AZ-305 Design infrastructure solutions Practice Test 12 — 15 Questions

Question 1

Which THREE of the following are best practices for securing an Azure Kubernetes Service (AKS) cluster? (Choose three.)

Accepted Answer

Enable Azure Policy for Kubernetes to enforce security policies.. Correct answers are A, B, and C. Option A is a best practice because Azure Policy for Kubernetes enables enforcing security policies like allowed container registries and host networking restrictions. Option B is a best practice because Azure AD integration provides centralized identity management and access control. Option C is a best practice because managed identities allow pods to securely access Azure resources without managing secrets. Option D is incorrect because allowing all pod-to-pod communication without network policies violates the principle of least privilege and increases the risk of lateral movement. Option E is incorrect because disabling Kubernetes RBAC reduces security granularity; Azure RBAC alone does not provide namespace-level authorization that Kubernetes RBAC offers.

Answer

Allow all pod-to-pod communication within the cluster without network policies.

Answer

Disable Kubernetes RBAC and use only Azure RBAC for simplicity.

Question 2

Which TWO of the following are valid data storage solutions for an Azure-based microservices architecture that requires high throughput and low latency? (Choose two.)

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is a fully managed NoSQL database that provides single-digit millisecond read and write latencies at the 99th percentile, guaranteed by SLAs. It supports multiple APIs (SQL, MongoDB, Cassandra, Gremlin, Table) and can be configured for high throughput with automatic indexing, making it ideal for microservices that require fast, scalable data access.

Answer

Azure Table Storage

Answer

Azure Files

Answer

Azure SQL Database

Question 3

Your company is migrating a legacy on-premises application to Azure. The application requires low-latency access to a shared file system that supports SMB protocol. The solution must be highly available within a single Azure region and must not require the application to be modified. Which Azure service should you recommend?

Accepted Answer

Azure Files (premium tier). Azure Files (premium tier) provides fully managed SMB file shares with low-latency access, high availability within a single Azure region, and supports the SMB protocol natively without requiring any application modifications. This makes it the ideal choice for migrating legacy on-premises applications that rely on SMB-based file sharing.

Answer

Azure Managed Disks (SSD)

Answer

Azure NetApp Files

Answer

Azure Blob Storage

Question 4

A multinational corporation is designing a hub-spoke network topology in Azure to connect multiple on-premises sites and Azure regions. The hub contains Azure Firewall and Azure Bastion. Spokes are in different regions and need to communicate with each other through the hub. The solution must minimize latency and cost. What should you configure?

Accepted Answer

Use VNet peering to hub and UDRs to force traffic through Azure Firewall. VNet peering to the hub combined with user-defined routes (UDRs) that force spoke-to-spoke traffic through Azure Firewall allows traffic inspection while minimizing cost and latency by keeping traffic within Azure's backbone. Option A is incorrect because ExpressRoute Global Reach connects on-premises sites directly, bypassing the hub firewall and not addressing spoke-to-spoke communication. Option B is incorrect because Azure Virtual WAN with secured hub introduces additional complexity and cost, and is not necessary for this scenario. Option D is incorrect because direct VNet peering between spokes bypasses the hub firewall, violating security requirements.

Answer

Connect spokes via ExpressRoute Global Reach

Answer

Deploy Azure Virtual WAN with secured hub

Answer

Create VNet peering between spokes directly

Question 5

You are designing a disaster recovery solution for a critical application running in Azure. The application uses Azure SQL Database. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 30 minutes. Which Azure SQL Database configuration should you recommend?

Accepted Answer

Active geo-replication. Active geo-replication is the correct choice because it provides a continuous, asynchronous replication of data to a secondary database in a different Azure region, enabling an RPO of 5 seconds (typically under 5 seconds) and an RTO of 30 minutes or less by manually initiating a failover. This meets the stringent RPO and RTO requirements for a critical application using Azure SQL Database.

