AZ-305 Design infrastructure solutions — Timed 20 Questions

Question 1

A company has multiple Azure subscriptions and on-premises data centers connected via ExpressRoute. They want to centralize connectivity to the internet and enforce a single web filtering and security policy for all outbound internet traffic from Azure VMs. Which Azure networking architecture should they implement?

20 minute time limit — choose an answer to begin.

Accepted Answer

Use a hub-spoke topology with Azure Firewall in the hub for all outbound traffic.. A hub-spoke topology with Azure Firewall in the hub provides a centralized point for routing all outbound internet traffic from Azure VMs. By using user-defined routes (UDRs) on the spoke subnets that point to the Azure Firewall as the default gateway (0.0.0.0/0 next hop), all outbound traffic is forced through the firewall, enabling consistent web filtering and security policy enforcement. This architecture also integrates seamlessly with ExpressRoute for on-premises connectivity, ensuring a single egress point for internet-bound traffic.

Answer

Use a single virtual network for all resources with a network virtual appliance.

Answer

Use an Azure Virtual WAN with security virtual WAN hub.

Answer

Use Azure Traffic Manager with Azure Firewall.

Question 2

A company is deploying an internal web application on Azure VMs. The application requires SSL offloading, session stickiness, and URL-based routing (e.g., /api/* to one backend, /app/* to another). The solution must operate within a single Azure region and must not be exposed to the public internet. Which Azure load balancing solution should they use?

Accepted Answer

C. Azure Application Gateway v2 is the correct choice because it provides SSL offloading (SSL termination at the gateway), session stickiness (cookie-based affinity), and URL-based routing (path-based routing rules) within a single Azure region. It can be deployed with a private IP address only, ensuring it is not exposed to the public internet, meeting all requirements.

Answer

A

Answer

B

Answer

D

Question 3

A company is developing a containerized microservices application. They want to minimize operational overhead for managing orchestration. The application has a low-to-medium traffic pattern that can spike unpredictably. They need fast scaling and pay-per-second billing. Which Azure compute service should they use?

Accepted Answer

B. Azure Container Apps provides a serverless platform for microservices with built-in service discovery, autoscaling, and pay-per-second billing, while abstracting away the Kubernetes control plane. ACI, while serverless and per-second billed, does not offer native orchestration features such as service discovery or revision management, making it less suitable for a containerized microservices application.

Answer

A

Answer

C

Answer

D

Question 4

A company is designing a hub-spoke network topology across multiple Azure regions. They plan to deploy a third-party network virtual appliance (NVA) in the hub for traffic inspection. They require that all traffic between spokes in different regions must be routed through the hub NVA, and they want to minimize the number of peered connections. Which solution should they implement?

Accepted Answer

VNet peering with user-defined routes (UDRs) in each spoke pointing to the NVA IP in the hub. VNet peering combined with user-defined routes (UDRs) allows traffic between spokes in different regions to be forced through the NVA in the hub for inspection. By configuring UDRs in each spoke with the next hop set to the NVA's private IP, you ensure inter-spoke traffic traverses the hub without requiring a full mesh of peering connections. This minimizes the number of peered connections (only hub-to-spoke peering is needed) while meeting the routing requirement.

Answer

Azure Virtual WAN with a secured hub using Azure Firewall

Answer

Azure VNet-to-VNet VPN gateways between all spokes

Answer

Azure ExpressRoute with private peering

Question 5

A company is deploying a multi-tier web application on Azure. The web tier must be accessible from the internet. The application tier and database tier must be isolated within the virtual network and not directly accessible from the internet. The solution must provide SSL termination, URL-based routing, and Web Application Firewall (WAF) capabilities. Which Azure service should they use to expose the web tier?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer-7 load balancer that provides SSL termination, URL-based routing, and a built-in Web Application Firewall (WAF). It can expose the web tier to the internet while keeping the application and database tiers isolated within the virtual network, as it routes traffic to backend pools using HTTP/HTTPS rules without exposing those backends directly.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 6

A company needs to provide secure remote administration access to Azure virtual machines for their IT team. The VMs are in a virtual network with no public IP addresses. The IT team uses browsers to connect. The solution should not require any custom software on the client machines. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure virtual machines directly in the Azure portal over TLS. Because the VMs have no public IP addresses, Bastion acts as a jump server that is deployed inside the virtual network, eliminating the need for any public exposure. Since the IT team uses browsers and cannot install custom software, Bastion's native browser-based HTML5 client meets the requirement perfectly.

