AZ-305 Design infrastructure solutions Practice Test 18 — 15 Questions

Question 1

Your company has a multi-region Azure deployment with virtual networks in East US and West Europe connected via a hub-and-spoke topology. You need to ensure that all traffic between the spokes is routed through a centralized firewall in the hub. The hub uses Azure Firewall. Currently, spoke-to-spoke traffic is not being inspected. What should you configure?

Accepted Answer

Use Azure Firewall Manager to enforce routing by adding route tables to the spoke subnets with a default route to the firewall.. Option B is correct because you need to add route tables to the spoke subnets with a default route (0.0.0.0/0) to the Azure Firewall private IP to force all traffic through the firewall. Azure Firewall Manager can push these routes automatically. Option A is wrong because peering alone does not force routing through the firewall. Option C is wrong because VPN gateways are not required for this purpose. Option D is wrong because NSGs do not route traffic; they filter.

Answer

Apply NSG rules to block direct spoke-to-spoke traffic.

Answer

Configure VNet peering between all spokes.

Answer

Deploy VPN gateways in each spoke and configure site-to-site VPNs.

Question 2

Your organization is migrating an on-premises application to Azure. The application consists of a load-balanced web tier and a backend SQL Server database. The web tier requires session persistence (sticky sessions) and SSL offload. You need to design a solution that meets these requirements with minimal operational overhead. Which Azure service should you use for the web tier load balancing?

Accepted Answer

Azure Application Gateway. Option D is correct because Application Gateway provides application-layer load balancing with session affinity (sticky sessions) and SSL offload built-in. Option A is wrong because Traffic Manager is DNS-based and does not support session persistence or SSL offload. Option B is wrong because Front Door is a global load balancer optimized for HTTP/S but adds complexity for a single-region deployment. Option C is wrong because Load Balancer operates at Layer 4 and does not support SSL offload or application-layer session persistence.

Answer

Azure Traffic Manager

Answer

Azure Front Door

Answer

Azure Load Balancer

Question 3

You are designing a disaster recovery strategy for an Azure virtual machine running a critical application. The VM is in the East US region. Your recovery point objective (RPO) is 15 minutes, and your recovery time objective (RTO) is 1 hour. Which Azure service should you use to replicate the VM to the West US region?

Accepted Answer

Azure Site Recovery. Option A is correct because Azure Site Recovery provides automated replication with RPO as low as 30 seconds and RTO of minutes to hours. Option B is wrong because Azure Backup is for backup, not replication for DR. Option C is wrong because Azure Migrate is for assessment and migration. Option D is wrong because Azure Traffic Manager is for traffic routing.

Answer

Azure Traffic Manager

Answer

Azure Backup

Answer

Azure Migrate

Question 4

Refer to the exhibit. You are reviewing an Azure Policy definition that your team plans to assign. The policy is intended to deny the deployment of virtual networks and virtual machines if they do not have an NSG attached with a rule named containing 'Allow'. However, the policy is not working as expected. What is the most likely reason?

Accepted Answer

The policy does not check whether the NSG is actually associated with the resource.. Option C is correct because the existenceCondition checks the NSG rule name on the NSG resource, but the policy's 'if' condition only checks the resource type. The policy does not ensure that the NSG is associated with the subnet or NIC; an NSG can exist without being attached. Option A is wrong because the policy syntax is valid. Option B is wrong because 'deny' is a valid effect. Option D is wrong because the policy rule does not use aliases incorrectly.

Answer

The field 'Microsoft.Network/networkSecurityGroups/securityRules[*].name' is an incorrect alias.

Answer

The policy rule syntax is invalid.

Answer

The effect 'deny' cannot be used with existenceCondition.

Question 5

Your company has an Azure subscription that contains a hub virtual network and multiple spoke virtual networks connected via VNet peering. You need to ensure that all traffic between spokes is routed through a network virtual appliance (NVA) in the hub. The NVA is configured with IP forwarding enabled. What should you configure in the spoke virtual networks?

Accepted Answer

Add route tables to the spoke subnets with a default route (0.0.0.0/0) pointing to the NVA's private IP.. Option A is correct because user-defined routes (UDRs) in the spoke subnets with next hop as the NVA's private IP address force traffic through the NVA. Option B is wrong because BGP alone is not sufficient without route tables. Option C is wrong because VPN gateways are not needed. Option D is wrong because NSGs do not route.

Answer

Deploy a VPN gateway in each spoke and configure site-to-site VPNs.

Answer

Configure NSG rules to block direct spoke-to-spoke traffic.

Answer

Enable BGP on the VNet peerings.

Question 6

You need to design a storage solution for a new application that requires low-latency access to frequently accessed data and also needs to archive data that is older than 90 days to the most cost-effective storage tier. Which Azure storage account type and tier configuration should you recommend?

