AZ-305 Design infrastructure solutions Practice Test 20 — 15 Questions

Question 1

A government agency is designing a solution to store sensitive citizen data. The data must be encrypted at rest and in transit. The agency requires that the encryption keys be managed by the agency and stored in a hardware security module (HSM). Additionally, the solution must comply with regulatory requirements that mandate customer-managed keys. You need to recommend a key management solution. What should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Key Vault Managed HSM with FIPS 140-2 Level 3 validated HSMs.. Azure Key Vault Managed HSM provides a fully managed, FIPS 140-2 Level 3 validated HSM that allows the agency to retain sole control of the encryption keys, meeting the requirement for customer-managed keys. It ensures data is encrypted at rest and in transit while keeping keys within the agency's own HSM boundary, which is essential for regulatory compliance.

Answer

Use Azure Key Vault Standard with software-protected keys.

Answer

Use Microsoft Purview to manage keys and compliance.

Answer

Use Azure Information Protection with a custom protection template.

Question 2

A media company is building a video streaming platform on Azure. The platform will store original high-definition videos and convert them to multiple resolutions for distribution. The company needs a cost-effective storage solution for the original videos, which are accessed infrequently but must be instantly available when needed. The converted videos will be served to end users globally and must be cached at edge locations for low latency. You need to design a storage and content delivery solution. What should you recommend?

Accepted Answer

Store original videos in Azure Blob Storage Cool tier and use Azure CDN for distribution.. Azure Blob Storage Cool tier provides low-cost storage for infrequently accessed data with instant retrieval, meeting the requirement for original videos that are rarely accessed but must be available immediately. Azure CDN caches the converted videos at edge locations globally, ensuring low-latency delivery to end users.

Answer

Store original videos in Azure Blob Storage Premium tier and use Azure CDN for distribution.

Answer

Store original videos in Azure Blob Storage Archive tier and use Azure CDN for distribution.

Answer

Store original videos in Azure Files and use Azure Front Door for caching.

Question 3

A large enterprise is designing a hybrid network architecture. The company has an on-premises data center connected to Azure via ExpressRoute. They want to extend their on-premises network to Azure by using a site-to-site VPN as a backup connection. The company has multiple VNets in Azure that need to communicate with each other and with the on-premises network. The solution must be highly available and provide redundancy for the ExpressRoute connection. You need to recommend a network connectivity design. What should you include?

Accepted Answer

Use Azure ExpressRoute as the primary connection, and configure a site-to-site VPN as a backup. Use VNet peering for VNet-to-VNet connectivity.. It combines ExpressRoute as the primary connection with a site-to-site VPN as a backup, ensuring redundancy for on-premises connectivity. VNet peering is used for VNet-to-VNet communication, which is the recommended method for low-latency, high-bandwidth connectivity between VNets in the same region. This design meets the high availability and redundancy requirements without introducing unnecessary complexity.

Answer

Use Azure ExpressRoute as the primary connection, and configure VNet-to-VNet VPN as a backup for ExpressRoute.

Answer

Use Azure VPN Gateway to connect the on-premises network to Azure, and use VNet peering for VNet-to-VNet connectivity.

Answer

Use Azure ExpressRoute as the primary connection, and use Azure Firewall to inspect traffic between VNets.

Question 4

A startup is building a web application that will be used by a small number of users initially but is expected to grow rapidly. The application runs on Linux and uses a PostgreSQL database. The company wants to minimize operational overhead and costs during the early stages. You need to recommend a platform as a service (PaaS) solution for both the application and the database. What should you recommend?

Accepted Answer

Deploy the application on Azure App Service for Linux and use Azure Database for PostgreSQL.. Azure App Service for Linux provides a fully managed PaaS environment for hosting web applications, handling scaling, patching, and load balancing with minimal operational overhead. Azure Database for PostgreSQL is a managed PaaS database service that offers built-in high availability, automated backups, and scaling, which aligns with the startup's need to minimize costs and operational complexity during rapid growth.

Answer

Deploy the application on Azure Kubernetes Service (AKS) and use Azure Database for PostgreSQL.

Answer

Deploy the application as Azure Functions and use Azure Cosmos DB for storage.

Answer

Deploy the application on Azure Virtual Machines and use PostgreSQL on the same VM.

Question 5

A company is designing a disaster recovery solution for a critical application that runs on Azure VMs in a single region. The RTO is 4 hours, and the RPO is 1 hour. The application uses Azure SQL Database. The company wants to minimize the cost of the disaster recovery solution while meeting the RTO and RPO. You need to recommend a solution. What should you recommend?

