AZ-305 Design infrastructure solutions Practice Test 9 — 15 Questions

Question 1

You are designing an identity solution for a multinational corporation that uses Microsoft Entra ID. The company has a complex organizational structure with multiple subsidiaries. You need to ensure that users from one subsidiary cannot access resources in another subsidiary unless explicitly granted. The solution must minimize administrative overhead. What should you use?

Accepted Answer

Administrative units. Option D is correct. Administrative units in Microsoft Entra ID allow you to delegate administration and restrict access to a subset of users and resources. Option A is wrong because Conditional Access policies control access based on conditions but do not provide administrative boundaries. Option B is wrong because custom roles can be created but administrative units are designed for scoping. Option C is wrong because B2B collaboration is for external users, not internal subsidiaries.

Answer

Conditional Access policies

Answer

Microsoft Entra B2B collaboration

Answer

Custom directory roles

Question 2

You are designing a storage solution for a healthcare application that stores patient records. The solution must meet the following requirements: - Support for both structured and unstructured data. - Provide low-latency access to frequently accessed data. - Automatically move cold data to a lower-cost tier. - Encrypt data at rest using customer-managed keys. Which combination of Azure services should you recommend?

Accepted Answer

Azure Blob Storage for unstructured data and Azure Cosmos DB for structured data. Option A is correct. Azure Blob Storage supports unstructured data with hot, cool, and archive tiers; Azure Cosmos DB supports structured data with low-latency access; both support customer-managed keys. Option B is wrong because Azure Files is for file shares, not a database. Option C is wrong because Azure SQL Database is for relational data only. Option D is wrong because Azure Table Storage is a NoSQL key-value store but does not support automatic tiering.

Answer

Azure Table Storage for structured data and Azure Blob Storage for unstructured data

Answer

Azure Files for unstructured data and Azure SQL Database for structured data

Answer

Azure Blob Storage for unstructured data and Azure SQL Database for structured data

Question 3

Your company has a hybrid identity environment with Microsoft Entra ID and an on-premises Active Directory. You need to enable single sign-on (SSO) for users accessing Microsoft 365 applications from domain-joined devices. Which authentication method should you configure?

Accepted Answer

Microsoft Entra Seamless SSO. Option A is correct. Seamless SSO automatically signs users in when they are on domain-joined devices connected to the corporate network. Option B is wrong because Pass-through Authentication validates passwords on-premises but does not provide SSO. Option C is wrong because password hash sync does not provide SSO by itself. Option D is wrong because federation with AD FS can provide SSO but is more complex than Seamless SSO for this scenario.

Answer

Microsoft Entra Pass-through Authentication

Answer

Microsoft Entra password hash synchronization

Answer

Active Directory Federation Services (AD FS)

Question 4

You are designing a containerized microservices application on Azure Kubernetes Service (AKS). The application must scale automatically based on HTTP traffic. You need to minimize cost by scaling down to zero pods when there is no traffic. Which scaling solution should you use?

Accepted Answer

Kubernetes Event-driven Autoscaler (KEDA). Option B is correct. The Kubernetes Event-driven Autoscaler (KEDA) can scale based on HTTP requests and supports scaling to zero pods when there is no traffic. Option A is wrong because the horizontal pod autoscaler (HPA) cannot scale to zero. Option C is wrong because the cluster autoscaler scales nodes, not pods. Option D is wrong because the vertical pod autoscaler adjusts resource requests, not number of pods.

Answer

Horizontal Pod Autoscaler (HPA)

Answer

Cluster Autoscaler

Answer

Vertical Pod Autoscaler (VPA)

Question 5

Your company has a large number of IoT devices sending telemetry to Azure IoT Hub. The data must be processed in near real-time to detect anomalies and trigger alerts. Additionally, the processed data must be stored in a time-series database for historical analysis. Which combination of Azure services should you recommend?

Accepted Answer

Azure Stream Analytics and Azure Data Explorer. Option D is correct. Azure Stream Analytics can process streaming data from IoT Hub in near real-time and output to Azure Data Explorer (time-series database) for historical analysis. Option A is wrong because Azure Functions is not optimized for streaming. Option B is wrong because Azure Data Factory is for batch processing, not real-time. Option C is wrong because Azure HDInsight is for big data but not as efficient for time-series.

