AZ-305 Design infrastructure solutions Practice Test 12 — 15 Questions

Question 1

You are designing a containerized microservices application on Azure Kubernetes Service (AKS). The application must scale automatically based on HTTP traffic. You need to minimize cost by scaling down to zero pods when there is no traffic. Which scaling solution should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Kubernetes Event-driven Autoscaler (KEDA). KEDA (Kubernetes Event-driven Autoscaler) is the correct choice because it can scale the number of pods in an AKS deployment down to zero when there is no HTTP traffic, and then scale up from zero when traffic resumes. Unlike the Horizontal Pod Autoscaler (HPA), which cannot scale below 1 replica by default, KEDA works with external event sources (like HTTP requests via an add-on) to achieve true zero-to-N scaling, minimizing cost during idle periods.

Answer

Horizontal Pod Autoscaler (HPA)

Answer

Cluster Autoscaler

Answer

Vertical Pod Autoscaler (VPA)

Question 2

Your company has a large number of IoT devices sending telemetry to Azure IoT Hub. The data must be processed in near real-time to detect anomalies and trigger alerts. Additionally, the processed data must be stored in a time-series database for historical analysis. Which combination of Azure services should you recommend?

Accepted Answer

Azure Stream Analytics and Azure Data Explorer. Azure Stream Analytics provides real-time stream processing to detect anomalies and trigger alerts from IoT Hub telemetry. Azure Data Explorer (ADX) is a fully managed, high-performance time-series database optimized for storing and analyzing large volumes of time-stamped data, making it the ideal choice for historical analysis. Together, they meet both the near real-time processing and time-series storage requirements.

Answer

Azure Functions and Azure SQL Database

Answer

Azure HDInsight and Azure Cosmos DB

Answer

Azure Data Factory and Azure Blob Storage

Question 3

You need to design a solution to store configuration data for a cloud-native application. The configuration must be centrally managed, versioned, and accessible to multiple services without hard-coding values. Which Azure service should you use?

Accepted Answer

Azure App Configuration. Azure App Configuration is the correct choice because it is a fully managed service specifically designed for central management of application configuration and feature flags. It supports versioning of configuration key-values, provides instant access to multiple services via SDKs or REST API, and eliminates the need to hard-code values by allowing dynamic updates without redeployment.

Answer

Azure Cosmos DB

Answer

Azure Blob Storage

Answer

Azure Key Vault

Question 4

You are designing a disaster recovery (DR) solution for a critical application hosted on Azure VMs. The solution must meet the following requirements: - Recovery Point Objective (RPO) of 15 minutes. - Recovery Time Objective (RTO) of 1 hour. - Automatically fail over to a secondary region in the event of a regional outage. - Support for non-disruptive DR testing. Which THREE components should you include in the solution? (Choose three.)

Accepted Answer

Azure Site Recovery test failover capability. Azure Site Recovery's test failover capability allows you to perform non-disruptive DR testing by isolating the test failover in a separate virtual network, ensuring no impact on the production environment. This meets the explicit requirement for non-disruptive DR testing while validating replication and failover processes.

Answer

Azure Backup

Answer

Azure Front Door

Question 5

Your company has a critical application running on Azure Virtual Machines that processes financial transactions. You need to ensure that the application remains available during an Azure region failure. The application is stateless and can scale horizontally. What is the most cost-effective design to meet the availability requirement?

Accepted Answer

Deploy VMs in an availability zone in the primary region and use Azure Site Recovery to replicate to a secondary region.. Deploying VMs across availability zones within a region protects against datacenter-level failures, but for region-level failures, Azure Site Recovery (ASR) provides cost-effective disaster recovery by replicating VMs to a secondary region. Since the application is stateless and horizontally scalable, you can run a minimal footprint in the primary region and use ASR for orchestrated failover, avoiding the cost of always-on active-active infrastructure.

Answer

Deploy VMs in an active-active configuration across two Azure regions using Traffic Manager and Azure Front Door.

Answer

Deploy VMs in an availability set in the primary region and use Azure Site Recovery to failover to a secondary region.

Answer

Deploy VMs in a single region using Virtual Machine Scale Sets with automatic scaling.