Accepted Answer

Use Azure Site Recovery to replicate VMs to a secondary region and Azure SQL Database geo-replication for the database.. Azure Site Recovery provides orchestrated replication and failover for Azure VMs, meeting the 4-hour RTO with automated recovery plans. Azure SQL Database active geo-replication (or failover groups) enables continuous data synchronization with an RPO of 1 hour. This combination minimizes cost by using only the necessary replication services without over-provisioning resources.

Answer

Use Azure SQL Database active geo-replication for the database and Azure Backup for VMs.

Answer

Use Azure Backup to back up VMs and Azure SQL Database to a secondary region.

Answer

Use Azure Traffic Manager to distribute traffic to VMs in multiple regions and Azure SQL Database failover groups.

Question 6

A company is designing a solution for a data analytics workload. The company receives streaming data from multiple sources, including IoT devices and social media feeds. The data must be ingested, processed in real-time, and stored for historical analysis. The company also wants to use Power BI to create real-time dashboards from the streaming data. You need to recommend a data pipeline architecture. What should you include?

Accepted Answer

Use Azure Event Hubs for ingestion, Azure Stream Analytics for real-time processing, and Power BI for dashboards.. Azure Event Hubs is designed for high-throughput ingestion of streaming data from multiple sources, including IoT devices and social media feeds. Azure Stream Analytics provides real-time processing with low latency, and it can output directly to Power BI for live dashboards, meeting all requirements for ingestion, real-time processing, and visualization.

Answer

Use Azure IoT Hub for ingestion, Azure Stream Analytics for processing, and Power BI for dashboards.

Answer

Use Azure Event Hubs for ingestion, Azure Data Lake Analytics for processing, and Power BI for dashboards.

Answer

Use Azure Event Hubs for ingestion, Azure Synapse Analytics for processing, and Power BI for dashboards.

Question 7

Your company is migrating a legacy on-premises application to Azure. The application requires persistent storage for configuration files that must be accessible from multiple virtual machines in a virtual network. The storage must be accessible only from within the virtual network and should not be exposed to the internet. Which Azure storage solution should you use?

Accepted Answer

Azure Files with a private endpoint. Azure Files with a private endpoint is the correct choice because it provides fully managed file shares accessible via SMB or NFS protocols, supports persistent storage for configuration files, and ensures the storage is accessible only from within the virtual network by assigning a private IP address from the VNet, eliminating internet exposure. This meets the requirement for multi-VM access with network isolation.

Answer

Azure Disk Storage with shared disks

Answer

Azure NetApp Files with network security groups

Answer

Azure Blob Storage with a service endpoint

Question 8

A multinational corporation is designing a disaster recovery strategy for a critical application running on Azure VMs. The application must have a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The primary region is East US, and the secondary region is West US. The solution must minimize costs while meeting the requirements. What should you recommend?

Accepted Answer

Implement Azure Site Recovery for the VMs. Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs from a primary to a secondary region with an RPO as low as 15 minutes (Premium SSD) and RTOs that can be met within 1 hour through planned failover. It is the native Azure service designed for disaster recovery of IaaS workloads, offering cost-effective replication without requiring always-on secondary VMs, as it only incurs storage costs for replicated disks until failover.

Answer

Deploy an active-passive configuration with Azure Front Door and Traffic Manager

Answer

Configure the VMs in an availability zone across East US and West US

Answer

Use Azure Backup with cross-region restore for the VMs

Question 9

You are designing a cloud-native application that will run on Azure Kubernetes Service (AKS). The application needs to authenticate users and manage access to resources. Which identity service should you use?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the correct identity service for a cloud-native application on AKS because it provides OAuth 2.0 and OpenID Connect authentication, enabling secure user sign-in and role-based access control (RBAC) for Kubernetes resources. It integrates natively with AKS to manage identities for users and service principals, supporting managed identities for Azure resources without credential management.

Answer

Microsoft Entra External ID

Answer

Microsoft Account

Answer

Azure Active Directory Domain Services

Question 10

Your company has an Azure subscription that contains several virtual machines (VMs) running Windows Server. You need to ensure that all VMs are compliant with a baseline security policy that includes specific registry key settings. The solution must automatically remediate non-compliant settings without manual intervention. What should you use?

Accepted Answer

Azure Policy with Guest Configuration. Azure Policy with Guest Configuration is designed to audit and enforce settings inside VMs, including registry keys, and supports automatic remediation via DeployIfNotExists and Modify effects. It uses a guest configuration extension to evaluate the VM's configuration and can remediate non-compliant settings without manual intervention. This meets the requirement of ensuring compliance with a baseline security policy and automatic remediation.

