AZ-305 Design infrastructure solutions Practice Test 14 — 15 Questions

Question 1

You are designing a governance strategy for multiple Azure subscriptions. You need to ensure that all resources in a specific subscription are deployed only in the West US region. Additionally, any new resource group must contain a tag named 'Environment' with a value of 'Production'. What combination of Azure Policy initiatives should you assign?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the 'Allowed Locations' policy and the 'Require a tag on resource groups' policy to the subscription. It assigns both the 'Allowed Locations' policy and the 'Require a tag on resource groups' policy directly to the subscription. The 'Allowed Locations' policy restricts resource deployment to the West US region, while the 'Require a tag on resource groups' policy ensures that every new resource group includes the 'Environment' tag with a value of 'Production'. Assigning both policies at the subscription scope meets both requirements without unnecessary inheritance or scope issues.

Answer

Assign the 'Allowed Locations' policy to the management group and the 'Require a tag on resource groups' policy to the subscription

Answer

Assign the 'Allowed Locations' policy to the subscription and the 'Inherit a tag from the resource group' policy to the management group

Answer

Assign a single Azure Policy definition that includes both the allowed location and require tag effects

Question 2

Which TWO of the following are valid design considerations for implementing Azure SQL Database geo-replication? (Choose two.)

Accepted Answer

Geo-replication supports up to four readable secondary replicas. Azure SQL Database geo-replication supports up to four readable secondary replicas, which can be used for read-only query offloading and disaster recovery. Option E is correct because these secondary replicas are fully readable, allowing you to distribute read-only workloads to reduce load on the primary database.

Answer

Geo-replication ensures zero data loss during failover

Answer

Geo-replication provides automatic failover without manual intervention

Answer

Geo-replication requires a listener for client connections

Question 3

Which THREE of the following are valid methods to secure access to Azure Storage accounts? (Choose three.)

Accepted Answer

Generate Shared Access Signatures (SAS) with limited permissions and expiry. Shared Access Signatures (SAS) allow you to grant time-limited, delegated access to specific storage resources (e.g., blobs, queues) with granular permissions (read, write, delete) and an expiry time, without exposing the account key. This is a key security method for controlling access at the resource level.

Answer

Enable Azure Front Door to authenticate requests

Answer

Use storage account access keys for authentication

Question 4

Which TWO of the following are benefits of using Azure Policy? (Choose two.)

Accepted Answer

Assess compliance of resources against defined policies. Azure Policy is a service that enables you to create, assign, and manage policies that enforce rules and effects over your Azure resources. Option A is correct because one of its primary benefits is the ability to assess the compliance state of existing and newly deployed resources against defined policy definitions, providing a clear compliance dashboard and reports. This assessment is continuous and can be viewed at the subscription, management group, or resource group level.

Answer

Manage access control for resources

Answer

Create new Azure resources based on a template

Answer

Automatically remediate non-compliant resources without manual intervention

Question 5

Refer to the exhibit. You are reviewing an ARM template that deploys a virtual network with two subnets. Subnet-b includes a delegation to Microsoft.Web/serverFarms. What is the purpose of this delegation?

Accepted Answer

It enables Azure App Service instances to be deployed into subnet-b. Delegating a subnet to Microsoft.Web/serverFarms explicitly authorizes Azure App Service (specifically, the App Service Plan's infrastructure) to inject network interfaces into that subnet. This is required for features like regional VNet Integration, where an App Service instance needs direct access to resources in the virtual network without going through a public endpoint. Without this delegation, the App Service cannot use the subnet for its internal networking.

Answer

It allows subnet-b to use a different address space

Answer

It configures a firewall policy for subnet-b

Answer

It creates a peering connection to another virtual network

Question 6

Refer to the exhibit. You are reviewing the properties of an Azure Storage account. The encryption section shows keySource as Microsoft.Keyvault and infrastructureEncryption enabled. What does infrastructureEncryption mean in this context?

