AZ-305 Design infrastructure solutions Practice Test 8 — 15 Questions

Question 1

A company is designing a hybrid network solution connecting an on-premises data center to Azure. They require high availability with active-active routing and need to support up to 10 Gbps throughput. Which Azure service should they include in the design?

Accepted Answer

ExpressRoute FastPath. ExpressRoute FastPath provides active-active connectivity with high throughput up to 10 Gbps. Option A is wrong because VPN Gateway typically supports lower throughput and is active-passive. Option B is wrong because Azure Virtual WAN is a management layer, not a connectivity service itself. Option D is wrong because ExpressRoute Direct provides dedicated ports but not inherently active-active routing.

Answer

Site-to-Site VPN Gateway

Answer

Azure Virtual WAN

Answer

ExpressRoute Direct

Question 2

A multinational corporation needs to design a global DNS solution for Azure resources. They require automatic failover across Azure regions and low-latency responses based on the client's geographic location. The solution must also support custom domains without exposing the underlying Azure public IP addresses. Which combination of Azure services should they use?

Accepted Answer

Azure Traffic Manager with geographic routing and Azure Front Door. Azure Traffic Manager with geographic routing and Azure Front Door with custom domain and private endpoint integration provides the required functionality. Option A is wrong because Azure DNS does not provide traffic routing. Option C is wrong because Application Gateway does not provide global routing. Option D is wrong because Traffic Manager alone does not support custom domains without exposing IPs.

Answer

Azure Application Gateway with Azure Front Door

Answer

Azure DNS with Azure Traffic Manager

Answer

Azure Traffic Manager with priority routing and Azure Application Gateway

Question 3

A company is migrating a legacy application to Azure VMs. The application requires a static IP address that does not change if the VM is stopped and started. Which type of IP address should they assign to the VM?

Accepted Answer

Static public IP address. A static public IP address or a static private IP address ensures the IP does not change. Option A is wrong because dynamic public IPs change on stop/start. Option C is wrong because private IPs can be dynamic or static; dynamic changes. Option D is wrong because ephemeral IPs are for temporary usage.

Answer

Dynamic private IP address

Answer

Dynamic public IP address

Answer

Ephemeral IP address

Question 4

A company is designing a disaster recovery solution for Azure VMs running a critical application. They need a Recovery Time Objective (RTO) of less than 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The solution should be cost-effective and allow testing without affecting production. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery provides replication with RPO as low as 15 minutes and enables failover with RTO typically less than 1 hour. It also supports non-disruptive disaster recovery drills. Option A is wrong because Azure Backup has a higher RPO and RTO. Option C is wrong because Azure Migrate is for migration, not DR. Option D is wrong because Azure Front Door is for global load balancing.

Answer

Azure Migrate

Answer

Azure Backup

Answer

Azure Front Door

Question 5

An organization is designing a storage solution for Azure VMs running a database that requires low latency and high IOPS. The data is critical and must be durable with automatic replication across multiple datacenters in the same region. Which Azure managed disk type and redundancy option should they choose?

Accepted Answer

Premium SSD with ZRS. Premium SSD v2 managed disks with locally-redundant storage (LRS) provide high IOPS and low latency with synchronous replication within a datacenter, but LRS is not multi-datacenter. For multi-datacenter within a region, zone-redundant storage (ZRS) is needed, but Premium SSD v2 does not support ZRS. The correct choice is Premium SSD with ZRS to meet durability across datacenters. Option A is wrong because Premium SSD v2 with LRS is not multi-datacenter. Option C is wrong because Standard SSD is lower performance. Option D is wrong because Ultra Disk with LRS is single-datacenter.

Answer

Standard SSD with GRS

Answer

Ultra Disk with LRS

Answer

Premium SSD v2 with LRS

Question 6

A company needs to provide secure access to Azure resources for remote employees. They want to enforce multi-factor authentication and conditional access policies. The solution should not require a VPN connection. Which Azure service should they implement?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) with conditional access and MFA provides secure access without VPN. Option B is wrong because Azure VPN Gateway requires VPN. Option C is wrong because Azure Bastion is for RDP/SSH to VMs. Option D is wrong because Microsoft Intune is for device management.

Answer

Microsoft Intune

Answer

Azure VPN Gateway

Answer

Azure Bastion

Question 7

A company is designing an Azure Kubernetes Service (AKS) cluster for a microservices application. They need to ensure that pods can securely access Azure resources such as Azure Key Vault and Azure SQL Database without using service principals or connection strings. Which AKS feature should they enable?

Accepted Answer

Microsoft Entra Workload ID. Azure AD pod-managed identity (now called Microsoft Entra Workload ID) allows pods to assume an identity to access Azure resources. Option A is wrong because Azure RBAC is for Kubernetes authorization. Option B is wrong because Azure Policy is for compliance. Option C is wrong because Azure CNI is for networking.

Answer

Azure RBAC for Kubernetes authorization

Answer

Azure Policy for AKS

Answer

Azure CNI network plugin

Question 8

A financial services company must store sensitive customer data in Azure Blob Storage. The data must be encrypted at rest using a customer-managed key stored in a hardware security module (HSM). The key must be automatically rotated every 90 days. Which combination of Azure services and features should they use?

