Search Tutorials


AZ-305 Practice Test 3 | Designing Azure Infrastructure Solutions | JavaInUse

AZ-305 Designing Azure Infrastructure Solutions - Practice Test 3

Your Progress

0 / 50
Question 1MEDIUM
You are designing a monitoring solution for a multi-tier application. You need to correlate application performance data with infrastructure metrics. Which Azure Monitor feature provides an end-to-end topology view?
Application Map in Application Insights provides a visual topology showing all components and their dependencies, request rates, and failure rates. It enables end-to-end correlation across multi-tier applications. Metrics Explorer (A) shows individual metrics. Alerts (B) trigger on conditions. Service Health (D) shows Azure platform issues. See more: Logging and Monitoring
Question 2MEDIUM
You need to implement identity governance for your organization. External contractors should have time-limited access to specific Azure resources that automatically expires. Which feature should you use?
Entitlement Management access packages allow you to define bundles of resources with specific access, automatic expiration, and approval workflows for external users. Conditional Access (A) controls sign-in policies. B2C (C) is for customer identity. Application Proxy (D) publishes on-premises apps. See more: Authentication and Authorization
Question 3EASY
Your organization requires passwordless authentication for all employees. Which Microsoft Entra ID feature allows users to sign in using biometrics or a PIN on their device?
Windows Hello for Business provides passwordless authentication using biometrics (fingerprint, facial recognition) or a PIN tied to the device. Password Protection (B) prevents weak passwords. Smart Lockout (C) prevents brute force. Identity Protection (D) detects risky sign-ins. See more: Design Authentication
Question 4MEDIUM
You are designing authorization for a multi-subscription Azure environment. You need to deny specific resource types from being created across all subscriptions. What should you use?
Azure Policy with a deny effect at the management group scope prevents specific resource types from being created across all subscriptions within that management group. RBAC deny (A) is not user-configurable. Resource locks (B) prevent modification/deletion, not creation of new types. Conditional Access (C) controls sign-in. See more: Design Governance
Question 5MEDIUM
You are designing a data solution that requires both relational and document data models. The relational data requires complex joins and ACID transactions. The document data requires flexible schema. What architecture should you recommend?
A polyglot persistence approach uses the best database for each workload: Azure SQL Database for complex joins and ACID transactions, and Cosmos DB for flexible-schema document data. Using only Cosmos DB (A) sacrifices relational features. SQL alone (B) lacks flexible schema. Table Storage (D) lacks both. See more: Data Management Strategy
Question 6MEDIUM
You need to protect data at rest in Azure SQL Database. The security team requires that encryption keys are managed by the organization, not Microsoft. Which feature should you configure?
TDE with customer-managed keys (BYOK) stores the TDE protector in Azure Key Vault under the organization's control. Service-managed keys (A) are controlled by Microsoft. Always Encrypted (C) protects specific columns in use. Dynamic Data Masking (D) hides data from non-privileged users but doesn't encrypt. See more: Data Protection Strategy
Question 7EASY
You need to monitor the performance of an Azure SQL Database and receive alerts when DTU consumption exceeds 80%. Which service should you configure?
Azure Monitor metric alerts can be configured on DTU percentage for Azure SQL Database, triggering notifications when the threshold is exceeded. Advisor (B) provides recommendations, not real-time alerts. Service Health (C) monitors Azure platform status. SQL Server Profiler (D) is an on-premises tool. See more: Monitoring Strategy for the Data Platform
Question 8HARD
You are designing a disaster recovery solution for a business-critical application. The application has an RPO of 5 minutes and RTO of 1 hour. The application runs on Azure VMs with managed disks. Which combination provides the best solution?
Azure Site Recovery provides continuous replication with RPO as low as a few seconds and automated failover with RTO in minutes. Daily backups (A) have RPO of 24 hours. Scheduled image copy (B) does not meet 5-minute RPO. GRS disk storage (D) alone does not provide VM failover orchestration. See more: Site Recovery Strategy
Question 9MEDIUM
You are designing a highly available web application that must survive an entire Azure region failure. The application uses Azure SQL Database. Which SQL Database feature provides automatic failover to a secondary region?
