AZ-305 Design infrastructure solutions Practice Test 11 — 15 Questions

Question 1

A company is designing a backup strategy for Azure resources. They have the following resources: Azure VMs, Azure SQL Database, and Azure Files shares. They need to meet the following requirements: 1) Backup of VMs must be application-consistent. 2) SQL Database backups must be retained for 10 years. 3) Azure Files backups must support soft delete. Which THREE services or features should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Backup. Azure Backup is the correct service for VM backups because it supports application-consistent backups for Windows VMs via Volume Shadow Copy Service (VSS) and for Linux VMs via file-system-consistent snapshots with pre/post-scripts, ensuring that applications are in a consistent state at the time of backup. This directly meets requirement 1.

Answer

Azure Site Recovery

Answer

Azure Policy

Question 2

A company is planning to migrate on-premises SQL Server databases to Azure. They want to minimize administrative overhead and ensure high availability with automatic failover. Which TWO Azure SQL deployment options should they consider?

Accepted Answer

Azure SQL Database (single database). Azure SQL Database (single database) is correct because it is a fully managed PaaS offering where Microsoft handles patching, backups, and infrastructure, and it supports built-in high availability with automatic failover via the underlying service tier architecture. Azure SQL Database Managed Instance is also correct because it provides near-100% SQL Server compatibility as a PaaS service, reducing administrative overhead while including built-in high availability and automatic failover through Always On availability groups managed by the platform. SQL Server on Azure VMs is not appropriate here because it is IaaS, requiring the customer to manage OS patching, SQL updates, and configure their own Always On availability groups for failover. SQL Server Stretch Database is a deprecated feature for archiving cold data to Azure, not a migration target for high availability. Azure Synapse Analytics is an analytics/data warehousing service, not a transactional SQL Server database migration option.

Answer

SQL Server on Azure VMs

Answer

SQL Server Stretch Database

Answer

Azure Synapse Analytics

Question 3

A company is designing a hybrid network solution connecting an on-premises data center to Azure. They require high availability with active-active routing and need to support up to 10 Gbps throughput. Which Azure service should they include in the design?

Accepted Answer

ExpressRoute Direct. ExpressRoute Direct provides dedicated, private connections from on-premises to Azure, supporting bandwidths up to 100 Gbps (10 Gbps easily). It enables active-active routing by using two circuits with BGP, meeting high availability and throughput requirements. ExpressRoute FastPath is a performance feature that reduces latency but is not a standalone service and does not itself provide active-active routing or guaranteed throughput; it requires an ExpressRoute circuit and does not replace the need for Direct when dedicated throughput is required.

Answer

Site-to-Site VPN Gateway

Answer

Azure Virtual WAN

Answer

ExpressRoute FastPath

Question 4

A multinational corporation needs to design a global DNS solution for Azure resources. They require automatic failover across Azure regions and low-latency responses based on the client's geographic location. The solution must also support custom domains without exposing the underlying Azure public IP addresses. Which combination of Azure services should they use?

Accepted Answer

Azure Traffic Manager with geographic routing and Azure Front Door. Azure Front Door provides global load balancing with automatic failover across regions and low-latency routing based on the client's geographic location via its anycast protocol. Azure Traffic Manager with geographic routing complements this by directing traffic to specific regional endpoints based on the client's origin, and together they support custom domains while hiding the underlying Azure public IP addresses through Front Door's frontend endpoint.

Answer

Azure Application Gateway with Azure Front Door

Answer

Azure DNS with Azure Traffic Manager

Answer

Azure Traffic Manager with priority routing and Azure Application Gateway

Question 5

A company is designing a disaster recovery solution for Azure VMs running a critical application. They need a Recovery Time Objective (RTO) of less than 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The solution should be cost-effective and allow testing without affecting production. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct choice because it provides orchestrated replication and failover for Azure VMs, supporting RPOs as low as 15 minutes (with continuous replication) and RTOs under 1 hour. It also enables non-disruptive test failovers in isolated networks, meeting the requirement for testing without affecting production. ASR is cost-effective for critical workloads as it only charges for replication storage and compute during failover, unlike always-on redundancy solutions.

Answer

Azure Migrate

Answer

Azure Backup

Answer

Azure Front Door

Question 6

An organization is designing a storage solution for Azure VMs running a database that requires low latency and high IOPS. The data is critical and must be durable with automatic replication across multiple datacenters in the same region. Which Azure managed disk type and redundancy option should they choose?

Accepted Answer

Premium SSD with ZRS. Premium SSD with ZRS is correct because the database requires low latency and high IOPS, which Premium SSD provides, and ZRS (Zone-Redundant Storage) automatically replicates data synchronously across three Azure availability zones within the same region, ensuring durability and high availability without the cross-region latency of GRS.

Answer

Standard SSD with GRS

Answer

Ultra Disk with LRS

Answer

Premium SSD v2 with LRS

Question 7

A company needs to provide secure access to Azure resources for remote employees. They want to enforce multi-factor authentication and conditional access policies. The solution should not require a VPN connection. Which Azure service should they implement?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure Active Directory) provides identity and access management services that include multi-factor authentication (MFA) and conditional access policies. These capabilities allow you to enforce security requirements like MFA and device compliance before granting access to Azure resources, all without requiring a VPN connection. Entra ID acts as the identity provider and policy engine, making it the correct choice for this scenario.

Answer

Microsoft Intune

Answer

Azure VPN Gateway

Answer

Azure Bastion

Question 8

A company is designing an Azure Kubernetes Service (AKS) cluster for a microservices application. They need to ensure that pods can securely access Azure resources such as Azure Key Vault and Azure SQL Database without using service principals or connection strings. Which AKS feature should they enable?

