AZ-305 Design infrastructure solutions Practice Test 14 — 15 Questions

Question 1

A company is designing a data warehouse solution in Azure. The solution must support petabyte-scale data, high-performance queries, and integration with Power BI. The data includes both structured and semi-structured data. Which THREE services should you recommend?

Accepted Answer

Power BI. Option A is correct because Azure Synapse Analytics provides petabyte-scale data warehousing with high-performance queries. Option B is incorrect because Azure HDInsight is for big data processing, not data warehousing. Option C is correct because Azure Data Lake Storage can store structured and semi-structured data at petabyte scale. Option D is incorrect because Azure Analysis Services is for semantic models, not data warehousing. Option E is correct because Power BI integrates with Synapse Analytics for reporting.

Answer

Azure Analysis Services

Answer

Azure HDInsight

Question 2

Your company is deploying a critical application on Azure VMs. The application requires a static private IP address that does not change even if the VM is stopped and deallocated. The VM must be placed in an availability zone for high availability. Which networking approach should you use?

Accepted Answer

Assign a static private IP address to the VM's NIC and use a standard public load balancer.. Option A is correct because a standard public load balancer can be used in front of VMs, and static private IPs can be assigned via NIC-level static IP allocation. Option B is incorrect because Azure Firewall is not for load balancing. Option C is incorrect because Traffic Manager is a DNS-based load balancer for global traffic. Option D is incorrect because Application Gateway is a layer 7 load balancer, but it does not provide static private IP for the VM itself.

Answer

Use Azure Firewall to provide static private IP and load balancing.

Answer

Use Azure Traffic Manager to assign static private IP.

Answer

Use Application Gateway with a static private IP.

Question 3

Your organization is building a serverless application that processes events from Azure Event Hubs and stores results in Azure Cosmos DB. The processing logic must be scalable and cost-effective, with no idle costs. Which compute service should you use?

Accepted Answer

Azure Functions. Option A is correct because Azure Functions can be triggered by Event Hubs and scales automatically, with pay-per-execution pricing. Option B is incorrect because Azure Logic Apps is more expensive and less suitable for high-throughput event processing. Option C is incorrect because Azure Container Instances have idle costs and are not serverless. Option D is incorrect because Azure Kubernetes Service has management overhead and idle costs.

Answer

Azure Container Instances

Answer

Azure Logic Apps

Answer

Azure Kubernetes Service

Question 4

You are designing a disaster recovery solution for an Azure IaaS workload. The application runs on Azure VMs in a single region and requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which of the following is the most cost-effective approach to meet these requirements?

Accepted Answer

Deploy Azure Site Recovery to replicate VMs to the secondary region with a replication policy that meets the RPO and RTO.. Option C is correct because Azure Site Recovery provides replication with RPO as low as 30 seconds to another region, easily meeting 15 minutes, and automated failover within minutes, meeting 4-hour RTO. Option A is wrong because geo-redundant storage applies to storage accounts, not VMs, and doesn't provide automated failover. Option B is wrong because backing up to a secondary region via Azure Backup has an RPO of 1-2 hours and RTO of hours to days. Option D is wrong because Azure Front Door is for web traffic load balancing, not VM failover.

Answer

Configure geo-redundant storage (GRS) for the VM disks and manually attach them to new VMs in the secondary region.

Answer

Use Azure Front Door with a back-end pool containing VMs in both regions, and configure health probes to route traffic on failure.

Answer

Use Azure Backup to back up VMs to a Recovery Services vault in the secondary region and perform restore during failover.

Question 5

You are designing a landing zone in Azure for a regulated financial services company. They require that all storage accounts be restricted to specific virtual networks and have encryption using customer-managed keys (CMK). Additionally, they want to ensure that any storage account creation outside of the approved network boundaries is prevented. Which combination of Azure Policy and Network Security controls should you recommend?

Accepted Answer

Use Azure Policy to enforce service endpoints on storage accounts and deny creation if not present, along with a policy requiring CMK encryption.. Option B is correct because Azure Policy can enforce service endpoints and deny creation if a required tag (like 'network') is not set. Network security groups alone cannot enforce encryption or creation policies. Option A is wrong because NSGs are not used for storage account access control. Option C is wrong because Azure Firewall is for outbound traffic, not storage access. Option D is wrong because Private Endpoint is recommended for private connectivity, but service endpoints can also be used with policies; however, the question requires enforcement of network restrictions and CMK, which Azure Policy does.

