AZ-305 Design infrastructure solutions Practice Test 14 — 15 Questions

Question 1

Your company is designing a new cloud-native application on Azure that consists of multiple microservices running on Azure Kubernetes Service (AKS). The application must be accessible from the internet via a custom domain name (app.contoso.com) and must support SSL/TLS termination. You need to design a secure ingress solution that provides Web Application Firewall (WAF) capabilities, SSL offloading, and automatic scaling. The solution should also support path-based routing to different microservices (e.g., /api, /web). You have the following options: Option A: Deploy an Azure Application Gateway v2 with WAF in front of the AKS cluster. Configure Application Gateway Ingress Controller (AGIC) to route traffic to the services. Option B: Deploy an Azure Load Balancer with a public IP and install an NGINX ingress controller on AKS. Configure SSL termination on NGINX and use a third-party WAF. Option C: Deploy an Azure Front Door with WAF policy in front of the AKS cluster. Use Azure Private Link to connect Front Door to the internal load balancer of AKS. Option D: Deploy an Azure API Management instance with WAF and expose the microservices through API endpoints. Use Azure Application Gateway as a reverse proxy. Which option best meets the requirements for a high-performance, integrated, and managed solution with minimal operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy an Azure Application Gateway v2 with WAF in front of the AKS cluster. Configure Application Gateway Ingress Controller (AGIC) to route traffic to the services.. Azure Application Gateway v2 with WAF provides a fully managed, integrated ingress solution that natively supports SSL/TLS offloading, path-based routing, and Web Application Firewall capabilities. By using the Application Gateway Ingress Controller (AGIC), traffic is automatically routed to the appropriate AKS microservices based on URL paths (e.g., /api, /web), and the gateway can scale automatically based on load. This minimizes operational overhead while meeting all stated requirements.

Answer

Deploy an Azure Front Door with WAF policy in front of the AKS cluster. Use Azure Private Link to connect Front Door to the internal load balancer of AKS.

Answer

Deploy an Azure Load Balancer with a public IP and install an NGINX ingress controller on AKS. Configure SSL termination on NGINX and use a third-party WAF.

Answer

Deploy an Azure API Management instance with WAF and expose the microservices through API endpoints. Use Azure Application Gateway as a reverse proxy.

Question 2

Your company has a multi-region Azure deployment with virtual networks in East US and West Europe connected via a hub-and-spoke topology. You need to ensure that all traffic between the spokes is routed through a centralized firewall in the hub. The hub uses Azure Firewall. Currently, spoke-to-spoke traffic is not being inspected. What should you configure?

Accepted Answer

Use Azure Firewall Manager to enforce routing by adding route tables to the spoke subnets with a default route to the firewall.. Azure Firewall Manager can centrally manage and enforce routing policies across a hub-and-spoke topology. By configuring route tables on spoke subnets with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP, all spoke-to-spoke traffic is forced through the firewall for inspection, ensuring traffic is inspected and not bypassed via direct VNet peering.

Answer

Apply NSG rules to block direct spoke-to-spoke traffic.

Answer

Configure VNet peering between all spokes.

Answer

Deploy VPN gateways in each spoke and configure site-to-site VPNs.

Question 3

Your organization is migrating an on-premises application to Azure. The application consists of a load-balanced web tier and a backend SQL Server database. The web tier requires session persistence (sticky sessions) and SSL offload. You need to design a solution that meets these requirements with minimal operational overhead. Which Azure service should you use for the web tier load balancing?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that natively supports HTTP-based session persistence (sticky sessions) via cookie affinity and SSL termination (offload) at the gateway. This meets both requirements while minimizing operational overhead, as it handles SSL certificates and session affinity without requiring changes to the web tier.

Answer

Azure Traffic Manager

Answer

Azure Front Door

Answer

Azure Load Balancer

Question 4

You are designing a disaster recovery strategy for an Azure virtual machine running a critical application. The VM is in the East US region. Your recovery point objective (RPO) is 15 minutes, and your recovery time objective (RTO) is 1 hour. Which Azure service should you use to replicate the VM to the West US region?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions. It supports continuous replication with an RPO as low as 30 seconds and can meet your 15-minute RPO, while automated failover and recovery plans can achieve a 1-hour RTO by spinning up replicated VMs in the West US region.

Answer

Azure Traffic Manager

Answer

Azure Backup

Answer

Azure Migrate

Question 5

Refer to the exhibit. You are reviewing an Azure Policy definition that your team plans to assign. The policy is intended to deny the deployment of virtual networks and virtual machines if they do not have an NSG attached with a rule named containing 'Allow'. However, the policy is not working as expected. What is the most likely reason?

Accepted Answer

The policy does not check whether the NSG is actually associated with the resource.. The policy's existenceCondition only checks for the existence of an NSG with a rule name containing 'Allow', but it does not verify that the NSG is actually associated with the virtual network or virtual machine. In Azure Policy, the 'Microsoft.Network/networkInterfaces/networkSecurityGroup' or 'Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup' aliases must be used to check association. Without this, the policy can pass even if the NSG is not linked to the resource, rendering the deny effect ineffective.

