AZ-305 Design infrastructure solutions Practice Test 7 — 15 Questions

Question 1

Your company is designing a new application that will run on Azure VMs. The application must be highly available across two Azure regions. You need to ensure that the application can automatically fail over if a regional outage occurs. Which THREE components should you include in the architecture? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Traffic Manager. To achieve automatic failover across two Azure regions, you need a global load balancer like Azure Traffic Manager (B) to route traffic between regions based on availability. Within each region, you should use Azure Load Balancer (E) to distribute traffic among VMs, and Azure Availability Zones (D) to protect against zonal failures within a region, ensuring high availability. Availability Sets (C) only provide protection within a single datacenter and do not support cross-region failover. Application Gateway (A) is a regional service and not suitable for cross-region failover.

Answer

Azure Application Gateway

Answer

Availability Sets

Question 2

Your company has a critical application running on Azure Virtual Machines that processes financial transactions. You need to ensure that the application remains available during an Azure region failure. The application is stateless and can scale horizontally. What is the most cost-effective design to meet the availability requirement?

Accepted Answer

Deploy VMs in an availability zone in the primary region and use Azure Site Recovery to replicate to a secondary region.. Deploying VMs across availability zones within a region protects against datacenter-level failures, but for region-level failures, Azure Site Recovery (ASR) provides cost-effective disaster recovery by replicating VMs to a secondary region. Since the application is stateless and horizontally scalable, you can run a minimal footprint in the primary region and use ASR for orchestrated failover, avoiding the cost of always-on active-active infrastructure.

Answer

Deploy VMs in an active-active configuration across two Azure regions using Traffic Manager and Azure Front Door.

Answer

Deploy VMs in an availability set in the primary region and use Azure Site Recovery to failover to a secondary region.

Answer

Deploy VMs in a single region using Virtual Machine Scale Sets with automatic scaling.

Question 3

You are designing a storage solution for a new application that will store large binary files (up to 5 TB each) and require high throughput for sequential reads. The data is accessed infrequently but must be retained for 7 years for compliance. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage in the Cool tier. Azure Blob Storage in the Cool tier is correct because it supports objects up to 5 TB in size (with block blobs) and provides high throughput for sequential reads, which is ideal for large binary files. The Cool tier offers low storage costs for infrequently accessed data while meeting the 7-year retention requirement, and it can be combined with lifecycle management policies to transition data to Archive tier if needed.

Answer

Azure Managed Disks with Standard HDD

Answer

Azure Files shares in the Premium tier

Answer

Azure NetApp Files with Standard service level

Question 4

Your organization is migrating a legacy on-premises application to Azure. The application uses a proprietary authentication protocol that is not supported by Microsoft Entra ID. You need to integrate the application with Microsoft Entra ID without modifying the application code. What should you do?

Accepted Answer

Configure Microsoft Entra ID Application Proxy to provide secure remote access and pass through authentication.. Microsoft Entra ID Application Proxy can be configured to publish on-premises applications that use legacy authentication protocols. It acts as a reverse proxy, terminating the external connection and forwarding requests to the internal application. Because it can be set to pass through authentication without requiring any changes to the application code, it allows the proprietary authentication protocol to continue working while still integrating with Microsoft Entra ID for access control and conditional access policies.

Answer

Use Azure Active Directory B2C with custom policies to translate the authentication protocol.

Answer

Deploy Azure Active Directory Domain Services and domain-join the application servers.

Answer

Implement Azure Active Directory Connect with pass-through authentication.

Question 5

You need to design a networking solution for a multi-tier application that includes a web front-end, an API layer, and a database. The web and API tiers must be accessible from the internet, while the database tier must be isolated. What is the most secure and efficient design?

Accepted Answer

Deploy all tiers in the same VNet with separate subnets, and use NSGs to restrict traffic. Place an Azure Application Gateway with WAF in front of the web tier.. It uses a single VNet with separate subnets for each tier, allowing Network Security Groups (NSGs) to enforce micro-segmentation and restrict traffic between tiers. The Azure Application Gateway with Web Application Firewall (WAF) provides Layer 7 protection and SSL termination for internet-facing web traffic, while the database tier remains isolated with no public endpoint. This design minimizes latency by keeping all tiers within the same VNet and avoids the complexity of VNet peering or unnecessary firewall inspection.

