AZ-305 Design infrastructure solutions Practice Test 5 — 15 Questions

Question 1

A company is designing a solution for storing sensitive documents in Azure Blob Storage. They require that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they want to prevent any accidental deletion of the key vault and its keys. Which combination of actions should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable soft-delete and purge protection on the key vault. Enabling soft-delete and purge protection on the Azure Key Vault prevents accidental or malicious deletion of the key vault and its keys, which is essential when using customer-managed keys for encryption at rest. Soft-delete allows recovery of deleted vaults and keys within a retention period, while purge protection prevents permanent deletion until the retention period expires. Option A is incorrect because Key Vault Contributor role allows management of the vault but does not prevent deletion; in fact, it could allow authorized users to delete the vault. Option B is incorrect because firewall rules restrict network access but do not prevent deletion of the vault itself. Option D is incorrect because diagnostic settings and logging only provide monitoring and auditing, not protection against deletion.

Answer

Assign the Key Vault Contributor role to only the security team

Answer

Configure firewall rules to restrict network access

Answer

Enable diagnostic settings and send logs to a Log Analytics workspace

Question 2

A company needs to implement a hybrid identity solution that allows users to access both on-premises applications and Microsoft 365 using a single identity. The company has on-premises Active Directory Domain Services (AD DS). They want to synchronize identities to the cloud while also enabling password writeback for self-service password reset. Which Azure service should they use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct tool for synchronizing on-premises AD DS identities to Microsoft Entra ID while enabling password writeback for self-service password reset (SSPR). It supports the required hybrid identity scenarios, including password hash synchronization or pass-through authentication, and can be configured to write passwords back to on-premises AD DS via the SSPR writeback feature.

Answer

Microsoft Entra ID

Answer

Microsoft Entra Connect Health

Answer

Microsoft Entra Domain Services

Question 3

A company is planning to migrate a legacy application to Azure VMs. The application requires a static IP address for licensing purposes. The VM must be highly available within a single region. Which combination of Azure resources should they use?

Accepted Answer

Standard Load Balancer with a static frontend IP and availability set. A Standard Load Balancer with a static frontend IP provides a fixed IP address for licensing, and an availability set ensures high availability by distributing VMs across fault and update domains within a single region. This combination meets the requirement for a static IP and regional HA without needing scale-out or global routing.

Answer

Application Gateway with a static frontend IP and virtual machine scale set

Answer

Basic Load Balancer with a static frontend IP and availability zone

Answer

Azure Front Door with a static backend IP and VM in an availability zone

Question 4

A company is designing a containerized application on Azure Kubernetes Service (AKS). They need to ensure that the control plane is managed by Microsoft and that the worker nodes are isolated to a single tenant. They also require that the worker nodes be automatically patched for security updates. Which AKS node pool type should they use?

Accepted Answer

System node pools. System node pools are managed by Azure and provide automatic patching for worker nodes. They also ensure that worker nodes are isolated to a single tenant (dedicated). User node pools (Option C) are for user workloads but do not provide automatic patching by default and are not managed in the same way. Spot node pools (Option B) are for cost savings on non-critical workloads and lack automatic patching. Virtual nodes (Option D) are serverless and do not involve worker nodes at all.

Answer

Spot node pools

Answer

User node pools

Answer

Virtual nodes (serverless)

Question 5

A company is using Azure SQL Database for a critical application. They need to ensure that the database is automatically backed up and that backups are retained for 35 days. What should they configure?

Accepted Answer

Configure the point-in-time restore (PITR) retention to 35 days. Azure SQL Database has a default point-in-time restore (PITR) retention period of 7 days, which can be configured up to 35 days. By setting the PITR retention to 35 days, the company ensures that automated backups are retained for the required duration, allowing restoration to any point within that window. This meets the requirement without additional services or configurations.

Answer

Enable long-term retention (LTR) for backups

Answer

Configure active geo-replication

Answer

Use Azure Backup to back up the SQL Database

Question 6

A company is deploying a web application on Azure App Service. The application must authenticate users with their Microsoft Entra ID credentials. The development team wants to use the Microsoft Authentication Library (MSAL) for authentication. Which App Service authentication feature should they use to simplify integration?

Accepted Answer

Configure the App Service authentication / authorization feature to use Microsoft Entra ID. The App Service authentication / authorization feature (also known as Easy Auth) provides a built-in, code-free integration with Microsoft Entra ID. By enabling this feature and configuring it to use Microsoft Entra ID, the App Service automatically handles token validation, session management, and redirects, allowing the development team to use MSAL on the client side for sign-in without writing server-side authentication logic.

Answer

Use Application Insights to capture authentication logs

Answer

Use Azure API Management to handle authentication

Answer

Use Azure AD B2C for identity management

Question 7

A company is designing a backup strategy for Azure resources. They have the following resources: Azure VMs, Azure SQL Database, and Azure Files shares. They need to meet the following requirements: 1) Backup of VMs must be application-consistent. 2) SQL Database backups must be retained for 10 years. 3) Azure Files backups must support soft delete. Which THREE services or features should they use?

Accepted Answer

Azure Backup. Azure Backup is the correct service for VM backups because it supports application-consistent backups for Windows VMs via Volume Shadow Copy Service (VSS) and for Linux VMs via file-system-consistent snapshots with pre/post-scripts, ensuring that applications are in a consistent state at the time of backup. This directly meets requirement 1.

Answer

Azure Site Recovery

Answer

Azure Policy

Question 8

A company is planning to migrate on-premises SQL Server databases to Azure. They want to minimize administrative overhead and ensure high availability with automatic failover. Which TWO Azure SQL deployment options should they consider?

