AZ-305 Design infrastructure solutions Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an Azure Policy definition that your team plans to assign. The policy is intended to deny the deployment of virtual networks and virtual machines if they do not have an NSG attached with a rule named containing 'Allow'. However, the policy is not working as expected. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy does not check whether the NSG is actually associated with the resource.. The policy's existenceCondition only checks for the existence of an NSG with a rule name containing 'Allow', but it does not verify that the NSG is actually associated with the virtual network or virtual machine. In Azure Policy, the 'Microsoft.Network/networkInterfaces/networkSecurityGroup' or 'Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup' aliases must be used to check association. Without this, the policy can pass even if the NSG is not linked to the resource, rendering the deny effect ineffective.

Answer

The field 'Microsoft.Network/networkSecurityGroups/securityRules[*].name' is an incorrect alias.

Answer

The policy rule syntax is invalid.

Answer

The effect 'deny' cannot be used with existenceCondition.

Question 2

You need to design a storage solution for a new application that requires low-latency access to frequently accessed data and also needs to archive data that is older than 90 days to the most cost-effective storage tier. Which Azure storage account type and tier configuration should you recommend?

Accepted Answer

General-purpose v2 account with hot tier and a lifecycle management policy to move to cool tier after 90 days.. A General-purpose v2 (GPv2) storage account supports both hot and cool tiers, and lifecycle management policies can automatically move blobs from hot to cool tier after 90 days. This meets the low-latency requirement for frequently accessed data (hot tier) and the cost-effective archiving requirement (cool tier) without manual intervention.

Answer

Premium block blob storage account.

Answer

General-purpose v1 account with cool tier.

Answer

BlockBlobStorage account with hot tier.

Question 3

You are designing a network architecture for a critical application that spans multiple Azure regions. The application requires low-latency communication between regions and must maintain connectivity even if an entire region fails. You need to recommend a solution that provides cross-region connectivity with automatic failover. Which TWO options meet the requirements?

Accepted Answer

Azure Front Door. Azure Front Door (A) is correct because it is a global Layer 7 load balancer and CDN that routes user traffic to the closest healthy regional endpoint, providing low-latency global connectivity and automatic failover across regions via health probes and priority/latency-based routing. Azure Traffic Manager (C) is correct because it is a DNS-based global traffic load balancer that distributes traffic across regional endpoints using routing methods such as priority or performance, and automatically fails over to a healthy region when an endpoint becomes unhealthy. Azure Firewall (B) is incorrect because it is a regional, stateful network security service for filtering traffic, not a cross-region connectivity or failover mechanism. VPN Gateway (D) is incorrect because it provides encrypted site-to-site or point-to-site connectivity to a VNet, not automatic cross-region failover for application traffic. VNet peering (E) is incorrect because it connects VNets (including cross-region global peering) but does not provide automatic failover or latency-based global traffic distribution on its own.

Answer

Azure Firewall

Answer

VPN Gateway

Answer

VNet peering

Question 4

Your company is expanding its Azure presence to a new region in Asia. You need to design a network connectivity solution between the on-premises data center in New York and the new Azure region in Singapore. The solution must provide high bandwidth, low latency, and high availability. The company already has an ExpressRoute circuit to the East US region. You want to use that circuit to extend connectivity to Singapore if possible. The budget allows for additional ExpressRoute circuits if needed. What should you recommend?

Accepted Answer

Use ExpressRoute Global Reach to connect the on-premises network to the Singapore region via the existing circuit.. ExpressRoute Global Reach allows you to connect on-premises networks to different Azure regions through a single ExpressRoute circuit. By enabling Global Reach on the existing circuit to East US, you can route traffic from New York to Singapore with high bandwidth, low latency, and high availability, meeting all requirements without deploying a new circuit.

Answer

Set up a site-to-site VPN between the on-premises network and the Singapore region.

Answer

Deploy Azure Front Door to route traffic between on-premises and Singapore.

Answer

Peer the East US VNet with the Singapore VNet and route traffic through the existing ExpressRoute.