Auto-failover groups provide automatic geo-failover with a read-write listener endpoint that automatically routes to the primary. Elastic pools (A) pool DTUs. Zone-redundant (C) survives zone failure, not region failure. Hyperscale (D) is a performance tier, not a failover mechanism. See more: High Availability
Question 10MEDIUM
You need to store rarely accessed audit logs for 7 years to meet compliance requirements. Cost must be minimized. Which storage tier should you recommend?
Archive tier offers the lowest storage cost for data that is rarely accessed and can tolerate retrieval latency of hours. It is ideal for long-term retention (7 years). Hot (A) and Cool (B) are more expensive. Cold (C) is cheaper than Cool but more expensive than Archive. See more: Data Archiving Strategy
Question 11MEDIUM
You are deploying a containerized microservices application. Each service needs to scale independently and you want to minimize infrastructure management. Which deployment option should you recommend?
Azure Container Apps provides serverless container hosting with per-service scaling, Dapr integration, and KEDA-based autoscaling, minimizing infrastructure management. VMSS (B) requires VM management. Batch (C) is for HPC jobs. Service Fabric (D) has more operational overhead. See more: Design Deployments
Question 12MEDIUM
Your company is migrating 500 on-premises VMs to Azure. You need to assess the VMs for Azure compatibility, right-size recommendations, and cost estimates before migration. Which tool should you use first?
Azure Migrate: Discovery and Assessment discovers on-premises servers, assesses Azure readiness, provides right-sizing, and estimates costs before migration. Server Migration (A) is for the actual migration. Database Migration Service (B) is for databases. Cost Management (D) tracks existing Azure costs. See more: Design Migrations
Question 13MEDIUM
You are designing an API solution where multiple backend services need to be exposed through a single endpoint with rate limiting and OAuth2 validation. Which service should you use?
Azure API Management provides a unified API gateway with rate limiting, OAuth2 validation, throttling, request/response transformation, and developer portal. Front Door (A) is global load balancing. Application Gateway (C) is Layer 7 LB without API policies. Traffic Manager (D) is DNS-based routing. See more: API Integration Strategy
Question 14EASY
You need to store unstructured data such as images, videos, and documents. Which Azure storage service is most appropriate?
Azure Blob Storage is optimized for storing massive amounts of unstructured data such as images, videos, and documents. Table Storage (B) is for structured NoSQL data. Queue Storage (C) is for messaging. Azure Files (D) is for SMB file shares. See more: Storage Strategy
Question 15MEDIUM
You need to run a batch processing workload that requires 1000 CPU cores for 4 hours per week. Cost optimization is the primary concern. Which compute option should you recommend?
Azure Batch with low-priority VMs provides massive parallel compute at significantly reduced cost (up to 80% discount). VMs are provisioned only when needed. App Service (A) is not for HPC. AKS reserved (B) pays for always-on capacity. Permanent VMs (C) waste resources. See more: Compute Strategy
Question 16MEDIUM
You are designing a network for a multi-region deployment. You need to ensure all inter-region traffic stays on the Microsoft backbone network and avoids the public internet. What should you configure?
Global VNet peering connects VNets across Azure regions using the Microsoft backbone network with low latency and high bandwidth. VPN Gateway (A) encrypts traffic but adds latency. CDN (B) is for static content. DNS private zones (D) resolve names, not route traffic. See more: Networking Strategy
Question 17HARD
You are designing a solution to collect logs from 200 Azure VMs and 50 on-premises servers into a centralized Log Analytics workspace. You also need to detect security threats across all sources. Which combination should you implement?
Azure Monitor Agent (AMA) collects logs from both Azure and on-premises servers into Log Analytics. Microsoft Sentinel then uses the Log Analytics data for SIEM/SOAR threat detection and investigation. Advisor (A) gives recommendations. App Insights SDK (C) is for application telemetry. Traffic Analytics (D) is network-focused. See more: Logging and Monitoring
Question 18MEDIUM
You are implementing Azure AD Connect Cloud Sync for hybrid identity. Compared to Azure AD Connect (classic), what is a key advantage?