Answer

Azure Functions and Azure SQL Database

Answer

Azure HDInsight and Azure Cosmos DB

Answer

Azure Data Factory and Azure Blob Storage

Question 6

You need to design a solution to store configuration data for a cloud-native application. The configuration must be centrally managed, versioned, and accessible to multiple services without hard-coding values. Which Azure service should you use?

Accepted Answer

Azure App Configuration. Option A is correct. Azure App Configuration provides centralized management, versioning, and access for application settings. Option B is wrong because Azure Key Vault is for secrets, not configuration. Option C is wrong because Azure Cosmos DB is a database, not a configuration store. Option D is wrong because Azure Blob Storage is for unstructured data.

Answer

Azure Cosmos DB

Answer

Azure Blob Storage

Answer

Azure Key Vault

Question 7

Your company plans to migrate a legacy on-premises application to Azure. The application has a monolithic architecture and requires low-latency access to a shared file system. You need to choose a migration strategy that minimizes changes to the application code. Which TWO options should you recommend? (Choose two.)

Accepted Answer

Use Azure Migrate to perform a lift-and-shift migration to Azure VMs. Option A and Option D are correct. Azure Migrate with lift-and-shift moves VMs as-is, minimizing code changes. Azure Files provides a managed file share that can be accessed via SMB. Option B is wrong because refactoring to containers requires code changes. Option C is wrong because Azure NetApp Files is also a file share but is more expensive and complex for this scenario. Option E is wrong because rearchitecting to microservices is a major change.

Answer

Refactor the application to run in Azure Kubernetes Service (AKS)

Answer

Migrate the file share to Azure NetApp Files

Answer

Rearchitect the application to use a microservices architecture

Question 8

You are designing a disaster recovery (DR) solution for a critical application hosted on Azure VMs. The solution must meet the following requirements: - Recovery Point Objective (RPO) of 15 minutes. - Recovery Time Objective (RTO) of 1 hour. - Automatically fail over to a secondary region in the event of a regional outage. - Support for non-disruptive DR testing. Which THREE components should you include in the solution? (Choose three.)

Accepted Answer

Azure Site Recovery test failover capability. Option A, Option B, and Option E are correct. Azure Site Recovery provides replication and orchestration of failover to a secondary region, meeting RPO of 15 minutes and RTO of 1 hour. Azure Traffic Manager can be used to route traffic to the secondary region after failover. Azure Site Recovery supports non-disruptive DR testing with test failover. Option C is wrong because Azure Backup is for backup, not DR with automatic failover. Option D is wrong because Azure Front Door is a global load balancer but does not provide DR orchestration; Traffic Manager is sufficient.

Answer

Azure Backup

Answer

Azure Front Door

Question 9

Your company is designing a new application that will run on Azure VMs. The application must be highly available across two Azure regions. You need to ensure that the application can automatically fail over if a regional outage occurs. Which THREE components should you include in the architecture? (Choose three.)

Accepted Answer

Azure Traffic Manager. Option A, Option C, and Option D are correct. Azure Traffic Manager distributes traffic across regions. Azure Load Balancer distributes traffic within a region. Availability Sets protect against failures within a datacenter. Option B is wrong because Availability Zones are within a region, not across regions. Option E is wrong because Azure Application Gateway is a regional load balancer but not necessary if using Traffic Manager and Load Balancer.

Answer

Azure Application Gateway

Answer

Availability Zones

Question 10

Your company has a critical application running on Azure Virtual Machines that processes financial transactions. You need to ensure that the application remains available during an Azure region failure. The application is stateless and can scale horizontally. What is the most cost-effective design to meet the availability requirement?

Accepted Answer

Deploy VMs in an availability zone in the primary region and use Azure Site Recovery to replicate to a secondary region.. Option A is correct because deploying VMs across availability zones provides resilience within a region, but for region failure, you need a secondary region. Option B (active-passive with Azure Site Recovery) is cost-effective for stateless apps but incurs DR costs. Option C (active-active across regions) is more expensive. Option D (single region with scale sets) does not protect against region failure.

Answer

Deploy VMs in an active-active configuration across two Azure regions using Traffic Manager and Azure Front Door.

Answer

Deploy VMs in an availability set in the primary region and use Azure Site Recovery to failover to a secondary region.