Question 5

Your company is migrating a critical application to Azure and needs to design a highly available and disaster recovery solution. The application runs on Azure VMs with SQL Server Always On Availability Groups. You need to ensure that the database remains available even during a regional outage. Which TWO options should you include in the design? (Choose two.)

Accepted Answer

Enable geo-redundant backup storage (RA-GRS) for the database.. The correct answers are A and C. Geo-redundant backup storage (RA-GRS) ensures database backups are replicated to a paired region, providing a recovery point for disaster recovery. Azure SQL Database Managed Instance with auto-failover groups enables automatic failover to a secondary region, maintaining availability during a regional outage. Option B is incorrect because Azure Site Recovery replicates VMs but does not guarantee SQL Server transactional consistency for Always On Availability Groups. Option D is incorrect because deploying Always On Availability Groups across availability zones only protects against zonal failures, not regional outages. Option E is incorrect because a load balancer distributes network traffic but does not provide database-level failover or consistency.

Answer

Configure Azure Site Recovery for the SQL Server VMs.

Answer

Deploy SQL Server Always On Availability Groups across availability zones.

Answer

Deploy a load balancer and distribute traffic to multiple replicas.

Question 6

A company is designing a storage solution for a new application that will store large amounts of unstructured data, such as images and videos. The data must be highly durable and available, and the solution should minimize costs for infrequently accessed data. Which TWO storage options should be recommended? (Choose two.)

Accepted Answer

Azure Blob Storage with Cool access tier. Azure Blob Storage with Cool access tier is correct because it is optimized for storing large amounts of unstructured data (images, videos) that are infrequently accessed, offering high durability (99.9999999999% with LRS/RA-GRS) and availability at lower storage costs compared to Hot tier. The Cool tier balances cost and access latency for data accessed less than once per month, making it ideal for this scenario. Azure Blob Storage with Archive access tier is not recommended because Archive tier data must be rehydrated before access, which can take hours, violating the availability requirement for 'highly durable and available' data. Therefore, only the Cool tier meets both the cost and availability needs.

Answer

Azure Disk Storage with Standard HDD

Answer

Azure Files with Premium performance tier

Answer

Azure NetApp Files with Standard service level

Answer

Azure Blob Storage with Archive access tier

Question 7

A healthcare organization is migrating its on-premises applications to Azure. The applications use custom authentication and authorization logic and require low latency between application tiers. The organization needs to ensure that the applications can scale out dynamically based on user demand, and that costs are minimized by only paying for resources when they are used. The applications are expected to have variable traffic patterns, with peak usage during business hours and low usage at night. You need to design a compute solution that meets these requirements. What should you recommend?

Accepted Answer

Migrate the applications to Azure App Service with autoscaling enabled.. Azure App Service with autoscaling is the best fit because it supports custom authentication and authorization logic through its built-in authentication/authorization module or custom middleware, provides low latency between application tiers via VNet integration, and enables dynamic scale-out based on demand. While App Service uses plan-based billing, autoscaling allows the number of instances to adjust based on traffic, scaling down during low usage to minimize costs. This matches the variable traffic pattern with peak business hours and low nighttime usage, while still providing the necessary infrastructure for custom authentication and multi-tier applications.

Answer

Migrate the applications to Azure Virtual Machine Scale Sets with autoscaling.

Answer

Migrate the applications to Azure Functions with consumption plan.

Answer

Migrate the applications to Azure Kubernetes Service (AKS) with cluster autoscaler.

Question 8

You are designing a backup and disaster recovery solution for a financial services company. The company has a critical application running on Azure VMs with premium SSDs. The RPO for the application is 15 minutes, and the RTO is 1 hour. The application data is stored on a separate managed disk with a premium SSD. The company wants to ensure that backups are cost-effective and do not impact application performance. You need to recommend a backup strategy. What should you do?

