AZ-305 Design infrastructure solutions Practice Test 9 — 15 Questions

Question 1

A company plans to migrate a legacy web application to Azure. The application runs on multiple Windows virtual machines (VMs) in an availability set. The VMs must be exposed to the internet via a single endpoint that performs SSL termination and health checks. The load-balancing solution must preserve the original client IP address for logging purposes. Which Azure service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports SSL termination, health probes, and provides a single public endpoint. It preserves the original client IP address by inserting the X-Forwarded-For header in the HTTP request, which the backend VMs can read for logging. This meets all requirements: single internet-facing endpoint, SSL offload, health checks, and client IP preservation.

Answer

Azure Load Balancer (Standard)

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 2

A hub-and-spoke Azure network must centralize outbound inspection and still allow spokes to resolve private endpoint DNS names. Which two components are commonly required? (Choose 2.)

Accepted Answer

User-defined routes from spoke subnets to the firewall or NVA.. User-defined routes (UDRs) on spoke subnets force all outbound traffic (including internet-bound traffic) to the central firewall or network virtual appliance (NVA) in the hub, enabling centralized inspection. Without UDRs, spoke VMs would bypass the firewall and use default outbound internet access, breaking the inspection requirement.

Answer

A public IP address on every private endpoint.

Answer

Basic SKU load balancers in each spoke.

Question 3

A company is designing a virtual network architecture for a three-tier application (web, application, database). They want network isolation between tiers and secure access from the internet to the web tier only. Which Azure networking solution should they use?

Accepted Answer

Azure Virtual Network with subnets for each tier and Network Security Groups.. Deploying each tier in its own subnet within an Azure Virtual Network and applying Network Security Groups (NSGs) allows granular inbound/outbound rule enforcement. NSGs can restrict traffic so that only the web tier is reachable from the internet (via a public IP or Azure Load Balancer), while the application and database tiers are isolated from direct internet access and can only communicate with the adjacent tier as defined by NSG rules.

Answer

Azure Virtual Network with a single subnet and application security groups.

Answer

Azure Virtual Network with subnets and Azure Firewall.

Answer

Azure Virtual Network with subnets and a network virtual appliance (NVA).

Question 4

A company needs to connect its on-premises data center to Azure for hybrid workloads. The connection must be private, dedicated, and provide guaranteed bandwidth. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a private, dedicated connection from on-premises to Azure, bypassing the public internet. It offers guaranteed bandwidth, higher reliability, and lower latency compared to VPN-based solutions, making it ideal for hybrid workloads requiring consistent performance.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 5

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

Accepted Answer

Peer each spoke VNet with the hub VNet. B is correct because VNet peering is required to establish connectivity between the spoke VNets and the hub VNet, enabling traffic to flow through the central Azure Firewall. Without peering, the spoke VNets would be isolated and unable to route traffic to the hub. C is correct because a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP ensures that all outbound internet traffic from spoke subnets is forced through the firewall for inspection and control.

Answer

Enable public IP addresses on all workload VMs

Answer

Deploy a NAT gateway in every spoke subnet

Question 6

An on-premises datacenter must connect privately to Azure with predictable bandwidth and avoid traversal of the public internet. Which connectivity option should be recommended?

Accepted Answer

ExpressRoute. ExpressRoute provides a dedicated private connection from on-premises to Azure, bypassing the public internet entirely. It offers predictable bandwidth, low latency, and high reliability through a Layer 3 MPLS or direct fiber link from a connectivity provider. This meets the requirement for a private, consistent network path without internet traversal.

Answer

Azure Bastion

Answer

Point-to-site VPN

Answer

Site-to-site VPN only

Question 7

A company is designing private access to a PaaS database from workloads in a VNet. The database should not be reachable over its public endpoint. What should be recommended?

Accepted Answer

Private Endpoint with public network access disabled. Private Endpoint with public network access disabled is the correct recommendation because it assigns a private IP address from the VNet to the PaaS database, making it accessible only over the private network. This eliminates exposure to the public internet by disabling the public endpoint, aligning with the requirement that the database should not be reachable over its public endpoint.

Answer

A public IP address with NSG rules

Answer

A route table to the internet gateway

Answer

Azure CDN endpoint

Question 8

Drag and drop the steps to set up Azure Private Link for an Azure SQL Database into the correct order.

Accepted Answer

Create endpoint, then approve, then configure DNS, then test, then disable public access. The correct sequence for setting up Azure Private Link for an Azure SQL Database is: first create the private endpoint in the virtual network, then approve the private link connection from the Azure SQL Database side, next configure DNS (typically using a private DNS zone) to resolve the database's FQDN to the private endpoint IP, test connectivity from within the virtual network, and finally disable public access to the database to enforce private connectivity. This order ensures each step builds on the previous one, avoiding connectivity issues or premature security restrictions.

