AZ-305 Design infrastructure solutions Practice Test 8 — 15 Questions

Question 1

You need to design a solution to securely connect an on-premises data center to Azure for hybrid workloads. The connection must be private, use the internet for transport, and provide high availability. Which TWO Azure services should you consider? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure VPN Gateway (Site-to-Site VPN). Azure VPN Gateway (Site-to-Site VPN) provides a private, encrypted connection between an on-premises data center and Azure over the internet using IPsec/IKE tunnels. This meets the requirement for internet-based transport while ensuring privacy through encryption. Option D is correct because deploying the VPN gateway in active-active mode uses two active instances, each with its own public IP, to provide high availability by maintaining connectivity even if one instance or tunnel fails.

Answer

Azure Virtual WAN

Answer

Azure ExpressRoute

Answer

Azure Bastion

Question 2

A multinational company plans to deploy a new application on Azure. The application must comply with GDPR and requires data residency in the EU. The solution should minimize latency for users in Europe and provide disaster recovery across regions. Which Azure architecture should the company implement?

Accepted Answer

Deploy the application in two EU regions with Azure Traffic Manager and Azure Cosmos DB multi-region writes.. It meets all requirements: deploying in two EU regions ensures data residency within the EU, Azure Traffic Manager provides low-latency routing for European users via DNS-based traffic distribution, and Azure Cosmos DB multi-region writes enable active-active disaster recovery with automatic failover and no data loss, minimizing latency for writes across regions.

Answer

Deploy the application in two EU regions with Azure Front Door and Azure SQL Database geo-replication.

Answer

Deploy the application in a single Azure region in Ireland with Azure Site Recovery for DR.

Answer

Deploy the application in a single EU region with Azure Site Recovery and Azure Redis Cache.

Question 3

You need to design a virtual network architecture for a three-tier application in Azure. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of Azure services should you use?

Accepted Answer

Use Azure Application Gateway with WAF, network security groups (NSGs) on subnets, and Azure Private Endpoints for the database.. It uses Azure Application Gateway with WAF to provide internet-facing, layer-7 web traffic management and protection, network security groups (NSGs) on subnets to enforce east-west traffic isolation (web-to-app, app-to-database), and Azure Private Endpoints for the database to ensure the database is accessible only via a private IP within the virtual network, eliminating exposure to the internet. This combination meets the three-tier isolation requirements precisely.

Answer

Use Azure Front Door, service endpoints, and Azure SQL Database with firewall rules.

Answer

Use Azure Load Balancer, Azure Firewall, and Azure SQL Database with public endpoint.

Answer

Use a single virtual network with three subnets, no NSGs, and Azure SQL Database with VNet injection.

Question 4

A company runs a critical application on Azure VMs in a single region. They need to improve availability to meet an SLA of 99.99% while minimizing costs. The application is stateless and can run on multiple VMs. Which solution should you recommend?

Accepted Answer

Deploy a virtual machine scale set across multiple availability zones in a single region.. A virtual machine scale set deployed across multiple availability zones in a single region provides zone-level redundancy, protecting against datacenter failures while keeping traffic within a single region for low latency. This configuration can achieve up to 99.99% availability (when using two or more zones) without the cost and complexity of multi-region replication, making it the most cost-effective solution for a stateless application.

Answer

Deploy two VMs in the same availability set in a single region.

Answer

Deploy a single VM with Azure Site Recovery to another region.

Answer

Deploy two VMs in two different Azure regions with Azure Traffic Manager.

Question 5

Your company has an Azure subscription with multiple virtual networks connected via VNet peering. You need to design a solution to allow VMs in different peered VNets to resolve each other's private IP addresses using custom DNS suffixes. The solution must minimize administrative overhead. What should you implement?

Accepted Answer

Create an Azure Private DNS Zone linked to each VNet with auto-registration enabled.. Azure Private DNS Zone with auto-registration enables VMs in peered VNets to resolve each other's private IP addresses using custom DNS suffixes without deploying or managing custom DNS servers. When auto-registration is enabled, Azure automatically creates and updates A records for VMs in the linked VNet, and VNet peering propagates DNS resolution across peered VNets. This minimizes administrative overhead because no manual DNS server configuration or VM-level DNS suffix updates are needed.