Accepted Answer

Azure SQL Database (single database). Azure SQL Database (single database) and Azure SQL Database Managed Instance are both correct because they are fully managed Platform-as-a-Service (PaaS) offerings that include built-in high availability with automatic failover via service tiers that use Always On Availability Groups. This minimizes administrative overhead as Microsoft handles patching, backups, and replication, meeting the requirement for automatic failover without manual intervention. SQL Server on Azure VMs requires manual configuration of availability, and the other options are not appropriate for standard OLTP migrations.

Answer

SQL Server on Azure VMs

Answer

SQL Server Stretch Database

Answer

Azure Synapse Analytics

Question 9

A multinational corporation needs to design a global DNS solution for Azure resources. They require automatic failover across Azure regions and low-latency responses based on the client's geographic location. The solution must also support custom domains without exposing the underlying Azure public IP addresses. Which combination of Azure services should they use?

Accepted Answer

Azure Traffic Manager with geographic routing and Azure Front Door. Azure Front Door provides global load balancing with automatic failover across regions and low-latency routing based on the client's geographic location via its anycast protocol. Azure Traffic Manager with geographic routing complements this by directing traffic to specific regional endpoints based on the client's origin, and together they support custom domains while hiding the underlying Azure public IP addresses through Front Door's frontend endpoint.

Answer

Azure Application Gateway with Azure Front Door

Answer

Azure DNS with Azure Traffic Manager

Answer

Azure Traffic Manager with priority routing and Azure Application Gateway

Question 10

A company is migrating a legacy application to Azure VMs. The application requires a static IP address that does not change if the VM is stopped and started. Which type of IP address should they assign to the VM?

Accepted Answer

Static public IP address. A static public IP address in Azure remains permanently assigned to a VM even when the VM is stopped and deallocated. This meets the requirement for a fixed, unchanging IP address that persists across VM lifecycle operations, which is essential for legacy applications that rely on a stable endpoint for client connections or licensing.

Answer

Dynamic private IP address

Answer

Dynamic public IP address

Answer

Ephemeral IP address

Question 11

A company is designing a disaster recovery solution for Azure VMs running a critical application. They need a Recovery Time Objective (RTO) of less than 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The solution should be cost-effective and allow testing without affecting production. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct choice because it provides orchestrated replication and failover for Azure VMs, supporting RPOs as low as 15 minutes (with continuous replication) and RTOs under 1 hour. It also enables non-disruptive test failovers in isolated networks, meeting the requirement for testing without affecting production. ASR is cost-effective for critical workloads as it only charges for replication storage and compute during failover, unlike always-on redundancy solutions.

Answer

Azure Migrate

Answer

Azure Backup

Answer

Azure Front Door

Question 12

An organization is designing a storage solution for Azure VMs running a database that requires low latency and high IOPS. The data is critical and must be durable with automatic replication across multiple datacenters in the same region. Which Azure managed disk type and redundancy option should they choose?

Accepted Answer

Premium SSD with ZRS. Premium SSD with ZRS is correct because the database requires low latency and high IOPS, which Premium SSD provides, and ZRS (Zone-Redundant Storage) automatically replicates data synchronously across three Azure availability zones within the same region, ensuring durability and high availability without the cross-region latency of GRS.

Answer

Standard SSD with GRS

Answer

Ultra Disk with LRS

Answer

Premium SSD v2 with LRS

Question 13

A company needs to provide secure access to Azure resources for remote employees. They want to enforce multi-factor authentication and conditional access policies. The solution should not require a VPN connection. Which Azure service should they implement?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure Active Directory) provides identity and access management services that include multi-factor authentication (MFA) and conditional access policies. These capabilities allow you to enforce security requirements like MFA and device compliance before granting access to Azure resources, all without requiring a VPN connection. Entra ID acts as the identity provider and policy engine, making it the correct choice for this scenario.

Answer

Microsoft Intune

Answer

Azure VPN Gateway

Answer

Azure Bastion

Question 14

A company is designing an Azure Kubernetes Service (AKS) cluster for a microservices application. They need to ensure that pods can securely access Azure resources such as Azure Key Vault and Azure SQL Database without using service principals or connection strings. Which AKS feature should they enable?

Accepted Answer

Microsoft Entra Workload ID. Microsoft Entra Workload ID (formerly Azure AD Workload Identity) enables pods in AKS to authenticate to Azure resources like Key Vault and Azure SQL Database using federated identity credentials, eliminating the need for service principals or connection strings. It works by projecting an Entra ID-managed identity into the pod via a sidecar or mutating webhook, allowing the pod to obtain tokens directly from the Microsoft identity platform.

Answer

Azure RBAC for Kubernetes authorization

Answer

Azure Policy for AKS

Answer

Azure CNI network plugin

Question 15

A financial services company must store sensitive customer data in Azure Blob Storage. The data must be encrypted at rest using a customer-managed key stored in a hardware security module (HSM). The key must be automatically rotated every 90 days. Which combination of Azure services and features should they use?

Accepted Answer

Azure Key Vault Managed HSM with automatic key rotation. Azure Key Vault Managed HSM is a fully managed, FIPS 140-2 Level 3 validated HSM that supports customer-managed keys for Azure Storage encryption. It provides built-in automatic key rotation policies, enabling you to set a rotation interval (e.g., every 90 days) without custom code. This meets the requirements for HSM-backed keys and automated rotation.

Answer

Azure Key Vault (Standard) with Azure Storage encryption

Answer

Azure Key Vault (Premium) with custom rotation logic

Answer

Azure Storage encryption with customer-managed keys stored in Azure Key Vault (Standard)