AZ-305 Design infrastructure solutions Practice Test 15 — 15 Questions

Question 1

You are designing a solution to grant external partners access to specific Azure resources. The partners must authenticate using their own corporate credentials. You need to manage their access centrally. Which Microsoft Entra ID feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra ID B2B collaboration. Microsoft Entra ID B2B collaboration is the correct choice because it allows external partners to authenticate using their own corporate credentials (via their home tenant or identity provider) while enabling centralized management of their access to Azure resources. B2B collaboration supports features like cross-tenant synchronization, conditional access policies, and entitlement management, making it ideal for granting granular, centrally managed access to external users without requiring them to create new accounts.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Connect

Question 2

Your organization is deploying a critical application on Azure virtual machines. You need to ensure that the VMs are distributed across multiple fault domains and update domains within an availability set. You create an availability set with 3 fault domains and 5 update domains. How many VMs can you add to this availability set to maximize fault tolerance?

Accepted Answer

Unlimited. B is correct because Azure availability sets do not limit the number of VMs you can place into them; you can add an unlimited number of VMs. The fault domains (3) and update domains (5) define the maximum distribution groups, but Azure will place VMs across these domains as evenly as possible. Adding more VMs beyond the number of fault or update domains does not reduce fault tolerance—it simply means multiple VMs will share the same fault or update domain, but the set still provides the best possible distribution given the defined domain counts.

Answer

5 VMs

Answer

15 VMs

Answer

3 VMs

Question 3

A company is planning to migrate its on-premises Active Directory to Microsoft Entra ID. They have a complex on-premises infrastructure with multiple forests and over 50,000 users. They need to synchronize identities and enable single sign-on (SSO) for Office 365. What should you recommend?

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync is the appropriate tool for synchronizing identities from a complex on-premises infrastructure with multiple forests and over 50,000 users to Microsoft Entra ID. It supports full identity synchronization, password hash synchronization, pass-through authentication, and federation for SSO to Office 365, and it can handle multi-forest environments with advanced configuration options. Microsoft Entra Connect Health only monitors the synchronization infrastructure and does not perform identity synchronization.

Answer

Microsoft Entra Connect Cloud Sync

Answer

Microsoft Entra Connect Health

Answer

Microsoft Entra ID synchronization

Question 4

Your organization is designing a solution to capture and analyze IoT data from millions of devices. The solution must ingest data at high velocity, store the data for long-term analytics, and provide real-time dashboards. Which combination of Azure services should you recommend?

Accepted Answer

Azure Event Hubs, Azure Data Lake Storage, and Azure Stream Analytics. Azure Event Hubs is designed for high-velocity data ingestion from millions of devices, Azure Data Lake Storage provides scalable and cost-effective long-term storage for analytics, and Azure Stream Analytics enables real-time processing and dashboarding. This combination directly addresses the requirements of high-throughput ingestion, durable storage, and real-time analytics without unnecessary complexity.

Answer

Azure Service Bus, Azure SQL Database, and Power BI

Answer

Azure Cosmos DB, Azure Data Explorer, and Azure Logic Apps

Answer

Azure IoT Hub, Azure Blob Storage, and Azure Functions

Question 5

Your company is designing a hybrid network architecture to connect an on-premises data center to Azure. The requirements include: high availability, low latency, and cost optimization. Which TWO options should you recommend?

Accepted Answer

ExpressRoute Gateway. ExpressRoute Gateway is correct because it provides a dedicated, private connection from on-premises to Azure, bypassing the public internet for lower latency and more consistent performance. It supports high availability through active-active configurations and can be paired with multiple circuits for redundancy, meeting the hybrid network requirements.

Answer

Single ExpressRoute circuit

Answer

Site-to-Site VPN

Answer

ExpressRoute Direct

Question 6

A multinational corporation is designing a backup and disaster recovery strategy for Azure IaaS VMs. The solution must support cross-region failover, meet a recovery point objective (RPO) of 15 minutes, and a recovery time objective (RTO) of 1 hour. Which TWO options should you include in the design?

