AZ-305 Design infrastructure solutions Practice Test 15 — 15 Questions

Question 1

You are designing a disaster recovery strategy for an Azure virtual machine running a critical application. The VM is in the East US region. Your recovery point objective (RPO) is 15 minutes, and your recovery time objective (RTO) is 1 hour. Which Azure service should you use to replicate the VM to the West US region?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions. It supports continuous replication with an RPO as low as 30 seconds and can meet your 15-minute RPO, while automated failover and recovery plans can achieve a 1-hour RTO by spinning up replicated VMs in the West US region.

Answer

Azure Traffic Manager

Answer

Azure Backup

Answer

Azure Migrate

Question 2

Refer to the exhibit. You are reviewing an Azure Policy definition that your team plans to assign. The policy is intended to deny the deployment of virtual networks and virtual machines if they do not have an NSG attached with a rule named containing 'Allow'. However, the policy is not working as expected. What is the most likely reason?

Accepted Answer

The policy does not check whether the NSG is actually associated with the resource.. The policy's existenceCondition only checks for the existence of an NSG with a rule name containing 'Allow', but it does not verify that the NSG is actually associated with the virtual network or virtual machine. In Azure Policy, the 'Microsoft.Network/networkInterfaces/networkSecurityGroup' or 'Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup' aliases must be used to check association. Without this, the policy can pass even if the NSG is not linked to the resource, rendering the deny effect ineffective.

Answer

The field 'Microsoft.Network/networkSecurityGroups/securityRules[*].name' is an incorrect alias.

Answer

The policy rule syntax is invalid.

Answer

The effect 'deny' cannot be used with existenceCondition.

Question 3

Your company has an Azure subscription that contains a hub virtual network and multiple spoke virtual networks connected via VNet peering. You need to ensure that all traffic between spokes is routed through a network virtual appliance (NVA) in the hub. The NVA is configured with IP forwarding enabled. What should you configure in the spoke virtual networks?

Accepted Answer

Add route tables to the spoke subnets with a default route (0.0.0.0/0) pointing to the NVA's private IP.. Adding a route table to the spoke subnets with a default route (0.0.0.0/0) pointing to the NVA's private IP forces all outbound traffic from the spoke, including traffic destined for other spokes, to be forwarded to the NVA. The NVA, with IP forwarding enabled, can then inspect and route the traffic to the target spoke. This ensures the desired traffic flow through the hub without requiring any changes to the VNet peering configuration.

Answer

Deploy a VPN gateway in each spoke and configure site-to-site VPNs.

Answer

Configure NSG rules to block direct spoke-to-spoke traffic.

Answer

Enable BGP on the VNet peerings.

Question 4

You need to design a storage solution for a new application that requires low-latency access to frequently accessed data and also needs to archive data that is older than 90 days to the most cost-effective storage tier. Which Azure storage account type and tier configuration should you recommend?

Accepted Answer

General-purpose v2 account with hot tier and a lifecycle management policy to move to cool tier after 90 days.. A General-purpose v2 (GPv2) storage account supports both hot and cool tiers, and lifecycle management policies can automatically move blobs from hot to cool tier after 90 days. This meets the low-latency requirement for frequently accessed data (hot tier) and the cost-effective archiving requirement (cool tier) without manual intervention.

Answer

Premium block blob storage account.

Answer

General-purpose v1 account with cool tier.

Answer

BlockBlobStorage account with hot tier.

Question 5

Your company is designing a hybrid identity solution that will allow users to authenticate to Azure resources using their on-premises Active Directory credentials. The solution must support multi-factor authentication (MFA) and conditional access policies. Which TWO components should you include?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to authenticate with their corporate credentials. Microsoft Entra ID is the cloud-based identity and access management service that processes authentication requests, enforces multi-factor authentication (MFA), and evaluates conditional access policies. Together, they form the core of a hybrid identity solution that supports MFA and conditional access.

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Application Proxy

Answer

Microsoft Intune

Question 6

You are designing a network architecture for a critical application that spans multiple Azure regions. The application requires low-latency communication between regions and must maintain connectivity even if an entire region fails. You need to recommend a solution that provides cross-region connectivity with automatic failover. Which TWO options meet the requirements?

Accepted Answer

Azure Front Door. Azure Front Door is correct because it provides global load balancing and application delivery with automatic failover across regions using anycast routing, ensuring low-latency and continuous availability. Azure Traffic Manager is also correct because it provides DNS-based global traffic routing with automatic failover based on endpoint health monitoring. While Traffic Manager relies on DNS caching and TTLs, it can still provide effective failover for multi-region applications. Both services meet the requirement for cross-region connectivity with automatic failover.

Answer

Azure Firewall

Answer

VPN Gateway

Answer

VNet peering

Question 7

You are designing a backup and disaster recovery strategy for a SQL Server database hosted on an Azure virtual machine. The database is critical and has a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 4 hours. Which TWO services should you include in the solution?