Answer

Azure Automation State Configuration (DSC)

Answer

Microsoft Defender for Cloud with custom recommendations

Answer

Microsoft Intune

Question 11

A healthcare organization is deploying a new application on Azure that will handle Protected Health Information (PHI). The application must be compliant with HIPAA. The security team requires encryption at rest and in transit, and the ability to audit access to the data. The solution should minimize administrative overhead. Which storage solution should you recommend?

Accepted Answer

Azure SQL Database with Transparent Data Encryption and Always Encrypted. Azure SQL Database provides encryption at rest via Transparent Data Encryption (TDE), which is enabled by default, and encryption in transit via TLS. It also supports Always Encrypted to protect sensitive data client-side, ensuring PHI is never exposed to database administrators. Built-in auditing tracks access, and as a PaaS service, it minimizes administrative overhead compared to SQL Managed Instance or IaaS.

Answer

Azure Cosmos DB with encryption at rest

Answer

Azure SQL Managed Instance with customer-managed keys

Answer

SQL Server on Azure Virtual Machine with BitLocker

Question 12

Your organization is planning to migrate a large number of on-premises file servers to Azure. The data includes millions of small files. You need to select a storage solution that supports SMB protocol and can handle high file counts. Which TWO Azure services meet these requirements?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB file shares in the cloud, supporting the SMB protocol natively and capable of handling high file counts (up to 100 million files per share with large shares enabled). This makes it a direct match for migrating on-premises file servers with millions of small files.

Answer

Azure Stack Edge

Answer

Azure Blob Storage with NFS 3.0

Answer

Azure Disk Storage

Question 13

A logistics company runs a customer-facing web application on 20 Azure VMs behind an Azure Standard Load Balancer. The company requires a 99.99% availability SLA for the VMs. The VMs are currently all deployed in a single availability set within one Azure region. What should you recommend to meet the SLA requirement with minimal architectural changes?

Accepted Answer

Deploy the VMs across three availability zones in the same region.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across three zones provides a 99.99% SLA, higher than the 99.95% offered by availability sets. This approach requires minimal changes because the existing load balancer can be made zone-redundant, and no cross-region data replication is needed.

Answer

Deploy the VMs across multiple regions and use Azure Traffic Manager for load balancing.

Answer

Keep the VMs in the availability set but add a second availability set in the same region.

Answer

Move the VMs to Azure Virtual Machine Scale Sets with a single placement group.

Question 14

A company is deploying a multi-tier application on Azure. The web tier runs on Azure App Service, and the database tier runs on Azure SQL Database. The company wants to secure the connection between the web tier and the database by using a private endpoint for Azure SQL Database. They also want to ensure that the web tier can resolve the private endpoint's DNS name. What should you recommend?

Accepted Answer

Configure a private endpoint for Azure SQL Database and integrate an Azure Private DNS zone with the virtual network used by the web tier.. To securely connect to Azure SQL Database using a private endpoint, you must create the private endpoint and integrate an Azure Private DNS zone with the virtual network. The Private DNS zone automatically creates the necessary A record for the SQL server's FQDN, resolving to the private IP. This allows the web tier to connect securely without exposing traffic to the public internet.

Answer

Configure a private endpoint for Azure SQL Database and use Azure Firewall to redirect DNS queries.

Answer

Configure a service endpoint for Azure SQL Database and enable Azure Private Link.

Answer

Configure a private endpoint for Azure SQL Database and add a custom DNS record in the Azure DNS zone for the web tier's domain.

Question 15

A healthcare company is designing a new Azure solution that must comply with HIPAA. The solution will store patient records in Azure Blob Storage and must ensure that data is encrypted at rest using customer-managed keys. The company also requires that the encryption keys be stored in a hardware security module (HSM) and that they have full control over key rotation. Which Azure service should the solutions architect use to meet these requirements?

Accepted Answer

Azure Key Vault Managed HSM. Azure Key Vault Managed HSM provides HSM-backed keys with full customer control, meeting the HIPAA and key rotation requirements. It integrates with Azure Storage for customer-managed keys, allowing the healthcare company to encrypt Blob Storage using keys stored in a hardware security module. Other options either lack HSM backing, are not integrated with Blob Storage, or are intended for different purposes.

Answer

Azure Disk Encryption

Answer

Azure Dedicated HSM

Answer

Azure Key Vault (standard tier)