Answer

Point-in-time restore to a different region

Answer

Auto-failover groups

Answer

Azure Backup for SQL Server in Azure VM

Question 6

Your company has a web application deployed on Azure App Service that experiences periodic traffic spikes. You need to ensure the application scales out quickly without manual intervention. The solution must minimize cost during low-traffic periods. What should you configure?

Accepted Answer

Configure Autoscale rules based on CPU or memory metrics. Autoscale rules based on CPU or memory metrics allow the App Service to automatically increase or decrease the number of instances in response to traffic spikes, meeting the requirement for quick scaling without manual intervention. By scaling down during low-traffic periods, it minimizes cost, as you only pay for the instances you use. This is the native Azure App Service scaling feature that directly addresses the need for elastic, cost-effective scaling.

Answer

Enable pre-warming in the App Service plan

Answer

Deploy the app to a Virtual Machine Scale Set

Answer

Manually increase the instance count before expected spikes

Question 7

You are designing a solution to securely store and manage secrets for multiple applications deployed in Azure. The solution must support automated rotation of secrets and provide audit logging. Which Azure service should you use?

Accepted Answer

Azure Key Vault with managed identity and rotation policy. Azure Key Vault with a managed identity and a rotation policy is the correct choice because it provides a centralized, secure store for secrets, supports automated rotation via built-in policies or custom logic, and integrates with Azure Monitor for audit logging. Managed identities eliminate the need for hard-coded credentials, and the rotation policy ensures secrets are automatically updated without manual intervention.

Answer

Microsoft Entra ID application registration

Answer

Azure App Service Key Vault references

Answer

Azure Automation with PowerShell runbooks

Question 8

A healthcare organization needs to store patient health records in Azure. The data must be encrypted at rest and in transit. The organization requires a customer-managed key (CMK) with automatic key rotation every 90 days. The solution must support Azure SQL Database and Azure Blob Storage. Which key management solution should you recommend?

Accepted Answer

Azure Key Vault Managed HSM (Premium tier). Azure Key Vault Managed HSM (Premium tier) is the correct choice because it provides FIPS 140-2 Level 3 validated hardware security modules (HSMs) that support customer-managed keys (CMKs) with automatic key rotation. It integrates directly with Azure SQL Database and Azure Blob Storage for encryption at rest using TDE and client-side encryption, and enforces encryption in transit via TLS. The 90-day automatic rotation policy is configurable via the key rotation policy in Managed HSM, meeting the organization's compliance requirements.

Answer

Azure Storage Service Encryption

Answer

Azure Information Protection

Answer

Azure Key Vault Standard

Question 9

Your company has Azure virtual machines running a critical application. You need to back up these VMs daily and retain backups for 7 years. The solution must be cost-effective and support application-consistent backups. What should you use?

Accepted Answer

Azure Backup. Azure Backup is the correct choice because it provides a native, cost-effective backup solution for Azure VMs that supports application-consistent backups via the Volume Shadow Copy Service (VSS) for Windows and file-system-consistent backups for Linux. It allows you to configure a backup policy with daily backups and a retention duration of up to 99 years, easily meeting the 7-year requirement. Azure Backup also integrates with Azure Recovery Services vault, offering centralized management and long-term retention at a lower cost than other disaster recovery or snapshot-based approaches.

Answer

Azure Files backup

Answer

Azure Site Recovery

Answer

Azure VM snapshots stored in Azure Storage

Question 10

You are designing a solution to monitor a hybrid environment consisting of Azure VMs and on-premises servers. The solution must provide centralized log analytics, security threat detection, and the ability to run custom queries across all logs. Which TWO Azure services should you include? (Choose two.)

Accepted Answer

Azure Log Analytics workspace. A Log Analytics workspace is the central repository in Azure that ingests and stores log data from various sources, including Azure VMs and on-premises servers. It enables you to run custom Kusto Query Language (KQL) queries across all collected logs, which directly satisfies the requirement for centralized log analytics and custom querying.