Answer

Use Azure Policy to require storage account encryption with CMK, and use network security groups (NSGs) to restrict storage account access to specific subnets.

Answer

Deploy Azure Firewall in the hub virtual network and configure application rules to allow only approved storage accounts.

Answer

Use Azure Policy to require storage accounts to use private endpoints, and use Azure Private Link to restrict access from specific virtual networks.

Question 6

A company plans to migrate an on-premises application with strict low-latency requirements to Azure. The application must communicate with an Azure SQL Database. Which of the following is the best design to minimize latency?

Accepted Answer

Deploy the application and Azure SQL Database in the same Azure region, and connect via Azure Private Link.. Option A is correct because deploying in the same region and using Azure Private Link for a private connection keeps traffic within the Microsoft backbone, minimizing latency. Option B is wrong because ExpressRoute adds extra latency. Option C is wrong because different regions increase latency. Option D is wrong because Point-to-Site VPN is not suitable for production applications and adds latency.

Answer

Deploy the application in one region and Azure SQL Database in a different region, using Azure Traffic Manager.

Answer

Deploy the application on-premises and use a Point-to-Site VPN to connect to Azure SQL Database.

Answer

Deploy the application on-premises and use ExpressRoute to connect to Azure SQL Database.

Question 7

You are designing a compute solution for a batch processing workload that runs once per day for about 30 minutes. The workload is CPU-intensive and can be parallelized. The team wants to minimize cost while ensuring the job completes within 2 hours. Which of the following is the most cost-effective solution?

Accepted Answer

Use Azure Batch with a pool of low-priority VMs, and scale up to many nodes to complete the job quickly.. Option D is correct because Azure Batch with low-priority VMs provides significant cost savings for interruptible workloads and can be scaled to complete quickly. Option A is wrong because App Service is not designed for batch processing and would be more expensive. Option B is wrong because a VM running all the time incurs cost even when idle. Option C is wrong because Functions have a timeout limit (default 5 min, max 10 min) unsuitable for 30-min job.

Answer

Deploy an Azure App Service plan with multiple instances, and trigger the job with a timer.

Answer

Use Azure Functions with a timer trigger and a Premium plan to allow longer execution.

Answer

Create an Azure VM that runs the job on schedule and turn it off after completion.

Question 8

You are designing a connectivity solution for a hybrid network. The company has an on-premises network connected to an Azure virtual network via ExpressRoute. They also have a site-to-site VPN to the same Azure virtual network as a backup. When the ExpressRoute connection fails, traffic should automatically fail over to the VPN. How should you configure the routes to ensure automatic failover?

Accepted Answer

Ensure the ExpressRoute connection has a lower BGP metric than the VPN connection; Azure automatically prefers lower metric.. Option C is correct because ExpressRoute routes have lower metric (higher preference) by default, so they are preferred. When ExpressRoute fails, the VPN routes with higher metric are used. Option A is wrong because BGP metrics are used, not Azure Route Server. Option B is wrong because higher metric for ExpressRoute would make VPN preferred. Option D is wrong because location-based routing is not used for failover.

Answer

Configure Azure Traffic Manager with a priority routing method to direct traffic to ExpressRoute first.

Answer

Set the BGP metrics (local preference) on the ExpressRoute connection to be higher than the VPN connection.

Answer

Configure Azure Route Server to propagate routes with a lower metric for the VPN connection.

Question 9

You need to design a storage solution for an application that stores large amounts of unstructured data that is accessed frequently for the first 30 days, then rarely after that. Compliance requirements mandate that data be retained for 7 years. Which of the following is the most cost-effective storage solution?

Accepted Answer

Use Azure Blob Storage with lifecycle management to transition blobs from Hot to Cool to Archive tiers.. Option B is correct because Azure Blob Storage with lifecycle management can automatically move blobs from Hot to Cool to Archive tiers as access patterns change, minimizing cost. Option A is wrong because Azure Files is for file shares, not optimal for large unstructured data. Option C is wrong because keeping all data in Hot tier is expensive. Option D is wrong because managed disks are for VM disks, not for general unstructured data storage.

Answer

Use Azure Files with snapshots and keep files in the Premium tier for 30 days, then move to Standard tier.

Answer

Use Azure Managed Disks with read-only snapshots and delete snapshots after 7 years.

Answer

Store all data in Blob Storage Hot tier and delete after 7 years.

