AZ-305 Design infrastructure solutions Practice Test 16 — 15 Questions

Question 1

Your company has an Azure subscription that contains several virtual machines (VMs) running Windows Server. You need to ensure that all VMs are compliant with a baseline security policy that includes specific registry key settings. The solution must automatically remediate non-compliant settings without manual intervention. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy with Guest Configuration. Azure Policy with Guest Configuration is the correct choice because it can audit and automatically remediate settings inside virtual machines, including registry keys, using built-in or custom policies. Guest Configuration extends Azure Policy to in-guest settings, enabling compliance checks and auto-remediation without manual intervention. Option A (Azure Automation DSC) can configure settings but does not natively integrate with Azure Policy for continuous compliance audits and automatic remediation triggered by policy evaluation. Option C (Microsoft Defender for Cloud with custom recommendations) provides security recommendations but does not directly enforce or remediate registry key settings automatically within VMs. Option D (Microsoft Intune) manages endpoints and can apply registry settings, but it is designed for client devices, not server VMs, and does not provide Azure Policy integration for compliance reporting across the subscription.

Answer

Azure Automation State Configuration (DSC)

Answer

Microsoft Defender for Cloud with custom recommendations

Answer

Microsoft Intune

Question 2

A healthcare organization is deploying a new application on Azure that will handle Protected Health Information (PHI). The application must be compliant with HIPAA. The security team requires encryption at rest and in transit, and the ability to audit access to the data. The solution should minimize administrative overhead. Which storage solution should you recommend?

Accepted Answer

Azure SQL Database with Transparent Data Encryption and Always Encrypted. Azure SQL Database provides encryption at rest via Transparent Data Encryption (TDE), which is enabled by default, and encryption in transit via TLS. It also supports Always Encrypted to protect sensitive data client-side, ensuring PHI is never exposed to database administrators. Built-in auditing tracks access, and as a PaaS service, it minimizes administrative overhead compared to SQL Managed Instance or IaaS.

Answer

Azure Cosmos DB with encryption at rest

Answer

Azure SQL Managed Instance with customer-managed keys

Answer

SQL Server on Azure Virtual Machine with BitLocker

Question 3

Your organization is planning to migrate a large number of on-premises file servers to Azure. The data includes millions of small files. You need to select a storage solution that supports SMB protocol and can handle high file counts. Which TWO Azure services meet these requirements?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB file shares in the cloud, supporting the SMB protocol natively and capable of handling high file counts (up to 100 million files per share with large shares enabled). This makes it a direct match for migrating on-premises file servers with millions of small files.

Answer

Azure Stack Edge

Answer

Azure Blob Storage with NFS 3.0

Answer

Azure Disk Storage

Question 4

A company is designing a hybrid network architecture that connects an on-premises data center to Azure. The requirements include high availability (99.99% SLA), low latency, and the ability to use existing MPLS connections. Which THREE Azure connectivity options should be considered?

Accepted Answer

Azure Virtual WAN with ExpressRoute. Azure ExpressRoute provides dedicated, private connectivity with high bandwidth and low latency, meeting the 99.99% SLA requirement. Azure Virtual WAN with ExpressRoute integrates ExpressRoute into a managed wide-area network, simplifying connectivity and also offering 99.99% SLA. Azure VPN Gateway (active-active) only provides up to 99.95% SLA, not meeting the 99.99% requirement, so it is not a valid option for the stated SLA.

Answer

Azure VPN Gateway (active-active)

Answer

Azure Traffic Manager

Answer

Azure Private Link

Question 5

Your company, Contoso Ltd., is migrating its on-premises e-commerce application to Azure. The application consists of a web frontend, an API layer, and a SQL Server database. The migration must meet the following requirements:
- The web frontend must automatically scale out based on CPU utilization.
- The API layer must be stateless and scale out based on request count.
- The database must be a managed service with high availability and disaster recovery across Azure regions.
- All components must be secured using Azure Firewall and Web Application Firewall (WAF).
- The solution must minimize operational overhead.

You propose the following architecture:
- Azure App Service for the web frontend with autoscaling rules based on CPU.
- Azure Functions for the API layer (stateless, scaling based on request count).
- Azure SQL Database with active geo-replication for the database.
- Azure Front Door with WAF policies for global load balancing and security.
- Azure Firewall to control outbound traffic.

