AZ-305 Design infrastructure solutions Practice Test 17 — 15 Questions

Question 1

You are designing a network architecture for a three-tier application in Azure. The web tier must be accessible from the internet. The application tier must only accept traffic from the web tier. The database tier must only accept traffic from the application tier. Which TWO Azure services should you use to enforce these network rules? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are the correct choice because they act as a distributed, stateful firewall that can filter traffic at the subnet or NIC level using source and destination IP addresses, ports, and protocols. By applying NSGs to the subnets hosting the application and database tiers, you can create inbound rules that restrict traffic to only the preceding tier's subnet or IP range, enforcing the required east-west segmentation without introducing additional latency or cost.

Answer

Azure Bastion

Answer

Azure Front Door

Answer

Azure Firewall

Question 2

Refer to the exhibit. The ARM template provisions a VM. The deployment succeeds but the VM fails to start. What is the most likely cause?

Accepted Answer

The VM size Standard_D2s_v3 is not available in the region. The VM size Standard_D2s_v3 may not be available in the specified region or subscription. ARM template deployments can succeed in provisioning the resource definition, but the VM fails to start if the scheduler cannot allocate a host that supports this VM size. This is a common issue when the size is restricted or not available in the region, causing a delayed failure after deployment.

Answer

The admin password is in plaintext and does not meet complexity requirements

Answer

The data disk size 1023 GB exceeds the maximum for StandardSSD_LRS

Answer

The network interface resource ID is incorrectly formatted

Question 3

Refer to the exhibit. A custom role is created. A user assigned this role reports being unable to view the VM's boot diagnostics in the Azure portal. What is the most likely reason?

Accepted Answer

The role lacks permissions to the diagnostics storage account. Boot diagnostics in Azure require access to a storage account where the serial console output and screenshots are stored. Even if the user has Microsoft.Compute/virtualMachines/read permission on the VM, they must also have the appropriate role (e.g., Storage Blob Data Reader) on the diagnostics storage account to read the boot diagnostics data. Without this, the portal will show an error or blank boot diagnostics pane.

Answer

The user does not have permission to start or restart the VM

Answer

The VM is stopped and deallocated

Answer

The role does not include Microsoft.Compute/virtualMachines/read

Question 4

You are a solutions architect for a financial services company. The company is deploying a new critical application on Azure that processes sensitive customer transactions. The application consists of an ASP.NET Core web app (Azure App Service), a REST API (Azure Kubernetes Service), and an Azure SQL Database. The requirements are:

- All data at rest must be encrypted using customer-managed keys (CMK) stored in a managed HSM.
- All network traffic between components must be encrypted and traverse the Microsoft backbone network.
- The web app must be protected against common web attacks (SQL injection, XSS).
- The solution must automatically scale the API based on CPU utilization.
- All API calls must be authenticated using OAuth 2.0 with Microsoft Entra ID.
- Logs from all components must be sent to a central Log Analytics workspace for analysis.
- The solution must have a recovery time objective (RTO) of 1 hour and recovery point objective (RPO) of 5 minutes for the database.

Which combination of Azure services should you recommend to meet ALL requirements?

Accepted Answer

Azure Application Gateway with WAF, Azure SQL Database failover groups, Azure Key Vault Managed HSM, Azure App Service with service endpoint, AKS with HPA, Azure Monitor Agent, Microsoft Entra ID. Meets all requirements: Azure Application Gateway with WAF protects against SQL injection and XSS; Azure SQL Database failover groups provide an RPO of 5 seconds and an RTO of 1 hour (auto-failover); Azure Key Vault Managed HSM stores customer-managed keys for encryption at rest; App Service with service endpoint ensures traffic to other Azure services stays on the Microsoft backbone network (combined with AKS in a VNet, internal traffic stays on backbone); AKS with Horizontal Pod Autoscaler (HPA) scales pods based on CPU utilization; Azure Monitor Agent sends logs to Log Analytics; Microsoft Entra ID authenticates API calls via OAuth 2.0. Option A uses point-in-time restore, which cannot guarantee RPO of 5 minutes and RTO of 1 hour. Option B uses Key Vault Standard instead of Managed HSM. Option C uses cluster autoscaler, which scales nodes, not pods, failing the CPU-based scaling requirement.