Cloud Sync uses lightweight provisioning agents that don't require a dedicated server, supporting multiple disconnected AD forests. Device writeback (B), Exchange hybrid (C), and ADFS federation (D) are currently only supported by the classic Azure AD Connect. See more: Design Authentication
Question 19MEDIUM
You need to ensure that administrators authenticate with strong MFA before accessing Azure resources via the portal. This should be enforced regardless of which device or network they use. What should you configure?
A Conditional Access policy targeting the Microsoft Azure Management cloud app with MFA as a grant control enforces MFA for all Azure portal access, regardless of device or network. Per-user MFA (A) lacks granular control. Identity Protection (B) is risk-based. PIM (C) controls role activation. See more: Design Authorization
Question 20MEDIUM
You need to deploy standardized environments using ARM templates. Different teams should be allowed to deploy only from pre-approved template versions without modifying them. Which feature should you use?
Template Specs are versioned ARM templates stored in Azure that can be shared via RBAC. Teams can deploy them without access to the underlying template code. Blueprints (A) are being deprecated. Pipeline templates (B) require Azure DevOps. Linked templates (D) require storage account management. See more: Design Governance
Question 21MEDIUM
You are designing a database solution that needs to handle 50,000 reads per second with sub-millisecond latency. The data is key-value pairs with simple lookups. Which database should you recommend?
Azure Cache for Redis provides sub-millisecond latency in-memory data store ideal for high-throughput key-value lookups. SQL Hyperscale (A) has higher latency. Cosmos DB (C) provides single-digit millisecond, not sub-millisecond. PostgreSQL (D) is not designed for this throughput pattern. See more: Data Management Strategy
Question 22MEDIUM
You need to prevent accidental deletion of a production Azure SQL Database. The protection should also prevent any modifications to the resource configuration. Which feature should you use?
A ReadOnly lock prevents both deletion and modification of the resource. A Delete lock (B) only prevents deletion but allows modifications. Azure Policy (C) prevents non-compliant deployments. RBAC deny (D) is not user-configurable. See more: Data Protection Strategy
Question 23HARD
You are architecting a solution where the Recovery Point Objective (RPO) for some workloads is near-zero while others can tolerate 24 hours of data loss. Budget is limited. Which approach optimizes cost while meeting requirements?
Tiering DR strategies matches the protection level to the RPO requirement: ASR for near-zero RPO workloads (continuous replication) and Azure Backup for 24-hour RPO workloads (daily backups). Uniform approaches (A, B, C) over-spend on non-critical workloads. See more: Site Recovery Strategy
Question 24MEDIUM
You need to deploy a highly available application across three availability zones in a single region. The application uses Azure VMs behind a load balancer. Which load balancer SKU supports zone-redundant deployment?
Standard Load Balancer supports zone-redundant frontend IPs and can distribute traffic across VMs in multiple availability zones. Basic LB (A) does not support zones. Application Gateway v1 (B) does not support zones. Traffic Manager (D) is DNS-level, not zone-aware LB. See more: High Availability
Question 25MEDIUM
You need to implement lifecycle management for blob data. Blobs should move from Hot to Cool after 30 days, from Cool to Archive after 90 days, and be deleted after 365 days. Which feature automates this?
Blob Storage lifecycle management policies define rules to automatically transition blobs between tiers and delete them based on age. Logic Apps (A), Automation (C), and Functions (D) would work but require custom development and maintenance. See more: Data Archiving Strategy
Question 26MEDIUM
You are deploying Azure resources using Infrastructure as Code. You want to use a declarative language with type safety and modularity that deploys ARM resources. Which tool should you use?
Bicep is a declarative, type-safe domain-specific language that compiles to ARM templates. It provides modularity, IntelliSense, and simpler syntax. Azure CLI (B) and PowerShell (C) are imperative. Terraform (D) is multi-cloud but not native ARM. See more: Design Deployments
Question 27MEDIUM
Your company is migrating an on-premises SQL Server database to Azure. The application uses CLR assemblies and cross-database queries. Which migration target should you recommend?