Answer

Place all VMs in the same subnet and use a single Azure Load Balancer to distribute traffic.

Answer

Use separate VNets for each tier and connect them with VNet peering.

Answer

Deploy all VMs in a single subnet and use Azure Firewall to inspect all inbound and outbound traffic.

Question 6

Your company is deploying a new application that uses Azure Cosmos DB for globally distributed low-latency reads and writes. The application must be highly available with a recovery point objective (RPO) of less than 5 seconds and recovery time objective (RTO) of less than 1 second in case of a regional outage. Which Cosmos DB configuration should you recommend?

Accepted Answer

Multiple write regions enabled with automatic failover and session consistency.. Enabling multiple write regions with automatic failover ensures that if a write region fails, another region continues accepting writes, meeting the sub-1-second RTO. Session consistency provides read-your-writes and monotonic guarantees, and with multiple write regions, replication lag is typically low enough to achieve an RPO under 5 seconds. Other options either rely on manual failover (higher RTO) or single-write regions that cannot achieve sub-1-second RTO during regional outages.

Answer

Multiple write regions with manual failover and eventual consistency.

Answer

Single write region with strong consistency and multi-region writes disabled.

Answer

Single write region with multiple read regions and multi-region writes disabled.

Question 7

You are designing a backup and disaster recovery strategy for an Azure SQL Database instance that runs a critical business application. The database is 500 GB and experiences high transaction rates. The recovery point objective (RPO) is 1 minute and recovery time objective (RTO) is 1 hour. What should you recommend?

Accepted Answer

Configure active geo-replication to a secondary region in the same Azure geography.. Active geo-replication for Azure SQL Database provides a continuously synchronized readable secondary replica in a different Azure region, enabling failover with an RPO of 1 minute (due to synchronous replication) and an RTO of 1 hour (since failover is manual or can be automated). This meets the critical business application's requirements for high transaction rates and low data loss.

Answer

Enable geo-redundant backup storage and use geo-restore in the secondary region.

Answer

Configure automated backups with locally-redundant storage (LRS) and enable point-in-time restore.

Answer

Export the database to a bacpac file daily and store it in Azure Blob Storage.

Question 8

Your organization has a hybrid identity environment with Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to access cloud applications using their on-premises credentials, and also enables single sign-on (SSO) for legacy on-premises applications that do not support modern authentication protocols. What should you recommend?

Accepted Answer

Implement Azure AD Connect with password hash synchronization and Azure AD Application Proxy.. Azure AD Connect with password hash synchronization enables users to authenticate to cloud applications using their on-premises credentials, while Azure AD Application Proxy provides secure remote access and SSO for legacy on-premises applications that do not support modern authentication protocols (such as Kerberos, SAML, or OAuth). The Application Proxy can pass Kerberos constrained delegation tickets to legacy apps, enabling SSO without requiring those apps to be domain-joined or modified.

Answer

Deploy Azure Active Directory Domain Services and domain-join the legacy application servers.

Answer

Use Azure Active Directory B2B collaboration for internal users.

Answer

Configure Azure AD Seamless SSO and use Azure AD Connect with pass-through authentication.

Question 9

You need to design a monitoring solution for a set of Azure virtual machines running a business-critical application. The solution must provide centralized log management, enable real-time analysis of security events, and support custom alerts for anomalous behavior. Which Azure service should you use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that provides centralized log management, real-time security event analysis, and built-in support for custom analytics rules to detect anomalous behavior. Unlike Azure Monitor or Log Analytics, Sentinel is specifically designed for security-focused monitoring and can ingest logs from multiple sources, including Azure VMs, and use machine learning to identify threats.

Answer

Azure Log Analytics

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 10

Your company is planning to migrate a large number of on-premises servers to Azure. The migration must be completed within 3 months. You need to assess the current on-premises environment and recommend the most appropriate Azure VM sizes and costs. What should you do?

Accepted Answer

Use Azure Migrate to discover and assess the on-premises environment, and generate sizing and cost recommendations.. Azure Migrate is the correct tool because it provides automated discovery and assessment of on-premises servers, including performance data, dependencies, and configuration details. It then generates right-sized Azure VM recommendations and cost estimates based on actual usage, which is essential for a large-scale migration with a tight 3-month deadline.

Answer

Create a manual inventory of all servers and use Azure Pricing Calculator to estimate costs.