Question 6

Your organization is migrating a legacy on-premises application to Azure. The application uses a proprietary authentication protocol that is not supported by Microsoft Entra ID. You need to integrate the application with Microsoft Entra ID without modifying the application code. What should you do?

Accepted Answer

Configure Microsoft Entra ID Application Proxy to provide secure remote access and pass through authentication.. Microsoft Entra ID Application Proxy can be configured to publish on-premises applications that use legacy authentication protocols. It acts as a reverse proxy, terminating the external connection and forwarding requests to the internal application. Because it can be set to pass through authentication without requiring any changes to the application code, it allows the proprietary authentication protocol to continue working while still integrating with Microsoft Entra ID for access control and conditional access policies.

Answer

Use Azure Active Directory B2C with custom policies to translate the authentication protocol.

Answer

Deploy Azure Active Directory Domain Services and domain-join the application servers.

Answer

Implement Azure Active Directory Connect with pass-through authentication.

Question 7

You need to design a networking solution for a multi-tier application that includes a web front-end, an API layer, and a database. The web and API tiers must be accessible from the internet, while the database tier must be isolated. What is the most secure and efficient design?

Accepted Answer

Deploy all tiers in the same VNet with separate subnets, and use NSGs to restrict traffic. Place an Azure Application Gateway with WAF in front of the web tier.. It uses a single VNet with separate subnets for each tier, allowing Network Security Groups (NSGs) to enforce micro-segmentation and restrict traffic between tiers. The Azure Application Gateway with Web Application Firewall (WAF) provides Layer 7 protection and SSL termination for internet-facing web traffic, while the database tier remains isolated with no public endpoint. This design minimizes latency by keeping all tiers within the same VNet and avoids the complexity of VNet peering or unnecessary firewall inspection.

Answer

Place all VMs in the same subnet and use a single Azure Load Balancer to distribute traffic.

Answer

Use separate VNets for each tier and connect them with VNet peering.

Answer

Deploy all VMs in a single subnet and use Azure Firewall to inspect all inbound and outbound traffic.

Question 8

You are designing a backup and disaster recovery strategy for an Azure SQL Database instance that runs a critical business application. The database is 500 GB and experiences high transaction rates. The recovery point objective (RPO) is 1 minute and recovery time objective (RTO) is 1 hour. What should you recommend?

Accepted Answer

Configure active geo-replication to a secondary region in the same Azure geography.. Active geo-replication for Azure SQL Database provides a continuously synchronized readable secondary replica in a different Azure region, enabling failover with an RPO of 1 minute (due to synchronous replication) and an RTO of 1 hour (since failover is manual or can be automated). This meets the critical business application's requirements for high transaction rates and low data loss.

Answer

Enable geo-redundant backup storage and use geo-restore in the secondary region.

Answer

Configure automated backups with locally-redundant storage (LRS) and enable point-in-time restore.

Answer

Export the database to a bacpac file daily and store it in Azure Blob Storage.

Question 9

Your organization has a hybrid identity environment with Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to access cloud applications using their on-premises credentials, and also enables single sign-on (SSO) for legacy on-premises applications that do not support modern authentication protocols. What should you recommend?

Accepted Answer

Implement Azure AD Connect with password hash synchronization and Azure AD Application Proxy.. Microsoft Entra Connect with password hash synchronization enables users to authenticate to cloud applications using their on-premises credentials, while Microsoft Entra application proxy provides secure remote access and SSO for legacy on-premises applications that do not support modern authentication protocols (such as Kerberos, SAML, or OAuth). The Application Proxy can pass Kerberos constrained delegation tickets to legacy apps, enabling SSO without requiring those apps to be domain-joined or modified.

Answer

Deploy Azure Active Directory Domain Services and domain-join the legacy application servers.

Answer

Use Azure Active Directory B2B collaboration for internal users.

Answer

Configure Azure AD Seamless SSO and use Azure AD Connect with pass-through authentication.

Question 10

You need to design a monitoring solution for a set of Azure virtual machines running a business-critical application. The solution must provide centralized log management, enable real-time analysis of security events, and support custom alerts for anomalous behavior. Which Azure service should you use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that provides centralized log management, real-time security event analysis, and built-in support for custom analytics rules to detect anomalous behavior. Unlike Azure Monitor or Log Analytics, Sentinel is specifically designed for security-focused monitoring and can ingest logs from multiple sources, including Azure VMs, and use machine learning to identify threats.

