AZ-305 Design infrastructure solutions Practice Test 2 — 15 Questions

Question 1

Your company plans to migrate on-premises SQL Server databases to Azure. The databases require high availability with automatic failover to a secondary region in the event of a regional outage. The solution must minimize data loss and support read-only queries on the secondary replica. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure SQL Database with failover groups. Failover groups provide automatic failover to a secondary region and support readable secondaries. They use asynchronous replication with an RPO of up to 5 seconds, minimizing data loss. Active geo-replication (Option B) does not support automatic failover; it requires manual initiation. Therefore, failover groups are the correct choice for automatic failover with a readable secondary.

Answer

Azure SQL Database with geo-restore

Answer

Azure SQL Database with active geo-replication

Answer

Azure SQL Managed Instance with failover groups

Question 2

You are designing a networking solution for a multi-tier application in Azure. The front-end web tier must be accessible from the internet, while the back-end database tier must only be accessible from the web tier. You need to minimize management overhead and ensure that the back-end tier is not directly reachable from the internet. What should you use?

Accepted Answer

Azure Application Gateway on the web subnet and network security groups on the database subnet. Azure Application Gateway can be placed on the web subnet to provide internet-facing HTTP/HTTPS load balancing for the front-end tier, while network security groups (NSGs) on the database subnet act as a stateful firewall to restrict inbound traffic to only the web tier's private IP addresses or subnet. This combination minimizes management overhead by using native Azure services without requiring additional virtual appliances or complex routing, and it ensures the back-end tier is not directly reachable from the internet by denying all inbound traffic from public sources.

Answer

Azure Bastion for database access and Azure Front Door for web access

Answer

Azure Front Door with private link for the web tier and service endpoints for the database tier

Answer

Azure Firewall in a hub VNet with forced tunneling for all traffic

Question 3

You are designing an identity solution for a multinational corporation that uses Microsoft Entra ID. The company has a complex organizational structure with multiple subsidiaries. You need to ensure that users from one subsidiary cannot access resources in another subsidiary unless explicitly granted. The solution must minimize administrative overhead. What should you use?

Accepted Answer

Administrative units. Administrative units (AUs) in Microsoft Entra ID allow you to delegate administration and restrict management scope to specific subsets of users, groups, or devices. By creating separate AUs for each subsidiary and assigning only the relevant users to each AU, you ensure that users from one subsidiary cannot access resources in another unless explicitly granted via group membership or resource permissions. This minimizes administrative overhead because AUs are managed centrally without requiring separate directories or complex federation.

Answer

Conditional Access policies

Answer

Microsoft Entra B2B collaboration

Answer

Custom directory roles

Question 4

Your company plans to migrate a legacy on-premises application to Azure. The application has a monolithic architecture and requires low-latency access to a shared file system. You need to choose a migration strategy that minimizes changes to the application code. Which TWO options should you recommend? (Choose two.)

Accepted Answer

Use Azure Migrate to perform a lift-and-shift migration to Azure VMs. Option A is correct because Azure Migrate supports lift-and-shift (rehost) migrations of on-premises servers and monolithic applications to Azure VMs, which preserves the existing application code and configuration with minimal changes. Option C is correct because Azure Files provides SMB/NFS file shares that the migrated VMs can mount directly, satisfying the shared file system requirement while keeping the application's file access patterns intact. Option B is incorrect because refactoring to AKS requires containerizing and modifying the application, which increases code changes and complexity. Option D is incorrect because Azure NetApp Files, while offering high-performance file shares, is typically used for specialized workloads and would not minimize changes as directly as Azure Files for a simple lift-and-shift scenario. Option E is incorrect because rearchitecting to microservices involves significant code changes and is not a minimal-change migration strategy.

