AZ-305 Design infrastructure solutions Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. You are analyzing Azure VM performance using Azure Monitor Logs. You run the KQL query shown. What is the purpose of the 'take 10' operator?

Accepted Answer

Limits the results to the first 10 rows after sorting by time.. The 'take 10' operator in Kusto Query Language (KQL) returns a specified number of arbitrary rows from the query result set. When used after a sort operator (e.g., 'order by TimeGenerated desc'), it effectively limits the output to the first 10 rows of the sorted data, which in this context are the 10 most recent log entries. This is the standard behavior of 'take' in KQL, as it does not guarantee any specific order unless preceded by a sort.

Answer

Limits the time range to the last 10 hours.

Answer

Filters the results to only include the top 10 CPUs.

Answer

Samples the data to reduce query cost.

Question 2

Your company is migrating a legacy application to Azure. The application uses a proprietary database that requires file-level access to data files. You need to minimize changes to the application. Which Azure storage solution should you recommend?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB and NFS file shares that offer file-level access over the network, which is exactly what a legacy application requiring file-level access to data files needs. By mapping a drive to an Azure file share, the application can continue using standard file I/O APIs with minimal or no code changes, making it the correct choice for this migration scenario.

Answer

Azure Disk Storage

Answer

Azure Blob Storage

Answer

Azure NetApp Files

Question 3

A company is designing a solution for a global e-commerce platform that requires low-latency access to product catalog data from multiple regions. The data is read-heavy with occasional updates. The solution must support automatic scaling and provide high availability. Which Azure service should you recommend?

Accepted Answer

Azure Cosmos DB with multi-region writes. Azure Cosmos DB with multi-region writes is the correct choice because it provides global distribution with turnkey multi-master replication, enabling low-latency reads and writes from any Azure region. It supports automatic scaling through request units (RU/s) and offers 99.999% high availability with multiple well-defined consistency levels, making it ideal for a read-heavy, globally distributed e-commerce catalog with occasional updates.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Table Storage

Answer

Azure Cache for Redis

Question 4

Your organization needs to provide temporary, limited-privilege access to Azure resources for external auditors. The access must be time-bound and require approval from a manager. Which Azure feature should you use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing time-bound activation of roles with approval workflows. This directly meets the requirement for temporary, limited-privilege access that requires manager approval, making it the correct choice for external auditor scenarios.

Answer

Managed identities

Answer

Conditional Access policies

Answer

Azure RBAC roles

Question 5

A company is designing a data warehouse solution in Azure. The solution must support petabyte-scale data, high-performance queries, and integration with Power BI. The data includes both structured and semi-structured data. Which THREE services should you recommend?

Accepted Answer

Power BI. (Power BI) is correct because Power BI integrates with Azure Synapse Analytics for reporting. Option B (Azure Analysis Services) is incorrect because it is for semantic models, not data warehousing. Option C (Azure Data Lake Storage) is correct because it can store structured and semi-structured data at petabyte scale. Option D (Azure Synapse Analytics) is correct because it provides petabyte-scale data warehousing with high-performance queries. Option E (Azure HDInsight) is incorrect because it is for big data processing, not data warehousing.

Answer

Azure Analysis Services

Answer

Azure HDInsight

Question 6

Your company is deploying a critical application on Azure VMs. The application requires a static private IP address that does not change even if the VM is stopped and deallocated. The VM must be placed in an availability zone for high availability. Which networking approach should you use?

Accepted Answer

Assign a static private IP address to the VM's NIC and use a standard public load balancer.. A static private IP address assigned to the VM's NIC persists even when the VM is stopped and deallocated, ensuring the application always uses the same private IP. Placing the VM in an availability zone provides high availability by protecting against zonal failures, and a standard public load balancer can distribute traffic across VMs in different zones while preserving the static private IP for each VM.

Answer

Use Azure Firewall to provide static private IP and load balancing.

Answer

Use Azure Traffic Manager to assign static private IP.

