AZ-305 Design infrastructure solutions Practice Test 18 — 15 Questions

Question 1

A large enterprise is designing a data analytics platform in Azure that will ingest terabytes of data daily from multiple sources, including IoT devices, social media feeds, and internal databases. The data must be stored in a raw format for future processing, and then transformed and aggregated for reporting. The company requires low-latency querying for real-time dashboards and the ability to run complex batch analytics using Spark. The solution must also provide a unified data governance layer for cataloging and lineage tracking. Which combination of Azure services should the company choose to meet all these requirements with minimal operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Data Lake Storage, Azure Synapse Analytics, and Microsoft Purview. Azure Data Lake Storage provides scalable, cost-effective raw storage for terabytes of daily data, Azure Synapse Analytics offers both low-latency querying for real-time dashboards and Spark-based batch analytics, and Microsoft Purview delivers a unified data governance layer with cataloging and lineage tracking. This combination minimizes operational overhead by integrating storage, compute, and governance into a single, managed platform.

Answer

Azure Cosmos DB, Azure Stream Analytics, and Azure Analysis Services

Answer

Azure Blob Storage, Azure HDInsight, and Azure Data Factory

Answer

Azure SQL Database, Azure Databricks, and Azure Data Catalog

Question 2

Your organization plans to migrate a legacy on-premises application that uses a proprietary authentication mechanism to Azure. The application must run as a virtual machine and must not require any code changes. You need to design an identity solution that integrates with the application without modifying it. What should you use?

Accepted Answer

Microsoft Entra Application Proxy with Kerberos Constrained Delegation. Microsoft Entra Application Proxy with Kerberos Constrained Delegation (KCD) allows you to publish on-premises applications that use Kerberos authentication without modifying the application code. The Application Proxy pre-authenticates users via Entra ID, then uses KCD to obtain a Kerberos ticket on behalf of the user and pass it to the legacy application running on a VM. This meets the requirement of no code changes while integrating the proprietary authentication mechanism with Azure identity.

Answer

Azure VPN Gateway

Answer

Microsoft Entra Domain Services

Answer

Azure Bastion

Question 3

A company uses Azure Firewall to secure outbound traffic from a hub virtual network. The security team reports that some traffic is bypassing the firewall because of asymmetric routing. You need to design a solution to force all outbound traffic through the firewall. What should you implement?

Accepted Answer

User Defined Routes (UDRs) with a default route (0.0.0.0/0) pointing to Azure Firewall. User Defined Routes (UDRs) with a default route (0.0.0.0/0) pointing to Azure Firewall as the next hop are the correct solution because they override the system default route and force all outbound traffic from subnets to be forwarded to the firewall, preventing asymmetric routing. Asymmetric routing occurs when traffic takes different paths to and from a destination; by ensuring the firewall is the next hop for all outbound traffic, UDRs guarantee symmetric flow through the firewall.

Answer

VNet peering with gateway transit

Answer

Azure Route Server

Answer

Azure Firewall Manager to enforce routing policies

Question 4

You are designing a backup strategy for Azure virtual machines that must support application-consistent backups and be capable of restoring to a different Azure region. Which solution should you use?

Accepted Answer

Azure Backup. Azure Backup is the correct solution because it provides native support for application-consistent backups of Azure VMs using the Volume Shadow Copy Service (VSS) on Windows or file-system-consistent snapshots on Linux, and it supports Cross-Region Restore (CRR) to recover backups to a different Azure region. This meets both requirements directly without additional configuration.

Answer

Azure Site Recovery

Answer

Azure Files

Answer

Azure Disk Backup

Question 5

Your company has a hybrid network with multiple on-premises sites connected to Azure via ExpressRoute. You need to design a DNS resolution strategy that allows Azure resources to resolve on-premises hostnames and on-premises clients to resolve Azure hostnames. The solution must minimize administrative overhead. What should you use?

Accepted Answer

Azure DNS Private Resolver. Azure DNS Private Resolver enables hybrid DNS resolution by forwarding DNS queries between on-premises networks and Azure virtual networks without requiring domain-joined VMs or custom DNS servers. It supports conditional forwarding to on-premises DNS servers via ExpressRoute, allowing Azure resources to resolve on-premises hostnames and vice versa, while minimizing administrative overhead through a managed service.

