AZ-305 Design infrastructure solutions Practice Test 9 — 15 Questions

Question 1

Your company is migrating on-premises virtual machines to Azure. You need to assess the current environment and get a cost estimate for Azure. Which tool should you use?

Accepted Answer

Azure Migrate. Azure Migrate provides assessment and migration capabilities for on-premises workloads to Azure. It can discover on-premises VMs and provide a cost estimate for running them in Azure. Option A (Azure Cost Management) is for cost analysis after migration, not for initial assessment. Option C (Azure Monitor) is for monitoring, not assessment. Option D (Azure Advisor) gives optimization recommendations after deployment.

Answer

Azure Cost Management

Answer

Azure Monitor

Answer

Azure Advisor

Question 2

You are designing a solution to provide high availability for a critical application running on Azure Virtual Machines. The virtual machines must be placed on physically separate hardware and have guaranteed availability during Azure maintenance events. Which option meets these requirements?

Accepted Answer

Deploy VMs in different Availability Zones. Availability Zones provide physically separate locations within an Azure region, protecting against datacenter failures and maintenance events. Option A (Availability Set) spreads VMs across fault and update domains within a single datacenter, not across separate physical facilities. Option B (Proximity Placement Group) is for low latency, not high availability. Option D (Virtual Machine Scale Set) is for auto-scaling and can be combined with Availability Zones, but alone it does not guarantee placement on separate hardware.

Answer

Deploy VMs in an Availability Set

Answer

Deploy VMs in a Proximity Placement Group

Answer

Deploy VMs in a Virtual Machine Scale Set

Question 3

Your organization has a hybrid identity solution using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to use their on-premises credentials to authenticate to cloud applications, but you want to avoid synchronizing password hashes to the cloud. Which authentication method should you choose?

Accepted Answer

Pass-through Authentication. Pass-through Authentication (PTA) is the correct choice because it validates users' passwords directly against on-premises Active Directory without ever storing password hashes in the cloud. This meets the requirement to avoid synchronizing password hashes while still enabling authentication to cloud applications via Microsoft Entra ID.

Answer

Seamless Single Sign-On

Answer

Active Directory Federation Services (AD FS)

Answer

Password Hash Synchronization

Question 4

You need to design a storage solution for unstructured data that requires low latency (single-digit milliseconds) for frequently accessed files and must support NFS and SMB protocols. Which Azure storage solution should you recommend?

Accepted Answer

Azure NetApp Files. Azure NetApp Files is a fully managed, high-performance file share service that supports both NFS (v3/v4.1) and SMB protocols natively, and is designed for low-latency (single-digit milliseconds) access to unstructured data. It provides the required protocol flexibility and performance for frequently accessed files, making it the correct choice for this scenario.

Answer

Azure Files

Answer

Azure Blob Storage

Answer

Azure Disk Storage

Question 5

Your company is deploying a web application that experiences unpredictable traffic spikes. You need to ensure the application can handle sudden increases in load automatically without manual intervention and minimize costs during low traffic periods. Which Azure service should you use?

Accepted Answer

Virtual Machine Scale Set with autoscale. Virtual Machine Scale Sets with autoscale rules can automatically adjust the number of VM instances based on demand. Option A (Azure App Service with manual scaling) does not autoscale automatically. Option B (Azure Functions) is for event-driven workloads, not web apps. Option D (Azure Container Instances) does not autoscale natively.

Answer

Azure App Service with manual scale-out

Answer

Azure Functions with consumption plan

Answer

Azure Container Instances

Question 6

You are designing a governance strategy for multiple Azure subscriptions. You need to ensure that all resources in a specific subscription are deployed only in the West US region. Additionally, any new resource group must contain a tag named 'Environment' with a value of 'Production'. What combination of Azure Policy initiatives should you assign?

Accepted Answer

Assign the 'Allowed Locations' policy and the 'Require a tag on resource groups' policy to the subscription. It assigns both the 'Allowed Locations' policy and the 'Require a tag on resource groups' policy directly to the subscription. The 'Allowed Locations' policy restricts resource deployment to the West US region, while the 'Require a tag on resource groups' policy ensures that every new resource group includes the 'Environment' tag with a value of 'Production'. Assigning both policies at the subscription scope meets both requirements without unnecessary inheritance or scope issues.

Answer

Assign the 'Allowed Locations' policy to the management group and the 'Require a tag on resource groups' policy to the subscription

Answer

Assign the 'Allowed Locations' policy to the subscription and the 'Inherit a tag from the resource group' policy to the management group

Answer

Assign a single Azure Policy definition that includes both the allowed location and require tag effects

Question 7

Which TWO of the following are valid design considerations for implementing Azure SQL Database geo-replication? (Choose two.)

Accepted Answer

Geo-replication supports up to four readable secondary replicas. Azure SQL Database geo-replication supports up to four readable secondary replicas, which can be used for read-only query offloading and disaster recovery. Option E is correct because these secondary replicas are fully readable, allowing you to distribute read-only workloads to reduce load on the primary database.

Answer

Geo-replication ensures zero data loss during failover

Answer

Geo-replication provides automatic failover without manual intervention

Answer

Geo-replication requires a listener for client connections

Question 8

Which THREE of the following are valid methods to secure access to Azure Storage accounts? (Choose three.)

Accepted Answer

Generate Shared Access Signatures (SAS) with limited permissions and expiry. Shared Access Signatures (SAS) allow you to grant time-limited, delegated access to specific storage resources (e.g., blobs, queues) with granular permissions (read, write, delete) and an expiry time, without exposing the account key. This is a key security method for controlling access at the resource level.

Answer

Enable Azure Front Door to authenticate requests

Answer

Use storage account access keys for authentication

Question 9

Which TWO of the following are benefits of using Azure Policy? (Choose two.)