Answer

Use Application Gateway with a static private IP.

Question 7

Your organization is building a serverless application that processes events from Azure Event Hubs and stores results in Azure Cosmos DB. The processing logic must be scalable and cost-effective, with no idle costs. Which compute service should you use?

Accepted Answer

Azure Functions. Azure Functions is the correct choice because it provides a serverless, event-driven compute service that can be triggered directly by Azure Event Hubs. It scales automatically based on the number of events, and you only pay for execution time, resulting in zero idle costs. This makes it ideal for processing streaming events in a cost-effective, scalable manner without managing infrastructure.

Answer

Azure Container Instances

Answer

Azure Logic Apps

Answer

Azure Kubernetes Service

Question 8

You are designing a landing zone in Azure for a regulated financial services company. They require that all storage accounts be restricted to specific virtual networks and have encryption using customer-managed keys (CMK). Additionally, they want to ensure that any storage account creation outside of the approved network boundaries is prevented. Which combination of Azure Policy and Network Security controls should you recommend?

Accepted Answer

Use Azure Policy to enforce service endpoints on storage accounts and deny creation if not present, along with a policy requiring CMK encryption.. It combines Azure Policy to enforce service endpoints on storage accounts (denying creation if not present) with a policy requiring customer-managed keys (CMK) for encryption. Service endpoints restrict storage account access to specific virtual networks at the network layer, while the CMK policy ensures compliance with encryption requirements. This directly addresses the company's need to prevent storage account creation outside approved network boundaries and enforce encryption.

Answer

Use Azure Policy to require storage account encryption with CMK, and use network security groups (NSGs) to restrict storage account access to specific subnets.

Answer

Deploy Azure Firewall in the hub virtual network and configure application rules to allow only approved storage accounts.

Answer

Use Azure Policy to require storage accounts to use private endpoints, and use Azure Private Link to restrict access from specific virtual networks.

Question 9

A company plans to migrate an on-premises application with strict low-latency requirements to Azure. The application must communicate with an Azure SQL Database. Which of the following is the best design to minimize latency?

Accepted Answer

Deploy the application and Azure SQL Database in the same Azure region, and connect via Azure Private Link.. The best design because deploying both the application and Azure SQL Database in the same Azure region minimizes network distance and latency. Using Azure Private Link creates a private endpoint for the SQL Database within the application's virtual network, eliminating internet routing and reducing latency further by keeping traffic entirely within the Microsoft backbone network.

Answer

Deploy the application in one region and Azure SQL Database in a different region, using Azure Traffic Manager.

Answer

Deploy the application on-premises and use a Point-to-Site VPN to connect to Azure SQL Database.

Answer

Deploy the application on-premises and use ExpressRoute to connect to Azure SQL Database.

Question 10

You are designing a compute solution for a batch processing workload that runs once per day for about 30 minutes. The workload is CPU-intensive and can be parallelized. The team wants to minimize cost while ensuring the job completes within 2 hours. Which of the following is the most cost-effective solution?

Accepted Answer

Use Azure Batch with a pool of low-priority VMs, and scale up to many nodes to complete the job quickly.. The most cost-effective because Azure Batch with low-priority VMs offers significant cost savings (up to 80% compared to dedicated VMs) and can scale out to many nodes to parallelize the CPU-intensive workload, completing it within 30 minutes—well under the 2-hour limit. Low-priority VMs use Azure's surplus capacity, making them ideal for interruptible batch jobs that run briefly once per day.

Answer

Deploy an Azure App Service plan with multiple instances, and trigger the job with a timer.

Answer

Use Azure Functions with a timer trigger and a Premium plan to allow longer execution.

Answer

Create an Azure VM that runs the job on schedule and turn it off after completion.

Question 11

You need to design a storage solution for an application that stores large amounts of unstructured data that is accessed frequently for the first 30 days, then rarely after that. Compliance requirements mandate that data be retained for 7 years. Which of the following is the most cost-effective storage solution?

