AZ-305 Design infrastructure solutions Practice Test 16 — 15 Questions

Question 1

You are designing a landing zone in Azure for a regulated financial services company. They require that all storage accounts be restricted to specific virtual networks and have encryption using customer-managed keys (CMK). Additionally, they want to ensure that any storage account creation outside of the approved network boundaries is prevented. Which combination of Azure Policy and Network Security controls should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Policy to enforce service endpoints on storage accounts and deny creation if not present, along with a policy requiring CMK encryption.. It combines Azure Policy to enforce service endpoints on storage accounts (denying creation if not present) with a policy requiring customer-managed keys (CMK) for encryption. Service endpoints restrict storage account access to specific virtual networks at the network layer, while the CMK policy ensures compliance with encryption requirements. This directly addresses the company's need to prevent storage account creation outside approved network boundaries and enforce encryption.

Answer

Use Azure Policy to require storage account encryption with CMK, and use network security groups (NSGs) to restrict storage account access to specific subnets.

Answer

Deploy Azure Firewall in the hub virtual network and configure application rules to allow only approved storage accounts.

Answer

Use Azure Policy to require storage accounts to use private endpoints, and use Azure Private Link to restrict access from specific virtual networks.

Question 2

A company plans to migrate an on-premises application with strict low-latency requirements to Azure. The application must communicate with an Azure SQL Database. Which of the following is the best design to minimize latency?

Accepted Answer

Deploy the application and Azure SQL Database in the same Azure region, and connect via Azure Private Link.. The best design because deploying both the application and Azure SQL Database in the same Azure region minimizes network distance and latency. Using Azure Private Link creates a private endpoint for the SQL Database within the application's virtual network, eliminating internet routing and reducing latency further by keeping traffic entirely within the Microsoft backbone network.

Answer

Deploy the application in one region and Azure SQL Database in a different region, using Azure Traffic Manager.

Answer

Deploy the application on-premises and use a Point-to-Site VPN to connect to Azure SQL Database.

Answer

Deploy the application on-premises and use ExpressRoute to connect to Azure SQL Database.

Question 3

You are designing a connectivity solution for a hybrid network. The company has an on-premises network connected to an Azure virtual network via ExpressRoute. They also have a site-to-site VPN to the same Azure virtual network as a backup. When the ExpressRoute connection fails, traffic should automatically fail over to the VPN. How should you configure the routes to ensure automatic failover?

Accepted Answer

Ensure the ExpressRoute connection has a lower BGP metric than the VPN connection; Azure automatically prefers lower metric.. B is correct because when both ExpressRoute and VPN connections use BGP to advertise routes to Azure, Azure automatically selects the route with the lowest BGP metric (MED). By configuring the ExpressRoute connection with a lower BGP metric than the VPN connection, Azure will prefer the ExpressRoute path under normal conditions. If the ExpressRoute fails, its routes are withdrawn, and Azure falls back to the VPN routes, providing automatic failover.

Answer

Configure Azure Traffic Manager with a priority routing method to direct traffic to ExpressRoute first.

Answer

Set the BGP metrics (local preference) on the ExpressRoute connection to be higher than the VPN connection.

Answer

Configure Azure Route Server to propagate routes with a lower metric for the VPN connection.

Question 4

You need to design a storage solution for an application that stores large amounts of unstructured data that is accessed frequently for the first 30 days, then rarely after that. Compliance requirements mandate that data be retained for 7 years. Which of the following is the most cost-effective storage solution?

Accepted Answer

Use Azure Blob Storage with lifecycle management to transition blobs from Hot to Cool to Archive tiers.. Azure Blob Storage lifecycle management allows you to automatically transition blobs from Hot to Cool after 30 days (once the initial frequent access period ends), and then to Archive after an additional period of low access (e.g., another 30 days) to meet the 7-year retention requirement at the lowest cost. The Archive tier provides the cheapest storage for rarely accessed data, while Hot and Cool tiers optimize for the initial high-access period.

Answer

Use Azure Files with snapshots and keep files in the Premium tier for 30 days, then move to Standard tier.

Answer

Use Azure Managed Disks with read-only snapshots and delete snapshots after 7 years.