Answer

Refactor the application to run in Azure Kubernetes Service (AKS)

Answer

Migrate the file share to Azure NetApp Files

Answer

Rearchitect the application to use a microservices architecture

Question 5

Your company is designing a new application that will run on Azure VMs. The application must be highly available across two Azure regions. You need to ensure that the application can automatically fail over if a regional outage occurs. Which THREE components should you include in the architecture? (Choose three.)

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager (B) is correct because it is a DNS-based global traffic load balancer that can route users to endpoints in different Azure regions and automatically fail over to a secondary region when the primary becomes unavailable, which directly satisfies the cross-region automatic failover requirement. Availability Zones (D) is correct because deploying VMs across Availability Zones within a region protects the application from datacenter-level failures and provides the in-region high availability that complements cross-region failover. Azure Load Balancer (E) is correct because it distributes traffic across VMs within a region at Layer 4 and works with health probes to remove unhealthy instances, providing the regional load-balancing and resilience layer needed in each region. Azure Application Gateway (A) is not selected because it is a regional Layer 7 web traffic load balancer and does not by itself provide cross-region failover. Availability Sets (C) is not selected because it only protects against hardware failures within a single datacenter and does not provide zone-level or cross-region high availability.

Answer

Azure Application Gateway

Answer

Availability Sets

Question 6

You are designing a storage solution for a new application that will store large binary files (up to 5 TB each) and require high throughput for sequential reads. The data is accessed infrequently but must be retained for 7 years for compliance. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage in the Cool tier. Azure Blob Storage in the Cool tier is correct because it supports objects up to 5 TB in size (with block blobs) and provides high throughput for sequential reads, which is ideal for large binary files. The Cool tier offers low storage costs for infrequently accessed data while meeting the 7-year retention requirement, and it can be combined with lifecycle management policies to transition data to Archive tier if needed.

Answer

Azure Managed Disks with Standard HDD

Answer

Azure Files shares in the Premium tier

Answer

Azure NetApp Files with Standard service level

Question 7

Your company is deploying a new application that uses Azure Cosmos DB for globally distributed low-latency reads and writes. The application must be highly available with a recovery point objective (RPO) of less than 5 seconds and recovery time objective (RTO) of less than 1 second in case of a regional outage. Which Cosmos DB configuration should you recommend?

Accepted Answer

Multiple write regions enabled with automatic failover and session consistency.. Enabling multiple write regions with automatic failover ensures that if a write region fails, another region continues accepting writes, meeting the sub-1-second RTO. Session consistency provides read-your-writes and monotonic guarantees, and with multiple write regions, replication lag is typically low enough to achieve an RPO under 5 seconds. Other options either rely on manual failover (higher RTO) or single-write regions that cannot achieve sub-1-second RTO during regional outages.

Answer

Multiple write regions with manual failover and eventual consistency.

Answer

Single write region with strong consistency and multi-region writes disabled.

Answer

Single write region with multiple read regions and multi-region writes disabled.

Question 8

You are reviewing a network security group (NSG) rule for a subnet that hosts web servers. The subnet's address space is 10.0.1.0/24. What is the effect of this rule?

Accepted Answer

The rule allows inbound TCP traffic on ports 80 and 443 from any source.. The rule's source is set to 'VirtualNetwork', which includes all subnets and resources within the same virtual network (including peered networks). Therefore, it allows inbound TCP traffic on ports 80 and 443 from any source that is part of the virtual network, but not from the internet or other external sources.

Answer

The rule allows inbound TCP traffic on ports 80 and 443 from the same subnet.

Answer

The rule denies inbound TCP traffic on ports 80 and 443 from any source.

Answer

The rule allows inbound TCP traffic on ports 80 and 443 from the internet.

Question 9

You are designing a highly available architecture for a stateful application running on Azure Virtual Machines. The application requires a shared storage solution that supports concurrent read/write access from multiple VMs, and must be resilient to zone failures. Which TWO Azure solutions meet these requirements? (Choose TWO.)