Accepted Answer

It enables double encryption of data at rest. Infrastructure encryption in Azure Storage provides double encryption of data at rest. When enabled, data is encrypted twice: once at the service level using a Microsoft-managed key or a customer-managed key from Azure Key Vault (as indicated by keySource: Microsoft.Keyvault), and a second layer at the infrastructure level using a separate platform-managed key. This ensures that even if one encryption layer is compromised, the second layer protects the data, meeting compliance requirements for highly sensitive workloads.

Answer

It enforces HTTPS for all data in transit

Answer

It automatically rotates the encryption key daily

Answer

It encrypts the encryption key stored in Key Vault

Question 7

Refer to the exhibit. You have an Azure Storage account with the settings shown. A developer reports that they cannot access the storage account from their Azure VM that is connected to subnet-a. The VM's subnet ID matches the one in the rule. What is the most likely cause of the issue?

Accepted Answer

The subnet does not have a service endpoint for Microsoft.Storage enabled. The most likely cause is that the subnet does not have a service endpoint for Microsoft.Storage enabled. When a storage account firewall rule allows access from a specific subnet, that subnet must have a service endpoint configured for Microsoft.Storage; otherwise, traffic from the VM is treated as originating from the VM's public IP and is blocked by the firewall. The exhibit shows a firewall rule for the subnet, but without the service endpoint, the rule is ineffective.

Answer

The storage account requires HTTPS and the VM is using HTTP

Answer

The storage account does not have a firewall rule for the VM's public IP

Answer

The storage account uses GRS replication which is not supported with network rules

Question 8

Your organization has a hybrid identity infrastructure with Microsoft Entra ID Connect Sync. You plan to enable Microsoft Entra ID Seamless Single Sign-On (Seamless SSO) for domain-joined Windows devices. What is the minimum requirement for the on-premises Active Directory forest functional level?

Accepted Answer

Windows Server 2008. Microsoft Entra ID Seamless SSO works by having the client computer attempt Kerberos authentication against a local Active Directory domain controller using a special service principal name (AZUREADSSOACC). This process requires the on-premises Active Directory forest functional level to be at least Windows Server 2008, because the Kerberos service ticket used for Seamless SSO relies on the AES encryption type, which is only supported in domains with a Windows Server 2008 or higher functional level. Lower functional levels (2003 or earlier) do not support AES encryption, causing the authentication to fail.

Answer

Windows Server 2016

Answer

Windows Server 2012

Answer

Windows Server 2003

Question 9

Your company deploys a line-of-business application on Azure App Service. The application requires custom domain names and SSL/TLS certificates. You need to ensure that the application can be accessed via a custom domain with HTTPS. What should you configure in the App Service?

Accepted Answer

Add the custom domain and bind the SSL/TLS certificate.. To access an App Service via a custom domain with HTTPS, you must first add the custom domain to the App Service and then bind an SSL/TLS certificate (either App Service Managed Certificate, a Key Vault certificate, or a third-party certificate) to that domain. This binding enables the App Service to present the certificate during the TLS handshake, allowing secure HTTPS connections. Without both steps, the custom domain will not resolve securely.

Answer

Configure IP restrictions to allow only the custom domain.

Answer

Create a deployment slot for production traffic.

Answer

Scale out the App Service plan to increase instance count.

Question 10

You are designing a solution to store sensitive documents in Azure Blob Storage. The data must be encrypted at rest and access must be audited. You need to ensure that the encryption keys are managed by your organization and that access to the keys is logged. Which combination of Azure services should you use?

Accepted Answer

Azure Storage encryption with customer-managed keys in Azure Key Vault and Azure Monitor. Azure Storage encryption with customer-managed keys in Azure Key Vault meets the requirement for organization-managed encryption keys, while Azure Monitor (specifically the Azure Activity Log or diagnostic settings) captures access logs for both the storage account and Key Vault operations, enabling full auditability of key usage and data access.