Accepted Answer

Azure Backup with geo-redundant storage (GRS). Azure Backup with geo-redundant storage (GRS) (A) is correct because GRS replicates backup data to a secondary Azure region hundreds of miles away, enabling cross-region restore and satisfying the cross-region failover requirement while supporting the 15-minute RPO through frequent backup schedules. Azure Site Recovery (E) is correct because it continuously replicates IaaS VM disks to a target region and can orchestrate failover with RTOs typically under an hour, directly meeting the 1-hour RTO and 15-minute RPO objectives. Azure Backup with LRS (B) is incorrect because locally redundant storage keeps three copies within a single datacenter in one region, providing no cross-region protection. Managed disk snapshots (C) are incorrect because they are stored regionally and are not a cross-region DR mechanism by themselves. Azure Backup with ZRS (D) is incorrect because zone-redundant storage only replicates across availability zones within one region, not across regions.

Answer

Azure Backup with locally redundant storage (LRS)

Answer

Managed disk snapshots

Answer

Azure Backup with zone-redundant storage (ZRS)

Question 7

Your organization is implementing a security strategy for Azure resources. You need to enforce consistent security policies across all subscriptions and ensure compliance with regulatory standards. Which TWO services should you use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (B) is correct because it provides continuous security assessment and regulatory compliance dashboards against standards such as ISO 27001, PCI DSS, and NIST, letting you measure and enforce compliance across subscriptions. Azure Policy (E) is correct because it enforces organizational standards and assesses compliance at scale by evaluating resource properties against policy definitions and applying deny, audit, or deployIfNotExists effects across all subscriptions. Together they cover both policy enforcement and regulatory compliance monitoring. Azure RBAC (A) only controls who can perform actions on resources and does not enforce configuration or regulatory standards. Microsoft Sentinel (C) is a SIEM/SOAR solution for threat detection and incident response, not policy or compliance enforcement. Azure Blueprints (D) orchestrates deployments of artifacts including policies, but it is a deployment/governance packaging tool rather than the service that itself enforces and reports compliance across subscriptions.

Answer

Azure RBAC

Answer

Microsoft Sentinel

Answer

Azure Blueprints

Question 8

Refer to the exhibit. You deploy this ARM template to a resource group in the East US region. You specify the parameter storageAccountType as 'Standard_GRS'. Which of the following is true about the deployed storage account?

Accepted Answer

The storage account is geo-redundant and replicates data to a paired region.. The parameter 'storageAccountType' is set to 'Standard_GRS', which specifies geo-redundant storage (GRS). GRS replicates your data synchronously three times within a single region using LRS, then asynchronously replicates to a paired secondary region, ensuring durability even during a regional outage.

Answer

The storage account name will be 'storage' followed by a random string.

Answer

The storage account will be deployed in the same region as specified by the parameter.

Answer

The storage account is zone-redundant and replicates data across availability zones.

Question 9

Refer to the exhibit. You are analyzing Azure VM performance using Azure Monitor Logs. You run the KQL query shown. What is the purpose of the 'take 10' operator?

Accepted Answer

Limits the results to the first 10 rows after sorting by time.. The 'take 10' operator in Kusto Query Language (KQL) returns a specified number of arbitrary rows from the query result set. When used after a sort operator (e.g., 'order by TimeGenerated desc'), it effectively limits the output to the first 10 rows of the sorted data, which in this context are the 10 most recent log entries. This is the standard behavior of 'take' in KQL, as it does not guarantee any specific order unless preceded by a sort.

Answer

Limits the time range to the last 10 hours.

Answer

Filters the results to only include the top 10 CPUs.

Answer

Samples the data to reduce query cost.