Accepted Answer

Assess compliance of resources against defined policies. Azure Policy is a service that enables you to create, assign, and manage policies that enforce rules and effects over your Azure resources. Option A is correct because one of its primary benefits is the ability to assess the compliance state of existing and newly deployed resources against defined policy definitions, providing a clear compliance dashboard and reports. This assessment is continuous and can be viewed at the subscription, management group, or resource group level.

Answer

Manage access control for resources

Answer

Create new Azure resources based on a template

Answer

Automatically remediate non-compliant resources without manual intervention

Question 10

Refer to the exhibit. You are reviewing an ARM template that deploys a virtual network with two subnets. Subnet-b includes a delegation to Microsoft.Web/serverFarms. What is the purpose of this delegation?

Accepted Answer

It enables Azure App Service instances to be deployed into subnet-b. Delegating a subnet to Microsoft.Web/serverFarms explicitly authorizes Azure App Service (specifically, the App Service Plan's infrastructure) to inject network interfaces into that subnet. This is required for features like regional VNet Integration, where an App Service instance needs direct access to resources in the virtual network without going through a public endpoint. Without this delegation, the App Service cannot use the subnet for its internal networking.

Answer

It allows subnet-b to use a different address space

Answer

It configures a firewall policy for subnet-b

Answer

It creates a peering connection to another virtual network

Question 11

Refer to the exhibit. You are reviewing the properties of an Azure Storage account. The encryption section shows keySource as Microsoft.Keyvault and infrastructureEncryption enabled. What does infrastructureEncryption mean in this context?

Accepted Answer

It enables double encryption of data at rest. Infrastructure encryption in Azure Storage provides double encryption of data at rest. When enabled, data is encrypted twice: once at the service level using a Microsoft-managed key or a customer-managed key from Azure Key Vault (as indicated by keySource: Microsoft.Keyvault), and a second layer at the infrastructure level using a separate platform-managed key. This ensures that even if one encryption layer is compromised, the second layer protects the data, meeting compliance requirements for highly sensitive workloads.

Answer

It enforces HTTPS for all data in transit

Answer

It automatically rotates the encryption key daily

Answer

It encrypts the encryption key stored in Key Vault

Question 12

Refer to the exhibit. You have an Azure Storage account with the settings shown. A developer reports that they cannot access the storage account from their Azure VM that is connected to subnet-a. The VM's subnet ID matches the one in the rule. What is the most likely cause of the issue?

Accepted Answer

The subnet does not have a service endpoint for Microsoft.Storage enabled. The most likely cause is that the subnet does not have a service endpoint for Microsoft.Storage enabled. When a storage account firewall rule allows access from a specific subnet, that subnet must have a service endpoint configured for Microsoft.Storage; otherwise, traffic from the VM is treated as originating from the VM's public IP and is blocked by the firewall. The exhibit shows a firewall rule for the subnet, but without the service endpoint, the rule is ineffective.

Answer

The storage account requires HTTPS and the VM is using HTTP

Answer

The storage account does not have a firewall rule for the VM's public IP

Answer

The storage account uses GRS replication which is not supported with network rules

Question 13

Your organization has a hybrid identity infrastructure with Microsoft Entra ID Connect Sync. You plan to enable Microsoft Entra ID Seamless Single Sign-On (Seamless SSO) for domain-joined Windows devices. What is the minimum requirement for the on-premises Active Directory forest functional level?

Accepted Answer

Windows Server 2008. Microsoft Entra ID Seamless SSO works by having the client computer attempt Kerberos authentication against a local Active Directory domain controller using a special service principal name (AZUREADSSOACC). This process requires the on-premises Active Directory forest functional level to be at least Windows Server 2008, because the Kerberos service ticket used for Seamless SSO relies on the AES encryption type, which is only supported in domains with a Windows Server 2008 or higher functional level. Lower functional levels (2003 or earlier) do not support AES encryption, causing the authentication to fail.

Answer

Windows Server 2016

Answer

Windows Server 2012

Answer

Windows Server 2003

Question 14

Your company deploys a line-of-business application on Azure App Service. The application requires custom domain names and SSL/TLS certificates. You need to ensure that the application can be accessed via a custom domain with HTTPS. What should you configure in the App Service?

Accepted Answer

Add the custom domain and bind the SSL/TLS certificate.. To access an App Service via a custom domain with HTTPS, you must first add the custom domain to the App Service and then bind an SSL/TLS certificate (either App Service Managed Certificate, a Key Vault certificate, or a third-party certificate) to that domain. This binding enables the App Service to present the certificate during the TLS handshake, allowing secure HTTPS connections. Without both steps, the custom domain will not resolve securely.

Answer

Configure IP restrictions to allow only the custom domain.

Answer

Create a deployment slot for production traffic.

Answer

Scale out the App Service plan to increase instance count.

Question 15

You are designing a solution to store sensitive documents in Azure Blob Storage. The data must be encrypted at rest and access must be audited. You need to ensure that the encryption keys are managed by your organization and that access to the keys is logged. Which combination of Azure services should you use?

Accepted Answer

Azure Storage encryption with customer-managed keys in Azure Key Vault and Azure Monitor. Azure Storage encryption with customer-managed keys in Azure Key Vault meets the requirement for organization-managed encryption keys, while Azure Monitor (specifically the Azure Activity Log or diagnostic settings) captures access logs for both the storage account and Key Vault operations, enabling full auditability of key usage and data access.

Answer

Azure Disk Encryption with Azure Key Vault

Answer

Azure Storage encryption with Microsoft-managed keys and Azure Monitor

Answer

Azure Information Protection and Azure Sentinel