Accepted Answer

Microsoft Entra Workload ID. Microsoft Entra Workload ID (formerly Azure AD Workload Identity) enables pods in AKS to authenticate to Azure resources like Key Vault and Azure SQL Database using federated identity credentials, eliminating the need for service principals or connection strings. It works by projecting an Entra ID-managed identity into the pod via a sidecar or mutating webhook, allowing the pod to obtain tokens directly from the Microsoft identity platform.

Answer

Azure RBAC for Kubernetes authorization

Answer

Azure Policy for AKS

Answer

Azure CNI network plugin

Question 9

A company is deploying a web application that must scale out automatically based on CPU usage. The application runs on Azure App Service. Which Azure feature should they configure?

Accepted Answer

Autoscale rules. Autoscale rules in Azure App Service allow the application to automatically increase or decrease the number of instances based on CPU usage metrics. This is the correct feature for scaling out a web application horizontally in response to load, as it directly adjusts the instance count of the App Service Plan.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 10

Which TWO Azure services can be used to provide a fully managed DNS solution that supports custom domains and DNSSEC?

Accepted Answer

Azure DNS. Azure DNS is a fully managed DNS hosting service that provides name resolution using Microsoft Azure infrastructure and supports custom domains via DNS zone delegation. Azure DNS DNSSEC support is currently limited (preview/not generally available for all scenarios). However, the stem asks for TWO services, and only Azure DNS among the listed options is a full DNS hosting solution. Azure Front Door and Traffic Manager provide DNS-based traffic routing but are not DNS hosting services and do not support DNSSEC zone management. Azure App Service and Azure Public IP addresses do not provide DNS hosting. Because only one option satisfies the criteria, the question as written is invalid and should be reworded to ask for a single service.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure App Service

Answer

Azure Public IP address

Question 11

Which THREE considerations are important when designing a highly available Azure SQL Database solution?

Accepted Answer

Auto-failover groups. Auto-failover groups (A) are correct because they enable automatic, policy-driven failover of one or more databases to a secondary region, providing a readable/writable listener endpoint and reducing RTO/RPO for a highly available Azure SQL Database solution. Active geo-replication (C) is correct because it lets you create up to four readable secondaries in different regions and manually fail over, which is a core mechanism for cross-region high availability and disaster recovery. Zone redundancy (D) is correct because it distributes the database across availability zones within a region, protecting against datacenter-level failures and improving local availability with an SLA up to 99.995%. Transparent Data Encryption (B) is not a high-availability consideration; it is a data-at-rest encryption feature that protects confidentiality but does not affect failover or uptime. Read scale-out (E) is a performance/read-offload capability using read-only replicas, not a high-availability design consideration, since it does not provide failover or redundancy.

Answer

Transparent Data Encryption

Answer

Read scale-out

Question 12

Which TWO Azure networking services provide DDoS protection at the application layer (Layer 7)?

Accepted Answer

Azure Front Door Premium with WAF. Azure Front Door Premium includes a web application firewall (WAF) that operates at Layer 7, inspecting HTTP/HTTPS traffic for application-layer attacks such as SQL injection and cross-site scripting. This integration provides both global load balancing and application-layer DDoS protection, making it a correct answer for Layer 7 DDoS defense.

Answer

Azure Firewall

Answer

Azure DDoS Protection Standard

Answer

Azure Bastion

Question 13

Your organization has a large number of virtual machines running in Azure. You need to centrally manage backup policies, monitor backup jobs, and ensure compliance with retention requirements. Which Azure service should you use?

Accepted Answer

Azure Backup Center. Azure Backup Center provides a single, unified management experience for backup estates, enabling centralized policy management, monitoring of backup jobs and alerts, and compliance reporting across multiple vaults and subscriptions. It is specifically designed to address the need for a central console to govern backup operations at scale, unlike other services that focus on policy enforcement, disaster recovery, or general monitoring.

Answer

Azure Policy

Answer

Azure Site Recovery

Answer

Azure Monitor

Question 14

You are designing a storage solution for a healthcare application that stores patient records. The solution must meet the following requirements: - Support for both structured and unstructured data. - Provide low-latency access to frequently accessed data. - Automatically move cold data to a lower-cost tier. - Encrypt data at rest using customer-managed keys. Which combination of Azure services should you recommend?

Accepted Answer

Azure Blob Storage for unstructured data and Azure Cosmos DB for structured data. Azure Cosmos DB provides low-latency access to structured data with multi-region writes and automatic indexing, while Azure Blob Storage handles unstructured data like medical images. Both services support encryption at rest with customer-managed keys via Azure Key Vault, and Blob Storage offers lifecycle management policies to automatically move cold data to lower-cost tiers like Cool or Archive.

Answer

Azure Table Storage for structured data and Azure Blob Storage for unstructured data

Answer

Azure Files for unstructured data and Azure SQL Database for structured data

Answer

Azure Blob Storage for unstructured data and Azure SQL Database for structured data

Question 15

Your company has a hybrid identity environment with Microsoft Entra ID and an on-premises Active Directory. You need to enable single sign-on (SSO) for users accessing Microsoft 365 applications from domain-joined devices. Which authentication method should you configure?

Accepted Answer

Microsoft Entra Seamless SSO. Microsoft Entra Seamless SSO (C) is the correct choice because it automatically signs users in when they are on domain-joined devices connected to the corporate network, without requiring any additional prompts. It integrates with password hash synchronization or pass-through authentication to provide a true single sign-on experience for Microsoft 365 applications, leveraging Kerberos delegation to validate the user's identity against on-premises Active Directory.

Answer

Microsoft Entra Pass-through Authentication

Answer

Microsoft Entra password hash synchronization

Answer

Active Directory Federation Services (AD FS)