Azure SQL Managed Instance has near 100% compatibility with on-premises SQL Server, supporting CLR assemblies, cross-database queries, linked servers, and SQL Agent. SQL Database (A) doesn't support CLR. PostgreSQL (B) and Cosmos DB (C) are different engines. See more: Design Migrations
Question 28MEDIUM
You need to implement rate limiting per API consumer in Azure API Management. Each consumer should be identified by their subscription key. Which policy should you use?
rate-limit-by-key limits the call rate per specified key (e.g., subscription key) within a time window. ip-filter (A) restricts by IP address. quota-by-key (B) limits total calls over a longer period. validate-jwt (D) validates tokens. See more: API Integration Strategy
Question 29EASY
You need to select a storage account redundancy option that provides durability within a single region by replicating across three availability zones. Which option should you choose?
ZRS replicates data synchronously across three availability zones in the primary region. LRS (A) replicates within a single datacenter. GRS (C) adds geo-redundancy but uses LRS locally. RA-GZRS (D) adds both zone and geo redundancy with read access. See more: Storage Strategy
Question 30MEDIUM
You are designing a virtual desktop solution for 500 remote workers. Users need a Windows 11 multi-session experience with Office 365 apps pre-installed. Which Azure service should you recommend?
Azure Virtual Desktop (formerly Windows Virtual Desktop) provides Windows 11 multi-session with Office 365, load balancing, FSLogix user profiles, and simplified management. Individual VMs with RDP (B) don't scale. App Service (C) is for web apps. ACI (D) is for containers. See more: Compute Strategy
Question 31MEDIUM
You need to expose on-premises web applications to external users securely without opening inbound firewall ports or deploying a VPN. Which feature should you use?
Microsoft Entra Application Proxy uses connectors that make outbound connections only (no inbound ports), securely publishing on-premises web apps to external users via Entra ID. ExpressRoute (A) is private connectivity. Front Door (B) requires public endpoints. Firewall (C) is for network security. See more: Networking Strategy
Question 32MEDIUM
You are designing a KQL query to find VMs with CPU utilization over 90% in the last hour. Which Log Analytics table contains VM performance data?
The Perf table in Log Analytics stores performance counter data from VMs, including CPU, memory, disk, and network metrics. AzureActivity (A) logs management operations. SecurityEvent (B) logs security events. Heartbeat (D) shows connectivity status only. See more: Logging and Monitoring
Question 33MEDIUM
You are designing authentication for a SaaS application. Customers from different Azure AD tenants should be able to sign in. The application should support guest users from any organization. Which configuration should you use?
A multi-tenant app registration allows users from any Azure AD tenant to sign in. Single-tenant (A) only allows one tenant. B2C (C) is for consumer identity. Personal accounts (D) don't support organizational identities. See more: Design Authentication
Question 34MEDIUM
You need to implement Just-In-Time (JIT) VM access to reduce the attack surface of Azure VMs. Management ports should be closed by default and opened only on request. Which service provides this capability?
Defender for Cloud JIT VM access locks down management ports using NSG rules and opens them temporarily on user request with approval workflows. Bastion (B) provides secure RDP/SSH but doesn't close ports dynamically. Firewall (C) is general network security. NSG flow logs (D) monitor traffic. See more: Design Authorization
Question 35MEDIUM
Your application stores sensitive data in Azure Cosmos DB. You need to ensure data is encrypted with a key your organization controls and rotates. What should you configure?
Cosmos DB supports customer-managed keys stored in Azure Key Vault, giving your organization control over the encryption key lifecycle including rotation. Service-managed (A) is Microsoft-controlled. Client-side (B) adds complexity. Disk Encryption (C) is for VM disks. See more: Data Protection Strategy
Question 36MEDIUM
You need to monitor the health and compliance status of all Azure resources across multiple subscriptions. Alerts should fire when resources become non-compliant. Which combination should you implement?
Azure Policy tracks compliance across subscriptions and Azure Monitor can alert on policy state change events. App Insights (A) is for application monitoring. Advisor (B) gives recommendations. Security Center free (D) provides basic posture but not custom compliance alerting. See more: Monitoring Strategy for the Data Platform
Question 37MEDIUM
You are designing ASR for a workload. The failover region needs to be geographically close to the primary for low latency yet separate enough for disaster protection. What is the recommended region selection strategy?
Azure paired regions provide geographical separation within the same geography, aligned with data residency boundaries, and prioritized recovery during widespread outages. Different continent (A) adds too much latency. Same region zones (C) won't survive region failure. ASR doesn't auto-select (D). See more: Site Recovery Strategy
Question 38MEDIUM
You are designing storage for a virtual machine that requires 99.99% SLA and can tolerate at most 1 hour of downtime per year. The VM runs a critical database. Which managed disk type and deployment should you recommend?