Question 10

You are designing an authentication solution for a mobile application that uses Azure AD B2C (now Microsoft Entra External ID). The application needs to support social logins (Google, Facebook) and also allow users to sign in with their corporate Microsoft Entra ID accounts. Which of the following identity providers should you configure?

Accepted Answer

Configure Google and Facebook as social identity providers, and add Microsoft Entra ID as a custom identity provider.. Option A is correct because Microsoft Entra External ID (formerly Azure AD B2C) supports both social identity providers and Microsoft Entra ID as a custom identity provider. Option B is wrong because Microsoft Entra ID alone does not support social logins. Option C is wrong because Microsoft account is not for corporate accounts. Option D is wrong because it doesn't include corporate identity.

Answer

Use Microsoft Entra ID as the only identity provider and configure federation with Google and Facebook.

Answer

Use Microsoft Entra External ID with Google and Facebook only, and advise corporate users to create local accounts.

Answer

Configure only Google and Facebook as identity providers, and use Microsoft account for corporate users.

Question 11

You are designing a logging and monitoring solution for a multi-region application. The application is deployed in three Azure regions. Security requirements mandate that all authentication and authorization logs be retained for 7 years. Logs must be queryable centrally from a single location. What is the most cost-effective way to meet these requirements?

Accepted Answer

Deploy a Log Analytics workspace per region, set retention to 7 years, and use cross-workspace queries from a central Log Analytics workspace or Azure Sentinel.. Option D is correct because Azure Monitor Log Analytics workspaces can be used in each region, and then you can query across them using cross-workspace queries in the Azure Portal or using Azure Sentinel. Option A is wrong because Log Analytics workspace can store logs for 7 years with retention settings, but using a single workspace for all regions introduces latency and potential data loss if region fails. Option B is wrong because Event Hubs is for real-time streaming, not long-term retention. Option C is wrong because Storage Analytics is for storage accounts only.

Answer

Use Azure Storage Analytics logs and store them in a geo-redundant storage account in each region.

Answer

Use Azure Event Hubs to collect logs from all regions and stream them to a Log Analytics workspace in a central region.

Answer

Deploy a single Log Analytics workspace in one region and configure all VMs to send logs to it.

Question 12

You are designing a high-availability solution for a stateless web application running on Azure VMs. The solution must provide automatic failover to another region in the event of a regional outage. Which Azure service should you use to distribute traffic across regions?

Accepted Answer

Azure Front Door. Option C is correct because Azure Front Door provides global load balancing with automatic failover across regions. Option A is wrong because Azure Traffic Manager is DNS-based and can also do cross-region failover, but Front Door provides more features like SSL offload and WAF. Option B is wrong because Azure Load Balancer is for regional load balancing. Option D is wrong because Application Gateway is regional.

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 13

Which TWO of the following are valid considerations when designing a SQL Server Always On availability group in Azure VMs? (Choose two.)

Accepted Answer

The availability group listener should use a static IP address in the same subnet as the primary replica.. Correct answers are B and D. Option A is wrong because availability group replicas should be in different subnets for proper routing. Option C is wrong because cloud witness is recommended for quorum, not file share witness. Option E is wrong because the listener requires a dedicated IP address.

Answer

The availability group listener can use DHCP to automatically assign an IP address.

Answer

A file share witness is required for the quorum configuration.

Answer

All replicas must be in the same subnet to use a single internal load balancer.

Question 14

Which THREE of the following are best practices for securing an Azure Kubernetes Service (AKS) cluster? (Choose three.)

Accepted Answer

Enable Azure Policy for Kubernetes to enforce security policies.. Correct answers are A, B, and D. Option C is wrong because AKS supports Azure RBAC for Kubernetes authorization. Option E is wrong because network policies are recommended to micro-segment traffic.

Answer

Allow all pod-to-pod communication within the cluster without network policies.

Answer

Disable Kubernetes RBAC and use only Azure RBAC for simplicity.

Question 15

Which TWO of the following are valid data storage solutions for an Azure-based microservices architecture that requires high throughput and low latency? (Choose two.)

Accepted Answer

Azure Cosmos DB. Correct answers are A and D. Option B is wrong because Azure SQL Database is relational and may not provide the scalability needed for high throughput. Option C is wrong because Azure Files is for file shares, not optimized for microservices. Option E is wrong because Table Storage is for NoSQL key-value store but lower throughput than Cosmos DB.

Answer

Azure Table Storage

Answer

Azure Files

Answer

Azure SQL Database