AZ-305 Design infrastructure solutions Practice Test 17 — 15 Questions

Question 1

Your organization plans to migrate a legacy on-premises application that uses a proprietary authentication mechanism to Azure. The application must run as a virtual machine and must not require any code changes. You need to design an identity solution that integrates with the application without modifying it. What should you use?

Accepted Answer

Microsoft Entra Application Proxy with Kerberos Constrained Delegation. Option C is correct because Application Proxy with Kerberos Constrained Delegation allows legacy apps using Kerberos authentication to be published without code changes. Option A is wrong because Azure VPN Gateway provides network connectivity, not identity integration. Option B is wrong because Microsoft Entra Domain Services provides domain services but does not directly proxy legacy authentication. Option D is wrong because Azure Bastion provides secure RDP/SSH access, not application-level authentication.

Answer

Azure VPN Gateway

Answer

Microsoft Entra Domain Services

Answer

Azure Bastion

Question 2

A company uses Azure Firewall to secure outbound traffic from a hub virtual network. The security team reports that some traffic is bypassing the firewall because of asymmetric routing. You need to design a solution to force all outbound traffic through the firewall. What should you implement?

Accepted Answer

User Defined Routes (UDRs) with a default route (0.0.0.0/0) pointing to Azure Firewall. Option D is correct because User Defined Routes with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP enforce traffic symmetry. Option A is wrong because Azure Firewall Manager does not enforce routing; it manages policies. Option B is wrong because VNet peering does not force traffic through a firewall. Option C is wrong because Azure Route Server learns routes dynamically but does not enforce forced tunneling.

Answer

VNet peering with gateway transit

Answer

Azure Route Server

Answer

Azure Firewall Manager to enforce routing policies

Question 3

You are designing a backup strategy for Azure virtual machines that must support application-consistent backups and be capable of restoring to a different Azure region. Which solution should you use?

Accepted Answer

Azure Backup. Option C is correct because Azure Backup supports application-consistent backups for VMs and cross-region restore. Option A is wrong because Azure Site Recovery provides disaster recovery, not backup. Option B is wrong because Azure Disk Backup supports disk-level backups but not application-consistent backups. Option D is wrong because Azure Files is a storage service, not a backup service.

Answer

Azure Site Recovery

Answer

Azure Files

Answer

Azure Disk Backup

Question 4

Your company has a hybrid network with multiple on-premises sites connected to Azure via ExpressRoute. You need to design a DNS resolution strategy that allows Azure resources to resolve on-premises hostnames and on-premises clients to resolve Azure hostnames. The solution must minimize administrative overhead. What should you use?

Accepted Answer

Azure DNS Private Resolver. Option B is correct because Azure DNS Private Resolver can resolve between on-premises and Azure DNS zones without additional DNS servers. Option A is wrong because Azure DNS (public) does not resolve private hostnames. Option C is wrong because Azure Firewall DNS proxy requires manual forwarding rules. Option D is wrong because Azure Bastion is not a DNS resolution service.

Answer

Azure Bastion

Answer

Azure DNS public zones with conditional forwarding

Answer

Azure Firewall DNS proxy

Question 5

You are designing a solution for a critical application that requires low latency between multiple Azure regions. The application must handle failover automatically if a region becomes unavailable. You need to distribute traffic across regions and ensure that users are directed to the closest healthy endpoint. What should you implement?

Accepted Answer

Azure Traffic Manager with geographic routing and endpoint monitoring. Option D is correct because Azure Traffic Manager with geographic routing can direct users to the closest region and automatically fail over. Option A is wrong because Azure Front Door uses anycast and is better for HTTP/S applications but not necessarily the closest endpoint for non-HTTP traffic. Option B is wrong because Azure Load Balancer is regional, not global. Option C is wrong because Azure Application Gateway is regional and layer 7 only.

Answer

Azure Standard Load Balancer with cross-region load balancing

Answer

Azure Front Door with priority routing

Answer

Azure Application Gateway with autoscaling

Question 6

You need to design a storage solution for a data lake that will store petabytes of structured and unstructured data. The data must be accessible from Azure Databricks and Azure Machine Learning. The solution must optimize costs by automatically moving data to cooler tiers when access frequency decreases. Which Azure storage solution should you use?

Accepted Answer

Azure Data Lake Storage Gen2. Option B is correct because Azure Data Lake Storage Gen2 provides hierarchical namespace, integration with analytics services, and lifecycle management to tier data to cool and archive tiers. Option A is wrong because Azure Blob Storage (flat namespace) is not optimized for data lake workloads. Option C is wrong because Azure NetApp Files is for high-performance file shares, not data lakes. Option D is wrong because Azure Files is for file shares, not petabyte-scale data lakes.