Answer

Just-in-Time VM access

Answer

Azure VPN Gateway

Answer

Microsoft Entra ID Domain Services

Question 7

A company has an Azure SQL Database that they need to access from an on-premises data center over ExpressRoute. They want to use a private IP address to connect to the database, ensuring traffic never traverses the public internet. Which Azure service should they use?

Accepted Answer

Azure Private Link. Azure Private Link allows you to access Azure SQL Database over a private endpoint within your virtual network, using a private IP address. When combined with ExpressRoute, traffic from your on-premises data center to the database traverses the Microsoft backbone network and never touches the public internet, meeting the requirement for a private, secure connection.

Answer

Azure Service Endpoints

Answer

Azure VPN Gateway

Answer

Azure Front Door

Question 8

A company has an on-premises data center and wants to connect it to Azure to extend their network. They require a dedicated, private, high-bandwidth connection that is not routed over the public internet. They also want a lower-cost backup connection for redundancy in case the primary connection fails. Which combination of connectivity options should they implement?

Accepted Answer

ExpressRoute as the primary connection and a Site-to-Site VPN as the backup connection.. ExpressRoute provides a dedicated, private, high-bandwidth connection that bypasses the public internet, meeting the primary requirement. A Site-to-Site VPN over the internet serves as a cost-effective backup path for redundancy, as it uses encrypted tunnels over the public internet without the recurring costs of a second ExpressRoute circuit.

Answer

Two ExpressRoute circuits from different service providers, both active.

Answer

Site-to-Site VPN as the primary connection and Point-to-Site VPN as the backup.

Answer

Azure VPN Gateway with active-passive mode and a second VPN Gateway for failover.

Question 9

A company deploys a web application on Azure VMs across multiple availability zones in a region. They need to distribute incoming traffic across VMs in all zones, maintain session persistence, and support SSL offloading and URL-based routing (e.g., /api/* to one pool, /app/* to another). Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 (HTTP/HTTPS) load balancer that supports SSL offloading, URL-based routing (e.g., /api/* and /app/* to different backend pools), and session persistence (cookie-based affinity). It can distribute traffic across VMs in multiple availability zones within a region, meeting all stated requirements.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 10

A company has deployed several Azure VMs that do not have public IP addresses. Administrators need to securely connect to these VMs using RDP and SSH from the internet over a browser without deploying a jump box or managing VPN connections. The solution must use Microsoft Entra ID authentication for single sign-on. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS, without requiring public IP addresses, jump boxes, or VPN connections. It supports Microsoft Entra ID authentication for single sign-on, meeting the requirement for browser-based access with no additional management overhead.

Answer

Azure Jump Box VM

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 11

A company has an Azure virtual network (VNet) in the East US region hosting a web application. They need to securely connect to an on-premises data center in the same region using a dedicated, private network connection with high throughput and low latency. They also need a backup connection for redundancy in case the primary connection fails. Which connectivity solution should they implement?

Accepted Answer

ExpressRoute as primary with Site-to-Site VPN as backup. ExpressRoute provides a dedicated, private, high-throughput, low-latency connection to Azure, ideal for the primary link. A Site-to-Site VPN over the internet serves as a cost-effective, encrypted backup path that activates if the ExpressRoute circuit fails, meeting the redundancy requirement without relying on the same physical infrastructure.

Answer

Site-to-Site VPN only

Answer

ExpressRoute only

Answer

Azure Virtual WAN with VPN

Question 12

A company deploys a web application in two Azure regions for high availability. They need to automatically direct users to the nearest healthy region based on geographic location and endpoint health. Which Azure service should they use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that directs users to the nearest healthy region based on geographic location and endpoint health. It uses DNS resolution to route traffic to the closest available endpoint, making it ideal for global high-availability scenarios where users need automatic failover across regions.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 13

A company deploys a web application on Azure VMs within a single region. They need to distribute incoming HTTP traffic across multiple VMs, offload SSL encryption, and maintain session persistence (sticky sessions) for user sessions. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that can route HTTP/HTTPS traffic, offload SSL/TLS encryption, and support session affinity (sticky sessions) using cookies. Unlike a Layer 4 load balancer, it can inspect application-layer data, making it ideal for web applications requiring SSL termination and persistent user sessions.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 14

A company deploys Azure VNets in multiple regions and has on-premises data centers. They need to connect all VNets to each other and to on-premises sites using the Microsoft global network for optimal routing. They also want to simplify management by using a single orchestration interface. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN (D) is correct because it provides a hub-and-spoke architecture that connects VNets across multiple regions and on-premises sites using the Microsoft global network for optimal routing. It offers a single orchestration interface (the Virtual WAN portal/API) to manage all connectivity, including site-to-site VPN, ExpressRoute, and VNet-to-VNet traffic, simplifying management and ensuring traffic traverses Microsoft's backbone rather than the public internet.