Accepted Answer

General-purpose v2 account with hot tier and a lifecycle management policy to move to cool tier after 90 days.. Option B is correct because a general-purpose v2 account supports both hot and cool tiers, and lifecycle management can move blobs to the cool tier after 90 days. Option A is wrong because BlockBlobStorage does not support lifecycle management to cool. Option C is wrong because general-purpose v1 does not support tiering. Option D is wrong because premium block blob is for high-performance but not cost-effective for archiving.

Answer

Premium block blob storage account.

Answer

General-purpose v1 account with cool tier.

Answer

BlockBlobStorage account with hot tier.

Question 7

Your company is designing a hybrid identity solution that will allow users to authenticate to Azure resources using their on-premises Active Directory credentials. The solution must support multi-factor authentication (MFA) and conditional access policies. Which TWO components should you include?

Accepted Answer

Microsoft Entra Connect. Options A and D are correct. Microsoft Entra Connect syncs identities to the cloud, and Microsoft Entra ID provides the authentication and policy enforcement. Option B is wrong because ADFS is not required if using password hash sync or pass-through authentication with MFA. Option C is wrong because Intune is for device management, not authentication. Option E is wrong because Azure AD Application Proxy is for publishing on-prem apps.

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Application Proxy

Answer

Microsoft Intune

Question 8

You are designing a network architecture for a critical application that spans multiple Azure regions. The application requires low-latency communication between regions and must maintain connectivity even if an entire region fails. You need to recommend a solution that provides cross-region connectivity with automatic failover. Which TWO options meet the requirements?

Accepted Answer

Azure Front Door. Options A and D are correct. Azure Front Door provides global load balancing with automatic failover across regions. Azure Traffic Manager also provides DNS-based failover. Option B is wrong because VNet peering does not automatically failover; it requires manual action or additional routing. Option C is wrong because VPN Gateway can connect regions but failover is not automatic. Option E is wrong because Azure Firewall is not a WAN connectivity service.

Answer

Azure Firewall

Answer

VPN Gateway

Answer

VNet peering

Question 9

You are designing a backup and disaster recovery strategy for a SQL Server database hosted on an Azure virtual machine. The database is critical and has a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 4 hours. Which THREE services should you include in the solution?

Accepted Answer

Azure Backup. Options B, C, and D are correct. Azure Backup can back up the VM and database with application-consistent backups. Azure Site Recovery replicates the VM to another region for DR. Azure SQL Database auto-failover groups are for PaaS, not IaaS. Option A is wrong because Azure SQL Database is a different service; for SQL Server on VM, you need IaaS solutions. Option E is wrong because Azure Files is for file shares, not SQL.

Answer

Azure Files

Answer

Azure SQL Database auto-failover groups

Question 10

Your organization needs to ensure that all Azure resources are compliant with corporate security policies. You need to design a solution that can enforce policies at scale, audit compliance, and automatically remediate non-compliant resources. Which THREE Azure services should you include?

Accepted Answer

Azure Policy. Options A, C, and D are correct. Azure Policy enforces rules, Azure Blueprints packages policies, and Azure Automation can run remediation scripts. Option B is wrong because Azure RBAC is for access control, not policy enforcement. Option E is wrong because Azure Monitor is for monitoring, not policy.

Answer

Azure Monitor

Answer

Azure RBAC

Question 11

Your company, Contoso Ltd., operates a global e-commerce platform hosted on Azure. The architecture consists of: (1) A web front-end running on Azure App Service in multiple regions (East US, West Europe, Southeast Asia). (2) A microservices backend running on Azure Kubernetes Service (AKS) in East US. (3) A SQL Database in East US with geo-replication to West Europe and Southeast Asia for read scaling. (4) Azure Redis Cache for session state. (5) Azure Front Door for global load balancing. The platform experiences periodic traffic spikes, and during a recent spike, users reported slow page loads and intermittent errors. The operations team observed that the SQL Database in East US reached 100% DTU consumption, causing timeouts. The geo-replicated databases in other regions were underutilized. The application logic is read-heavy but also writes to a separate write-only table. You need to design a solution to improve scalability and reduce database load. The solution must: minimize latency for users, ensure write consistency, and handle traffic spikes without over-provisioning. What should you do?

Accepted Answer

Configure read-only routing in the application connection string to use the geo-replicated databases for read queries, and keep writes directed to the primary.. Option B is correct because it offloads read traffic to read replicas, which is the most effective way to reduce primary database load. Option A is wrong because increasing DTU is expensive and does not scale globally. Option C is wrong because Redis is already used for caching; further caching may help but does not address database read load as directly. Option D is wrong because splitting the database into shards adds complexity and may not be necessary.

Answer

Upgrade the SQL Database in East US to a higher DTU tier and enable auto-scaling.

Answer

Implement a second-level cache using Azure Cache for Redis with a local cache pattern in the web front-end.

Answer

Shard the database by customer region and deploy shards in each region.

