Services (AD FS) enables SSO for on-premises and cloud apps. D is wrong because Azure AD Application Proxy is for publishing on-premises apps, not SSO. E is wrong because Microsoft Entra Domain Services manages domain services in the cloud, but is not required for SSO.

Answer

Microsoft Entra Domain Services

Answer

Azure AD Application Proxy

Question 6

Which TWO Azure services can be used to implement a serverless event-driven architecture that processes messages from a queue and stores results in a database? (Choose two.)

Accepted Answer

Azure Logic Apps. A and D are correct. Azure Functions can process messages from Azure Queue Storage; Azure Logic Apps can also process messages from queues and orchestrate workflows. B is wrong because Azure Event Grid is for event routing, not queue processing. C is wrong because Azure Batch is for parallel compute jobs. E is wrong because Azure Service Bus is a messaging service, not a compute trigger in serverless context.

Answer

Azure Event Grid

Answer

Azure Service Bus

Answer

Azure Batch

Question 7

You are designing a solution to securely store secrets, keys, and certificates for a cloud application. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service for securely storing and managing secrets, keys, and certificates. Option A (Azure App Configuration) is wrong because it is optimized for application configuration, not secrets. Option B (Azure Managed HSM) is a hardware security module but is more specialized and not the standard recommendation for general secret storage. Option D (Azure Storage) is incorrect as it lacks native secret management capabilities.

Answer

Azure App Configuration

Answer

Azure Managed HSM

Answer

Azure Storage

Question 8

Your company has a global application deployed across multiple Azure regions. You need to design a disaster recovery solution that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The solution should use Azure-native services and minimize costs. Which option should you choose?

Accepted Answer

Azure Site Recovery with 15-minute replication. Azure Site Recovery with replication frequency of 15 minutes meets the RPO, and the orchestrated failover meets the RTO. Option A (Active geo-replication for Azure SQL Database) is not applicable to all workloads. Option B (Azure Backup) has a longer RTO. Option D (Traffic Manager with health probes) is for load balancing, not disaster recovery.

Answer

Azure Traffic Manager with priority routing

Answer

Active geo-replication for Azure SQL Database

Answer

Azure Backup with cross-region restore

Question 9

You are designing a network architecture for a three-tier application hosted in Azure. The front-end tier must be accessible from the internet, the business tier must only communicate with the front-end tier, and the data tier must only communicate with the business tier. You need to minimize exposure and use Azure-native services. Which combination of services should you use?

Accepted Answer

Azure Application Gateway with WAF for front-end, NSGs on subnets, and service endpoints. Azure Application Gateway with WAF provides internet-facing front-end with web firewall. Network Security Groups (NSGs) on subnets restrict traffic between tiers. Option A (Azure Load Balancer) lacks WAF. Option C (Azure Firewall) is overkill for simple tier isolation. Option D (VPN Gateway) is for on-premises connectivity, not internal isolation.

Answer

Azure Load Balancer for front-end, NSGs on subnets, and VNet peering

Answer

VPN Gateway for front-end, NSGs on subnets, and private endpoints

Answer

Azure Firewall for all inbound traffic, NSGs on subnets, and VNet peering

Question 10

Your company is migrating on-premises virtual machines to Azure. You need to assess the current environment and get a cost estimate for Azure. Which tool should you use?

Accepted Answer

Azure Migrate. Azure Migrate provides assessment and migration capabilities for on-premises workloads to Azure. Option A (Azure Advisor) gives optimization recommendations after deployment. Option B (Azure Cost Management) is for cost analysis after migration. Option D (Azure Monitor) is for monitoring, not assessment.

Answer

Azure Cost Management

Answer

Azure Monitor

Answer

Azure Advisor

Question 11

You are designing a solution to provide high availability for a critical application running on Azure Virtual Machines. The virtual machines must be placed on physically separate hardware and have guaranteed availability during Azure maintenance events. Which option meets these requirements?

Accepted Answer

Deploy VMs in different Availability Zones. Availability Zones provide physically separate locations within an Azure region, protecting against datacenter failures. Option A (Availability Set) spreads VMs across fault domains but not across separate physical facilities. Option C (Scale Set) is for auto-scaling, not high availability. Option D (Proximity Placement Group) is for low latency, not HA.

Answer

Deploy VMs in an Availability Set

Answer

Deploy VMs in a Proximity Placement Group

Answer

Deploy VMs in a Virtual Machine Scale Set

Question 12

Your organization has a hybrid identity solution using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to use their on-premises credentials to authenticate to cloud applications, but you want to avoid synchronizing password hashes to the cloud. Which authentication method should you choose?

Accepted Answer

Pass-through Authentication. Pass-through Authentication allows users to sign in using their on-premises password without synchronizing password hashes to Microsoft Entra ID. Option A (Password Hash Synchronization) requires hash sync. Option B (Federation with AD FS) requires federation infrastructure. Option D (Seamless Single Sign-On) is a feature that works with other methods.

Answer

Seamless Single Sign-On

Answer

Active Directory Federation Services (AD FS)

Answer

Password Hash Synchronization

Question 13

You need to design a storage solution for unstructured data that requires low latency (single-digit milliseconds) for frequently accessed files and must support NFS and SMB protocols. Which Azure storage solution should you recommend?

Accepted Answer

Azure NetApp Files. Azure NetApp Files provides high-performance file storage with NFS and SMB support in a fully managed service. Option A (Azure Blob Storage) is object storage, not file shares. Option B (Azure Files) supports SMB but not NFS and may have higher latency. Option D (Azure Disk Storage) is block storage for VMs.

Answer

Azure Files

Answer

Azure Blob Storage

Answer

Azure Disk Storage

Question 14

Your company is deploying a web application that experiences unpredictable traffic spikes. You need to ensure the application can handle sudden increases in load automatically without manual intervention and minimize costs during low traffic periods. Which Azure service should you use?

Accepted Answer

Virtual Machine Scale Set with autoscale. Virtual Machine Scale Sets with autoscale rules can automatically adjust the number of VM instances based on demand. Option A (Azure App Service with manual scaling) does not autoscale automatically. Option B (Azure Functions) is for event-driven workloads, not web apps. Option D (Azure Container Instances) does not autoscale natively.

Answer

Azure App Service with manual scale-out

Answer

Azure Functions with consumption plan

Answer

Azure Container Instances

Question 15

You are designing a governance strategy for multiple Azure subscriptions. You need to ensure that all resources in a specific subscription are deployed only in the West US region. Additionally, any new resource group must contain a tag named 'Environment' with a value of 'Production'. What combination of Azure Policy initiatives should you assign?

Accepted Answer

Assign the 'Allowed Locations' policy and the 'Require a tag on resource groups' policy to the subscription. You need two policy definitions: one to restrict allowed locations and one to require a tag on resource groups. Assigning both policies to the subscription meets the requirements. Option A (single policy with both effects) is not possible. Option B requires resource groups to inherit tag, not enforce. Option D (management group assignment) is not specific to the subscription.

Answer

Assign the 'Allowed Locations' policy to the management group and the 'Require a tag on resource groups' policy to the subscription

Answer

Assign the 'Allowed Locations' policy to the subscription and the 'Inherit a tag from the resource group' policy to the management group

Answer

Assign a single Azure Policy definition that includes both the allowed location and require tag effects