Answer

Deploy custom DNS servers on Azure VMs and configure VNets to use those servers.

Answer

Configure Azure DNS to use a custom domain name and update each VM's DNS suffix.

Answer

Use Azure Firewall as a DNS proxy with custom DNS settings.

Question 6

A company plans to migrate on-premises SQL Server databases to Azure. They need to minimize changes to existing applications and want to use the latest features of SQL Server. Which Azure data service should they use?

Accepted Answer

Azure SQL Managed Instance. Azure SQL Managed Instance is the correct choice because it provides near 100% compatibility with on-premises SQL Server, enabling a lift-and-shift migration with minimal application changes. It also supports the latest SQL Server features, such as native JSON support, temporal tables, and intelligent query processing, while offloading infrastructure management to Azure.

Answer

SQL Server on Azure Virtual Machines

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Question 7

You are designing a storage solution for a media company that needs to store large video files (up to 50 GB each) and serve them to a global audience with low latency. The solution must be cost-effective and support resumable uploads. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large unstructured data like video files, and Azure CDN ensures low-latency global delivery. Blob Storage natively supports resumable uploads via block blob APIs, making additional services like Azure Files unnecessary. This solution is cost-effective due to Blob Storage's tiered pricing and CDN edge caching.

Answer

Azure Files with Azure File Sync and Azure CDN.

Answer

Azure Disk Storage with Azure Load Balancer.

Answer

Azure NetApp Files with Azure Front Door.

Question 8

A company wants to implement a backup strategy for their Azure virtual machines. They need to retain backups for 7 years for compliance and ensure backups are encrypted at rest. Which solution should you recommend?

Accepted Answer

Azure Backup with a vault configured for 7-year retention and encryption at rest.. Azure Backup is the correct solution because it provides long-term retention (up to 99 years) and supports encryption at rest using platform-managed keys (PMK) or customer-managed keys (CMK). It meets the 7-year compliance requirement and ensures backups are encrypted by default using Azure Storage Service Encryption (SSE).

Answer

Azure Disk Snapshot with a lifecycle management policy.

Answer

Azure Files Backup to a Recovery Services vault.

Answer

Azure Site Recovery with custom retention policies.

Question 9

You need to design a network topology for a global e-commerce platform on Azure. The solution must provide low-latency access to static content and protect the backend APIs from DDoS attacks. The backend APIs are deployed in multiple regions behind an internal load balancer. Which services should you use?

Accepted Answer

Azure Front Door with WAF and Azure API Management.. Azure Front Door with WAF provides global load balancing and low-latency access to static content via its anycast-based routing, while the integrated Web Application Firewall (WAF) protects backend APIs from DDoS and application-layer attacks. Azure API Management secures and manages the backend APIs, offering policies for throttling, authentication, and transformation. This combination meets the requirements for global low-latency content delivery and DDoS protection for multi-region backend APIs.

Answer

Azure Traffic Manager and Azure Firewall.

Answer

Azure Content Delivery Network (CDN) and Azure Load Balancer.

Answer

Azure Application Gateway with WAF and Azure API Management.

Question 10

Which TWO services should you use to design a highly available and scalable web application on Azure that runs on Linux containers and requires automatic scaling based on HTTP traffic? (Choose two.)

Accepted Answer

Azure Application Gateway. Azure Application Gateway (C) is correct because it provides layer-7 HTTP/HTTPS load balancing with TLS termination, URL path-based routing, and cookie-based session affinity, which are essential for managing HTTP traffic. It can scale out based on HTTP metrics like requests per second. Azure Kubernetes Service (AKS) (D) is correct because it runs Linux containers, provides orchestration, and supports automatic scaling of pods using the Horizontal Pod Autoscaler (HPA), which can scale based on HTTP traffic metrics from Application Gateway (e.g., via the Application Gateway Ingress Controller). Together, they enable a highly available and scalable web application. Options A (Azure Load Balancer) is layer-4 and lacks HTTP awareness, so it cannot scale based on HTTP traffic. Option B (Azure Web App for Containers) can run containers and scale, but it does not offer the same container orchestration and autoscaling control as AKS, and the question requires two specific services; AKS is the correct container platform. Option E (Azure Container Instances) is for individual containers without orchestration or autoscaling based on HTTP metrics.

