AZ-305 Design infrastructure solutions Practice Test 6 — 15 Questions

Question 1

Drag and drop the steps to set up Azure Key Vault for storing secrets and access them from an Azure function into the correct order.

Question 2

Match each Azure identity service to its description.

Question 3

Match each Azure monitoring service to its function.

Question 4

Your company plans to migrate an on-premises application to Azure. The application requires low-latency access to a shared file system that supports SMB protocol. Which Azure storage solution should you recommend?

Accepted Answer

Azure Files. Option B is correct because Azure Files supports SMB protocol and can be used as a shared file system with low-latency access when deployed in the same region. Option A is wrong because Blob Storage does not support SMB natively. Option C is wrong because Disk Storage is block-level and not shared. Option D is wrong because Queue Storage is for messaging.

Answer

Azure Blob Storage

Answer

Azure Disk Storage

Answer

Azure Queue Storage

Question 5

You are designing a disaster recovery solution for a critical application hosted in Azure VMs. The primary region is East US. The application requires a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes. Which Azure service should you use to replicate the VMs?

Accepted Answer

Azure Site Recovery. Option C is correct because Azure Site Recovery provides replication with RPO as low as 15 minutes and can meet the RTO with proper planning. Option A is wrong because Azure Backup has higher RPO. Option B is wrong because Azure Traffic Manager is for traffic routing, not replication. Option D is wrong because Azure Front Door is a global load balancer.

Answer

Azure Front Door

Answer

Azure Backup

Answer

Azure Traffic Manager

Question 6

You are designing a hybrid identity solution for a company with 5,000 on-premises users. The company wants to use Microsoft Entra ID for single sign-on and self-service password reset. They also need to synchronize user passwords to the cloud. Which feature should you enable to ensure password changes on-premises are immediately propagated to Microsoft Entra ID?

Accepted Answer

Password Hash Synchronization. Option A is correct because Password Hash Synchronization with Microsoft Entra Connect synchronizes password hashes and can be configured for immediate sync on change. Option B is wrong because Pass-through Authentication does not synchronize passwords. Option C is wrong because Federation uses AD FS and does not sync passwords. Option D is wrong because Microsoft Entra Cloud Sync is for syncing objects but password sync is a feature of Connect.

Answer

Federation with AD FS

Answer

Pass-through Authentication

Answer

Microsoft Entra Cloud Sync

Question 7

You are designing a network topology for a multi-tier application in Azure. The application has a web tier, an API tier, and a database tier. You need to ensure that the web tier can communicate with the API tier, and the API tier can communicate with the database tier, but the web tier cannot directly access the database tier. Which Azure networking solution should you implement?

Accepted Answer

Azure Application Security Groups (ASGs). Option B is correct because Azure Application Security Groups (ASGs) allow you to define network security policies based on application groups, and you can create rules that permit traffic only between specific tiers. Option A is wrong because NSGs alone would require complex rule management. Option C is wrong because Azure Firewall is a managed firewall but is overkill for this scenario. Option D is wrong because VNet peering is for connecting VNets, not controlling traffic within a VNet.

Answer

Azure Firewall

Answer

Network Security Groups (NSGs) with service tags

Answer

VNet peering

Question 8

Your company has an Azure subscription with multiple virtual networks (VNets) in different regions. You need to ensure that resources in all VNets can communicate with each other privately over the Microsoft backbone network. Which Azure solution should you implement?

Accepted Answer

VNet peering. Option D is correct because VNet peering connects VNets within the same region or across regions using the Microsoft backbone. Option A is wrong because Azure VPN Gateway connects on-premises to Azure, not VNet-to-VNet. Option B is wrong because Azure ExpressRoute connects on-premises to Azure. Option C is wrong because Azure DNS is for domain name resolution.

Answer

Azure ExpressRoute

Answer

Azure DNS

Answer

Azure VPN Gateway

Question 9

You are designing a storage strategy for a data analytics solution that processes large volumes of streaming data. The data must be stored in a cost-effective manner with low latency for hot data and infrequent access for cold data after 30 days. The solution must support both batch and interactive queries. Which combination of Azure storage services should you recommend?

Accepted Answer

Azure Data Lake Storage Gen2 with lifecycle management. Option B is correct because Azure Data Lake Storage Gen2 provides scalable storage for analytics with hierarchical namespace, and lifecycle management policies can move data to cool or archive tiers. Option A is wrong because Blob Storage with hot/cool tiers works but Data Lake Gen2 is optimized for analytics. Option C is wrong because Azure SQL Database is relational and expensive for large-scale analytics. Option D is wrong because Cosmos DB is for NoSQL workloads.

