AZ-305 Design infrastructure solutions Practice Test 4 — 15 Questions

Question 1

You are designing a hybrid identity solution for a company with 5,000 on-premises users. The company wants to use Microsoft Entra ID for single sign-on and self-service password reset. They also need to synchronize user passwords to the cloud. Which feature should you enable to ensure password changes on-premises are immediately propagated to Microsoft Entra ID?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (PHS) is the correct choice because it synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID, enabling propagation of password changes. When a user changes their password on-premises, the updated hash is synced during the next synchronization cycle, allowing seamless single sign-on and self-service password reset in the cloud.

Answer

Federation with AD FS

Answer

Pass-through Authentication

Answer

Microsoft Entra Cloud Sync

Question 2

You are designing a network topology for a multi-tier application in Azure. The application has a web tier, an API tier, and a database tier. You need to ensure that the web tier can communicate with the API tier, and the API tier can communicate with the database tier, but the web tier cannot directly access the database tier. Which Azure networking solution should you implement?

Accepted Answer

Azure Application Security Groups (ASGs). Azure Application Security Groups (ASGs) allow you to group virtual machines by application tier and define network security rules based on those groups. You can create a rule that allows traffic from the web tier ASG to the API tier ASG, and another rule allowing the API tier ASG to the database tier ASG, while blocking direct traffic from web to database. Option A is wrong because Azure Firewall is a managed firewall service that is typically used for more complex security and routing scenarios, and would be overkill for this simple tier-to-tier access control. Option B is wrong because although NSGs with service tags can control traffic, they are more suited for controlling traffic from Azure services (like Azure SQL) rather than grouping specific VMs by application tier; ASGs provide a more scalable and manageable approach within a VNet. Option D is wrong because VNet peering is used to connect separate virtual networks, not to control traffic between subnets or VMs within the same VNet.

Answer

Azure Firewall

Answer

Network Security Groups (NSGs) with service tags

Answer

VNet peering

Question 3

Your company has an Azure subscription with multiple virtual networks (VNets) in different regions. You need to ensure that resources in all VNets can communicate with each other privately over the Microsoft backbone network. Which Azure solution should you implement?

Accepted Answer

VNet peering. VNet peering connects Azure virtual networks privately over the Microsoft backbone network, enabling resources in different VNets (including those in different regions) to communicate directly without traversing the public internet. It uses the Azure infrastructure to route traffic between peered VNets with low latency and high bandwidth, meeting the requirement for private inter-VNet communication.

Answer

Azure ExpressRoute

Answer

Azure DNS

Answer

Azure VPN Gateway

Question 4

You are designing a storage strategy for a data analytics solution that processes large volumes of streaming data. The data must be stored in a cost-effective manner with low latency for hot data and infrequent access for cold data after 30 days. The solution must support both batch and interactive queries. Which combination of Azure storage services should you recommend?

Accepted Answer

Azure Data Lake Storage Gen2 with lifecycle management. Azure Data Lake Storage Gen2 (ADLS Gen2) combines the scalability and cost benefits of object storage with a hierarchical namespace, enabling both batch and interactive queries via services like Azure Synapse Analytics and Apache Spark. Lifecycle management policies can automatically transition hot data to cooler tiers (e.g., cool or archive) after 30 days, reducing costs for infrequently accessed cold data while maintaining low-latency access for hot data. This makes ADLS Gen2 the ideal choice for streaming data analytics that requires cost-effective tiered storage and supports diverse query patterns.

Answer

Azure SQL Database with geo-replication

Answer

Azure Blob Storage with hot and cool access tiers

Answer

Azure Cosmos DB with multiple consistency levels

Question 5

Your company is deploying a web application on Azure App Service. The application must be able to read secrets from Azure Key Vault without storing credentials in application code. Which feature should you enable?

Accepted Answer

Managed Identity. Managed Identity (C) is correct because it allows the App Service to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity lifecycle, and the app uses the Azure Identity SDK to obtain tokens for Key Vault access via the IMDS endpoint (169.254.169.254). This eliminates the need for secrets or certificates in the application.

Answer

Key Vault access policies

Answer

Azure AD Application Registration with client secret

Answer

App Service Authentication / Authorization

Question 6

You are designing a backup strategy for Azure VMs running critical business applications. The solution must support application-consistent backups and allow for restoration to a different region. Which Azure service and configuration should you use?

Accepted Answer

Azure Backup with application-consistent backup policy and geo-redundant storage. Azure Backup with an application-consistent backup policy uses the Volume Shadow Copy Service (VSS) on Windows or pre/post-scripts on Linux to ensure that all in-memory data and pending I/O operations are flushed before the snapshot is taken. By configuring the Backup vault with geo-redundant storage (GRS), the backup data is replicated to a paired region, enabling restoration to a different region in the event of a regional disaster.

Answer

Azure Disk Encryption with Azure Backup

Answer

Azure Snapshot with cross-region copy

Answer

Azure Site Recovery with replication to secondary region

Question 7

Your organization has a policy that all administrative access to Azure resources must be performed using just-in-time (JIT) access. Which Azure service allows you to enable JIT VM access?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides just-in-time (JIT) VM access, which locks down inbound traffic to Azure VMs by creating network security group (NSG) rules that deny all inbound traffic except for specific ports. When a user requests access, Defender for Cloud temporarily creates an allow rule for the requested ports and source IP, then automatically removes it after the configured time period. This directly enforces the policy that administrative access must be JIT.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure AD Privileged Identity Management

Question 8

You are designing a solution to monitor and analyze security events across your Azure environment. Which TWO Azure services should you include in your design to provide centralized logging and threat detection? (Choose two.)