Which component of this design should be reconsidered to better meet the requirement to minimize operational overhead?

Accepted Answer

Replace Azure Front Door with Azure Traffic Manager. The design aims to minimize operational overhead by using fully managed services. Azure Front Door, while feature-rich, introduces additional management overhead due to its WAF policies, custom domain configuration, and rule sets. For an e-commerce application, Azure Traffic Manager provides simpler DNS-based global load balancing with lower operational overhead. Security can still be achieved by combining Azure Firewall and Web Application Firewall (WAF) at the application level. Thus, replacing Front Door with Traffic Manager better aligns with minimizing operational overhead.

Answer

Replace Azure App Service with Azure Virtual Machine Scale Sets

Answer

Replace Azure Functions with Azure Kubernetes Service (AKS)

Answer

Replace Azure SQL Database with Azure SQL Managed Instance

Question 6

A company is designing a hub-spoke network topology in Azure. The hub contains a third-party network virtual appliance (NVA) for inspection. Spokes need to communicate with each other, and all inter-spoke traffic must be routed through the NVA in the hub. Which configuration should they use?

Accepted Answer

Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA. User-defined routes (UDRs) allow you to explicitly override Azure's default system routes. By adding a route in each spoke subnet with the hub NVA's private IP as the next hop for inter-spoke traffic (e.g., 10.1.0.0/16 -> 10.0.0.4), all traffic between spokes is forced through the NVA for inspection. This ensures the hub-spoke topology meets the requirement without relying on Azure Firewall or Internet routing.

Answer

Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet

Answer

Configure Azure Firewall in the hub with forced tunneling to on-premises

Answer

Use VNet peering with gateway transit enabled

Question 7

A company is deploying a web application on Azure App Service. They need to guarantee that all traffic from the internet goes through a Web Application Firewall (WAF) before reaching the app. The solution must be cost-effective for a single application. Which Azure service should they place in front of the App Service?

Accepted Answer

Azure Application Gateway with WAF.. Azure Application Gateway with WAF is the correct choice because it provides a regional, layer-7 load balancer with built-in Web Application Firewall capabilities, designed to protect web applications from common exploits and vulnerabilities. For a single application, it is more cost-effective than Azure Front Door, which is a global service with higher minimum costs and additional features not required here. Application Gateway can be deployed directly in front of App Service to inspect and filter all internet traffic before it reaches the app.

Answer

Azure Front Door with WAF policy.

Answer

Azure Firewall with application rules.

Answer

Azure Traffic Manager.

Question 8

A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is a managed networking service that aggregates branch, VPN, and ExpressRoute connectivity into a single hub-and-spoke architecture. It automatically handles routing between branches and Azure, supports any-to-any connectivity, and integrates natively with ExpressRoute and VPN gateways, making it the correct choice for a scalable, managed solution that simplifies network architecture.

Answer

Azure Virtual Network

Answer

Azure ExpressRoute

Answer

Azure VPN Gateway

Question 9

A company runs a high-performance computing (HPC) workload on Azure that requires extremely low latency (under 10 microseconds) between multiple VMs for MPI communication. The VMs are part of a single job and must be placed together to minimize network latency. Which VM deployment option should they use?

Accepted Answer

Azure Virtual Machine Scale Sets with a Proximity Placement Group. A Proximity Placement Group (PPG) within a Virtual Machine Scale Set ensures that all VMs are physically located as close as possible within an Azure datacenter, reducing network latency to under 10 microseconds for MPI communication. This is the only option that guarantees co-location of VMs for a single HPC job, as PPGs minimize inter-VM latency by placing VMs in the same rack or cluster.

Answer

Azure Availability Sets

Answer

Azure Virtual Machine Scale Sets across Availability Zones

Answer

Azure Kubernetes Service (AKS)

Question 10

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

Accepted Answer

A. Azure ExpressRoute provides a private, high-bandwidth, and reliable connection from on-premises data centers to Azure, bypassing the public internet. To meet the low-cost backup requirement, Azure VPN Gateway (Site-to-Site VPN) offers a secure, encrypted connection over the internet as a failover path, which is significantly cheaper than a second ExpressRoute circuit. This combination ensures primary connectivity via ExpressRoute and cost-effective redundancy via VPN.

