AZ-305 Design infrastructure solutions Practice Test 12 — 15 Questions

Question 1

Which TWO of the following are valid design considerations for implementing Azure SQL Database geo-replication? (Choose two.)

Accepted Answer

Geo-replication supports up to four readable secondary replicas. Geo-replication creates readable secondaries in a paired region for disaster recovery. Option B (automatically failover without data loss) is incorrect because geo-replication is asynchronous, so there may be data loss. Option D (supports up to 4 readable secondaries) is correct. Option E (can be used for read-only query offloading) is correct. Option A is incorrect because failover is manual or you can use auto-failover groups. Option C is incorrect because geo-replication does not require a listener; connection strings point to the server name.

Answer

Geo-replication ensures zero data loss during failover

Answer

Geo-replication provides automatic failover without manual intervention

Answer

Geo-replication requires a listener for client connections

Question 2

Which THREE of the following are valid methods to secure access to Azure Storage accounts? (Choose three.)

Accepted Answer

Generate Shared Access Signatures (SAS) with limited permissions and expiry. Options A, B, and D are valid security methods. Option A (Azure AD RBAC) allows fine-grained access control. Option B (Shared Access Signatures) provide delegated access. Option D (Firewall and virtual network service endpoints) restrict network access. Option C is incorrect because access keys provide full access and are not a security best practice. Option E is incorrect; Azure Front Door does not provide storage access control.

Answer

Enable Azure Front Door to authenticate requests

Answer

Use storage account access keys for authentication

Question 3

Which TWO of the following are benefits of using Azure Policy? (Choose two.)

Accepted Answer

Assess compliance of resources against defined policies. Azure Policy enforces organizational standards and assesses compliance. Option A (enforce tags) is a common use. Option D (assess compliance) is a core feature. Option B is wrong because Azure Policy does not auto-remediate; it can trigger remediation tasks but not automatically fix all issues. Option C is wrong because Azure Policy does not create resources. Option E is wrong because RBAC is separate.

Answer

Manage access control for resources

Answer

Create new Azure resources based on a template

Answer

Automatically remediate non-compliant resources without manual intervention

Question 4

Refer to the exhibit. You are reviewing an ARM template that deploys a virtual network with two subnets. Subnet-b includes a delegation to Microsoft.Web/serverFarms. What is the purpose of this delegation?

Accepted Answer

It enables Azure App Service instances to be deployed into subnet-b. Delegation to Microsoft.Web/serverFarms indicates that the subnet is intended for use by Azure App Service (App Service Plan). Option A is incorrect because the delegation does not define address space. Option C is incorrect because firewall policies are not configured via delegation. Option D is incorrect because VNet peering is unrelated.

Answer

It allows subnet-b to use a different address space

Answer

It configures a firewall policy for subnet-b

Answer

It creates a peering connection to another virtual network

Question 5

Refer to the exhibit. You are reviewing the properties of an Azure Storage account. The encryption section shows keySource as Microsoft.Keyvault and infrastructureEncryption enabled. What does infrastructureEncryption mean in this context?

Accepted Answer

It enables double encryption of data at rest. Infrastructure encryption provides an additional layer of encryption at the infrastructure level, encrypting data twice. Option A is incorrect because it does not refer to the key vault itself. Option C is incorrect because TLS is separate. Option D is incorrect because it is not about automatically rotating keys.

Answer

It enforces HTTPS for all data in transit

Answer

It automatically rotates the encryption key daily

Answer

It encrypts the encryption key stored in Key Vault

Question 6

Refer to the exhibit. You have an Azure Storage account with the settings shown. A developer reports that they cannot access the storage account from their Azure VM that is connected to subnet-a. The VM's subnet ID matches the one in the rule. What is the most likely cause of the issue?

Accepted Answer

The subnet does not have a service endpoint for Microsoft.Storage enabled. The network rule set has defaultAction set to Deny, and only virtual network rules are configured. For traffic from a VM in subnet-a to be allowed, the VM's subnet must be listed. However, the VM might not have a service endpoint enabled for Microsoft.Storage on that subnet. Option A is wrong because the subnet is listed. Option C is wrong because HTTPS is enabled. Option D is wrong because GRS does not prevent access.