Answer

Azure Disk Encryption with Azure Key Vault

Answer

Azure Storage encryption with Microsoft-managed keys and Azure Monitor

Answer

Azure Information Protection and Azure Sentinel

Question 11

You are designing a microservices architecture on Azure Kubernetes Service (AKS). The solution must handle traffic spikes by automatically scaling pods based on CPU utilization. Additionally, you need to minimize cost by scaling down nodes when not in use. Which two features should you implement? (Choose two.)

Accepted Answer

Horizontal Pod Autoscaler (HPA). Horizontal Pod Autoscaler (HPA) automatically scales the number of pod replicas based on observed CPU utilization (or custom metrics), directly addressing the requirement to handle traffic spikes by scaling pods. Cluster Autoscaler automatically adjusts the number of AKS nodes by scaling down unused nodes and scaling up when pods are unschedulable, which minimizes cost by reducing node count during low usage.

Answer

Azure Load Balancer

Answer

Vertical Pod Autoscaler (VPA)

Answer

Azure Container Instances (ACI)

Question 12

Your organization uses Microsoft Purview to govern data assets across Azure SQL Database, Azure Data Lake Storage, and on-premises SQL Server. You need to ensure that sensitive data such as credit card numbers are automatically detected and classified. What should you configure in Microsoft Purview?

Accepted Answer

Data classification rules. Microsoft Purview's data classification rules are specifically designed to automatically detect and classify sensitive data like credit card numbers across data sources. By configuring classification rules, you define patterns (e.g., regex for credit card numbers) that Purview scans against assets in Azure SQL Database, Azure Data Lake Storage, and on-premises SQL Server, applying sensitivity labels accordingly.

Answer

Data share

Answer

Data catalog

Answer

Data lineage mapping

Question 13

You need to design a solution to store log data from multiple Azure services. The data must be retained for 7 years for compliance purposes and should be queryable for analysis. Which Azure service should you use as the primary storage for these logs?

Accepted Answer

Azure Log Analytics workspace. Azure Log Analytics workspace is the correct choice because it is purpose-built for ingesting, storing, and querying log data from Azure services. It supports long-term retention up to 7 years (via the Basic Logs tier or data archiving with Azure Data Explorer) and provides Kusto Query Language (KQL) for interactive analysis, meeting both compliance and queryability requirements.

Answer

Azure Data Lake Storage

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 14

You are designing a network architecture for a multi-tier application. The front-end tier is an Azure Application Gateway that routes traffic to a web app on Azure App Service. The back-end tier is an Azure SQL Database. You need to ensure that all traffic between the Application Gateway and the web app remains within the Azure backbone network, and that the web app can only be accessed through the Application Gateway. What should you configure?

Accepted Answer

Enable Service Endpoints for the web app and configure the Application Gateway with a private IP.. Enabling Service Endpoints for the web app allows traffic from the Application Gateway to reach the App Service over the Azure backbone network, bypassing the public internet. Configuring the Application Gateway with a private IP and restricting the web app's access to only that private IP ensures the web app can only be accessed through the gateway, meeting both requirements.

Answer

Use Azure Private Link for the web app and disable public access.

Answer

Deploy Azure Firewall in front of the Application Gateway.

Answer

Use a site-to-site VPN between the App Service and Application Gateway.

Question 15

Your company plans to migrate on-premises file servers to Azure. The solution must support SMB protocol and integrate with Microsoft Entra ID for authentication. You need to choose a service that provides fully managed file shares accessible from multiple Azure regions. Which Azure service should you use?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB file shares that can be accessed from multiple Azure regions using the SMB 3.0 protocol. It integrates natively with Microsoft Entra ID (formerly Azure AD) for Kerberos-based authentication, allowing on-premises identities to access shares without additional domain controllers. This makes it the correct choice for migrating on-premises file servers to a multi-region, identity-aware managed file service.

Answer

Azure Disk Storage

Answer

Azure NetApp Files

Answer

Azure Blob Storage