Accepted Answer

Azure Backup. Azure Backup provides application-consistent backups for SQL Server on Azure VMs, supporting transaction log backups every 5–15 minutes to meet the 15-minute RPO. Azure Site Recovery replicates the entire VM to a secondary region, enabling failover within minutes to meet the 4-hour RTO. Azure SQL Database backup is a PaaS feature that does not apply to SQL Server on Azure VMs; this is an IaaS workload. Azure SQL Database auto-failover groups are for PaaS databases, not applicable here. Azure Files is not part of a backup/DR strategy for SQL Server on Azure VMs.

Answer

Azure SQL Database backup

Answer

Azure Files

Answer

Azure SQL Database auto-failover groups

Question 8

Your organization needs to ensure that all Azure resources are compliant with corporate security policies. You need to design a solution that can enforce policies at scale, audit compliance, and automatically remediate non-compliant resources. Which THREE Azure services should you include?

Accepted Answer

Azure Policy. Options A, C, and E are correct. Azure Policy enforces and audits compliance rules. Azure Automation can run remediation scripts for non-compliant resources. Azure Blueprints packages policies, role assignments, and resource groups for repeatable deployments. Option B (Azure Monitor) is for monitoring and alerts, not policy enforcement. Option D (Azure RBAC) is for access control, not compliance policy.

Answer

Azure Monitor

Answer

Azure RBAC

Question 9

Your company, Contoso Ltd., operates a global e-commerce platform hosted on Azure. The architecture consists of: (1) A web front-end running on Azure App Service in multiple regions (East US, West Europe, Southeast Asia). (2) A microservices backend running on Azure Kubernetes Service (AKS) in East US. (3) A SQL Database in East US with geo-replication to West Europe and Southeast Asia for read scaling. (4) Azure Redis Cache for session state. (5) Azure Front Door for global load balancing. The platform experiences periodic traffic spikes, and during a recent spike, users reported slow page loads and intermittent errors. The operations team observed that the SQL Database in East US reached 100% DTU consumption, causing timeouts. The geo-replicated databases in other regions were underutilized. The application logic is read-heavy but also writes to a separate write-only table. You need to design a solution to improve scalability and reduce database load. The solution must: minimize latency for users, ensure write consistency, and handle traffic spikes without over-provisioning. What should you do?

Accepted Answer

Configure read-only routing in the application connection string to use the geo-replicated databases for read queries, and keep writes directed to the primary.. It leverages the existing geo-replicated SQL Databases for read scaling without additional cost. By configuring read-only routing in the application connection string, read queries are automatically directed to the readable secondary replicas in West Europe and Southeast Asia, offloading the primary East US database. This reduces DTU consumption on the primary while maintaining write consistency, as all writes still go to the primary. Azure SQL Database's active geo-replication supports this pattern, and Azure Front Door can route users to the nearest region for low latency.

Answer

Upgrade the SQL Database in East US to a higher DTU tier and enable auto-scaling.

Answer

Implement a second-level cache using Azure Cache for Redis with a local cache pattern in the web front-end.

Answer

Shard the database by customer region and deploy shards in each region.

Question 10

Your organization is migrating a legacy on-premises application to Azure. The application uses a monolithic architecture and requires high availability. The application tier runs on Windows Server and uses a SQL Server database. You need to design a migration strategy that minimizes changes to the application code while maximizing availability. The application can be stateless if session state is externalized. You have the following requirements: (1) The application must be resilient to Azure region failures. (2) The database must have an RPO of 5 minutes and RTO of 1 hour. (3) The migration must be completed within 6 months. (4) The solution should use platform-as-a-service (PaaS) services where possible to reduce operational overhead. Which approach should you recommend?

Accepted Answer

Migrate the web tier to Azure App Service with staging slots and use Azure SQL Database with active geo-replication.. It uses Azure App Service (PaaS) to host the stateless web tier with staging slots for zero-downtime deployments and Azure SQL Database with active geo-replication to meet the RPO of 5 minutes and RTO of 1 hour. This approach minimizes code changes by externalizing session state (e.g., using Azure Cache for Redis) and leverages PaaS to reduce operational overhead while providing regional failover resilience.

Answer

Rehost the application on Azure VMs in an availability set and use SQL Server Always On Availability Groups.

Answer

Refactor the application into microservices and deploy to Azure Kubernetes Service.

Answer

Containerize the application using Docker and deploy to Azure Container Instances in paired regions.

Question 11

Your company is designing a new application that will process large volumes of streaming data from IoT devices. The data will be ingested, processed in near real-time, and stored for long-term analytics. You need to design a solution that meets the following requirements: (1) Ingest up to 1 million events per second. (2) Process events with a latency of less than 10 seconds. (3) Store processed data for 7 years for compliance. (4) Enable ad-hoc querying of the stored data. Which combination of Azure services should you recommend?