Answer

Azure Load Balancer

Answer

Azure Web App for Containers

Answer

Azure Container Instances (ACI)

Question 11

Which THREE components are required to implement a hybrid cloud solution that extends on-premises Active Directory to Azure and provides single sign-on (SSO) to cloud applications? (Choose three.)

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync synchronizes on-premises Active Directory objects (users, groups, passwords) to Microsoft Entra ID, creating a unified identity store. Microsoft Entra ID (the cloud identity platform) provides the identity backbone for authentication to cloud applications. Active Directory Federation Services (AD FS) enables federation between on-premises AD and Microsoft Entra ID, allowing SSO to cloud applications by passing Kerberos or SAML tokens. Together, these three components form the core of a hybrid identity solution: Connect Sync for synchronization, Microsoft Entra ID as the cloud identity provider, and AD FS for federated SSO.

Answer

Microsoft Entra Domain Services

Answer

Azure AD Application Proxy

Question 12

Which TWO Azure services can be used to implement a serverless event-driven architecture that processes messages from a queue and stores results in a database? (Choose two.)

Accepted Answer

Azure Logic Apps. Azure Logic Apps is correct because it provides a serverless workflow engine that can be triggered by a queue (e.g., Azure Service Bus queue or Storage queue) and then process messages using built-in connectors to write results into a database like Azure SQL Database or Cosmos DB. It supports event-driven execution without managing infrastructure, making it ideal for orchestrating message processing and persistence.

Answer

Azure Event Grid

Answer

Azure Service Bus

Answer

Azure Batch

Question 13

You are designing a solution to securely store secrets, keys, and certificates for a cloud application. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it is specifically designed to securely store and manage secrets, encryption keys, and certificates. It provides centralized control with hardware security module (HSM) backed keys, access policies, and audit logging, meeting the core requirement for a cloud application's secure storage.

Answer

Azure App Configuration

Answer

Azure Managed HSM

Answer

Azure Storage

Question 14

Your company has a global application deployed across multiple Azure regions. You need to design a disaster recovery solution that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The solution should use Azure-native services and minimize costs. Which option should you choose?

Accepted Answer

Azure Site Recovery with 15-minute replication. Azure Site Recovery (ASR) with 15-minute replication is the correct choice because it provides application-consistent replication for Azure VMs with a configurable RPO as low as 15 minutes and supports failover within the 1-hour RTO. ASR is an Azure-native disaster recovery service that orchestrates replication, failover, and failback across regions, making it the most cost-effective option for meeting the stated RPO and RTO requirements for a multi-region application.

Answer

Azure Traffic Manager with priority routing

Answer

Active geo-replication for Azure SQL Database

Answer

Azure Backup with cross-region restore

Question 15

You are designing a network architecture for a three-tier application hosted in Azure. The front-end tier must be accessible from the internet, the business tier must only communicate with the front-end tier, and the data tier must only communicate with the business tier. You need to minimize exposure and use Azure-native services. Which combination of services should you use?

Accepted Answer

Azure Application Gateway with WAF for front-end, NSGs on subnets, and service endpoints. Azure Application Gateway with WAF provides Layer 7 HTTP/HTTPS load balancing and web application firewall protection for internet-facing front-end traffic. Network Security Groups (NSGs) on subnets enforce east-west traffic isolation, allowing the business tier to only receive traffic from the front-end subnet and the data tier to only receive traffic from the business subnet. Service endpoints secure access to PaaS data services (e.g., Azure SQL Database) from the data tier subnet without exposing public endpoints, meeting the requirement to minimize exposure using Azure-native services.

Answer

Azure Load Balancer for front-end, NSGs on subnets, and VNet peering

Answer

VPN Gateway for front-end, NSGs on subnets, and private endpoints

Answer

Azure Firewall for all inbound traffic, NSGs on subnets, and VNet peering