Answer

The field 'Microsoft.Network/networkSecurityGroups/securityRules[*].name' is an incorrect alias.

Answer

The policy rule syntax is invalid.

Answer

The effect 'deny' cannot be used with existenceCondition.

Question 6

Your company has an Azure subscription that contains a hub virtual network and multiple spoke virtual networks connected via VNet peering. You need to ensure that all traffic between spokes is routed through a network virtual appliance (NVA) in the hub. The NVA is configured with IP forwarding enabled. What should you configure in the spoke virtual networks?

Accepted Answer

Add route tables to the spoke subnets with a default route (0.0.0.0/0) pointing to the NVA's private IP.. Adding a route table to the spoke subnets with a default route (0.0.0.0/0) pointing to the NVA's private IP forces all outbound traffic from the spoke, including traffic destined for other spokes, to be forwarded to the NVA. The NVA, with IP forwarding enabled, can then inspect and route the traffic to the target spoke. This ensures the desired traffic flow through the hub without requiring any changes to the VNet peering configuration.

Answer

Deploy a VPN gateway in each spoke and configure site-to-site VPNs.

Answer

Configure NSG rules to block direct spoke-to-spoke traffic.

Answer

Enable BGP on the VNet peerings.

Question 7

You need to design a storage solution for a new application that requires low-latency access to frequently accessed data and also needs to archive data that is older than 90 days to the most cost-effective storage tier. Which Azure storage account type and tier configuration should you recommend?

Accepted Answer

General-purpose v2 account with hot tier and a lifecycle management policy to move to cool tier after 90 days.. A General-purpose v2 (GPv2) storage account supports both hot and cool tiers, and lifecycle management policies can automatically move blobs from hot to cool tier after 90 days. This meets the low-latency requirement for frequently accessed data (hot tier) and the cost-effective archiving requirement (cool tier) without manual intervention.

Answer

Premium block blob storage account.

Answer

General-purpose v1 account with cool tier.

Answer

BlockBlobStorage account with hot tier.

Question 8

Your company is designing a hybrid identity solution that will allow users to authenticate to Azure resources using their on-premises Active Directory credentials. The solution must support multi-factor authentication (MFA) and conditional access policies. Which TWO components should you include?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to authenticate with their corporate credentials. Microsoft Entra ID is the cloud-based identity and access management service that processes authentication requests, enforces multi-factor authentication (MFA), and evaluates conditional access policies. Together, they form the core of a hybrid identity solution that supports MFA and conditional access.

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Application Proxy

Answer

Microsoft Intune

Question 9

You are designing a network architecture for a critical application that spans multiple Azure regions. The application requires low-latency communication between regions and must maintain connectivity even if an entire region fails. You need to recommend a solution that provides cross-region connectivity with automatic failover. Which TWO options meet the requirements?

Accepted Answer

Azure Front Door. Azure Front Door is correct because it provides global load balancing and application delivery with automatic failover across regions using anycast routing, ensuring low-latency and continuous availability. Azure Traffic Manager is also correct because it provides DNS-based global traffic routing with automatic failover based on endpoint health monitoring. While Traffic Manager relies on DNS caching and TTLs, it can still provide effective failover for multi-region applications. Both services meet the requirement for cross-region connectivity with automatic failover.

Answer

Azure Firewall

Answer

VPN Gateway

Answer

VNet peering

Question 10

You are designing a backup and disaster recovery strategy for a SQL Server database hosted on an Azure virtual machine. The database is critical and has a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 4 hours. Which TWO services should you include in the solution?

Accepted Answer

Azure Backup. Azure Backup provides application-consistent backups for SQL Server on Azure VMs, supporting transaction log backups every 5–15 minutes to meet the 15-minute RPO. Azure Site Recovery replicates the entire VM to a secondary region, enabling failover within minutes to meet the 4-hour RTO. Azure SQL Database backup is a PaaS feature that does not apply to SQL Server on Azure VMs; this is an IaaS workload. Azure SQL Database auto-failover groups are for PaaS databases, not applicable here. Azure Files is not part of a backup/DR strategy for SQL Server on Azure VMs.

Answer

Azure SQL Database backup

Answer

Azure Files

Answer

Azure SQL Database auto-failover groups

Question 11

Your organization needs to ensure that all Azure resources are compliant with corporate security policies. You need to design a solution that can enforce policies at scale, audit compliance, and automatically remediate non-compliant resources. Which THREE Azure services should you include?

Accepted Answer

Azure Policy. Options A, C, and E are correct. Azure Policy enforces and audits compliance rules. Azure Automation can run remediation scripts for non-compliant resources. Azure Blueprints packages policies, role assignments, and resource groups for repeatable deployments. Option B (Azure Monitor) is for monitoring and alerts, not policy enforcement. Option D (Azure RBAC) is for access control, not compliance policy.