Answer

The storage account requires HTTPS and the VM is using HTTP

Answer

The storage account does not have a firewall rule for the VM's public IP

Answer

The storage account uses GRS replication which is not supported with network rules

Question 7

Your organization has a hybrid identity infrastructure with Microsoft Entra ID Connect Sync. You plan to enable Microsoft Entra ID Seamless Single Sign-On (Seamless SSO) for domain-joined Windows devices. What is the minimum requirement for the on-premises Active Directory forest functional level?

Accepted Answer

Windows Server 2008. Option B is correct because Microsoft Entra ID Seamless SSO requires the on-premises AD forest functional level to be Windows Server 2008 or higher. Option A is incorrect because Windows Server 2003 is too old. Option C (Windows Server 2012) and Option D (Windows Server 2016) are higher than necessary but would also work, but the question asks for the minimum.

Answer

Windows Server 2016

Answer

Windows Server 2012

Answer

Windows Server 2003

Question 8

You are designing a disaster recovery strategy for an Azure virtual machine running a SQL Server Always On availability group. The primary region is East US, and the secondary region is West US. You need to ensure minimal data loss and automatic failover. Which Azure service should you use for cross-region replication of the managed disks?

Accepted Answer

Azure Site Recovery. Option A is correct because Azure Site Recovery provides orchestrated replication and failover for Azure VMs, including managed disks, with recovery point objectives (RPO) as low as a few seconds. Option B (Azure Backup) is for backup, not replication. Option C (Azure Storage Geo-Redundant Storage) replicates at the storage level but does not handle VM failover orchestration. Option D (Azure Traffic Manager) is for DNS-level traffic distribution, not disk replication.

Answer

Azure Traffic Manager

Answer

Azure Backup

Answer

Azure Storage Geo-Redundant Storage (GRS)

Question 9

Your company deploys a line-of-business application on Azure App Service. The application requires custom domain names and SSL/TLS certificates. You need to ensure that the application can be accessed via a custom domain with HTTPS. What should you configure in the App Service?

Accepted Answer

Add the custom domain and bind the SSL/TLS certificate.. Option C is correct because to use a custom domain with HTTPS, you need to add the custom domain in the App Service's custom domains blade and upload or bind an SSL/TLS certificate. Option A is incorrect because scaling out does not affect custom domains. Option B is incorrect because deployment slots are for staging, not custom domains. Option D is incorrect because IP restrictions are for network security, not domain configuration.

Answer

Configure IP restrictions to allow only the custom domain.

Answer

Create a deployment slot for production traffic.

Answer

Scale out the App Service plan to increase instance count.

Question 10

You are designing a solution to store sensitive documents in Azure Blob Storage. The data must be encrypted at rest and access must be audited. You need to ensure that the encryption keys are managed by your organization and that access to the keys is logged. Which combination of Azure services should you use?

Accepted Answer

Azure Storage encryption with customer-managed keys in Azure Key Vault and Azure Monitor. Option B is correct because using customer-managed keys (CMK) with Azure Key Vault allows you to control encryption keys and enable logging for key access. Azure Storage encryption with CMK requires Key Vault for key storage. Option A uses Microsoft-managed keys, which do not provide key control. Option C uses Azure Information Protection, which is for classification, not storage encryption. Option D uses Azure Disk Encryption, which is for VM disks, not Blob Storage.

Answer

Azure Disk Encryption with Azure Key Vault

Answer

Azure Storage encryption with Microsoft-managed keys and Azure Monitor

Answer

Azure Information Protection and Azure Sentinel

Question 11

You are designing a microservices architecture on Azure Kubernetes Service (AKS). The solution must handle traffic spikes by automatically scaling pods based on CPU utilization. Additionally, you need to minimize cost by scaling down nodes when not in use. Which two features should you implement? (Choose two.)

