AZ-305 Design infrastructure solutions Practice Test 15 — 15 Questions

Question 1

Your company is migrating a legacy on-premises application to Azure. The application requires low-latency access to a shared file system that supports SMB protocol. The solution must be highly available within a single Azure region and must not require the application to be modified. Which Azure service should you recommend?

Accepted Answer

Azure Files (premium tier). Option C is correct because Azure Files with premium SSD (SMB) provides a fully managed SMB file share with low latency and high availability. Option A is wrong because Azure NetApp Files supports SMB but is more expensive and complex for this use case. Option B is wrong because Azure Blob Storage does not support SMB natively. Option D is wrong because Azure Managed Disks are block storage, not file shares.

Answer

Azure Managed Disks (SSD)

Answer

Azure NetApp Files

Answer

Azure Blob Storage

Question 2

A multinational corporation is designing a hub-spoke network topology in Azure to connect multiple on-premises sites and Azure regions. The hub contains Azure Firewall and Azure Bastion. Spokes are in different regions and need to communicate with each other through the hub. The solution must minimize latency and cost. What should you configure?

Accepted Answer

Use VNet peering to hub and UDRs to force traffic through Azure Firewall. Option D is correct because VNet peering with traffic forced through the hub firewall using user-defined routes (UDRs) allows spoke-to-spoke traffic to be inspected, minimizing additional cost. Option A is wrong because ExpressRoute Global Reach bypasses the hub firewall. Option B is wrong because Azure Virtual WAN is more expensive and complex. Option C is wrong because spoke-to-spoke direct peering bypasses the hub firewall.

Answer

Connect spokes via ExpressRoute Global Reach

Answer

Deploy Azure Virtual WAN with secured hub

Answer

Create VNet peering between spokes directly

Question 3

You are designing a disaster recovery solution for a critical application running in Azure. The application uses Azure SQL Database. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 30 minutes. Which Azure SQL Database configuration should you recommend?

Accepted Answer

Active geo-replication. Option A is correct because active geo-replication provides continuous replication with RPO of 5 seconds and supports failover within 30 minutes. Option B is wrong because auto-failover groups have similar RPO but slightly higher RTO. Option C is wrong because point-in-time restore cannot meet the RPO of 5 seconds. Option D is wrong because Azure Backup has higher RPO.

Answer

Point-in-time restore to a different region

Answer

Auto-failover groups

Answer

Azure Backup for SQL Server in Azure VM

Question 4

A company is designing a solution to store and analyze petabytes of IoT sensor data. The data is written once, rarely accessed, and must be retained for 10 years for compliance. The data must be queryable using SQL. Which combination of Azure services would be MOST cost-effective?

Accepted Answer

Azure Data Lake Storage Gen2 with Azure Synapse Serverless SQL. Option C is correct because Azure Data Lake Storage Gen2 (ADLS Gen2) provides low-cost storage for large volumes of data, and Azure Synapse Serverless SQL can query the data directly. Option A is wrong because Azure SQL Database is expensive for petabytes of cold data. Option B is wrong because Azure Cosmos DB is expensive for large cold storage. Option D is wrong because Azure Databricks is more expensive for simple SQL queries.

Answer

Azure Cosmos DB with analytical store

Answer

Azure SQL Database with Hyperscale tier

Answer

Azure Databricks with Delta Lake

Question 5

Your company has a web application deployed on Azure App Service that experiences periodic traffic spikes. You need to ensure the application scales out quickly without manual intervention. The solution must minimize cost during low-traffic periods. What should you configure?

Accepted Answer

Configure Autoscale rules based on CPU or memory metrics. Option B is correct because Autoscale rules with a metric-based trigger (e.g., CPU > 70%) automatically scale out during spikes and scale in during low traffic, minimizing cost. Option A is wrong because scale sets are for VMs, not App Service. Option C is wrong because manual scaling does not react automatically. Option D is wrong because pre-warming is not a scaling configuration.

Answer

Enable pre-warming in the App Service plan

Answer

Deploy the app to a Virtual Machine Scale Set

Answer

Manually increase the instance count before expected spikes

Question 6

Refer to the exhibit. The JSON shows role assignments for user1. The role definition IDs are: b24988ac-6180-42a0-ab88-20f7382dd24c = Key Vault Secrets User, 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 = Reader. User1 reports being unable to list secrets in the key vault 'vault-prod' using Azure CLI. What is the most likely cause?