Question 12

Your organization is migrating a legacy on-premises application to Azure. The application uses a monolithic architecture and requires high availability. The application tier runs on Windows Server and uses a SQL Server database. You need to design a migration strategy that minimizes changes to the application code while maximizing availability. The application can be stateless if session state is externalized. You have the following requirements: (1) The application must be resilient to Azure region failures. (2) The database must have an RPO of 5 minutes and RTO of 1 hour. (3) The migration must be completed within 6 months. (4) The solution should use platform-as-a-service (PaaS) services where possible to reduce operational overhead. Which approach should you recommend?

Accepted Answer

Migrate the web tier to Azure App Service with staging slots and use Azure SQL Database with active geo-replication.. Option C is correct because Azure App Service provides a PaaS environment that can host the web tier with minimal code changes, and Azure SQL Database with active geo-replication meets the RPO/RTO requirements. Option A is wrong because Azure VMs are IaaS, not PaaS, and require more management. Option B is wrong because Azure Container Instances are not ideal for monolithic apps. Option D is wrong because Azure Functions are event-driven and not suitable for a monolithic application.

Answer

Rehost the application on Azure VMs in an availability set and use SQL Server Always On Availability Groups.

Answer

Refactor the application into microservices and deploy to Azure Kubernetes Service.

Answer

Containerize the application using Docker and deploy to Azure Container Instances in paired regions.

Question 13

Your company is designing a new application that will process large volumes of streaming data from IoT devices. The data will be ingested, processed in near real-time, and stored for long-term analytics. You need to design a solution that meets the following requirements: (1) Ingest up to 1 million events per second. (2) Process events with a latency of less than 10 seconds. (3) Store processed data for 7 years for compliance. (4) Enable ad-hoc querying of the stored data. Which combination of Azure services should you recommend?

Accepted Answer

Azure Event Hubs, Azure Stream Analytics, and Azure Data Lake Storage Gen2.. Option D is correct because Event Hubs ingests high-volume streaming data, Stream Analytics processes it in real-time, and Azure Data Lake Storage Gen2 provides cost-effective long-term storage with query capabilities via Azure Synapse or U-SQL. Option A is wrong because IoT Hub is for device management, not high-throughput ingestion. Option B is wrong because Service Bus is for messaging, not streaming. Option C is wrong because Cosmos DB is not optimized for long-term analytics storage.

Answer

Azure IoT Hub, Azure Stream Analytics, and Azure Cosmos DB.

Answer

Azure Service Bus, Azure Functions, and Azure SQL Database.

Answer

Azure Event Hubs, Azure Functions, and Azure Cosmos DB.

Question 14

Your company is expanding its Azure presence to a new region in Asia. You need to design a network connectivity solution between the on-premises data center in New York and the new Azure region in Singapore. The solution must provide high bandwidth, low latency, and high availability. The company already has an ExpressRoute circuit to the East US region. You want to use that circuit to extend connectivity to Singapore if possible. The budget allows for additional ExpressRoute circuits if needed. What should you recommend?

Accepted Answer

Use ExpressRoute Global Reach to connect the on-premises network to the Singapore region via the existing circuit.. Option B is correct because ExpressRoute Global Reach allows you to connect your on-premises network to multiple Azure regions using a single circuit, providing low latency and high bandwidth. Option A is wrong because site-to-site VPN over the internet may have variable latency and is less reliable. Option C is wrong because VNet peering does not connect on-premises to Azure. Option D is wrong because Azure Front Door is a global load balancer, not a WAN connectivity solution.

Answer

Set up a site-to-site VPN between the on-premises network and the Singapore region.

Answer

Deploy Azure Front Door to route traffic between on-premises and Singapore.

Answer

Peer the East US VNet with the Singapore VNet and route traffic through the existing ExpressRoute.

Question 15

Your organization is designing a secure microservices architecture using Azure Kubernetes Service (AKS). The application must be compliant with PCI DSS, which requires strict network segmentation and encryption of data at rest and in transit. You need to design a solution that meets these requirements while minimizing operational overhead. The AKS cluster will be deployed in a virtual network. The application consists of multiple microservices that need to communicate with each other and with an Azure SQL Database. Some microservices are public-facing. Which design should you recommend?

Accepted Answer

Deploy AKS with a private API server, enable network policies, and use a service endpoint or private endpoint for Azure SQL Database.. Option C is correct because a private AKS cluster with a service endpoint on the subnet and Azure SQL Database firewall rules ensures network isolation. AKS can enforce network policies for micro-segmentation. Option A is wrong because a public cluster exposes the API server, which is less secure. Option B is wrong because a jump box adds operational overhead and is not required. Option D is wrong because disabling network policies reduces security.

Answer

Deploy AKS with a public API server and use Network Security Groups (NSGs) to restrict access.

Answer

Deploy AKS with a private API server and use a jump box for administration.

Answer

Deploy AKS with a public API server and disable network policies to simplify management.