AZ-305 Design infrastructure solutions Practice Test 5 — 15 Questions

Question 1

A company plans to deploy a multi-tier application on Azure. The web tier requires SSL termination and health probes. The application tier must be isolated from the internet. The database tier requires high availability. They want to minimize administrative overhead and use Azure native services. Which architecture should they recommend?

Accepted Answer

Azure Application Gateway for web tier, Azure Load Balancer (internal) for application tier, and Azure SQL Database with active geo-replication. Option A is correct because Azure Application Gateway provides SSL termination and health probes for the web tier, an internal Azure Load Balancer isolates the application tier from the internet, and Azure SQL Database with active geo-replication offers high availability with automatic failover, minimizing administrative overhead by using PaaS services.

Answer

Azure Front Door for web tier, Azure Load Balancer for database tier, and SQL Server on Azure VMs with Always On

Answer

Azure Traffic Manager for web tier, Azure Application Gateway for database tier, and Azure SQL Database with failover groups

Answer

Azure Application Gateway for web tier, Azure Load Balancer (internal) for application tier, and Azure SQL Database with geo-restore

Question 2

A company deploys a web application on Azure VMs in an availability set. They need to expose the application to the internet with SSL termination and health probes. Additionally, they need to protect against DDoS attacks and common web vulnerabilities. Which Azure service should they use?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF) and DDoS Protection. Azure Application Gateway with WAF and DDoS Protection is the correct choice because it provides Layer 7 load balancing with SSL termination at the gateway, health probes for backend VMs, and the WAF feature protects against common web vulnerabilities (e.g., OWASP Top 10). DDoS Protection (Azure DDoS Network Protection) can be enabled on the virtual network hosting the Application Gateway to mitigate volumetric attacks. This combination directly meets all stated requirements: internet exposure, SSL offload, health monitoring, and dual-layer security.

Answer

Azure Front Door with WAF and DDoS Protection

Answer

Azure Traffic Manager and Azure Load Balancer

Answer

Azure CDN with WAF

Question 3

A company deploys a containerized microservices application on Azure Kubernetes Service (AKS). They need to expose the application to the internet with TLS termination and provide a single endpoint for multiple services. The solution must also include a Web Application Firewall (WAF). Which Azure service should they use as the ingress controller?

Accepted Answer

Azure Application Gateway with WAF. Azure Application Gateway with WAF is the correct choice because it is a regional, layer-7 load balancer that can act as an ingress controller for AKS. It provides TLS termination at the gateway and integrates a Web Application Firewall (WAF) to protect against common web exploits. This allows a single public endpoint to route traffic to multiple microservices within the AKS cluster based on URL paths or host headers.

Answer

Azure Front Door with WAF

Answer

Azure Load Balancer with TLS termination

Answer

Azure Traffic Manager with health probes

Question 4

A company plans to deploy a web application on Azure VMs across multiple availability zones. They need to distribute incoming HTTP traffic across the VMs and provide health probes. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it operates at Layer 7 (HTTP/HTTPS), providing application-level routing, SSL termination, and HTTP health probes. This matches the requirement to distribute incoming HTTP traffic across VMs in multiple availability zones, whereas Azure Load Balancer operates at Layer 4 and cannot inspect HTTP headers or perform URL-based routing.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 5

A company has multiple on-premises sites and Azure VNets in different regions. They need to connect all networks with a single mesh topology, ensuring that any network can communicate with any other network directly. They also want to minimize administrative overhead. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the correct choice because it provides a managed, global mesh network that automatically connects on-premises sites and Azure VNets across regions using a hub-and-spoke architecture with built-in transitive routing. This eliminates the need to manually configure individual VPN gateways or ExpressRoute circuits for each pair of networks, directly supporting the requirement for any-to-any direct communication with minimal administrative overhead.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Peering Service

Question 6

A company deploys a web application on Azure VMs across availability zones. They need to distribute HTTPS traffic, offload SSL termination, and maintain session persistence. They do not require traffic inspection. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway v2.. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports HTTPS traffic distribution, SSL termination (offloading the decryption burden from backend VMs), and session persistence via cookie-based affinity. It meets all requirements without needing traffic inspection, which is optional and can be disabled.

Answer

Azure Load Balancer (Standard).

Answer

Azure Traffic Manager.

Answer

Azure Front Door.

Question 7

A company deploys a stateless web application on Azure VMs in a single region. They need to distribute incoming HTTP traffic across multiple VMs and perform health checks. The solution should be highly available within the region. Which Azure load balancing solution should they use?

