AZ-305 Design infrastructure solutions Practice Test 3 — 15 Questions

Question 1

A company plans to deploy a multi-tier application on Azure. The web tier requires SSL termination and health probes. The application tier must be isolated from the internet. The database tier requires high availability. They want to minimize administrative overhead and use Azure native services. Which architecture should they recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Application Gateway for web tier, Azure Load Balancer (internal) for application tier, and Azure SQL Database with active geo-replication. Azure Application Gateway provides SSL termination and health probes for the web tier, an internal Azure Load Balancer isolates the application tier from the internet, and Azure SQL Database with active geo-replication offers high availability with automatic failover, minimizing administrative overhead by using PaaS services.

Answer

Azure Front Door for web tier, Azure Load Balancer for database tier, and SQL Server on Azure VMs with Always On

Answer

Azure Traffic Manager for web tier, Azure Application Gateway for database tier, and Azure SQL Database with failover groups

Answer

Azure Application Gateway for web tier, Azure Load Balancer (internal) for application tier, and Azure SQL Database with geo-restore

Question 2

A company deploys a web application on Azure VMs in an availability set. They need to expose the application to the internet with SSL termination and health probes. Additionally, they need to protect against DDoS attacks and common web vulnerabilities. Which Azure service should they use?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF) and DDoS Protection. Azure Application Gateway with WAF and DDoS Protection is the correct choice because it provides Layer 7 load balancing with SSL termination at the gateway, health probes for backend VMs, and the WAF feature protects against common web vulnerabilities (e.g., OWASP Top 10). DDoS Protection (Azure DDoS Network Protection) can be enabled on the virtual network hosting the Application Gateway to mitigate volumetric attacks. This combination directly meets all stated requirements: internet exposure, SSL offload, health monitoring, and dual-layer security.

Answer

Azure Front Door with WAF and DDoS Protection

Answer

Azure Traffic Manager and Azure Load Balancer

Answer

Azure CDN with WAF

Question 3

A company deploys a containerized microservices application on Azure Kubernetes Service (AKS). They need to expose the application to the internet with TLS termination and provide a single endpoint for multiple services. The solution must also include a Web Application Firewall (WAF). Which Azure service should they use as the ingress controller?

Accepted Answer

Azure Application Gateway with WAF. Azure Application Gateway with WAF is the correct choice because it is a regional, layer-7 load balancer that can act as an ingress controller for AKS. It provides TLS termination at the gateway and integrates a Web Application Firewall (WAF) to protect against common web exploits. This allows a single public endpoint to route traffic to multiple microservices within the AKS cluster based on URL paths or host headers.

Answer

Azure Front Door with WAF

Answer

Azure Load Balancer with TLS termination

Answer

Azure Traffic Manager with health probes

Question 4

A company plans to deploy a web application on Azure VMs across multiple availability zones. They need to distribute incoming HTTP traffic across the VMs and provide health probes. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway operates at Layer 7 (HTTP/HTTPS) and is designed for web applications, offering application-level routing, SSL termination, and HTTP health probes. While Azure Load Balancer also supports HTTP health probes and can distribute TCP traffic, it does not provide Layer 7 features such as URL-based routing, cookie affinity, or WAF. For a web application that may need these capabilities, Application Gateway is the recommended solution.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 5

A hub-and-spoke Azure network must centralize outbound inspection and still allow spokes to resolve private endpoint DNS names. Which two components are commonly required? (Choose 2.)

Accepted Answer

User-defined routes from spoke subnets to the firewall or NVA.. User-defined routes (UDRs) on spoke subnets force all outbound traffic (including internet-bound traffic) to the central firewall or network virtual appliance (NVA) in the hub, enabling centralized inspection. Without UDRs, spoke VMs would bypass the firewall and use default outbound internet access, breaking the inspection requirement.

Answer

A public IP address on every private endpoint.

Answer

Basic SKU load balancers in each spoke.

Question 6

A company needs to connect its on-premises data center to Azure for hybrid workloads. The connection must be private, dedicated, and provide guaranteed bandwidth. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a private, dedicated connection from on-premises to Azure, bypassing the public internet. It offers guaranteed bandwidth, higher reliability, and lower latency compared to VPN-based solutions, making it ideal for hybrid workloads requiring consistent performance.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 7

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

Accepted Answer

Peer each spoke VNet with the hub VNet. B is correct because VNet peering is required to establish connectivity between the spoke VNets and the hub VNet, enabling traffic to flow through the central Azure Firewall. Without peering, the spoke VNets would be isolated and unable to route traffic to the hub. C is correct because a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP ensures that all outbound internet traffic from spoke subnets is forced through the firewall for inspection and control.

Answer

Enable public IP addresses on all workload VMs

Answer

Deploy a NAT gateway in every spoke subnet

Question 8

An on-premises datacenter must connect privately to Azure with predictable bandwidth and avoid traversal of the public internet. Which connectivity option should be recommended?