Accepted Answer

Use Azure Disk Backup with a backup policy of 15-minute frequency.. Azure Disk Backup supports a backup frequency of 15 minutes using crash-consistent snapshots, meeting the RPO requirement. It is cost-effective and has minimal performance impact on premium SSDs. Although not application-consistent, crash-consistent snapshots are acceptable for this scenario as the application can recover from them within the 1-hour RTO. Option C is incorrect because Azure Backup for Azure VMs does not support a 15-minute frequency; the minimum is 1 hour. Option A (Azure Site Recovery) is designed for disaster recovery, not scheduled backups, and is more expensive. Option D (Azure Compute Gallery) is used for managing custom images, not for backups.

Answer

Use Azure Site Recovery with replication from the primary to a secondary region.

Answer

Use Azure Backup with application-consistent snapshots and configure a backup policy with a 15-minute frequency.

Answer

Use Azure Compute Gallery to create custom snapshots every 15 minutes.

Question 9

A company is designing a hybrid network architecture that connects an on-premises data center to Azure. The requirements include high availability (99.99% SLA), low latency, and the ability to use existing MPLS connections. Which THREE Azure connectivity options should be considered?

Accepted Answer

Azure Virtual WAN with ExpressRoute. Azure ExpressRoute (C) is correct because it provides a dedicated, private connection between on-premises infrastructure and Azure through a connectivity provider, supporting existing MPLS connections, low latency, and a 99.99% SLA when configured with redundant circuits. Azure Virtual WAN with ExpressRoute (B) is correct because it builds on ExpressRoute to deliver a hub-and-spoke transit architecture with global reach, automated branch-to-branch and branch-to-VNet connectivity, and high availability that meets the 99.99% SLA requirement while leveraging existing MPLS links. Azure VPN Gateway (A) is not appropriate here because it runs over the public internet and cannot natively use existing MPLS connections, and its SLA is lower than the required 99.99%. Azure Traffic Manager (D) is a DNS-based global traffic distribution service, not a hybrid connectivity mechanism, so it cannot establish the on-premises-to-Azure link. Azure Private Link (E) provides private access to specific Azure PaaS services via private endpoints, not site-to-site hybrid connectivity, so it does not satisfy the scenario.

Answer

Azure VPN Gateway (active-active)

Answer

Azure Traffic Manager

Answer

Azure Private Link

Question 10

Your company, Contoso Ltd., is migrating its on-premises e-commerce application to Azure. The application consists of a web frontend, an API layer, and a SQL Server database. The migration must meet the following requirements:
- The web frontend must automatically scale out based on CPU utilization.
- The API layer must be stateless and scale out based on request count.
- The database must be a managed service with high availability and disaster recovery across Azure regions.
- All components must be secured using Azure Firewall and Web Application Firewall (WAF).
- The solution must minimize operational overhead.

You propose the following architecture:
- Azure App Service for the web frontend with autoscaling rules based on CPU.
- Azure Functions for the API layer (stateless, scaling based on request count).
- Azure SQL Database with active geo-replication for the database.
- Azure Front Door with WAF policies for global load balancing and security.
- Azure Firewall to control outbound traffic.

Which component of this design should be reconsidered to better meet the requirement to minimize operational overhead?

Accepted Answer

Replace Azure Front Door with Azure Traffic Manager. The design aims to minimize operational overhead by using fully managed services. Azure Front Door, while feature-rich, introduces additional management overhead due to its WAF policies, custom domain configuration, and rule sets. For an e-commerce application, Azure Traffic Manager provides simpler DNS-based global load balancing with lower operational overhead. Security can still be achieved by combining Azure Firewall and Web Application Firewall (WAF) at the application level. Thus, replacing Front Door with Traffic Manager better aligns with minimizing operational overhead.

Answer

Replace Azure App Service with Azure Virtual Machine Scale Sets

Answer

Replace Azure Functions with Azure Kubernetes Service (AKS)

Answer

Replace Azure SQL Database with Azure SQL Managed Instance

Question 11

A healthcare company stores sensitive patient data in Azure Blob Storage. The company must ensure that data is encrypted at rest using customer-managed keys (CMK) and that the keys are stored in a hardware security module (HSM). The company also needs to audit key usage. Which combination of Azure services should you recommend?