Answer

B

Answer

C

Answer

D

Question 11

A company is deploying a multi-tier web application on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must be isolated within the virtual network. The solution must provide SSL termination, web application firewall (WAF) capabilities, and URL-based routing. Which Azure service should they use to expose the web tier?

Accepted Answer

Use Azure Application Gateway with WAF, and configure NSGs to restrict traffic between tiers.. Azure Application Gateway is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL-based routing, making it ideal for exposing a web tier to the internet. By placing the gateway in front of the web tier and configuring network security groups (NSGs) on the application and database subnets, you can isolate internal tiers while meeting all stated requirements.

Answer

Use an Azure Load Balancer and configure NSGs on each subnet.

Answer

Use Azure Firewall to inspect all traffic and allow internet traffic to the web tier.

Answer

Use Azure Front Door to expose the web tier and NSGs for internal isolation.

Question 12

A global company is deploying a microservices application on AKS clusters in multiple Azure regions. They need to provide a single endpoint for users worldwide with SSL offloading, web application firewall, and URL path-based routing to the nearest healthy AKS cluster. They also need global load balancing with automatic failover. Which Azure service should they use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides global HTTP/HTTPS load balancing with SSL offloading, web application firewall (WAF) integration, and URL path-based routing. It uses Anycast-based routing to direct users to the nearest healthy AKS cluster, ensuring low latency and automatic failover across regions.

Answer

Azure Application Gateway

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Question 13

A company has a hub-spoke network topology in Azure. They have multiple spoke VNets connected to a hub VNet via peering. They need to ensure that all east-west traffic between spoke VNets goes through a network virtual appliance (NVA) in the hub for inspection. Additionally, all outbound internet traffic from spoke VMs must use a single public IP address. What should they configure?

Accepted Answer

Configure VNet peering with 'Allow forwarded traffic' enabled, add user-defined routes in each spoke pointing to the NVA IP for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet with a default route in spokes.. It combines two critical configurations: user-defined routes (UDRs) in each spoke VNet force inter-spoke traffic through the NVA in the hub by specifying the NVA's IP as the next hop, and 'Allow forwarded traffic' on the VNet peering enables the hub NVA to forward packets between spokes. For outbound internet traffic, Azure Firewall in the hub provides a single public IP, and a default route (0.0.0.0/0) in the spoke UDRs directs all internet-bound traffic to the Azure Firewall's private IP, ensuring centralized inspection and egress.

Answer

Configure spoke VNets with a default route to the NVA IP, and deploy a NAT gateway in the hub for outbound traffic.

Answer

Configure a route table in each spoke with a route to the hub NVA for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet traffic.

Answer

Enable 'Allow gateway transit' on the hub VNet and 'Use remote gateways' on the spoke VNets for the NVA.

Question 14

A company plans to deploy a stateless web application on Azure virtual machines. They want to ensure that the application remains available in the event of a hardware failure within a single Azure datacenter. The VMs must be placed in a way that ensures they are on different physical servers and racks, but are still within the same datacenter. Which deployment strategy should they use?

Accepted Answer

Deploy the VMs in an Availability Set.. An Availability Set ensures that VMs are distributed across multiple fault domains (different physical servers, racks, and network switches) and update domains within a single Azure datacenter. This protects against hardware failures in that datacenter by guaranteeing that not all VMs are affected by the same local failure, while keeping them in the same datacenter for low-latency communication.

Answer

Deploy the VMs in different Availability Zones.

Answer

Deploy the VMs in a single Virtual Machine Scale Set with a large instance count.

Answer

Deploy each VM in a separate resource group.

Question 15

A company is deploying a web application that must be accessible from the internet. The application is hosted on Azure virtual machines in a virtual network. The solution must provide SSL termination, web application firewall (WAF) protection, and URL path-based routing (e.g., /api/* to one backend pool, /app/* to another). The web tier must not be directly exposed to the internet. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL path-based routing. It can route traffic to different backend pools based on URL paths (e.g., /api/* and /app/*) while keeping the web tier isolated within the virtual network, as the gateway itself is exposed to the internet.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Traffic Manager