Answer

Store all data in Blob Storage Hot tier and delete after 7 years.

Question 5

You are designing an authentication solution for a mobile application that uses Azure AD B2C (now Microsoft Entra External ID). The application needs to support social logins (Google, Facebook) and also allow users to sign in with their corporate Microsoft Entra ID accounts. Which of the following identity providers should you configure?

Accepted Answer

Configure Google and Facebook as social identity providers, and add Microsoft Entra ID as a custom identity provider.. Microsoft Entra External ID (Azure AD B2C) supports social identity providers like Google and Facebook natively, and also allows you to add Microsoft Entra ID as a custom (OpenID Connect) identity provider. This enables corporate users to sign in with their existing Entra ID accounts while external users can use social logins, all within a single B2C tenant.

Answer

Use Microsoft Entra ID as the only identity provider and configure federation with Google and Facebook.

Answer

Use Microsoft Entra External ID with Google and Facebook only, and advise corporate users to create local accounts.

Answer

Configure only Google and Facebook as identity providers, and use Microsoft account for corporate users.

Question 6

You are designing a high-availability solution for a stateless web application running on Azure VMs. The solution must provide automatic failover to another region in the event of a regional outage. Which Azure service should you use to distribute traffic across regions?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it is a global, scalable entry point that uses HTTP/HTTPS traffic to provide cross-region load balancing and automatic failover. It supports path-based routing, SSL offload, and health probes that can detect a regional outage and instantly reroute traffic to a healthy region, meeting the requirement for stateless web applications.

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 7

Which TWO of the following are valid considerations when designing a SQL Server Always On availability group in Azure VMs? (Choose two.)

Accepted Answer

The availability group listener should use a static IP address in the same subnet as the primary replica.. The availability group listener in Azure VMs requires a static IP address in the same subnet as the primary replica. This is necessary because the internal load balancer (ILB) used for the listener must have a static frontend IP that matches the listener's IP, and the IP must reside in the same subnet as the primary replica to ensure proper routing and failover behavior.

Answer

The availability group listener can use DHCP to automatically assign an IP address.

Answer

A file share witness is required for the quorum configuration.

Answer

All replicas must be in the same subnet to use a single internal load balancer.

Question 8

Which THREE of the following are best practices for securing an Azure Kubernetes Service (AKS) cluster? (Choose three.)

Accepted Answer

Enable Azure Policy for Kubernetes to enforce security policies.. Option A is correct because Azure Policy for Kubernetes (via the Azure Policy add-on) enforces governance and security controls at scale, such as restricting privileged containers, hostPath mounts, and allowed registries, and it reports compliance for AKS clusters. Option B is correct because integrating Microsoft Entra ID (Microsoft Entra ID) with AKS enables centralized, identity-based authentication using Microsoft Entra ID credentials and supports Kubernetes RBAC authorization, eliminating static local admin accounts. Option C is correct because managed identities (or workload identity) let pods obtain Microsoft Entra ID tokens without storing credentials, enabling secure, secretless access to Azure resources like Key Vault and Storage. Option D is not a best practice: allowing unrestricted pod-to-pod traffic removes segmentation and increases lateral movement risk; network policies (Calico or Azure NPM) should restrict traffic. Option E is incorrect because disabling Kubernetes RBAC removes fine-grained, namespace-scoped authorization; Azure RBAC alone does not replace Kubernetes RBAC for in-cluster permissions, and both should be used together.

Answer

Allow all pod-to-pod communication within the cluster without network policies.

Answer

Disable Kubernetes RBAC and use only Azure RBAC for simplicity.

Question 9

Which TWO of the following are valid data storage solutions for an Azure-based microservices architecture that requires high throughput and low latency? (Choose two.)

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is a fully managed NoSQL database that provides single-digit millisecond read and write latencies at the 99th percentile, guaranteed by SLAs. It supports multiple APIs (SQL, MongoDB, Cassandra, Gremlin, Table) and can be configured for high throughput with automatic indexing, making it ideal for microservices that require fast, scalable data access.

Answer

Azure Table Storage

Answer

Azure Files

Answer

Azure SQL Database

Question 10

Your company is migrating a legacy on-premises application to Azure. The application requires low-latency access to a shared file system that supports SMB protocol. The solution must be highly available within a single Azure region and must not require the application to be modified. Which Azure service should you recommend?