Premium SSD with a zone-redundant deployment (VM in availability zones) provides the 99.99% SLA for a single VM. Standard HDD (B) gets 99.5% SLA. Availability sets (C) get 99.95%. Ultra Disk without redundancy (D) gets lower SLA. See more: High Availability
Question 39HARD
You are selecting the appropriate DTU-based tier for an Azure SQL Database. The workload has predictable peak periods with moderate CPU, IO, and memory usage. Which factor is MOST important when choosing between Basic, Standard, and Premium tiers?
DTU tiers are differentiated primarily by IO throughput, number of concurrent sessions/requests, and maximum database size. Premium provides the highest IO performance. Number of tables (A), backup size (B), and portal visuals (C) are not tier-selection criteria. See more: Data Management Strategy
Question 40MEDIUM
You need to ensure that all Azure Storage Accounts in your organization require secure transfer (HTTPS only) and deny public blob access. What is the best approach to enforce this across all subscriptions?
Azure Policy with deny effect at management group scope proactively prevents non-compliant storage accounts from being created or modified. Emails (A) are not enforceable. Scripts (B) are reactive. Advisor (D) only recommends, doesn't enforce. See more: Design Governance
Question 41MEDIUM
You are designing a solution for data loss prevention. Sensitive data in Azure SQL Database must be classified and alerts sent when potential data exfiltration is detected. Which feature provides this?
Microsoft Defender for SQL includes Advanced Threat Protection (detecting anomalous activities including data exfiltration) and data discovery and classification for sensitive data labeling. Auditing (A) logs but doesn't alert on threats. TDE (C) encrypts at rest. DDM (D) masks display data. See more: Data Protection Strategy
Question 42MEDIUM
You need to deploy a web application using blue-green deployment strategy. The application runs on Azure App Service. Which feature enables zero-downtime deployment with instant rollback?
Deployment slots allow you to deploy to a staging slot, warm it up, then swap with production instantly. Rollback is as simple as swapping back. GitHub deployment (B) doesn't provide instant swap. Azure DevOps (C) orchestrates but relies on slots for zero-downtime. FTP (D) causes downtime. See more: Design Deployments
Question 43MEDIUM
You need to route traffic to the closest Azure region based on network latency. The solution must provide automatic failover when a region is unhealthy. Which load balancing service should you use?
Azure Front Door provides global load balancing with latency-based routing, automatic failover, and Layer 7 features. Traffic Manager (C) also routes by performance but operates at DNS level with slower failover. Load Balancer (A) is regional L4. Application Gateway (B) is regional L7. See more: Networking Strategy
Question 44MEDIUM
You are implementing Azure RBAC for a development team. Developers need to deploy and manage resources in their resource group but should not be able to assign roles to others. Which built-in role should you assign?
Contributor allows full resource management but cannot assign roles (no Microsoft.Authorization/*/Write). Owner (A) includes role assignment. Reader (B) is read-only. User Access Administrator (D) can only manage role assignments. See more: Authentication and Authorization
Question 45HARD
You are designing a data warehouse solution with the following requirements: petabyte-scale analytics, serverless query option, integration with Apache Spark, and T-SQL compatibility. Which service should you recommend?
Azure Synapse Analytics provides dedicated and serverless SQL pools, Spark integration, petabyte-scale analytics, and T-SQL compatibility in a unified platform. SQL Hyperscale (A) is OLTP. Data Factory (C) is ETL. HDInsight (D) is open-source analytics without native T-SQL. See more: Data Management Strategy
Question 46MEDIUM
You are designing a solution where IoT devices send telemetry data to Azure. The data must be ingested in real-time and routed to different consumers based on message properties. Which service should you use for ingestion?
Azure Event Hubs is designed for high-throughput real-time data ingestion from IoT devices with millions of events per second, supporting message routing and multiple consumers. Service Bus (B) is for enterprise messaging. Blob Storage (C) is not real-time. Queue Storage (D) has limited throughput. See more: Storage Strategy
Question 47MEDIUM
You need to deploy a GPU-intensive machine learning training workload that runs for a few hours daily. Which compute option minimizes cost?