Accepted Answer

ExpressRoute. ExpressRoute provides a dedicated private connection from on-premises to Azure, bypassing the public internet entirely. It offers predictable bandwidth, low latency, and high reliability through a Layer 3 MPLS or direct fiber link from a connectivity provider. This meets the requirement for a private, consistent network path without internet traversal.

Answer

Azure Bastion

Answer

Point-to-site VPN

Answer

Site-to-site VPN only

Question 9

A company is designing private access to a PaaS database from workloads in a VNet. The database should not be reachable over its public endpoint. What should be recommended?

Accepted Answer

Private Endpoint with public network access disabled. Private Endpoint with public network access disabled is the correct recommendation because it assigns a private IP address from the VNet to the PaaS database, making it accessible only over the private network. This eliminates exposure to the public internet by disabling the public endpoint, aligning with the requirement that the database should not be reachable over its public endpoint.

Answer

A public IP address with NSG rules

Answer

A route table to the internet gateway

Answer

Azure CDN endpoint

Question 10

Drag and drop the steps to set up Azure Private Link for an Azure SQL Database into the correct order.

Accepted Answer

Create endpoint, then approve, then configure DNS, then test, then disable public access. The correct sequence for setting up Azure Private Link for an Azure SQL Database is: first create the private endpoint in the virtual network, then approve the private link connection from the Azure SQL Database side, next configure DNS (typically using a private DNS zone) to resolve the database's FQDN to the private endpoint IP, test connectivity from within the virtual network, and finally disable public access to the database to enforce private connectivity. This order ensures each step builds on the previous one, avoiding connectivity issues or premature security restrictions.

Answer

Create endpoint, then approve, then test, then configure DNS, then disable public access

Answer

Approve, then create endpoint, then configure DNS, then test, then disable public access

Answer

Create endpoint, then configure DNS, then approve, then test, then disable public access

Question 11

Drag and drop the steps to set up Azure Key Vault for storing secrets and access them from an Azure function into the correct order.

Accepted Answer

Create vault, Add secret, Grant access, Configure references, Test. The correct sequence for setting up Azure Key Vault with an Azure function begins with creating the vault, then adding the secret. Next, grant the function app's managed identity access to the vault (using an access policy). After that, configure app settings or references in the function app to point to the secret. Finally, test the function to ensure it can retrieve the secret successfully. Common mistakes include misordering the grant access and configure references steps, or attempting to add secrets or configure references before the vault exists.

Answer

Create vault, Add secret, Configure references, Grant access, Test

Answer

Create vault, Configure references, Add secret, Grant access, Test

Answer

Add secret, Create vault, Grant access, Configure references, Test

Question 12

Match each Azure identity service to its description.

Accepted Answer

Azure AD: Cloud-based identity and access management service for Microsoft cloud resources.. Azure AD is the core identity service for Microsoft cloud. Azure AD B2B enables external collaboration, Azure AD B2C serves customer-facing apps, and Azure AD DS provides domain services for VMs. Common confusions include swapping B2C with Azure AD or B2B with AD DS.

Answer

Azure AD: Identity service for customer-facing applications with customizable sign-up and sign-in.

Answer

Azure AD B2B: Provides domain services for Azure VMs.

Question 13

Match each Azure monitoring service to its function.

Accepted Answer

Azure Monitor: Collects and analyzes telemetry from Azure resources. The correct matches are: Azure Monitor for telemetry collection, Log Analytics for log analysis, Application Insights for APM, and Azure Sentinel for security. Common confusions include swapping Azure Monitor with Application Insights or Log Analytics.

Answer

Azure Monitor: Application performance management (APM) and diagnostics

Answer

Log Analytics: Collects and analyzes telemetry from Azure resources

Question 14

Your company plans to migrate an on-premises application to Azure. The application requires low-latency access to a shared file system that supports SMB protocol. Which Azure storage solution should you recommend?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, making it the ideal solution for migrating on-premises applications that require low-latency access to a shared file system. It allows you to lift and shift applications that rely on SMB file shares without code changes, and it can be accessed from Azure VMs or on-premises via SMB 3.0.

Answer

Azure Blob Storage

Answer

Azure Disk Storage

Answer

Azure Queue Storage

Question 15

You are designing a disaster recovery solution for a critical application hosted in Azure VMs. The primary region is East US. The application requires a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes. Which Azure service should you use to replicate the VMs?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions, meeting the RTO of 30 minutes and RPO of 15 minutes by using continuous replication with crash-consistent or app-consistent snapshots. It is the native Azure service designed specifically for disaster recovery of IaaS workloads with granular recovery objectives.

Answer

Azure Front Door

Answer

Azure Backup

Answer

Azure Traffic Manager