Answer

Create endpoint, then approve, then test, then configure DNS, then disable public access

Answer

Approve, then create endpoint, then configure DNS, then test, then disable public access

Answer

Create endpoint, then configure DNS, then approve, then test, then disable public access

Question 9

Drag and drop the steps to set up Azure Key Vault for storing secrets and access them from an Azure function into the correct order.

Accepted Answer

Create vault, Add secret, Grant access, Configure references, Test. The correct sequence for setting up Azure Key Vault with an Azure function begins with creating the vault, then adding the secret. Next, grant the function app's managed identity access to the vault (using an access policy). After that, configure app settings or references in the function app to point to the secret. Finally, test the function to ensure it can retrieve the secret successfully. Common mistakes include misordering the grant access and configure references steps, or attempting to add secrets or configure references before the vault exists.

Answer

Create vault, Add secret, Configure references, Grant access, Test

Answer

Create vault, Configure references, Add secret, Grant access, Test

Answer

Add secret, Create vault, Grant access, Configure references, Test

Question 10

Match each Azure identity service to its description.

Accepted Answer

Azure AD: Cloud-based identity and access management service for Microsoft cloud resources.. Microsoft Entra ID is the core identity service for Microsoft cloud. Microsoft Entra B2B enables external collaboration, Azure AD B2C serves customer-facing apps, and Microsoft Entra Domain Services provides domain services for VMs. Common confusions include swapping B2C with Microsoft Entra ID or B2B with AD DS.

Answer

Azure AD: Identity service for customer-facing applications with customizable sign-up and sign-in.

Answer

Azure AD B2B: Provides domain services for Azure VMs.

Question 11

Match each Azure monitoring service to its function.

Accepted Answer

Azure Monitor: Collects and analyzes telemetry from Azure resources. The correct matches are: Azure Monitor for telemetry collection, Log Analytics for log analysis, Application Insights for APM, and Azure Sentinel for security. Common confusions include swapping Azure Monitor with Application Insights or Log Analytics.

Answer

Azure Monitor: Application performance management (APM) and diagnostics

Answer

Log Analytics: Collects and analyzes telemetry from Azure resources

Question 12

Your company plans to migrate an on-premises application to Azure. The application requires low-latency access to a shared file system that supports SMB protocol. Which Azure storage solution should you recommend?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, making it the ideal solution for migrating on-premises applications that require low-latency access to a shared file system. It allows you to lift and shift applications that rely on SMB file shares without code changes, and it can be accessed from Azure VMs or on-premises via SMB 3.0.

Answer

Azure Blob Storage

Answer

Azure Disk Storage

Answer

Azure Queue Storage

Question 13

You are designing a disaster recovery solution for a critical application hosted in Azure VMs. The primary region is East US. The application requires a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes. Which Azure service should you use to replicate the VMs?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions, meeting the RTO of 30 minutes and RPO of 15 minutes by using continuous replication with crash-consistent or app-consistent snapshots. It is the native Azure service designed specifically for disaster recovery of IaaS workloads with granular recovery objectives.

Answer

Azure Front Door

Answer

Azure Backup

Answer

Azure Traffic Manager

Question 14

You are designing a network topology for a multi-tier application in Azure. The application has a web tier, an API tier, and a database tier. You need to ensure that the web tier can communicate with the API tier, and the API tier can communicate with the database tier, but the web tier cannot directly access the database tier. Which Azure networking solution should you implement?

Accepted Answer

Azure Application Security Groups (ASGs). Azure Application Security Groups (ASGs) let you group VMs by workload role (web, API, database) and then write NSG rules that reference those groups as source and destination, so you can allow web-to-API and API-to-database while implicitly denying web-to-database. This provides the tiered, role-based segmentation the scenario requires without managing individual IP addresses. ASGs are the purpose-built Azure construct for application-centric micro-segmentation within a VNet.

Answer

Azure Firewall

Answer

Network Security Groups (NSGs) with service tags

Answer

VNet peering

Question 15

Your company has an Azure subscription with multiple virtual networks (VNets) in different regions. You need to ensure that resources in all VNets can communicate with each other privately over the Microsoft backbone network. Which Azure solution should you implement?

Accepted Answer

VNet peering. VNet peering connects Azure virtual networks privately over the Microsoft backbone network, enabling resources in different VNets (including those in different regions) to communicate directly without traversing the public internet. It uses the Azure infrastructure to route traffic between peered VNets with low latency and high bandwidth, meeting the requirement for private inter-VNet communication.

Answer

Azure ExpressRoute

Answer

Azure DNS

Answer

Azure VPN Gateway