Answer

Azure Blob Storage (flat namespace)

Answer

Azure NetApp Files

Answer

Azure Files

Question 7

Your organization has a containerized application running on Azure Kubernetes Service (AKS). You need to design a solution to securely store and manage secrets (e.g., database passwords, API keys) that the application consumes. The solution must integrate with AKS and support automatic rotation of secrets. What should you use?

Accepted Answer

Azure Key Vault with the Secrets Store CSI driver. Option C is correct because Azure Key Vault with the Secrets Store CSI driver integrates with AKS to mount secrets as volumes and supports rotation. Option A is wrong because Azure Container Registry stores container images, not secrets. Option B is wrong because Azure App Configuration stores configuration, not secrets, and does not support automatic rotation. Option D is wrong because Azure Managed Identity provides identity, not secret storage.

Answer

Azure App Configuration

Answer

Azure Managed Identity

Answer

Azure Container Registry

Question 8

You are designing a disaster recovery solution for a multi-tier application. The application consists of a web tier, an application tier, and a database tier running SQL Server on Azure VMs. The RPO must be 5 seconds, and the RTO must be 15 minutes. You need to recommend a SQL Server availability solution that meets these requirements. What should you use?

Accepted Answer

SQL Server Always On Availability Groups with synchronous commit and automatic failover. Option A is correct because SQL Server Always On Availability Groups with synchronous commit can achieve an RPO of 5 seconds and an RTO of minutes with automatic failover. Option B is wrong because log shipping has a higher RPO (minutes to hours). Option C is wrong because Azure SQL Database Managed Instance automatic backups have an RPO of up to 5 minutes. Option D is wrong because Azure Site Recovery replication for SQL Server can have an RPO of a few seconds but RTO may exceed 15 minutes due to recovery time.

Answer

Azure SQL Database Managed Instance automatic backups

Answer

Azure Site Recovery with replication of SQL Server VMs

Answer

SQL Server log shipping

Question 9

You are designing a web application that will be hosted on Azure App Service. The application must authenticate users from your company's Microsoft Entra ID tenant. You need to implement authentication without writing any authentication code. What should you use?

Accepted Answer

App Service Authentication (EasyAuth). Option B is correct because EasyAuth (App Service Authentication) provides built-in authentication with Entra ID without requiring code changes. Option A is wrong because Microsoft Authentication Library (MSAL) requires code changes. Option C is wrong because Azure API Management can add authentication but requires configuration and may still need code. Option D is wrong because Azure Front Door does not provide authentication.

Answer

Azure API Management with OAuth 2.0 policy

Answer

Microsoft Authentication Library (MSAL) integrated into the application code

Answer

Azure Front Door with authentication rules

Question 10

Your company is designing a hybrid network architecture that connects multiple on-premises sites to Azure. You need to ensure high availability and redundancy for the connection. Which TWO solutions should you recommend? (Choose two.)

Accepted Answer

Deploy two ExpressRoute circuits in active-passive mode. Options A and D are correct. Active-passive ExpressRoute with redundant circuits provides high availability at the circuit level. VPN Gateway active-active mode provides redundancy for VPN connections. Option B (single ExpressRoute with VPN failover) works but is less redundant than two ExpressRoute circuits. Option C (single VPN gateway) is not highly available. Option E (Azure DNS) does not affect hybrid connectivity.

Answer

Implement Azure DNS Private Resolver for resolution

Answer

Use a single VPN gateway with active-standby mode

Answer

Use a single ExpressRoute circuit with a VPN gateway as failover

Question 11

You are designing a governance and compliance solution for a large Azure environment with multiple subscriptions. The solution must enforce tagging policies, restrict resource types, and ensure compliance with regulatory standards. Which THREE Azure services or features should you use? (Choose three.)

Accepted Answer

Azure Management Groups. Options A, B, and D are correct. Azure Policy enforces tags and restricts resource types. Management Groups allow hierarchical policy assignment. Azure Blueprints (now part of Azure Policy with initiatives) package policies and role assignments. Option C (Resource Graph) is for querying, not enforcement. Option E (Cost Management) monitors costs but not compliance.

Answer

Azure Resource Graph

Answer

Azure Cost Management

Question 12

Your organization is migrating a legacy application to Azure that requires Windows authentication and a fixed IP address. The application will run on an Azure VM. You need to design a networking solution that ensures the VM retains its IP address even after a reboot and that the application can be reached by on-premises users using its hostname. Which TWO actions should you take? (Choose two.)