Answer

Azure Front Door with WAF, Azure SQL Database point-in-time restore, Azure Key Vault Managed HSM, Azure App Service with private endpoint, AKS with HPA, Azure Log Analytics agent, Microsoft Entra ID

Answer

Azure Front Door with WAF, Azure SQL Database geo-replication, Azure Key Vault (Standard), Azure App Service with private endpoint, AKS with HPA, Azure Diagnostics extension, Microsoft Entra ID

Answer

Azure Application Gateway with WAF, Azure SQL Database active geo-replication, Azure Key Vault Managed HSM, Azure App Service with VNet integration, AKS with cluster autoscaler, Azure Monitor Agent, Microsoft Entra ID

Question 5

A healthcare organization is migrating a regulatory-compliant application to Azure. The application must be isolated from the internet and accessible only from on-premises networks via a private IP address. The solution must minimize latency and maximize throughput for large data transfers. Which Azure networking solution should the organization implement?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated private connection from on-premises networks to Azure, bypassing the public internet. This ensures the application is isolated from the internet, uses private IP addresses, and offers the lowest latency and highest throughput for large data transfers due to dedicated bandwidth and no internet congestion.

Answer

Azure Private Link

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Question 6

A company plans to deploy a web application on Azure App Service that will be accessed by users worldwide. The application must have a single endpoint and use Azure Web Application Firewall (WAF) policies. Which Azure service should be placed in front of the App Service to meet these requirements?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides a single, global endpoint with built-in Web Application Firewall (WAF) policies at the edge. It operates at Layer 7 (HTTP/HTTPS) and uses anycast routing to route user traffic to the nearest App Service instance, ensuring low latency and high availability worldwide.

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 7

A company is designing a hybrid identity solution that allows users to access both on-premises applications and Microsoft 365 using a single identity. The solution must support legacy authentication protocols for on-premises apps and modern authentication for cloud apps. Which Azure service should the company use?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by publishing them through the Microsoft Entra ID service. It supports legacy authentication protocols (such as Integrated Windows Authentication) for on-premises apps while enabling modern authentication (OAuth 2.0, OpenID Connect) for cloud apps like Microsoft 365, all using a single identity from Microsoft Entra ID. This makes it the correct choice for a hybrid identity solution that bridges on-premises and cloud authentication requirements.

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra ID

Answer

Microsoft Entra Connect

Question 8

A financial services company is designing a data platform on Azure that must comply with strict regulatory requirements. The platform will store sensitive customer data in Azure SQL Database. The company needs to prevent data exfiltration and ensure that only authorized Microsoft Entra ID users can access the data. The solution must also encrypt data at rest and in transit. Which combination of Azure services should the company implement?

Accepted Answer

Azure SQL Database with Managed Identity, Azure Private Link, and Transparent Data Encryption (TDE). It combines Managed Identity for secure, password-free authentication to Azure SQL Database, Azure Private Link to eliminate public internet exposure and prevent data exfiltration, and Transparent Data Encryption (TDE) to encrypt data at rest. This trio directly addresses the regulatory requirements for access control, network isolation, and encryption without relying on less secure firewall rules or client-side encryption.

Answer

Azure SQL Database firewall rules, Transparent Data Encryption (TDE), and Always Encrypted

Answer

Azure SQL Database with IP firewall rules, TLS 1.2, and Azure Information Protection

Answer

Azure SQL Database with Microsoft Entra ID authentication, Azure Key Vault, and Azure Storage Service Encryption

Question 9

A company is deploying a new application on Azure Kubernetes Service (AKS). The application requires persistent storage that can be dynamically provisioned and accessed by multiple pods simultaneously. Which Azure storage solution should the company use?

Accepted Answer

Azure Files. Azure Files provides SMB and NFS file shares that can be mounted concurrently by multiple pods in Azure Kubernetes Service (AKS), meeting the requirement for persistent storage that is dynamically provisioned and accessible by multiple pods simultaneously. Azure Files supports the ReadWriteMany (RWX) access mode, which is essential for multi-pod access, and can be dynamically provisioned using a StorageClass with the `provisioner: file.csi.azure.com`.

Answer

Azure Blob Storage

Answer

Azure Disk

Answer

Azure NetApp Files

Question 10

A company is designing a backup strategy for a critical Azure SQL Database. The database is used in a production environment and the company requires the ability to restore to any point within the last 35 days with a maximum granularity of 5 minutes. Which backup configuration should the company choose?