Answer

Azure Monitor Agent

Answer

Azure Arc

Answer

Azure Update Manager

Question 11

A global e-commerce company is designing a highly available application on Azure. The application uses Azure SQL Database and requires that in the event of a regional outage, failover to a secondary region occurs automatically without manual intervention. The solution must minimize data loss. Which THREE components should be included? (Choose three.)

Accepted Answer

Azure App Service with deployment slots in secondary region. Azure App Service with deployment slots in the secondary region is correct because it enables staging and production slots that can be swapped to redirect traffic to the secondary region during a failover. This supports automated failover by using slot swap operations triggered by Azure Traffic Manager's priority routing, ensuring the application remains available without manual intervention.

Answer

Azure Front Door with health probes

Answer

Azure DNS with alias records

Question 12

You are designing a network architecture for a three-tier application in Azure. The web tier must be accessible from the internet. The application tier must only accept traffic from the web tier. The database tier must only accept traffic from the application tier. Which TWO Azure services should you use to enforce these network rules? (Choose two.)

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are the correct choice because they act as a distributed, stateful firewall that can filter traffic at the subnet or NIC level using source and destination IP addresses, ports, and protocols. By applying NSGs to the subnets hosting the application and database tiers, you can create inbound rules that restrict traffic to only the preceding tier's subnet or IP range, enforcing the required east-west segmentation without introducing additional latency or cost.

Answer

Azure Bastion

Answer

Azure Front Door

Answer

Azure Firewall

Question 13

Refer to the exhibit. The ARM template provisions a VM. The deployment succeeds but the VM fails to start. What is the most likely cause?

Accepted Answer

The VM size Standard_D2s_v3 is not available in the region. The VM size Standard_D2s_v3 may not be available in the specified region or subscription. ARM template deployments can succeed in provisioning the resource definition, but the VM fails to start if the scheduler cannot allocate a host that supports this VM size. This is a common issue when the size is restricted or not available in the region, causing a delayed failure after deployment.

Answer

The admin password is in plaintext and does not meet complexity requirements

Answer

The data disk size 1023 GB exceeds the maximum for StandardSSD_LRS

Answer

The network interface resource ID is incorrectly formatted

Question 14

Refer to the exhibit. A custom role is created. A user assigned this role reports being unable to view the VM's boot diagnostics in the Azure portal. What is the most likely reason?

Accepted Answer

The role lacks permissions to the diagnostics storage account. Boot diagnostics in Azure require access to a storage account where the serial console output and screenshots are stored. Even if the user has Microsoft.Compute/virtualMachines/read permission on the VM, they must also have the appropriate role (e.g., Storage Blob Data Reader) on the diagnostics storage account to read the boot diagnostics data. Without this, the portal will show an error or blank boot diagnostics pane.

Answer

The user does not have permission to start or restart the VM

Answer

The VM is stopped and deallocated

Answer

The role does not include Microsoft.Compute/virtualMachines/read

Question 15

A company is designing a multi-region disaster recovery solution for a mission-critical application hosted on Azure VMs. The application requires synchronous replication of storage and automatic failover with no data loss. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 0. Which Azure service should the company use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) provides orchestrated replication and automatic failover for Azure VMs across regions. While ASR uses asynchronous replication and does not guarantee a strict RPO of 0, it can achieve a very low RPO (seconds to minutes), making it the best choice among the given options to meet the stringent RTO/RPO requirements. Azure Backup is designed for backup, not disaster recovery, and does not provide automatic failover. Azure Availability Zones protect against datacenter failures but not region-level failures. Geo-redundant storage (GRS) uses asynchronous replication and cannot guarantee zero data loss. Therefore, despite not achieving a strict RPO of 0, ASR is the most suitable service for this scenario.

Answer

Azure Availability Zones

Answer

Azure Backup

Answer

Azure Storage with geo-redundant storage (GRS)