Accepted Answer

The Key Vault Secrets User role does not include the ability to list secrets. Option B is correct because the Key Vault Secrets User role at the vault scope does not include the 'list' permission on secrets; it only allows reading secret values. Option A is wrong because user1 has a role assignment at the vault scope. Option C is wrong because the Reader role at resource group scope does not grant permissions on secrets. Option D is wrong because the permissions are explicit.

Answer

User1 does not have any role assignment on the key vault

Answer

User1 must have the Contributor role on the key vault

Answer

The Reader role at resource group scope overrides the vault role

Question 7

You are designing a solution to securely store and manage secrets for multiple applications deployed in Azure. The solution must support automated rotation of secrets and provide audit logging. Which Azure service should you use?

Accepted Answer

Azure Key Vault with managed identity and rotation policy. Option C is correct because Azure Key Vault with managed identities and rotation policies provides automated secret rotation and audit logging. Option A is wrong because Azure App Service Key Vault references are for referencing secrets, not managing rotation. Option B is wrong because Azure Automation can rotate secrets but is more complex. Option D is wrong because Microsoft Entra ID is for identity, not secret storage.

Answer

Microsoft Entra ID application registration

Answer

Azure App Service Key Vault references

Answer

Azure Automation with PowerShell runbooks

Question 8

A healthcare organization needs to store patient health records in Azure. The data must be encrypted at rest and in transit. The organization requires a customer-managed key (CMK) with automatic key rotation every 90 days. The solution must support Azure SQL Database and Azure Blob Storage. Which key management solution should you recommend?

Accepted Answer

Azure Key Vault Managed HSM (Premium tier). Option A is correct because Azure Key Vault Managed HSM supports CMK with automatic rotation and FIPS 140-2 Level 3 validation, meeting compliance. Option B is wrong because Key Vault Standard does not support automatic rotation. Option C is wrong because Azure Information Protection is for classification, not key management. Option D is wrong because Azure Storage encryption uses Microsoft-managed keys by default.

Answer

Azure Storage Service Encryption

Answer

Azure Information Protection

Answer

Azure Key Vault Standard

Question 9

Your company has Azure virtual machines running a critical application. You need to back up these VMs daily and retain backups for 7 years. The solution must be cost-effective and support application-consistent backups. What should you use?

Accepted Answer

Azure Backup. Option D is correct because Azure Backup supports daily backup, long-term retention (up to 99 years), and application-consistent backups via VSS. Option A is wrong because Azure Site Recovery is for disaster recovery, not backup. Option B is wrong because Azure VM snapshots are not managed backups. Option C is wrong because Azure Files is for file shares, not VM backup.

Answer

Azure Files backup

Answer

Azure Site Recovery

Answer

Azure VM snapshots stored in Azure Storage

Question 10

You are designing a solution to monitor a hybrid environment consisting of Azure VMs and on-premises servers. The solution must provide centralized log analytics, security threat detection, and the ability to run custom queries across all logs. Which TWO Azure services should you include? (Choose two.)

Accepted Answer

Azure Log Analytics workspace. Options B and C are correct. Azure Log Analytics workspace is the central repository for logs and supports KQL queries. Microsoft Sentinel provides security threat detection and SIEM capabilities. Option A is wrong because Azure Monitor Agent is a data collection mechanism, not a central analytics service. Option D is wrong because Azure Update Manager is for patching, not monitoring. Option E is wrong because Azure Arc is for management, not log analytics.

Answer

Azure Monitor Agent

Answer

Azure Arc

Answer

Azure Update Manager

Question 11

A global e-commerce company is designing a highly available application on Azure. The application uses Azure SQL Database and requires that in the event of a regional outage, failover to a secondary region occurs automatically without manual intervention. The solution must minimize data loss. Which THREE components should be included? (Choose three.)

Accepted Answer

Azure App Service with deployment slots in secondary region. Options A, C, and E are correct. Azure SQL Database active geo-replication provides continuous replication. Azure Traffic Manager with priority routing ensures automatic traffic redirection. Azure App Service with deployment slots in secondary region allows fast application failover. Option B is wrong because Azure Front Door is for global load balancing, not SQL failover. Option D is wrong because Azure DNS does not provide failover routing.

Answer

Azure Front Door with health probes

Answer

Azure DNS with alias records

Question 12

You are designing a network architecture for a three-tier application in Azure. The web tier must be accessible from the internet. The application tier must only accept traffic from the web tier. The database tier must only accept traffic from the application tier. Which TWO Azure services should you use to enforce these network rules? (Choose two.)