Accepted Answer

Azure Key Vault Managed HSM with automatic key rotation. Azure Key Vault Managed HSM provides FIPS 140-2 Level 3 validated HSM with automatic key rotation. Option A is wrong because Key Vault Standard does not support HSM. Option B is wrong because Key Vault Premium supports HSM but not automatic rotation without custom logic. Option C is wrong because Azure Storage encryption uses Microsoft-managed keys by default.

Answer

Azure Key Vault (Standard) with Azure Storage encryption

Answer

Azure Key Vault (Premium) with custom rotation logic

Answer

Azure Storage encryption with customer-managed keys stored in Azure Key Vault (Standard)

Question 9

A company is deploying a web application that must scale out automatically based on CPU usage. The application runs on Azure App Service. Which Azure feature should they configure?

Accepted Answer

Autoscale rules. Autoscale rules in App Service can scale out based on CPU percentage. Option A is wrong because Azure Load Balancer distributes traffic but does not scale. Option B is wrong because Traffic Manager is for global routing. Option C is wrong because Azure Front Door is for global load balancing with acceleration.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 10

Which TWO Azure services can be used to provide a fully managed DNS solution that supports custom domains and DNSSEC?

Accepted Answer

Azure DNS. Azure DNS provides managed DNS with DNSSEC support (if enabled for certain zones). Azure Traffic Manager uses DNS to route traffic but does not manage DNS zones directly. Azure Front Door uses custom domains but does not provide DNS hosting or DNSSEC. Azure App Service provides custom domains but not DNS management. Azure Public IP does not provide DNS. Therefore, only Azure DNS supports DNSSEC and custom domains.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure App Service

Answer

Azure Public IP address

Question 11

Which THREE considerations are important when designing a highly available Azure SQL Database solution?

Accepted Answer

Auto-failover groups. Active geo-replication provides read-scale and failover to a secondary region. Zone redundancy provides resilience within a region. Auto-failover groups enable automatic failover. Read scale-out is not related to HA. Transparent Data Encryption is for security, not HA.

Answer

Transparent Data Encryption

Answer

Read scale-out

Question 12

Which TWO Azure networking services provide DDoS protection at the application layer (Layer 7)?

Accepted Answer

Azure Front Door Premium with WAF. Azure Web Application Firewall (WAF) on Application Gateway and Azure Front Door Premium provide Layer 7 DDoS protection. Azure DDoS Protection is for network layers. Azure Firewall is for network and application layers but not specifically DDoS. Azure Bastion is for secure access.

Answer

Azure Firewall

Answer

Azure DDoS Protection Standard

Answer

Azure Bastion

Question 13

Your company plans to migrate on-premises SQL Server databases to Azure. The databases require high availability with automatic failover to a secondary region in the event of a regional outage. The solution must minimize data loss and support read-only queries on the secondary replica. Which Azure service should you use?

Accepted Answer

Azure SQL Database with active geo-replication. Option B is correct because Azure SQL Database with active geo-replication provides automatic failover to a secondary region, supports read-only queries on the secondary, and minimizes data loss with synchronous replication within the primary region. Option A is wrong because Azure SQL Managed Instance does not support geo-replication by default. Option C is wrong because Azure SQL Database with failover groups uses asynchronous replication, which may cause data loss. Option D is wrong because Azure SQL Database with geo-restore does not provide automatic failover or a readable secondary.

Answer

Azure SQL Database with geo-restore

Answer

Azure SQL Database with failover groups

Answer

Azure SQL Managed Instance with failover groups

Question 14

You are designing a networking solution for a multi-tier application in Azure. The front-end web tier must be accessible from the internet, while the back-end database tier must only be accessible from the web tier. You need to minimize management overhead and ensure that the back-end tier is not directly reachable from the internet. What should you use?

Accepted Answer

Azure Application Gateway on the web subnet and network security groups on the database subnet. Option C is correct. Azure Application Gateway can be placed in front of the web tier in a VNet, and network security groups (NSGs) on the database subnet can restrict inbound traffic to only the web tier subnet. Option A is wrong because Azure Front Door is a global load balancer, not a regional one, and does not provide VNet-level isolation. Option B is wrong because Azure Firewall is a managed firewall but adds unnecessary complexity; NSGs are simpler for subnet-level filtering. Option D is wrong because Azure Bastion is for RDP/SSH access, not for application traffic.

Answer

Azure Bastion for database access and Azure Front Door for web access

Answer

Azure Front Door with private link for the web tier and service endpoints for the database tier

Answer

Azure Firewall in a hub VNet with forced tunneling for all traffic

Question 15

Your organization has a large number of virtual machines running in Azure. You need to centrally manage backup policies, monitor backup jobs, and ensure compliance with retention requirements. Which Azure service should you use?

Accepted Answer

Azure Backup Center. Option B is correct. Azure Backup Center provides a single pane of glass for managing backups across Azure VMs, SQL in VMs, SAP HANA, and Azure Files. Option A is wrong because Azure Site Recovery is for disaster recovery, not backup. Option C is wrong because Azure Policy can enforce backup policies but does not provide monitoring and management. Option D is wrong because Azure Monitor can monitor backup jobs but does not manage policies.

Answer

Azure Policy

Answer

Azure Site Recovery

Answer

Azure Monitor