Answer

Azure Monitor

Answer

Azure RBAC

Question 12

Your company, Contoso Ltd., operates a global e-commerce platform hosted on Azure. The architecture consists of: (1) A web front-end running on Azure App Service in multiple regions (East US, West Europe, Southeast Asia). (2) A microservices backend running on Azure Kubernetes Service (AKS) in East US. (3) A SQL Database in East US with geo-replication to West Europe and Southeast Asia for read scaling. (4) Azure Redis Cache for session state. (5) Azure Front Door for global load balancing. The platform experiences periodic traffic spikes, and during a recent spike, users reported slow page loads and intermittent errors. The operations team observed that the SQL Database in East US reached 100% DTU consumption, causing timeouts. The geo-replicated databases in other regions were underutilized. The application logic is read-heavy but also writes to a separate write-only table. You need to design a solution to improve scalability and reduce database load. The solution must: minimize latency for users, ensure write consistency, and handle traffic spikes without over-provisioning. What should you do?

Accepted Answer

Configure read-only routing in the application connection string to use the geo-replicated databases for read queries, and keep writes directed to the primary.. It leverages the existing geo-replicated SQL Databases for read scaling without additional cost. By configuring read-only routing in the application connection string, read queries are automatically directed to the readable secondary replicas in West Europe and Southeast Asia, offloading the primary East US database. This reduces DTU consumption on the primary while maintaining write consistency, as all writes still go to the primary. Azure SQL Database's active geo-replication supports this pattern, and Azure Front Door can route users to the nearest region for low latency.

Answer

Upgrade the SQL Database in East US to a higher DTU tier and enable auto-scaling.

Answer

Implement a second-level cache using Azure Cache for Redis with a local cache pattern in the web front-end.

Answer

Shard the database by customer region and deploy shards in each region.

Question 13

Your organization is migrating a legacy on-premises application to Azure. The application uses a monolithic architecture and requires high availability. The application tier runs on Windows Server and uses a SQL Server database. You need to design a migration strategy that minimizes changes to the application code while maximizing availability. The application can be stateless if session state is externalized. You have the following requirements: (1) The application must be resilient to Azure region failures. (2) The database must have an RPO of 5 minutes and RTO of 1 hour. (3) The migration must be completed within 6 months. (4) The solution should use platform-as-a-service (PaaS) services where possible to reduce operational overhead. Which approach should you recommend?

Accepted Answer

Migrate the web tier to Azure App Service with staging slots and use Azure SQL Database with active geo-replication.. It uses Azure App Service (PaaS) to host the stateless web tier with staging slots for zero-downtime deployments and Azure SQL Database with active geo-replication to meet the RPO of 5 minutes and RTO of 1 hour. This approach minimizes code changes by externalizing session state (e.g., using Azure Cache for Redis) and leverages PaaS to reduce operational overhead while providing regional failover resilience.

Answer

Rehost the application on Azure VMs in an availability set and use SQL Server Always On Availability Groups.

Answer

Refactor the application into microservices and deploy to Azure Kubernetes Service.

Answer

Containerize the application using Docker and deploy to Azure Container Instances in paired regions.

Question 14

Your company is designing a new application that will process large volumes of streaming data from IoT devices. The data will be ingested, processed in near real-time, and stored for long-term analytics. You need to design a solution that meets the following requirements: (1) Ingest up to 1 million events per second. (2) Process events with a latency of less than 10 seconds. (3) Store processed data for 7 years for compliance. (4) Enable ad-hoc querying of the stored data. Which combination of Azure services should you recommend?

Accepted Answer

Azure Event Hubs, Azure Stream Analytics, and Azure Data Lake Storage Gen2.. Azure Event Hubs can ingest up to 1 million events per second with low latency, Azure Stream Analytics processes the streaming data in near real-time (sub-10-second latency) using temporal windowing and SQL-like queries, and Azure Data Lake Storage Gen2 provides cost-effective, scalable storage for 7 years of compliance data while supporting ad-hoc querying via tools like Azure Synapse Analytics or PolyBase. This combination meets all requirements: high-throughput ingestion, low-latency processing, long-term retention, and queryability.

Answer

Azure IoT Hub, Azure Stream Analytics, and Azure Cosmos DB.

Answer

Azure Service Bus, Azure Functions, and Azure SQL Database.

Answer

Azure Event Hubs, Azure Functions, and Azure Cosmos DB.

Question 15

Your company is expanding its Azure presence to a new region in Asia. You need to design a network connectivity solution between the on-premises data center in New York and the new Azure region in Singapore. The solution must provide high bandwidth, low latency, and high availability. The company already has an ExpressRoute circuit to the East US region. You want to use that circuit to extend connectivity to Singapore if possible. The budget allows for additional ExpressRoute circuits if needed. What should you recommend?

Accepted Answer

Use ExpressRoute Global Reach to connect the on-premises network to the Singapore region via the existing circuit.. ExpressRoute Global Reach allows you to connect on-premises networks to different Azure regions through a single ExpressRoute circuit. By enabling Global Reach on the existing circuit to East US, you can route traffic from New York to Singapore with high bandwidth, low latency, and high availability, meeting all requirements without deploying a new circuit.

Answer

Set up a site-to-site VPN between the on-premises network and the Singapore region.

Answer

Deploy Azure Front Door to route traffic between on-premises and Singapore.

Answer

Peer the East US VNet with the Singapore VNet and route traffic through the existing ExpressRoute.