Accepted Answer

Horizontal Pod Autoscaler (HPA). Options A and D are correct. Horizontal Pod Autoscaler (HPA) scales pods based on CPU/memory metrics, and Cluster Autoscaler scales nodes up/down based on pod scheduling needs. Option B (Vertical Pod Autoscaler) scales pod resources but not nodes. Option C (Azure Load Balancer) distributes traffic but does not autoscale. Option E (Azure Container Instances) is for serverless containers, not integrated with AKS autoscaling.

Answer

Azure Load Balancer

Answer

Vertical Pod Autoscaler (VPA)

Answer

Azure Container Instances (ACI)

Question 12

Your organization uses Microsoft Purview to govern data assets across Azure SQL Database, Azure Data Lake Storage, and on-premises SQL Server. You need to ensure that sensitive data such as credit card numbers are automatically detected and classified. What should you configure in Microsoft Purview?

Accepted Answer

Data classification rules. Option D is correct because Microsoft Purview's data classification system uses built-in and custom classification rules to automatically detect sensitive data like credit card numbers via pattern matching. Option A (Data lineage) tracks data movement, not classification. Option B (Data share) is for sharing data, not classification. Option C (Data catalog) organizes metadata but requires manual or automated classification to detect sensitive data.

Answer

Data share

Answer

Data catalog

Answer

Data lineage mapping

Question 13

You need to design a solution to store log data from multiple Azure services. The data must be retained for 7 years for compliance purposes and should be queryable for analysis. Which Azure service should you use as the primary storage for these logs?

Accepted Answer

Azure Log Analytics workspace. Option B is correct because Azure Log Analytics workspaces (part of Azure Monitor) can ingest logs from multiple services, retain data for up to 7 years (with extended retention), and support KQL queries. Option A (Azure Blob Storage) can store logs but is not optimized for interactive querying. Option C (Azure Data Lake Storage) is for big data analytics, not primarily for logs. Option D (Azure SQL Database) is not designed for high-volume log ingestion and may be costly.

Answer

Azure Data Lake Storage

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 14

You are designing a network architecture for a multi-tier application. The front-end tier is an Azure Application Gateway that routes traffic to a web app on Azure App Service. The back-end tier is an Azure SQL Database. You need to ensure that all traffic between the Application Gateway and the web app remains within the Azure backbone network, and that the web app can only be accessed through the Application Gateway. What should you configure?

Accepted Answer

Enable Service Endpoints for the web app and configure the Application Gateway with a private IP.. Option C is correct because enabling Service Endpoints for the web app's subnet restricts access to that subnet, and configuring the Application Gateway to use a private IP ensures traffic stays within Azure. App Service can be integrated with a VNet via regional VNet integration, but Service Endpoints are simpler for this scenario. Option A (Azure Firewall) is not needed. Option B (VPN Gateway) is for hybrid connectivity. Option D (Private Link) is more complex and used for PaaS services; Service Endpoints are sufficient.

Answer

Use Azure Private Link for the web app and disable public access.

Answer

Deploy Azure Firewall in front of the Application Gateway.

Answer

Use a site-to-site VPN between the App Service and Application Gateway.

Question 15

Your company plans to migrate on-premises file servers to Azure. The solution must support SMB protocol and integrate with Microsoft Entra ID for authentication. You need to choose a service that provides fully managed file shares accessible from multiple Azure regions. Which Azure service should you use?

Accepted Answer

Azure Files. Option A is correct because Azure Files offers fully managed SMB file shares that can be accessed from multiple regions using Azure File Sync or through public endpoints. It also supports Microsoft Entra ID authentication. Option B (Azure NetApp Files) is for high-performance NFS/SMB but is more expensive. Option C (Azure Blob Storage) does not support SMB natively (only NFS for premium). Option D (Azure Disk Storage) is for VM disks, not file shares.

Answer

Azure Disk Storage

Answer

Azure NetApp Files

Answer

Azure Blob Storage