Answer

Azure SQL Database with geo-replication

Answer

Azure Blob Storage with hot and cool access tiers

Answer

Azure Cosmos DB with multiple consistency levels

Question 10

Your company is deploying a web application on Azure App Service. The application must be able to read secrets from Azure Key Vault without storing credentials in application code. Which feature should you enable?

Accepted Answer

Managed Identity. Option C is correct because Managed Identity allows the App Service to authenticate to Key Vault without storing credentials. Option A is wrong because App Service authentication is for user authentication. Option B is wrong because Azure AD Application Registration requires client secrets. Option D is wrong because Key Vault access policies are authorization, not authentication.

Answer

Key Vault access policies

Answer

Azure AD Application Registration with client secret

Answer

App Service Authentication / Authorization

Question 11

You are designing a backup strategy for Azure VMs running critical business applications. The solution must support application-consistent backups and allow for restoration to a different region. Which Azure service and configuration should you use?

Accepted Answer

Azure Backup with application-consistent backup policy and geo-redundant storage. Option A is correct because Azure Backup with application-consistent backups and geo-restore meets the requirements. Option B is wrong because Azure Site Recovery is for disaster recovery, not backups. Option C is wrong because Azure Snapshot is not application-consistent. Option D is wrong because Azure Disk Encryption encrypts disks but does not provide backups.

Answer

Azure Disk Encryption with Azure Backup

Answer

Azure Snapshot with cross-region copy

Answer

Azure Site Recovery with replication to secondary region

Question 12

Your organization has a policy that all administrative access to Azure resources must be performed using just-in-time (JIT) access. Which Azure service allows you to enable JIT VM access?

Accepted Answer

Microsoft Defender for Cloud. Option B is correct because Microsoft Defender for Cloud provides JIT VM access as a security feature. Option A is wrong because Azure Policy is for compliance. Option C is wrong because Microsoft Sentinel is a SIEM. Option D is wrong because Azure AD Privileged Identity Management (PIM) is for user role management, not VM access.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure AD Privileged Identity Management

Question 13

You are designing a solution to monitor and analyze security events across your Azure environment. Which TWO Azure services should you include in your design to provide centralized logging and threat detection? (Choose two.)

Accepted Answer

Azure Log Analytics. Options B and C are correct. Azure Log Analytics (now part of Azure Monitor) provides centralized logging and analysis. Microsoft Sentinel provides SIEM and threat detection. Option A is wrong because Azure Policy is for compliance. Option D is wrong because Azure Firewall is a network security service. Option E is wrong because Azure Network Watcher is for network monitoring.

Answer

Azure Firewall

Answer

Azure Policy

Answer

Azure Network Watcher

Question 14

Your company plans to migrate a large number of on-premises virtual machines to Azure. You need to assess the current environment and migrate the workloads with minimal downtime. Which THREE Azure services or tools should you use? (Choose three.)

Accepted Answer

Azure Data Box. Options A, B, and D are correct. Azure Migrate provides discovery and assessment. Azure Site Recovery performs replication and migration. Azure Data Box is for offline data transfer. Option C is wrong because Azure App Service is for web apps. Option E is wrong because Azure Import/Export is for physical disk shipping, not VM migration.

Answer

Azure App Service

Answer

Azure Import/Export Service

Question 15

You are designing a highly available architecture for a web application that runs on Azure VMs. The solution must distribute incoming traffic across multiple VMs in an availability set. Which TWO Azure components should you include? (Choose two.)

Accepted Answer

Azure Load Balancer. Options A and D are correct. Azure Load Balancer distributes incoming traffic. Availability Set provides VM redundancy. Option B is wrong because Azure Traffic Manager is for global traffic routing. Option C is wrong because Azure Application Gateway is a layer 7 load balancer with additional features, but the scenario specifically mentions distributing traffic across VMs in an availability set, which is a basic load balancer function. However, both Load Balancer and Application Gateway can distribute traffic, but the simplest is Load Balancer. For high availability, you need both a load balancer and an availability set. Option E is wrong because Azure Front Door is for global load balancing.

Answer

Azure Traffic Manager

Answer

Azure Front Door

Answer

Azure Application Gateway