Accepted Answer

Azure Log Analytics. B is correct because Azure Log Analytics is the central repository for log data in Azure Monitor, enabling you to collect, correlate, and query security events from multiple sources using Kusto Query Language (KQL). C is correct because Microsoft Sentinel is a cloud-native SIEM and SOAR solution that ingests logs from Log Analytics and provides advanced threat detection, investigation, and automated response. Together, they form the foundation for centralized logging and threat detection in Azure.

Answer

Azure Firewall

Answer

Azure Policy

Answer

Azure Network Watcher

Question 9

You are designing a highly available architecture for a web application that runs on Azure VMs. The solution must distribute incoming traffic across multiple VMs in an availability set. Which TWO Azure components should you include? (Choose two.)

Accepted Answer

Azure Load Balancer. Azure Load Balancer (A) is correct because it distributes incoming traffic across multiple VMs in an availability set at the transport layer (TCP/UDP), providing high availability by rerouting traffic away from failed instances. An availability set (D) is required to ensure VMs are placed in different fault domains and update domains, protecting against hardware failures and planned maintenance. Together, they form the core of a highly available architecture for VMs within a single Azure region.

Answer

Azure Traffic Manager

Answer

Azure Front Door

Answer

Azure Application Gateway

Question 10

You are an Azure administrator. You attempt to create a new virtual machine with size Standard_DS2_v2 in a subscription where the above Azure Policy is assigned. What will happen?

Accepted Answer

The VM creation will be denied.. The Azure Policy assigned to the subscription includes a deny effect for virtual machine sizes that are not in the allowed list. Standard_DS2_v2 is not an allowed size, so the policy engine evaluates the request during deployment and blocks it with a denial response. This is a common practice to enforce cost or performance standards across the organization.

Answer

The VM will be created but a compliance alert will be generated.

Answer

The VM will be created but the size will be changed to Standard_D2s_v3.

Answer

The VM will be created successfully.

Question 11

You execute the above PowerShell script to create a Windows VM in Azure. After the script completes, you try to RDP to the public IP address but the connection fails. What is the most likely reason?

Accepted Answer

The network interface is not attached to the VM.. The PowerShell script creates a VM but does not explicitly associate the network interface (NIC) with the VM. In Azure, a NIC must be attached to a VM for network connectivity; without this association, the VM has no network path, and RDP (TCP/3389) cannot reach the VM even if a public IP and NSG rules are correctly configured.

Answer

The public IP address is not assigned correctly.

Answer

The NSG rule blocks RDP traffic.

Answer

The VM size does not support RDP.

Question 12

You run the above KQL query in Azure Monitor Logs. What does the query return?

Accepted Answer

The number of successful VM write operations per caller per hour.. The KQL query filters the Azure Activity Log for the 'Microsoft.Compute/virtualMachines/write' operation. In the Activity Log, write operations are typically successful by default; failed operations have a distinct status but are not excluded in this query. The query groups the results by 'Caller' (the user or service principal that initiated the operation) and bins them into 1-hour intervals using 'bin(TimeGenerated, 1h)'. The 'summarize count()' calculates the number of such operations per caller per hour. Therefore, the query returns the number of successful VM write operations per caller per hour, which matches option C.

Answer

The number of failed VM creation attempts per hour.

Answer

The total number of successful operations across all Azure resources.

Answer

A list of all Azure activity log entries.

Question 13

A company is designing a multi-region disaster recovery solution for Azure VMs. They need to ensure that if the primary region fails, VMs can be failed over to a secondary region with minimal data loss. The application writes data to Azure SQL Database and Azure Files. Which Azure service should they use to meet the recovery point objective (RPO) of 5 seconds for the SQL Database?

Accepted Answer

Active geo-replication for SQL Database. Active geo-replication for Azure SQL Database provides a continuous, asynchronous replication mechanism that can achieve an RPO of 5 seconds by replicating transactions to a readable secondary database in a paired region. This meets the minimal data loss requirement because the secondary is kept nearly synchronized, and in a failover event, only transactions that were in-flight at the time of failure are lost, typically within the 5-second window.

Answer

Azure Site Recovery for SQL Server

Answer

Failover groups with auto-failover

Answer

Geo-restore of SQL Database backups

Question 14

A company is migrating on-premises applications to Azure. They require that all traffic between Azure resources and on-premises resources traverse a private connection. They also want to reduce the attack surface by eliminating exposure of management endpoints over the internet. Which solution should they implement?

Accepted Answer

Azure ExpressRoute with Private Link for Azure services. Azure ExpressRoute provides a private, dedicated connection from on-premises to Azure, bypassing the public internet. By combining ExpressRoute with Private Link for Azure services, you ensure that traffic to Azure PaaS services (e.g., Azure SQL, Storage) traverses only the private connection and that the service endpoints are not exposed over the internet, reducing the attack surface. This directly meets the requirement for private connectivity and elimination of public management endpoints.

Answer

Azure Firewall

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 15

A company has multiple Azure subscriptions and wants to enforce consistent network policies across all VNets. They need to ensure that all traffic going out to the internet is inspected by a central firewall. The solution must be scalable and support multiple regions. What should they implement?

Accepted Answer

Use Azure Virtual WAN with a secured hub and Azure Firewall Manager. Azure Virtual WAN with a secured hub and Azure Firewall Manager provides a centralized, scalable solution for enforcing consistent network policies across multiple subscriptions and regions. It enables a hub-and-spoke architecture where all internet-bound traffic from VNets is routed through a central Azure Firewall for inspection, with Azure Firewall Manager offering global policy management and automated routing.

Answer

Deploy Azure Firewall in each subscription and route traffic through it

Answer

Use Azure Policy to enforce route tables on each VNet

Answer

Create VNet peering and use a network virtual appliance in one subscription