Answer

Azure Bastion

Answer

Azure DNS public zones with conditional forwarding

Answer

Azure Firewall DNS proxy

Question 6

You are designing a solution for a critical application that requires low latency between multiple Azure regions. The application must handle failover automatically if a region becomes unavailable. You need to distribute traffic across regions and ensure that users are directed to the closest healthy endpoint. What should you implement?

Accepted Answer

Azure Traffic Manager with geographic routing and endpoint monitoring. Azure Traffic Manager with geographic routing and endpoint monitoring is the correct choice because it operates at the DNS level, directing users to the closest healthy endpoint based on geographic location. This ensures low latency by routing traffic to the nearest region and provides automatic failover by continuously monitoring endpoint health and rerouting traffic if a region becomes unavailable.

Answer

Azure Standard Load Balancer with cross-region load balancing

Answer

Azure Front Door with priority routing

Answer

Azure Application Gateway with autoscaling

Question 7

You need to design a storage solution for a data lake that will store petabytes of structured and unstructured data. The data must be accessible from Azure Databricks and Azure Machine Learning. The solution must optimize costs by automatically moving data to cooler tiers when access frequency decreases. Which Azure storage solution should you use?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with Blob Storage's tiered lifecycle management, enabling petabyte-scale storage for both structured and unstructured data. It integrates natively with Azure Databricks and Azure Machine Learning via the ABFS driver, and its lifecycle policies automatically move data to cooler tiers (cool, archive) based on access frequency, optimizing costs.

Answer

Azure Blob Storage (flat namespace)

Answer

Azure NetApp Files

Answer

Azure Files

Question 8

Your organization has a containerized application running on Azure Kubernetes Service (AKS). You need to design a solution to securely store and manage secrets (e.g., database passwords, API keys) that the application consumes. The solution must integrate with AKS and support automatic rotation of secrets. What should you use?

Accepted Answer

Azure Key Vault with the Secrets Store CSI driver. Azure Key Vault with the Secrets Store CSI driver is the correct choice because it provides a dedicated, secure vault for storing secrets and mounts them directly into AKS pods as volumes or environment variables without exposing them in application code. The CSI driver integrates natively with AKS and supports automatic rotation by periodically polling Key Vault for updated secret versions, ensuring pods consume the latest values without requiring a restart.

Answer

Azure App Configuration

Answer

Azure Managed Identity

Answer

Azure Container Registry

Question 9

You are designing a disaster recovery solution for a multi-tier application. The application consists of a web tier, an application tier, and a database tier running SQL Server on Azure VMs. The RPO must be 5 seconds, and the RTO must be 15 minutes. You need to recommend a SQL Server availability solution that meets these requirements. What should you use?

Accepted Answer

SQL Server Always On Availability Groups with synchronous commit and automatic failover. SQL Server Always On Availability Groups with synchronous commit and automatic failover provides near-zero data loss (RPO of 5 seconds) and rapid automatic failover (RTO of 15 minutes) by replicating data synchronously across replicas. This solution meets the stringent RPO/RTO requirements for a multi-tier application running SQL Server on Azure VMs, as it ensures transactions are committed on both primary and secondary replicas before acknowledging success, and automatic failover occurs within seconds if the primary fails.

Answer

Azure SQL Database Managed Instance automatic backups

Answer

Azure Site Recovery with replication of SQL Server VMs

Answer

SQL Server log shipping

Question 10

You are designing a web application that will be hosted on Azure App Service. The application must authenticate users from your company's Microsoft Entra ID tenant. You need to implement authentication without writing any authentication code. What should you use?

Accepted Answer

App Service Authentication (EasyAuth). App Service Authentication (also known as EasyAuth) is the correct choice because it provides built-in authentication for Azure App Service without requiring any custom code. It integrates directly with Microsoft Entra ID (formerly Azure AD) and automatically handles token validation, session management, and redirects by intercepting HTTP requests before they reach your application code.