Accepted Answer

Azure Load Balancer (Standard) with HTTP health probe.. Azure Load Balancer (Standard) operates at Layer 4 (TCP/UDP) and can distribute HTTP traffic across VMs in a single region while performing health checks via HTTP health probes. It provides high availability within a region by distributing traffic across availability zones or availability sets, meeting the requirement for a stateless web application without needing Layer 7 features.

Answer

Azure Application Gateway v2.

Answer

Azure Traffic Manager.

Answer

Azure Front Door.

Question 8

A company plans to migrate a legacy web application to Azure. The application runs on multiple Windows virtual machines (VMs) in an availability set. The VMs must be exposed to the internet via a single endpoint that performs SSL termination and health checks. The load-balancing solution must preserve the original client IP address for logging purposes. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports SSL termination, health probes, and provides a single public endpoint. It preserves the original client IP address by inserting the X-Forwarded-For header in the HTTP request, which the backend VMs can read for logging. This meets all requirements: single internet-facing endpoint, SSL offload, health checks, and client IP preservation.

Answer

Azure Load Balancer (Standard)

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 9

A hub-and-spoke Azure network must centralize outbound inspection and still allow spokes to resolve private endpoint DNS names. Which two components are commonly required? (Choose 2.)

Accepted Answer

User-defined routes from spoke subnets to the firewall or NVA.. Option A is correct because user-defined routes (UDRs) on spoke subnets force all outbound traffic (including internet-bound traffic) to the central firewall or network virtual appliance (NVA) in the hub, enabling centralized inspection. Without UDRs, spoke VMs would bypass the firewall and use default outbound internet access, breaking the inspection requirement.

Answer

A public IP address on every private endpoint.

Answer

Basic SKU load balancers in each spoke.

Question 10

A company is designing a virtual network architecture for a three-tier application (web, application, database). They want network isolation between tiers and secure access from the internet to the web tier only. Which Azure networking solution should they use?

Accepted Answer

Azure Virtual Network with subnets for each tier and Network Security Groups.. Option A is correct because deploying each tier in its own subnet within an Azure Virtual Network and applying Network Security Groups (NSGs) allows granular inbound/outbound rule enforcement. NSGs can restrict traffic so that only the web tier is reachable from the internet (via a public IP or Azure Load Balancer), while the application and database tiers are isolated from direct internet access and can only communicate with the adjacent tier as defined by NSG rules.

Answer

Azure Virtual Network with a single subnet and application security groups.

Answer

Azure Virtual Network with subnets and Azure Firewall.

Answer

Azure Virtual Network with subnets and a network virtual appliance (NVA).

Question 11

A company needs to connect its on-premises data center to Azure for hybrid workloads. The connection must be private, dedicated, and provide guaranteed bandwidth. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a private, dedicated connection from on-premises to Azure, bypassing the public internet. It offers guaranteed bandwidth, higher reliability, and lower latency compared to VPN-based solutions, making it ideal for hybrid workloads requiring consistent performance.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 12

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

Accepted Answer

Peer each spoke VNet with the hub VNet. B is correct because VNet peering is required to establish connectivity between the spoke VNets and the hub VNet, enabling traffic to flow through the central Azure Firewall. Without peering, the spoke VNets would be isolated and unable to route traffic to the hub. C is correct because a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP ensures that all outbound internet traffic from spoke subnets is forced through the firewall for inspection and control.

Answer

Enable public IP addresses on all workload VMs

Answer

Deploy a NAT gateway in every spoke subnet

Question 13

An on-premises datacenter must connect privately to Azure with predictable bandwidth and avoid traversal of the public internet. Which connectivity option should be recommended?

Accepted Answer

ExpressRoute. ExpressRoute provides a dedicated private connection from on-premises to Azure, bypassing the public internet entirely. It offers predictable bandwidth, low latency, and high reliability through a Layer 3 MPLS or direct fiber link from a connectivity provider. This meets the requirement for a private, consistent network path without internet traversal.

Answer

Azure Bastion

Answer

Point-to-site VPN

Answer

Site-to-site VPN only

Question 14

A company is designing private access to a PaaS database from workloads in a VNet. The database should not be reachable over its public endpoint. What should be recommended?

Accepted Answer

Private Endpoint with public network access disabled. Private Endpoint with public network access disabled is the correct recommendation because it assigns a private IP address from the VNet to the PaaS database, making it accessible only over the private network. This eliminates exposure to the public internet by disabling the public endpoint, aligning with the requirement that the database should not be reachable over its public endpoint.

Answer

A public IP address with NSG rules

Answer

A route table to the internet gateway

Answer

Azure CDN endpoint

Question 15

Drag and drop the steps to set up Azure Private Link for an Azure SQL Database into the correct order.