Answer

Use Azure Advisor to analyze on-premises server usage and recommend Azure VM sizes.

Answer

Use Azure Cost Management to estimate costs based on manual input of server specifications.

Question 11

You are reviewing a network security group (NSG) rule for a subnet that hosts web servers. The subnet's address space is 10.0.1.0/24. What is the effect of this rule?

Accepted Answer

The rule allows inbound TCP traffic on ports 80 and 443 from any source.. The rule's source is set to 'VirtualNetwork', which includes all subnets and resources within the same virtual network (including peered networks). Therefore, it allows inbound TCP traffic on ports 80 and 443 from any source that is part of the virtual network, but not from the internet or other external sources.

Answer

The rule allows inbound TCP traffic on ports 80 and 443 from the same subnet.

Answer

The rule denies inbound TCP traffic on ports 80 and 443 from any source.

Answer

The rule allows inbound TCP traffic on ports 80 and 443 from the internet.

Question 12

You are an Azure administrator. The above Azure Policy definition is assigned to a subscription. A developer tries to deploy a Virtual Machine with SKU Standard_DS2_v2. What will happen?

Accepted Answer

The deployment is denied and an error message is returned.. The Azure Policy definition assigned to the subscription includes a 'deny' effect for VM SKUs that are not in the allowed list. Since Standard_DS2_v2 is not an allowed SKU, the deployment is denied and an error message is returned to the developer, preventing the VM from being created.

Answer

The deployment succeeds with a warning logged.

Answer

The VM is created but the SKU is changed to a different series.

Answer

The deployment succeeds because the policy only audits.

Question 13

You executed the above Azure CLI commands. The remote VNet (yourVNet) has address space 10.1.0.0/16. What is the result?

Accepted Answer

A VNet with two subnets is created, and a VNet peering is established.. The Azure CLI commands create a VNet named 'myVNet' with two subnets ('subnet1' and 'subnet2') using the 'az network vnet create' command, which supports multiple subnet configurations in a single call. The subsequent 'az network vnet peering create' command establishes a VNet peering from 'myVNet' to the remote VNet 'yourVNet' (address space 10.1.0.0/16). Since both VNets exist and the commands are syntactically correct, the result is a VNet with two subnets and a successful peering.

Answer

The peering command fails because the remote VNet does not exist.

Answer

A VNet with one subnet is created, and no peering is established.

Answer

Only the first subnet is created, and the peering is established.

Question 14

You are designing a highly available architecture for a stateful application running on Azure Virtual Machines. The application requires a shared storage solution that supports concurrent read/write access from multiple VMs, and must be resilient to zone failures. Which TWO Azure solutions meet these requirements? (Choose TWO.)

Accepted Answer

Azure NetApp Files with cross-zone replication. Azure NetApp Files provides a high-performance shared file storage supporting NFS/SMB concurrent access. With cross-zone replication, data is replicated across availability zones, ensuring zone-failure resilience. Azure Files Premium tier also offers shared file storage via SMB, and with zone-redundant storage (ZRS), data is synchronously replicated across three zones in the same region, providing both high availability and zone-failure protection. Both solutions meet the requirements for shared concurrent read/write access from multiple VMs and resilience to zone failures.

Answer

Azure Disk Storage with shared disks enabled

Answer

Azure Managed Disks with Standard SSD

Answer

Azure Blob Storage with hot access tier and geo-redundant storage (GRS)

Question 15

Your organization is designing a data platform for real-time analytics on streaming data from IoT devices. The solution must ingest millions of events per second, process the data with low latency, and store results in a format optimized for analytical queries. Which THREE Azure services should you include in the design? (Choose THREE.)

Accepted Answer

Azure Event Hubs. Azure Event Hubs is correct because it is a highly scalable data streaming platform and event ingestion service capable of ingesting millions of events per second, providing low-latency durable event capture. Azure Stream Analytics is correct because it provides real-time stream processing with low latency, allowing you to query and transform the data as it arrives. Azure Synapse Analytics is correct because it is a cloud data warehouse optimized for analytical queries, enabling efficient storage and querying of the processed results. Azure IoT Hub is not chosen because its primary role is device management and secure communication, not high-scale event ingestion for real-time analytics. Azure Functions is not chosen as it is event-driven compute but not designed for continuous stream processing at the scale required.

Answer

Azure Functions

Answer

Azure IoT Hub