Question 10

Your company is migrating a legacy application to Azure. The application uses a proprietary database that requires file-level access to data files. You need to minimize changes to the application. Which Azure storage solution should you recommend?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB and NFS file shares that offer file-level access over the network, which is exactly what a legacy application requiring file-level access to data files needs. By mapping a drive to an Azure file share, the application can continue using standard file I/O APIs with minimal or no code changes, making it the correct choice for this migration scenario.

Answer

Azure Disk Storage

Answer

Azure Blob Storage

Answer

Azure NetApp Files

Question 11

A company is designing a solution for a global e-commerce platform that requires low-latency access to product catalog data from multiple regions. The data is read-heavy with occasional updates. The solution must support automatic scaling and provide high availability. Which Azure service should you recommend?

Accepted Answer

Azure Cosmos DB with multi-region writes. Azure Cosmos DB with multi-region writes is the correct choice because it provides global distribution with turnkey multi-master replication, enabling low-latency reads and writes from any Azure region. It supports automatic scaling through request units (RU/s) and offers 99.999% high availability with multiple well-defined consistency levels, making it ideal for a read-heavy, globally distributed e-commerce catalog with occasional updates.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Table Storage

Answer

Azure Cache for Redis

Question 12

Your organization needs to provide temporary, limited-privilege access to Azure resources for external auditors. The access must be time-bound and require approval from a manager. Which Azure feature should you use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing time-bound activation of roles with approval workflows. This directly meets the requirement for temporary, limited-privilege access that requires manager approval, making it the correct choice for external auditor scenarios.

Answer

Managed identities

Answer

Conditional Access policies

Answer

Azure RBAC roles

Question 13

Your company is deploying a critical application on Azure VMs. The application requires a static private IP address that does not change even if the VM is stopped and deallocated. The VM must be placed in an availability zone for high availability. Which networking approach should you use?

Accepted Answer

Assign a static private IP address to the VM's NIC and use a standard public load balancer.. A static private IP address assigned to the VM's NIC persists even when the VM is stopped and deallocated, ensuring the application always uses the same private IP. Placing the VM in an availability zone provides high availability by protecting against zonal failures, and a standard public load balancer can distribute traffic across VMs in different zones while preserving the static private IP for each VM.

Answer

Use Azure Firewall to provide static private IP and load balancing.

Answer

Use Azure Traffic Manager to assign static private IP.

Answer

Use Application Gateway with a static private IP.

Question 14

Your organization is building a serverless application that processes events from Azure Event Hubs and stores results in Azure Cosmos DB. The processing logic must be scalable and cost-effective, with no idle costs. Which compute service should you use?

Accepted Answer

Azure Functions. Azure Functions is the correct choice because it provides a serverless, event-driven compute service that can be triggered directly by Azure Event Hubs. It scales automatically based on the number of events, and you only pay for execution time, resulting in zero idle costs. This makes it ideal for processing streaming events in a cost-effective, scalable manner without managing infrastructure.

Answer

Azure Container Instances

Answer

Azure Logic Apps

Answer

Azure Kubernetes Service

Question 15

You are designing a disaster recovery solution for an Azure IaaS workload. The application runs on Azure VMs in a single region and requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which of the following is the most cost-effective approach to meet these requirements?

Accepted Answer

Deploy Azure Site Recovery to replicate VMs to the secondary region with a replication policy that meets the RPO and RTO.. Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs to a secondary region with configurable RPO (as low as 30 seconds) and supports automated failover, meeting the 15-minute RPO and 4-hour RTO requirements. It is the most cost-effective because it replicates only changed blocks and does not require running standby VMs, unlike multi-region active deployments.

Answer

Configure geo-redundant storage (GRS) for the VM disks and manually attach them to new VMs in the secondary region.

Answer

Use Azure Front Door with a back-end pool containing VMs in both regions, and configure health probes to route traffic on failure.

Answer

Use Azure Backup to back up VMs to a Recovery Services vault in the secondary region and perform restore during failover.