Answer

Azure Virtual Network peering

Answer

Azure VPN Gateway with multi-site connections

Answer

Azure ExpressRoute Gateway

Question 15

A company has multiple Azure virtual networks (VNets) in different regions. They want to connect all VNets to each other securely over the Microsoft backbone network, and also connect to their on-premises data center via ExpressRoute. What is the simplest Azure solution to enable connectivity between all VNets and on-premises?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the simplest solution because it provides a hub-and-spoke architecture that automatically connects all VNets and on-premises sites over the Microsoft backbone network. It natively integrates ExpressRoute and VPN gateways into a single managed service, eliminating the need to manually configure multiple peering or gateway connections.

Answer

VNet peering

Answer

ExpressRoute

Answer

VPN Gateway

Question 16

A company has multiple Azure virtual networks (VNets) in different Azure regions and an on-premises data center connected via ExpressRoute. They want to connect all VNets to each other and to the on-premises network securely over the Microsoft global backbone. They also want to simplify management by using a single orchestration interface. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is correct because it provides a hub-and-spoke architecture that connects branch offices, VNets, and on-premises networks over the Microsoft global backbone. It offers a single orchestration interface for managing connectivity, routing, and security policies across multiple regions and ExpressRoute circuits, meeting the requirement for secure, global connectivity with simplified management.

Answer

VNet peering

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 17

A company runs a web application on Azure VMs in a single region. The application must scale out automatically based on CPU utilization. The VMs are behind an Azure Load Balancer. Which Azure service should they use to automatically add or remove VMs based on demand?

Accepted Answer

Azure Virtual Machine Scale Sets. Azure Virtual Machine Scale Sets (VMSS) is the correct service because it provides automatic scaling of identical VM instances based on metrics like CPU utilization. When you configure an autoscale rule on a VMSS, it automatically adds or removes VM instances behind the Azure Load Balancer, ensuring the application scales out or in based on demand without manual intervention.

Answer

Azure App Service

Answer

Azure Functions

Answer

Azure Batch

Question 18

A company deploys a web application on multiple Azure VMs in a single region. They need to distribute incoming HTTP and HTTPS traffic across the VMs, offload SSL/TLS termination, and maintain session persistence (sticky sessions) so that all requests from a user session go to the same backend VM. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a Layer 7 load balancer that can distribute HTTP/HTTPS traffic, offload SSL/TLS termination, and support session persistence via cookie-based affinity (sticky sessions). These capabilities directly match the requirements, making it the correct choice.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 19

A company has an Azure API Management instance deployed in the internal virtual network (VNet) mode. They want to securely expose their backend APIs to external partners over the internet. External partners need to authenticate using OAuth2 tokens. The company also wants to enforce rate limits (throttling) per subscription, cache responses, and enable CORS. Which Azure service should they use to expose the APIs?

Accepted Answer

Azure Application Gateway. Azure API Management in internal mode places the gateway on a private IP inside a VNet and does not accept public internet traffic. To securely expose the backend APIs to external partners, you must put a public entry point, such as Azure Application Gateway, in front of the internal APIM. Application Gateway provides public access, and APIM continues to handle OAuth2 validation, rate limiting, caching, and CORS policies.

Answer

Azure API Management

Answer

Azure Front Door

Answer

Azure Traffic Manager

Question 20

A company has virtual machines in Azure that need to be grouped across multiple fault domains and update domains to ensure high availability. They plan to deploy three VMs running the same application tier. Which Azure feature should they use to provide redundancy within a single region?

Accepted Answer

Availability Set. An Availability Set distributes VMs across multiple fault domains (shared hardware, power, and networking) and update domains (planned maintenance) within a single Azure datacenter. This ensures that at least one VM remains available during both hardware failures and Azure patching cycles. For three VMs running the same application tier, an Availability Set provides the required redundancy without the complexity of zone-level isolation.

Answer

Availability Zone

Answer

Virtual Machine Scale Set with manual scaling

Answer

Azure Site Recovery