Accepted Answer

Use Azure SQL Database automatic backups with a retention period of 35 days. Azure SQL Database's built-in automatic backups provide point-in-time restore (PITR) with a configurable retention period of up to 35 days and a default backup frequency that enables restore granularity of 5 minutes. This meets the requirement without additional configuration or cost, as automatic backups are enabled by default and include differential and transaction log backups every 5-10 minutes.

Answer

Use Azure Backup for SQL Server in Azure VM

Answer

Configure point-in-time restore with a retention period of 35 days and a backup frequency of 5 minutes

Answer

Configure geo-redundant backup with long-term retention

Question 11

A multinational organization is designing a Microsoft 365 deployment for 10,000 users. The organization requires that all users have a consistent experience and that desktop settings follow users across devices. The solution must also support offline access to files and automatic sync. Which Microsoft 365 service should the organization use?

Accepted Answer

OneDrive for Business. OneDrive for Business is the correct choice because it provides per-user cloud storage with offline file access via Files On-Demand and automatic sync through the OneDrive sync client. It also enables desktop settings (such as desktop, documents, and pictures folders) to follow users across devices via Known Folder Move, ensuring a consistent experience. This directly meets the requirements for offline access, automatic sync, and cross-device settings roaming.

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Answer

Enterprise State Roaming

Question 12

A company is designing a serverless architecture for a real-time data processing pipeline. The pipeline ingests data from IoT devices, processes the data using Azure Functions, and stores the results in Azure Cosmos DB. The solution must scale automatically and minimize cold starts. Which Azure service should the company use to trigger the Azure Functions?

Accepted Answer

Azure Event Grid. Azure Event Grid is the correct choice because it provides a fully managed event routing service that can trigger Azure Functions in near real-time with sub-second latency, minimizing cold starts through its push-based model and support for serverless event handlers. It is ideal for IoT data ingestion scenarios where each device event needs to trigger a function independently, and it scales automatically to handle high throughput without requiring polling or batching.

Answer

Azure Queue Storage

Answer

Azure Event Hubs

Answer

Azure Service Bus

Question 13

Refer to the exhibit. You are analyzing a deployment of Azure Storage account with customer-managed key encryption. The deployment fails with an error indicating that the key vault is not accessible. Which of the following is the most likely cause?

Accepted Answer

The user-assigned managed identity does not have permissions to access the key. When using customer-managed keys (CMK) with Azure Storage encryption, the storage account must authenticate to the key vault to retrieve the key. If a user-assigned managed identity is specified in the encryption policy, that identity must have at least 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the key vault. Without these permissions, the storage account cannot access the key, resulting in a deployment failure with a 'key vault not accessible' error.

Answer

The key vault name is misspelled in the keyUri

Answer

The key vault has a firewall enabled and does not allow access from the storage account

Answer

The key vault is in a different Azure region than the storage account

Question 14

A company is designing a highly available architecture for a web application on Azure VMs. The solution must protect against both planned and unplanned downtime and provide automatic failover. Which TWO Azure services should the company use together? (Choose two.)

Accepted Answer

Azure Availability Zones. Azure Availability Zones (A) protect against datacenter-level failures by distributing VMs across physically separate zones within a region, each with independent power, cooling, and networking. Azure Load Balancer (D) provides automatic failover by distributing incoming traffic across healthy VMs in a backend pool, using health probes to detect and route away from failed instances. Together, they ensure the application remains available during both planned maintenance and unplanned outages, with the Load Balancer handling traffic redirection and Availability Zones providing infrastructure redundancy.

Answer

Azure Site Recovery

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Question 15

A company is designing a backup and disaster recovery solution for an on-premises SQL Server database that will be migrated to Azure. The solution must meet the following requirements: 1) Point-in-time restore up to 30 days. 2) Cross-region restore in case of a regional disaster. 3) Long-term retention of backups for 7 years for compliance. Which THREE Azure services or features should the company use? (Choose three.)

Accepted Answer

Azure Site Recovery. Azure Site Recovery (B) is correct because it provides cross-region replication and orchestrated failover for SQL Server, enabling disaster recovery with the ability to restore in a secondary Azure region. This directly meets the requirement for cross-region restore in case of a regional disaster.

Answer

Azure Backup Server

Answer

Azure Blob Storage