Accepted Answer

Azure NetApp Files with cross-zone replication. Option B (Azure NetApp Files with cross-zone replication) is correct because Azure NetApp Files is a fully managed, high-performance file storage service that natively supports concurrent read/write (NFS/SMB) access from multiple VMs, and its cross-zone replication feature provides resilience against availability zone failures by replicating volumes across zones. Option C (Azure Files Premium tier with ZRS) is correct because Azure Files supports SMB and NFS protocols allowing simultaneous multi-VM read/write access, and the Premium tier with zone-redundant storage synchronously replicates data across three availability zones in a region, delivering zone-failure resilience. Option A is not correct because shared disks on Azure Disk Storage only support a limited set of clustered scenarios (e.g., Windows Server Failover Clustering, SUSE/Red Hat HA) and are zone-scoped, not zone-resilient by themselves. Option D is not correct because Standard SSD managed disks are single-attach by default and do not provide concurrent multi-VM write access or zone-failure resilience. Option E is not correct because Blob Storage is object storage accessed via REST/HTTP, not a shared file system for concurrent VM read/write, and GRS replicates to a paired region rather than providing zone-level resilience.

Answer

Azure Disk Storage with shared disks enabled

Answer

Azure Managed Disks with Standard SSD

Answer

Azure Blob Storage with hot access tier and geo-redundant storage (GRS)

Question 10

Your organization is designing a data platform for real-time analytics on streaming data from IoT devices. The solution must ingest millions of events per second, process the data with low latency, and store results in a format optimized for analytical queries. Which THREE Azure services should you include in the design? (Choose THREE.)

Accepted Answer

Azure Event Hubs. Azure Event Hubs (A) is correct because it is a fully managed, distributed event-ingestion service designed to receive millions of events per second with low latency, making it ideal for high-throughput IoT streaming ingestion. Azure Stream Analytics (B) is correct because it provides real-time stream processing with SQL-like queries and sub-second latency, enabling continuous analytics on the data flowing from Event Hubs. Azure Synapse Analytics (D) is correct because it stores and queries results in a columnar, massively parallel processing format optimized for analytical (OLAP) workloads. Azure Functions (C) is not the best fit because it is a serverless compute service for event-driven code execution, not a dedicated high-throughput streaming ingestion or analytical storage engine. Azure IoT Hub (E) is not selected because, while it handles IoT device connectivity and command/control, Event Hubs is the appropriate high-scale telemetry ingestion service for millions of events per second in this analytics scenario.

Answer

Azure Functions

Answer

Azure IoT Hub

Question 11

You need to design a solution to securely connect an on-premises data center to Azure for hybrid workloads. The connection must be private, use the internet for transport, and provide high availability. Which TWO Azure services should you consider? (Choose TWO.)

Accepted Answer

Azure VPN Gateway (Site-to-Site VPN). Azure VPN Gateway (Site-to-Site VPN) (C) is correct because it establishes an encrypted IPsec/IKE tunnel over the public internet between on-premises VPN devices and an Azure VPN gateway, satisfying the private, internet-transported connectivity requirement for hybrid workloads. Azure VPN Gateway in active-active mode (D) is correct because deploying two gateway instances with two public IP addresses provides high availability and failover for the Site-to-Site tunnel, meeting the HA requirement. Azure Virtual WAN (A) is a networking service that can aggregate connectivity but is not itself the required secure tunnel mechanism for this scenario. Azure ExpressRoute (B) is incorrect because it uses a dedicated private circuit through a connectivity provider rather than the internet. Azure Bastion (E) is incorrect because it provides RDP/SSH access to VMs through the Azure portal over TLS, not site-to-site hybrid connectivity.

Answer

Azure Virtual WAN

Answer

Azure ExpressRoute

Answer

Azure Bastion

Question 12

Your company has a hybrid identity environment using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to authenticate to Azure services using their on-premises credentials and enforce conditional access policies for sensitive applications. The solution must support multi-factor authentication (MFA) using the Microsoft Authenticator app. Which components should you include?