Azure Machine Learning compute clusters with auto-scale (min 0 nodes) scale down to zero when idle, paying only for the hours used. Reserved VMs (A) pay 24/7. App Service (B) doesn't support GPU. Functions (D) doesn't support GPU workloads. See more: Compute Strategy
Question 48MEDIUM
You need to securely connect your on-premises data center to Azure with a private, dedicated connection that provides consistent latency rather than going over the public internet. Which service should you use?
Azure ExpressRoute provides a private, dedicated connection between on-premises infrastructure and Azure with predictable latency, higher bandwidth, and no public internet traversal. Site-to-site VPN (A) goes over the internet. Point-to-site (C) is for individual devices. CDN (D) caches content. See more: Networking Strategy
Question 49HARD
You need to implement immutable storage for financial records that must be retained for 7 years and cannot be modified or deleted even by administrators. Which Azure Blob Storage feature provides this?
Immutable blob storage with a locked time-based retention policy provides WORM (Write Once Read Many) compliance. Once locked, data cannot be modified or deleted until the retention period expires. Soft delete (A) allows recovery but not immutability. Versioning (B) tracks changes. Backup (C) is for recovery. See more: Data Archiving Strategy
Question 50MEDIUM
Your organization wants to adopt a Cloud Center of Excellence operating model for Azure migration. Multiple business units will have their own subscriptions. What is the recommended Azure management hierarchy?
Management groups provide hierarchical organization above subscriptions, enabling centralized policy and RBAC governance while allowing business units to manage their own subscriptions. Single subscription (A) limits isolation. Separate tenants (B) adds complexity. Resource groups (D) are below subscriptions. See more: Design Migrations

← Back to all AZ-305 Practice Tests


Popular Posts

1Z0-830 Java SE 21 Developer Certification Prepare with Notes and Real Time Practice Tests 1Z0-819 Java SE 11 Developer Certification Prepare with Notes and Real Time Practice Tests 1Z0-829 Java SE 17 Developer Certification Prepare with Notes and Real Time Practice Tests AWS AI Practitioner Certification Prepare with Notes and Real Time Practice Tests AZ-204 Azure Developer Associate Certification Prepare with Notes and Real Time Practice Tests AZ-305 Azure Solutions Architect Expert Certification Prepare with Notes and Real Time Practice Tests AZ-400 Azure DevOps Engineer Expert Certification Prepare with Notes and Real Time Practice Tests DP-100 Azure Data Scientist Associate Certification Prepare with Notes and Real Time Practice Tests AZ-900 Azure Fundamentals Certification Prepare with Notes and Real Time Practice Tests PL-300 Power BI Data Analyst Certification Prepare with Notes and Real Time Practice Tests Spring Professional Certification Prepare with Notes and Real Time Practice Tests Azure AI Foundry Hello World What is Azure AI Foundry Azure AI Agent Hello World Set up and run your first agent Foundry vs Hub Projects When to choose Foundry or hub-based Build Agents with SDK Threads, messages, runs in Python Bing Web Search Agent Ground agents with real-time data Function Calling Agent Custom functions & tool integration Spring Boot + Azure Key Vault Hello World Example Fetch secrets from Azure Key Vault in Spring Boot Spring Boot + Elasticsearch + Azure Key Vault Example Secure Elasticsearch config using Azure Key Vault Spring Boot Azure AD (Entra ID) OAuth 2.0 Authentication Connect Spring Boot to Azure AD using OAuth2 Deploy Spring Boot App to Azure App Service Host Spring Boot application on Azure App Service Secure Azure App Service using Azure API Management Protect deployed Spring Boot app with API Management Deploy Spring Boot JAR to Azure App Service Deploy executable JAR directly to Azure Deploy Spring Boot + MySQL to Azure App Service Host Spring Boot with MySQL database on Azure Spring Boot + Azure Managed Identity Example Access Azure Key Vault using Managed Identity Secure Spring Boot Azure Web App with Managed Identity + App Registration Secure Spring Boot app via Azure Portal configuration Elasticsearch 8 Security - Integrate Azure AD OIDC Integrate Azure AD OIDC with Elasticsearch & Kibana