Accepted Answer

Network Security Groups (NSGs). Options A and D are correct. Azure Application Gateway provides web traffic routing and WAF. Network Security Groups (NSGs) allow inbound/outbound rules to restrict traffic between tiers. Option B is wrong because Azure Firewall is a stateful firewall but not needed for simple tier isolation. Option C is wrong because Azure Bastion is for RDP/SSH access. Option E is wrong because Azure Front Door is for global load balancing.

Answer

Azure Bastion

Answer

Azure Front Door

Answer

Azure Firewall

Question 13

Refer to the exhibit. The ARM template provisions a VM. The deployment succeeds but the VM fails to start. What is the most likely cause?

Accepted Answer

The admin password is in plaintext and does not meet complexity requirements. Option C is correct because the template contains the admin password in plaintext, which violates Azure policy that requires a complex password or use of Key Vault. Option A is wrong because Premium_LRS is supported in most regions. Option B is wrong because StandardSSD_LRS is valid for data disks. Option D is wrong because the NIC reference uses the correct resourceId function.

Answer

The data disk size 1023 GB exceeds the maximum for StandardSSD_LRS

Answer

The network interface resource ID is incorrectly formatted

Answer

The VM size Standard_D2s_v3 is not available in the region

Question 14

Refer to the exhibit. A custom role is created. A user assigned this role reports being unable to view the VM's boot diagnostics in the Azure portal. What is the most likely reason?

Accepted Answer

The role lacks permissions to the diagnostics storage account. Option D is correct because the role does not include 'Microsoft.Storage/storageAccounts/listKeys/action' or 'Microsoft.Storage/storageAccounts/read' required to access boot diagnostics data in the diagnostics storage account. Option A is wrong because the role includes 'read' permission on VMs. Option B is wrong because start/restart are allowed. Option C is wrong because the issue is not related to VM size.

Answer

The user does not have permission to start or restart the VM

Answer

The VM is stopped and deallocated

Answer

The role does not include Microsoft.Compute/virtualMachines/read

Question 15

You are a solutions architect for a financial services company. The company is deploying a new critical application on Azure that processes sensitive customer transactions. The application consists of an ASP.NET Core web app (Azure App Service), a REST API (Azure Kubernetes Service), and an Azure SQL Database. The requirements are:

- All data at rest must be encrypted using customer-managed keys (CMK) stored in a managed HSM.
- All network traffic between components must be encrypted and traverse the Microsoft backbone network.
- The web app must be protected against common web attacks (SQL injection, XSS).
- The solution must automatically scale the API based on CPU utilization.
- All API calls must be authenticated using OAuth 2.0 with Microsoft Entra ID.
- Logs from all components must be sent to a central Log Analytics workspace for analysis.
- The solution must have a recovery time objective (RTO) of 1 hour and recovery point objective (RPO) of 5 minutes for the database.

Which combination of Azure services should you recommend to meet ALL requirements?

Accepted Answer

Azure Application Gateway with WAF, Azure SQL Database active geo-replication, Azure Key Vault Managed HSM, Azure App Service with VNet integration, AKS with cluster autoscaler, Azure Monitor Agent, Microsoft Entra ID. Option C is correct because it includes all required services: Azure Application Gateway with WAF for web protection, Azure SQL Database active geo-replication for DR with RPO=5s, Azure Key Vault Managed HSM for CMK, Azure App Service with VNet integration for private connectivity, Azure Kubernetes Service with cluster autoscaler for API scaling, Azure Monitor Agent for log collection, and Microsoft Entra ID for authentication. Option A is wrong because Azure Front Door does not provide WAF at the application layer for SQL injection. Option B is wrong because Azure Firewall is not a WAF. Option D is wrong because Azure SQL Database point-in-time restore cannot meet RPO of 5 minutes.

Answer

Azure Front Door with WAF, Azure SQL Database point-in-time restore, Azure Key Vault Managed HSM, Azure App Service with private endpoint, AKS with HPA, Azure Log Analytics agent, Microsoft Entra ID

Answer

Azure Front Door with WAF, Azure SQL Database geo-replication, Azure Key Vault (Standard), Azure App Service with private endpoint, AKS with HPA, Azure Diagnostics extension, Microsoft Entra ID

Answer

Azure Application Gateway with WAF, Azure SQL Database failover groups, Azure Key Vault Managed HSM, Azure App Service with service endpoint, AKS with HPA, Azure Monitor Agent, Microsoft Entra ID