Accepted Answer

Azure Event Hubs, Azure Stream Analytics, and Azure Data Lake Storage Gen2.. Azure Event Hubs can ingest up to 1 million events per second with low latency, Azure Stream Analytics processes the streaming data in near real-time (sub-10-second latency) using temporal windowing and SQL-like queries, and Azure Data Lake Storage Gen2 provides cost-effective, scalable storage for 7 years of compliance data while supporting ad-hoc querying via tools like Azure Synapse Analytics or PolyBase. This combination meets all requirements: high-throughput ingestion, low-latency processing, long-term retention, and queryability.

Answer

Azure IoT Hub, Azure Stream Analytics, and Azure Cosmos DB.

Answer

Azure Service Bus, Azure Functions, and Azure SQL Database.

Answer

Azure Event Hubs, Azure Functions, and Azure Cosmos DB.

Question 12

Your company is expanding its Azure presence to a new region in Asia. You need to design a network connectivity solution between the on-premises data center in New York and the new Azure region in Singapore. The solution must provide high bandwidth, low latency, and high availability. The company already has an ExpressRoute circuit to the East US region. You want to use that circuit to extend connectivity to Singapore if possible. The budget allows for additional ExpressRoute circuits if needed. What should you recommend?

Accepted Answer

Use ExpressRoute Global Reach to connect the on-premises network to the Singapore region via the existing circuit.. ExpressRoute Global Reach allows you to connect on-premises networks to different Azure regions through a single ExpressRoute circuit. By enabling Global Reach on the existing circuit to East US, you can route traffic from New York to Singapore with high bandwidth, low latency, and high availability, meeting all requirements without deploying a new circuit.

Answer

Set up a site-to-site VPN between the on-premises network and the Singapore region.

Answer

Deploy Azure Front Door to route traffic between on-premises and Singapore.

Answer

Peer the East US VNet with the Singapore VNet and route traffic through the existing ExpressRoute.

Question 13

Your organization is designing a secure microservices architecture using Azure Kubernetes Service (AKS). The application must be compliant with PCI DSS, which requires strict network segmentation and encryption of data at rest and in transit. You need to design a solution that meets these requirements while minimizing operational overhead. The AKS cluster will be deployed in a virtual network. The application consists of multiple microservices that need to communicate with each other and with an Azure SQL Database. Some microservices are public-facing. Which design should you recommend?

Accepted Answer

Deploy AKS with a private API server, enable network policies, and use a service endpoint or private endpoint for Azure SQL Database.. A private API server ensures the AKS control plane is inaccessible from the public internet, satisfying PCI DSS network segmentation. Enabling network policies (e.g., Calico or Azure Network Policy) enforces micro-segmentation between pods, and using a private endpoint for Azure SQL Database encrypts data in transit over the Microsoft backbone and isolates the database to the virtual network, meeting encryption and segmentation requirements with minimal operational overhead.

Answer

Deploy AKS with a public API server and use Network Security Groups (NSGs) to restrict access.

Answer

Deploy AKS with a private API server and use a jump box for administration.

Answer

Deploy AKS with a public API server and disable network policies to simplify management.

Question 14

Your company is migrating a critical application to Azure and needs to design a highly available and disaster recovery solution. The application runs on Azure VMs with SQL Server Always On Availability Groups. You need to ensure that the database remains available even during a regional outage. Which TWO options should you include in the design? (Choose two.)

Accepted Answer

Enable geo-redundant backup storage (RA-GRS) for the database.. The correct answers are A and C. Geo-redundant backup storage (RA-GRS) ensures database backups are replicated to a paired region, providing a recovery point for disaster recovery. Azure SQL Database Managed Instance with auto-failover groups enables automatic failover to a secondary region, maintaining availability during a regional outage. Option B is incorrect because Azure Site Recovery replicates VMs but does not guarantee SQL Server transactional consistency for Always On Availability Groups. Option D is incorrect because deploying Always On Availability Groups across availability zones only protects against zonal failures, not regional outages. Option E is incorrect because a load balancer distributes network traffic but does not provide database-level failover or consistency.

Answer

Configure Azure Site Recovery for the SQL Server VMs.

Answer

Deploy SQL Server Always On Availability Groups across availability zones.

Answer

Deploy a load balancer and distribute traffic to multiple replicas.

Question 15

A multinational corporation is designing a hybrid identity solution using Microsoft Entra ID. The company has multiple on-premises Active Directory forests with complex trust relationships. They require that users can authenticate to both cloud and on-premises resources using the same credentials, and they want to minimize changes to the existing infrastructure. Which THREE components should be part of the solution? (Choose three.)

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync is correct because it synchronizes user identities from multiple on-premises Active Directory forests to Microsoft Entra ID, enabling single sign-on and unified credential usage across cloud and on-premises resources. It supports complex forest trust relationships by using the source anchor and UPN mapping to ensure each user has a unique identity in the cloud without requiring changes to the existing on-premises infrastructure.

Answer

Microsoft Entra Connect Health

Answer

Microsoft Entra Domain Services