Accepted Answer

Assign a static private IP address to the VM's NIC. Options A and D are correct. A static private IP ensures the IP does not change after reboot. Azure DNS private zone allows custom DNS resolution for the hostname. Option B (public IP) is not required for internal access. Option C (Azure Bastion) is for management access, not name resolution. Option E (Azure Firewall) is not needed for this scenario.

Answer

Assign a static public IP address to the VM

Answer

Configure Azure Firewall to forward DNS requests

Answer

Connect to the VM using Azure Bastion for name resolution

Question 13

Refer to the exhibit. You are assigned an Azure policy that restricts resource group locations to eastus, westus, and centralus. A user attempts to create a resource group in 'eastus2' and receives a denial. The user argues that there are existing resources in 'eastus2' and that the policy should allow it. What is the best course of action to allow the resource group creation while maintaining compliance?

Accepted Answer

Instruct the user to create the resource group in an allowed location and then deploy resources to 'eastus2'. Option D is correct because the policy applies only to resource groups, not individual resources. The user can create the resource group in an allowed location (e.g., eastus) and then deploy resources to eastus2, as the policy does not restrict resource locations. Option A is wrong because modifying the policy to include eastus2 would weaken compliance. Option B is wrong because creating an exemption is not necessary if the policy does not restrict resource locations. Option C is wrong because disabling the policy would remove compliance.

Answer

Add 'eastus2' to the list of allowed locations in the policy parameters

Answer

Create an Azure Policy exemption for the user's subscription

Answer

Disable the policy assignment for that subscription

Question 14

Refer to the exhibit. You run the Azure Resource Graph query shown. A colleague asks why the query returns no results even though there are VMs in the subscription. The VMs use managed disks with Premium_LRS. What is the most likely reason for the empty result set?

Accepted Answer

The resource type string is case-sensitive; it should be 'Microsoft.Compute/virtualMachines'. Option B is correct because the query specifies 'microsoft.compute/virtualmachines' (all lowercase), but the correct casing includes capital letters: 'Microsoft.Compute/virtualMachines'. Option A is wrong because Premium_LRS is a valid storage account type. Option C is wrong because the query limits to 10 results, which is fine. Option D is wrong because the query does not filter by name.

Answer

The storage account type is incorrectly specified; it should be 'Premium_ZRS'

Answer

The 'limit 10' clause restricts too many results; remove the limit

Answer

The 'name' property does not exist; use 'properties.name' instead

Question 15

Your company is designing a new cloud-native application on Azure that consists of multiple microservices running on Azure Kubernetes Service (AKS). The application must be accessible from the internet via a custom domain name (app.contoso.com) and must support SSL/TLS termination. You need to design a secure ingress solution that provides Web Application Firewall (WAF) capabilities, SSL offloading, and automatic scaling. The solution should also support path-based routing to different microservices (e.g., /api, /web). You have the following options: Option A: Deploy an Azure Application Gateway v2 with WAF in front of the AKS cluster. Configure Application Gateway Ingress Controller (AGIC) to route traffic to the services. Option B: Deploy an Azure Load Balancer with a public IP and install an NGINX ingress controller on AKS. Configure SSL termination on NGINX and use a third-party WAF. Option C: Deploy an Azure Front Door with WAF policy in front of the AKS cluster. Use Azure Private Link to connect Front Door to the internal load balancer of AKS. Option D: Deploy an Azure API Management instance with WAF and expose the microservices through API endpoints. Use Azure Application Gateway as a reverse proxy. Which option best meets the requirements for a high-performance, integrated, and managed solution with minimal operational overhead?

Accepted Answer

Deploy an Azure Application Gateway v2 with WAF in front of the AKS cluster. Configure Application Gateway Ingress Controller (AGIC) to route traffic to the services.. Option A is correct because Azure Application Gateway v2 with WAF provides managed WAF, SSL offloading, automatic scaling, and path-based routing. AGIC simplifies integration with AKS. Option B involves more operational overhead (managing NGINX and third-party WAF). Option C, Azure Front Door, is a global load balancer; it can work but introduces additional latency for regional traffic and requires Private Link, increasing complexity. Option D adds unnecessary complexity with API Management; the requirement does not include API management features.

Answer

Deploy an Azure Front Door with WAF policy in front of the AKS cluster. Use Azure Private Link to connect Front Door to the internal load balancer of AKS.

Answer

Deploy an Azure Load Balancer with a public IP and install an NGINX ingress controller on AKS. Configure SSL termination on NGINX and use a third-party WAF.

Answer

Deploy an Azure API Management instance with WAF and expose the microservices through API endpoints. Use Azure Application Gateway as a reverse proxy.