Accepted Answer

Use Azure Blob Storage with lifecycle management to transition blobs from Hot to Cool to Archive tiers.. Azure Blob Storage lifecycle management allows you to automatically transition blobs from Hot to Cool after 30 days (once the initial frequent access period ends), and then to Archive after an additional period of low access (e.g., another 30 days) to meet the 7-year retention requirement at the lowest cost. The Archive tier provides the cheapest storage for rarely accessed data, while Hot and Cool tiers optimize for the initial high-access period.

Answer

Use Azure Files with snapshots and keep files in the Premium tier for 30 days, then move to Standard tier.

Answer

Use Azure Managed Disks with read-only snapshots and delete snapshots after 7 years.

Answer

Store all data in Blob Storage Hot tier and delete after 7 years.

Question 12

You are designing an authentication solution for a mobile application that uses Azure AD B2C (now Microsoft Entra External ID). The application needs to support social logins (Google, Facebook) and also allow users to sign in with their corporate Microsoft Entra ID accounts. Which of the following identity providers should you configure?

Accepted Answer

Configure Google and Facebook as social identity providers, and add Microsoft Entra ID as a custom identity provider.. Microsoft Entra External ID (Azure AD B2C) supports social identity providers like Google and Facebook natively, and also allows you to add Microsoft Entra ID as a custom (OpenID Connect) identity provider. This enables corporate users to sign in with their existing Entra ID accounts while external users can use social logins, all within a single B2C tenant.

Answer

Use Microsoft Entra ID as the only identity provider and configure federation with Google and Facebook.

Answer

Use Microsoft Entra External ID with Google and Facebook only, and advise corporate users to create local accounts.

Answer

Configure only Google and Facebook as identity providers, and use Microsoft account for corporate users.

Question 13

You are designing a logging and monitoring solution for a multi-region application. The application is deployed in three Azure regions. Security requirements mandate that all authentication and authorization logs be retained for 7 years. Logs must be queryable centrally from a single location. What is the most cost-effective way to meet these requirements?

Accepted Answer

Deploy a Log Analytics workspace per region, set retention to 7 years, and use cross-workspace queries from a central Log Analytics workspace or Azure Sentinel.. Deploying a Log Analytics workspace per region with 7-year retention satisfies the retention requirement, while cross-workspace queries from a central location (e.g., Azure Sentinel or a central Log Analytics workspace) enable centralized querying without moving data. This approach is cost-effective because it avoids cross-region egress costs and the additional costs of streaming logs via Event Hubs.

Answer

Use Azure Storage Analytics logs and store them in a geo-redundant storage account in each region.

Answer

Use Azure Event Hubs to collect logs from all regions and stream them to a Log Analytics workspace in a central region.

Answer

Deploy a single Log Analytics workspace in one region and configure all VMs to send logs to it.

Question 14

You are designing a high-availability solution for a stateless web application running on Azure VMs. The solution must provide automatic failover to another region in the event of a regional outage. Which Azure service should you use to distribute traffic across regions?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it is a global, scalable entry point that uses HTTP/HTTPS traffic to provide cross-region load balancing and automatic failover. It supports path-based routing, SSL offload, and health probes that can detect a regional outage and instantly reroute traffic to a healthy region, meeting the requirement for stateless web applications.

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 15

Which TWO of the following are valid considerations when designing a SQL Server Always On availability group in Azure VMs? (Choose two.)

Accepted Answer

The availability group listener should use a static IP address in the same subnet as the primary replica.. The availability group listener in Azure VMs requires a static IP address in the same subnet as the primary replica. This is necessary because the internal load balancer (ILB) used for the listener must have a static frontend IP that matches the listener's IP, and the IP must reside in the same subnet as the primary replica to ensure proper routing and failover behavior.

Answer

The availability group listener can use DHCP to automatically assign an IP address.

Answer

A file share witness is required for the quorum configuration.

Answer

All replicas must be in the same subnet to use a single internal load balancer.