Accepted Answer

Azure Key Vault (premium tier) with HSM-protected keys and Azure Monitor for auditing.. Azure Key Vault premium tier provides HSM-protected keys, which are required for the healthcare company's security policy. Blob Storage supports customer-managed keys stored in Key Vault, and Key Vault logs can be sent to Azure Monitor for auditing key usage. This combination meets encryption at rest with CMK, HSM storage, and auditing.

Answer

Azure Dedicated HSM with Azure Storage Service Encryption and Azure Policy for auditing.

Answer

Azure Managed HSM with Azure Blob Storage encryption and Azure Sentinel for auditing.

Answer

Azure Key Vault (standard tier) with software-protected keys and Azure Monitor for auditing.

Question 12

A financial services company runs a mission-critical workload on 40 Azure Virtual Machines in a single virtual network. The company requires that the VMs be distributed across separate physical racks and power sources within the Azure region to minimize the impact of hardware failures. They also need to minimize network latency between the VMs. Which Azure feature should the solutions architect recommend?

Accepted Answer

Availability sets. Availability sets are designed to keep VMs in a single datacenter while distributing them across fault domains (separate racks, power, and network) and update domains. This provides rack-level fault isolation without the latency penalty of spreading across datacenters. The requirement explicitly asks for rack-level distribution and low latency, which aligns with availability sets rather than zones or proximity placement groups.

Answer

Proximity placement groups

Answer

Availability zones

Answer

Virtual machine scale sets with flexible orchestration

Question 13

A financial services company is designing a disaster recovery strategy for an Azure SQL Database. The database is business-critical and must have a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour. The company wants to minimize costs while meeting these objectives. Which two features should you include in the design? (Choose two.)

Accepted Answer

Implement Azure SQL Database active geo-replication with a secondary in a paired region.. Active geo-replication provides asynchronous replication with an RPO of about 5 seconds and supports manual failover, achieving an RTO within 1 hour. It is cost-effective because it does not require the additional listener endpoints of auto-failover groups. Using a paired region ensures data residency and compliance. Together, these features meet the RPO and RTO while minimizing costs.

Answer

Enable zone-redundant configuration for the Azure SQL Database.

Answer

Use Azure SQL Database geo-restore from a geo-redundant backup.

Answer

Configure auto-failover groups for the Azure SQL Database.

Question 14

A retail company is designing a disaster recovery strategy for a stateless web application running on Azure Virtual Machines. The application is deployed in the East US region and must be able to fail over to the West US region. The company requires an RTO of 15 minutes and an RPO of 5 minutes. They want to minimize costs while meeting these objectives. Which two actions should the solutions architect include in the design? (Choose two.)

Accepted Answer

Configure Azure Site Recovery to replicate the VMs to West US.. Azure Site Recovery provides continuous replication to meet the RPO and enables orchestrated failover to meet the RTO. Azure Traffic Manager with priority routing ensures that user traffic is redirected to the secondary region during failover. Together, they form a cost-effective DR solution for a stateless web application with the specified recovery objectives.

Answer

Implement Azure Backup for the VMs and restore them in West US during a disaster.

Answer

Create an Azure Load Balancer in West US to distribute traffic across the VMs.

Answer

Deploy a duplicate set of VMs in West US in a stopped (deallocated) state.

Question 15

A company is deploying a new line-of-business application on Azure Virtual Machines. The application requires a shared file storage solution that can be accessed by multiple VMs simultaneously. The solution must provide SMB protocol support, be highly available, and allow the company to take point-in-time snapshots for backup purposes. Which Azure Storage solution should the solutions architect recommend?

Accepted Answer

Azure Files with the premium file share tier. Azure Files is a managed file share service that supports the SMB protocol and provides highly available storage. The premium tier offers SSD-backed performance suitable for line-of-business applications, and it supports share snapshots for point-in-time recovery. This meets all the requirements without the added cost and complexity of Azure NetApp Files.

Answer

Azure Blob Storage with a premium performance tier

Answer

Azure Queue Storage

Answer

Azure NetApp Files