Answer

Azure API Management with OAuth 2.0 policy

Answer

Microsoft Authentication Library (MSAL) integrated into the application code

Answer

Azure Front Door with authentication rules

Question 11

Your company is designing a hybrid network architecture that connects multiple on-premises sites to Azure. You need to ensure high availability and redundancy for the connection. Which TWO solutions should you recommend? (Choose two.)

Accepted Answer

Deploy two ExpressRoute circuits in active-passive mode. Deploying two ExpressRoute circuits in active-passive mode provides redundancy for the on-premises-to-Azure connection. If the primary circuit fails, traffic automatically fails over to the passive circuit, ensuring high availability. Option C is correct because an Azure VPN Gateway in active-active mode uses two active tunnels to provide redundancy and load balancing, which is essential for a highly available hybrid network.

Answer

Implement Azure DNS Private Resolver for resolution

Answer

Use a single VPN gateway with active-standby mode

Answer

Use a single ExpressRoute circuit with a VPN gateway as failover

Question 12

You are designing a governance and compliance solution for a large Azure environment with multiple subscriptions. The solution must enforce tagging policies, restrict resource types, and ensure compliance with regulatory standards. Which THREE Azure services or features should you use? (Choose three.)

Accepted Answer

Azure Management Groups. Azure Management Groups (B) are essential for organizing subscriptions hierarchically, enabling the application of governance policies and compliance controls at scale. They allow you to enforce tagging policies, restrict resource types, and ensure regulatory compliance across multiple subscriptions by inheriting Azure Policy and RBAC assignments from the root management group down to individual subscriptions.

Answer

Azure Resource Graph

Answer

Azure Cost Management

Question 13

Your organization is migrating a legacy application to Azure that requires Windows authentication and a fixed IP address. The application will run on an Azure VM. You need to design a networking solution that ensures the VM retains its IP address even after a reboot and that the application can be reached by on-premises users using its hostname. Which TWO actions should you take? (Choose two.)

Accepted Answer

Assign a static private IP address to the VM's NIC. A is correct because assigning a static private IP address to the VM's NIC ensures the IP address persists across reboots, which is required for Windows authentication and legacy application dependencies that rely on a fixed IP. This is done by setting the private IP allocation method to 'Static' in the NIC's IP configuration, preventing DHCP from assigning a new address after a restart.

Answer

Assign a static public IP address to the VM

Answer

Configure Azure Firewall to forward DNS requests

Answer

Connect to the VM using Azure Bastion for name resolution

Question 14

Refer to the exhibit. You are assigned an Azure policy that restricts resource group locations to eastus, westus, and centralus. A user attempts to create a resource group in 'eastus2' and receives a denial. The user argues that there are existing resources in 'eastus2' and that the policy should allow it. What is the best course of action to allow the resource group creation while maintaining compliance?

Accepted Answer

Instruct the user to create the resource group in an allowed location and then deploy resources to 'eastus2'. Azure Policy evaluates resource group location at creation time, not the location of individual resources within it. A resource group is a logical container that can hold resources in any region, regardless of the resource group's own location. By creating the resource group in an allowed location (eastus, westus, or centralus), the user satisfies the policy constraint while still being able to deploy resources to 'eastus2' within that resource group.

Answer

Add 'eastus2' to the list of allowed locations in the policy parameters

Answer

Create an Azure Policy exemption for the user's subscription

Answer

Disable the policy assignment for that subscription

Question 15

Refer to the exhibit. You run the Azure Resource Graph query shown. A colleague asks why the query returns no results even though there are VMs in the subscription. The VMs use managed disks with Premium_LRS. What is the most likely reason for the empty result set?

Accepted Answer

The resource type string is case-sensitive; it should be 'Microsoft.Compute/virtualMachines'. The query specifies 'microsoft.compute/virtualmachines' (all lowercase), but the correct casing includes capital letters: 'Microsoft.Compute/virtualMachines'. Option A is wrong because Premium_LRS is a valid storage account type. Option C is wrong because the query limits to 10 results, which is fine. Option D is wrong because the query does not filter by name.

Answer

The storage account type is incorrectly specified; it should be 'Premium_ZRS'

Answer

The 'limit 10' clause restricts too many results; remove the limit

Answer

The 'name' property does not exist; use 'properties.name' instead