Answer

Azure Log Analytics

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 11

Your company is planning to migrate a large number of on-premises servers to Azure. The migration must be completed within 3 months. You need to assess the current on-premises environment and recommend the most appropriate Azure VM sizes and costs. What should you do?

Accepted Answer

Use Azure Migrate to discover and assess the on-premises environment, and generate sizing and cost recommendations.. Azure Migrate is the correct tool because it provides automated discovery and assessment of on-premises servers, including performance data, dependencies, and configuration details. It then generates right-sized Azure VM recommendations and cost estimates based on actual usage, which is essential for a large-scale migration with a tight 3-month deadline.

Answer

Create a manual inventory of all servers and use Azure Pricing Calculator to estimate costs.

Answer

Use Azure Advisor to analyze on-premises server usage and recommend Azure VM sizes.

Answer

Use Azure Cost Management to estimate costs based on manual input of server specifications.

Question 12

You are an Azure administrator. The above Azure Policy definition is assigned to a subscription. A developer tries to deploy a Virtual Machine with SKU Standard_DS2_v2. What will happen?

Accepted Answer

The deployment is denied and an error message is returned.. The Azure Policy definition assigned to the subscription includes a 'deny' effect for VM SKUs that are not in the allowed list. Since Standard_DS2_v2 is not an allowed SKU, the deployment is denied and an error message is returned to the developer, preventing the VM from being created.

Answer

The deployment succeeds with a warning logged.

Answer

The VM is created but the SKU is changed to a different series.

Answer

The deployment succeeds because the policy only audits.

Question 13

You executed the above Azure CLI commands. The remote VNet (yourVNet) has address space 10.1.0.0/16. What is the result?

Accepted Answer

A VNet with two subnets is created, and a VNet peering is established.. The Azure CLI commands create a VNet named 'myVNet' with two subnets ('subnet1' and 'subnet2') using the 'az network vnet create' command, which supports multiple subnet configurations in a single call. The subsequent 'az network vnet peering create' command establishes a VNet peering from 'myVNet' to the remote VNet 'yourVNet' (address space 10.1.0.0/16). Since both VNets exist and the commands are syntactically correct, the result is a VNet with two subnets and a successful peering.

Answer

The peering command fails because the remote VNet does not exist.

Answer

A VNet with one subnet is created, and no peering is established.

Answer

Only the first subnet is created, and the peering is established.

Question 14

A multinational company plans to deploy a new application on Azure. The application must comply with GDPR and requires data residency in the EU. The solution should minimize latency for users in Europe and provide disaster recovery across regions. Which Azure architecture should the company implement?

Accepted Answer

Deploy the application in two EU regions with Azure Traffic Manager and Azure Cosmos DB multi-region writes.. It meets all requirements: deploying in two EU regions ensures data residency within the EU, Azure Traffic Manager provides low-latency routing for European users via DNS-based traffic distribution, and Azure Cosmos DB multi-region writes enable active-active disaster recovery with automatic failover and no data loss, minimizing latency for writes across regions.

Answer

Deploy the application in two EU regions with Azure Front Door and Azure SQL Database geo-replication.

Answer

Deploy the application in a single Azure region in Ireland with Azure Site Recovery for DR.

Answer

Deploy the application in a single EU region with Azure Site Recovery and Azure Redis Cache.

Question 15

You need to design a virtual network architecture for a three-tier application in Azure. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of Azure services should you use?

Accepted Answer

Use Azure Application Gateway with WAF, network security groups (NSGs) on subnets, and Azure Private Endpoints for the database.. It uses Azure Application Gateway with WAF to provide internet-facing, layer-7 web traffic management and protection, network security groups (NSGs) on subnets to enforce east-west traffic isolation (web-to-app, app-to-database), and Azure Private Endpoints for the database to ensure the database is accessible only via a private IP within the virtual network, eliminating exposure to the internet. This combination meets the three-tier isolation requirements precisely.

Answer

Use Azure Front Door, service endpoints, and Azure SQL Database with firewall rules.

Answer

Use Azure Load Balancer, Azure Firewall, and Azure SQL Database with public endpoint.

Answer

Use a single virtual network with three subnets, no NSGs, and Azure SQL Database with VNet injection.