Answer

Deploy VMs in a single region using Virtual Machine Scale Sets with automatic scaling.

Question 11

You are designing a storage solution for a new application that will store large binary files (up to 5 TB each) and require high throughput for sequential reads. The data is accessed infrequently but must be retained for 7 years for compliance. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage in the Cool tier. Option B is correct because Azure Blob Storage supports large blobs (up to ~4.75 TB) and the Cool tier is cost-effective for infrequently accessed data with long retention. Option A (Azure Files) has size limits. Option C (Azure Managed Disks) is for VM disks, not unstructured data. Option D (Azure NetApp Files) is for enterprise workloads, not cost-effective for archival.

Answer

Azure Managed Disks with Standard HDD

Answer

Azure Files shares in the Premium tier

Answer

Azure NetApp Files with Standard service level

Question 12

Your organization is migrating a legacy on-premises application to Azure. The application uses a proprietary authentication protocol that is not supported by Microsoft Entra ID. You need to integrate the application with Microsoft Entra ID without modifying the application code. What should you do?

Accepted Answer

Configure Microsoft Entra ID Application Proxy to provide secure remote access and pass through authentication.. Option A is correct because Microsoft Entra ID Application Proxy can be configured to pass authentication to the on-premises application, allowing legacy protocols. Option B (Azure AD Domain Services) is for Kerberos/NTLM. Option C (Azure AD B2C) is for customer-facing apps. Option D (Azure AD Connect) syncs identities but doesn't help with protocol translation.

Answer

Use Azure Active Directory B2C with custom policies to translate the authentication protocol.

Answer

Deploy Azure Active Directory Domain Services and domain-join the application servers.

Answer

Implement Azure Active Directory Connect with pass-through authentication.

Question 13

You need to design a networking solution for a multi-tier application that includes a web front-end, an API layer, and a database. The web and API tiers must be accessible from the internet, while the database tier must be isolated. What is the most secure and efficient design?

Accepted Answer

Deploy all tiers in the same VNet with separate subnets, and use NSGs to restrict traffic. Place an Azure Application Gateway with WAF in front of the web tier.. Option C is correct because using subnets for each tier with NSG restrictions provides isolation. Application Gateway with WAF protects the web tier. Option A (load balancer for all tiers) exposes the database. Option B (VNet peering) is not needed. Option D (Azure Firewall for all traffic) is overkill and complex.

Answer

Place all VMs in the same subnet and use a single Azure Load Balancer to distribute traffic.

Answer

Use separate VNets for each tier and connect them with VNet peering.

Answer

Deploy all VMs in a single subnet and use Azure Firewall to inspect all inbound and outbound traffic.

Question 14

Your company is deploying a new application that uses Azure Cosmos DB for globally distributed low-latency reads and writes. The application must be highly available with a recovery point objective (RPO) of less than 5 seconds and recovery time objective (RTO) of less than 1 second in case of a regional outage. Which Cosmos DB configuration should you recommend?

Accepted Answer

Multiple write regions enabled with automatic failover and session consistency.. Option B is correct because enabling multiple write regions with automatic failover provides RTO < 1s and RPO = 0 within a region. Option A (single write region with read replicas) has RTO > 1s. Option C (strong consistency) limits availability. Option D (manual failover) increases RTO.

Answer

Multiple write regions with manual failover and eventual consistency.

Answer

Single write region with strong consistency and multi-region writes disabled.

Answer

Single write region with multiple read regions and multi-region writes disabled.

Question 15

You are designing a backup and disaster recovery strategy for an Azure SQL Database instance that runs a critical business application. The database is 500 GB and experiences high transaction rates. The recovery point objective (RPO) is 1 minute and recovery time objective (RTO) is 1 hour. What should you recommend?

Accepted Answer

Configure active geo-replication to a secondary region in the same Azure geography.. Option D is correct because active geo-replication provides RPO < 1 minute and RTO < 1 hour with automatic failover. Option A (auto backup with LRS) has RPO > 1 minute. Option B (geo-restore) has RTO > 1 hour. Option C (export to blob) has high RTO.

Answer

Enable geo-redundant backup storage and use geo-restore in the secondary region.

Answer

Configure automated backups with locally-redundant storage (LRS) and enable point-in-time restore.

Answer

Export the database to a bacpac file daily and store it in Azure Blob Storage.