Accepted Answer

Azure Files (premium tier). Azure Files (premium tier) provides fully managed SMB file shares with low-latency access, high availability within a single Azure region, and supports the SMB protocol natively without requiring any application modifications. This makes it the ideal choice for migrating legacy on-premises applications that rely on SMB-based file sharing.

Answer

Azure Managed Disks (SSD)

Answer

Azure NetApp Files

Answer

Azure Blob Storage

Question 11

You are designing a disaster recovery solution for a critical application running in Azure. The application uses Azure SQL Database. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 30 minutes. Which Azure SQL Database configuration should you recommend?

Accepted Answer

Active geo-replication. Active geo-replication is the correct choice because it provides a continuous, asynchronous replication of data to a secondary database in a different Azure region, enabling an RPO of 5 seconds (typically under 5 seconds) and an RTO of 30 minutes or less by manually initiating a failover. This meets the stringent RPO and RTO requirements for a critical application using Azure SQL Database.

Answer

Point-in-time restore to a different region

Answer

Auto-failover groups

Answer

Azure Backup for SQL Server in Azure VM

Question 12

Your company has a web application deployed on Azure App Service that experiences periodic traffic spikes. You need to ensure the application scales out quickly without manual intervention. The solution must minimize cost during low-traffic periods. What should you configure?

Accepted Answer

Configure Autoscale rules based on CPU or memory metrics. Autoscale rules based on CPU or memory metrics allow the App Service to automatically increase or decrease the number of instances in response to traffic spikes, meeting the requirement for quick scaling without manual intervention. By scaling down during low-traffic periods, it minimizes cost, as you only pay for the instances you use. This is the native Azure App Service scaling feature that directly addresses the need for elastic, cost-effective scaling.

Answer

Enable pre-warming in the App Service plan

Answer

Deploy the app to a Virtual Machine Scale Set

Answer

Manually increase the instance count before expected spikes

Question 13

You are designing a solution to securely store and manage secrets for multiple applications deployed in Azure. The solution must support automated rotation of secrets and provide audit logging. Which Azure service should you use?

Accepted Answer

Azure Key Vault with managed identity and rotation policy. Azure Key Vault with a managed identity and a rotation policy is the correct choice because it provides a centralized, secure store for secrets, supports automated rotation via built-in policies or custom logic, and integrates with Azure Monitor for audit logging. Managed identities eliminate the need for hard-coded credentials, and the rotation policy ensures secrets are automatically updated without manual intervention.

Answer

Microsoft Entra ID application registration

Answer

Azure App Service Key Vault references

Answer

Azure Automation with PowerShell runbooks

Question 14

Your company has Azure virtual machines running a critical application. You need to back up these VMs daily and retain backups for 7 years. The solution must be cost-effective and support application-consistent backups. What should you use?

Accepted Answer

Azure Backup. Azure Backup is the correct choice because it provides a native, cost-effective backup solution for Azure VMs that supports application-consistent backups via the Volume Shadow Copy Service (VSS) for Windows and file-system-consistent backups for Linux. It allows you to configure a backup policy with daily backups and a retention duration of up to 99 years, easily meeting the 7-year requirement. Azure Backup also integrates with Azure Recovery Services vault, offering centralized management and long-term retention at a lower cost than other disaster recovery or snapshot-based approaches.

Answer

Azure Files backup

Answer

Azure Site Recovery

Answer

Azure VM snapshots stored in Azure Storage

Question 15

You are designing a solution to monitor a hybrid environment consisting of Azure VMs and on-premises servers. The solution must provide centralized log analytics, security threat detection, and the ability to run custom queries across all logs. Which TWO Azure services should you include? (Choose two.)

Accepted Answer

Azure Log Analytics workspace. A Log Analytics workspace is the central repository in Azure that ingests and stores log data from various sources, including Azure VMs and on-premises servers. It enables you to run custom Kusto Query Language (KQL) queries across all collected logs, which directly satisfies the requirement for centralized log analytics and custom querying.

Answer

Azure Monitor Agent

Answer

Azure Arc

Answer

Azure Update Manager