Accepted Answer

Microsoft Entra Connect Sync, Microsoft Entra ID, and Conditional Access policies with MFA.. Microsoft Entra Connect Sync synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials. Conditional Access policies in Microsoft Entra ID can then enforce MFA using the Microsoft Authenticator app for sensitive applications, meeting all requirements without additional infrastructure.

Answer

Microsoft Entra Connect Health, Microsoft Entra ID with cloud sync, and Azure AD Identity Protection.

Answer

Active Directory Federation Services (AD FS), Web Application Proxy, and Azure AD Conditional Access.

Answer

Azure AD Pass-through Authentication, Azure AD Application Proxy, and Azure AD Identity Protection.

Question 13

Which TWO services should you use to design a highly available and scalable web application on Azure that runs on Linux containers and requires automatic scaling based on HTTP traffic? (Choose two.)

Accepted Answer

Azure Application Gateway. Azure Application Gateway (C) is correct because it is a layer-7 (HTTP/HTTPS) load balancer that provides URL-based routing, SSL termination, and autoscaling, which directly satisfies the requirement for automatic scaling based on HTTP traffic. Azure Kubernetes Service (D) is correct because it orchestrates Linux containers with the Horizontal Pod Autoscaler and cluster autoscaler, enabling highly available, scalable deployments that can scale on HTTP-driven metrics when paired with an ingress controller. Azure Load Balancer (A) is not correct because it operates at layer 4 (TCP/UDP) and cannot make routing or scaling decisions based on HTTP traffic. Azure Web App for Containers (B) is not correct because, while it runs Linux containers and supports autoscaling, it is a PaaS web hosting service rather than a service for designing a highly available, scalable container-orchestration solution. Azure Container Instances (E) is not correct because it provides single, short-lived container groups without built-in orchestration, high availability, or HTTP-based autoscaling.

Answer

Azure Load Balancer

Answer

Azure Web App for Containers

Answer

Azure Container Instances (ACI)

Question 14

Which THREE components are required to implement a hybrid cloud solution that extends on-premises Active Directory to Azure and provides single sign-on (SSO) to cloud applications? (Choose three.)

Accepted Answer

Microsoft Entra Connect Sync. Option B (Microsoft Entra Connect Sync) is required because it synchronizes on-premises Active Directory users, groups, and password hashes to Microsoft Entra ID, which is the foundation for extending identity to the cloud and enabling SSO. Option D (Microsoft Entra ID) is required because it is the cloud identity provider that authenticates users and issues tokens to cloud applications, making SSO possible. Option E (Active Directory Federation Services) is required because AD FS provides the federated trust between the on-premises AD domain and Microsoft Entra ID, allowing users to authenticate with on-premises credentials and obtain claims for cloud apps. Option A (Microsoft Entra Domain Services) is not required here because it provides managed domain services (LDAP, Kerberos, domain join) for legacy workloads in Azure, not the federation and synchronization needed for SSO to cloud applications. Option C (Microsoft Entra application proxy) is not required because it publishes on-premises web applications for remote access, which is a different scenario than extending AD to Azure for cloud-app SSO.

Answer

Microsoft Entra Domain Services

Answer

Azure AD Application Proxy

Question 15

You are designing a disaster recovery strategy for an Azure virtual machine running a SQL Server Always On availability group. The primary region is East US, and the secondary region is West US. You need to ensure minimal data loss and automatic failover. Which Azure service should you use for cross-region replication of the managed disks?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs across regions. For a SQL Server Always On availability group, ASR can replicate the managed disks at the VM level, enabling automatic failover to the West US region with minimal data loss by using crash-consistent or app-consistent recovery points. This meets the requirement for cross-region replication with automatic failover, unlike storage-level replication which does not provide orchestrated failover.

Answer

Azure Traffic Manager

Answer

Azure Backup

Answer

Azure Storage Geo-Redundant Storage (GRS)