AZ-305 Designing Azure Infrastructure Solutions - Practice Test 4
Your Progress
0 / 50
Question 1MEDIUM
You need to implement distributed tracing across microservices deployed in Azure Kubernetes Service. Performance bottlenecks should be identified across service boundaries.
Which feature should you configure?
Application Insights with distributed tracing correlates requests across microservice boundaries, showing end-to-end transaction views and identifying bottlenecks. Container Insights (A) monitors infrastructure. Workbooks (B) are dashboards. Network Watcher (C) monitors network connectivity.
See more: Logging and Monitoring
Question 2MEDIUM
You need to allow external partner organizations to collaborate on resources in your Azure AD tenant. Partners should use their own organizational credentials and MFA policies.
Which feature enables this?
Azure AD B2B collaboration allows external users to access your resources using their own organizational identity and MFA. B2C (B) is for consumer applications. Domain Services (C) provides legacy AD features. Pass-through auth (D) is for on-prem to Azure AD sync.
See more: Authentication and Authorization
Question 3MEDIUM
You are implementing certificate-based authentication for a web API. Client certificates must be validated against a trusted CA.
Where should you configure certificate validation for Azure App Service?
App Service TLS/SSL settings allow enabling client certificate (mutual TLS/mTLS) authentication, requiring clients to present certificates validated against trusted CAs. Front Door WAF (A) filters HTTP threats. Key Vault (B) stores certificates. APIM (D) adds an extra layer.
See more: Design Authentication
Question 4MEDIUM
You need to implement Privileged Identity Management (PIM) for Azure AD roles. Administrators should receive time-limited role activations with justification and approval.
Which PIM setting controls the maximum activation duration?
PIM role settings include activation maximum duration (in hours), which controls how long a role remains active after activation. Notification settings (A) control alerts. Access reviews (C) check for stale assignments. Conditional Access (D) controls sign-in conditions.
See more: Design Authorization
Question 5MEDIUM
You need to enforce consistent resource naming conventions and tag requirements across your Azure environment.
Which governance tool should you use?
Azure Policy can enforce naming conventions (using pattern matching) and require specific tags on resources. Non-compliant resources are denied at deployment. Administrative Units (A) organize Azure AD. ARM templates (B) define infrastructure. Cost Management (C) tracks spending.
See more: Design Governance
Question 6HARD
You are designing a globally distributed application. The database must support multi-region writes with strong consistency at the session level. Latency must be under 10ms for reads and writes in each region.
Which database should you recommend?
Cosmos DB supports multi-region writes with guaranteed single-digit millisecond latency and configurable consistency levels including session consistency. Azure SQL (A) supports active geo-replication but not multi-write. MySQL replicas (B) are read-only. Managed Instance (D) has single-write primary.
See more: Data Management Strategy
Question 7MEDIUM
You need to classify and label sensitive data across Azure SQL databases, Azure Storage, and Azure Data Lake. The classification should align with Microsoft Information Protection labels.
Which service should you use?
Microsoft Purview Data Map provides unified data governance with automatic data discovery, classification, and labeling across multiple Azure data sources using MIP sensitivity labels. AIP client (A) is for Office documents. Security Center (C) focuses on security posture. Monitor (D) is for telemetry.
See more: Data Protection Strategy
Question 8MEDIUM
You need to monitor the availability of a web application from multiple geographic locations and receive alerts when it becomes unreachable.
Which Application Insights feature should you configure?
Availability tests send HTTP requests from multiple Azure datacenters worldwide and alert when responses fail or exceed latency thresholds. Live Metrics (B) shows real-time data. Smart Detection (C) identifies anomalies. Usage Analytics (D) tracks user behavior.
See more: Monitoring Strategy for the Data Platform
Question 9MEDIUM
You are designing a disaster recovery plan. The business requires that recovery plans be tested quarterly without impacting production systems.
Which ASR feature supports this?
Test failover in ASR creates VMs in an isolated virtual network for DR testing without affecting production replication or systems. Planned failover (A) actually switches production. Forced failover (B) is for emergencies. Reprotect (C) reverses replication direction after failover.
See more: Site Recovery Strategy
Question 10EASY
You are designing a solution that requires 99.99% uptime for a web application. The application is stateless and runs on Azure App Service.
What is the minimum configuration required?
99.99% uptime requires multi-region deployment with global load balancing. A single region App Service SLA is 99.95% maximum. Azure Front Door distributes traffic and fails over between regions. Free tier (A) has no SLA. Single Standard (B) maxes at 99.95%. Basic (D) doesn't support zones.
See more: High Availability
Question 11MEDIUM
You need to implement immutable infrastructure deployments where every change creates a new, fully provisioned environment rather than updating existing resources.
Which deployment pattern best describes this approach?
Blue-green deployment creates an entirely new environment (green) alongside the current one (blue), then switches traffic. The old environment is destroyed afterward. Rolling updates (A) modify in place. Canary (C) routes partial traffic. Feature flags (D) toggle code paths.
See more: Design Deployments
Question 12MEDIUM
Your organization is migrating a large on-premises Hadoop cluster to Azure. The existing workloads use Hive, Spark, and HDFS.
Which Azure service provides the most compatible lift-and-shift migration path?
Azure HDInsight provides managed clusters of Apache Hadoop, Spark, Hive, and other open-source frameworks, making it the closest lift-and-shift path. Databricks (B) is Spark-optimized but not Hadoop-compatible. Data Factory (C) is ETL. Stream Analytics (D) is for real-time streaming.
See more: Design Migrations
Question 13MEDIUM
You need to decouple components of a distributed application. Messages must be processed exactly once and in FIFO order.
Which messaging service supports this?
Azure Service Bus queues with sessions provide FIFO ordering and at-most-once/exactly-once processing semantics. Event Grid (A) is event-driven routing. Event Hubs (B) is for streaming telemetry. Queue Storage (C) doesn't guarantee FIFO or exactly-once.
See more: API Integration Strategy
Question 14MEDIUM
You need to provide shared file storage accessible by multiple Azure VMs simultaneously via SMB protocol. The solution must support identity-based authentication with Azure AD.
Which service should you use?
Azure Files provides SMB file shares with Azure AD DS identity-based authentication for seamless access from domain-joined VMs. Blob NFS (A) uses NFS, not SMB. Managed Disks (B) are single-VM. NetApp Files (C) supports SMB but uses AD, not native Azure AD integration.
See more: Storage Strategy
Question 15MEDIUM
You are designing a compute solution for a web API that experiences unpredictable traffic spikes. The solution should automatically scale to zero when idle and charge only for actual execution time.
Which compute service should you use?
Azure Functions Consumption plan scales to zero, charges per execution, and handles unpredictable traffic automatically. App Service Standard (A) always has a running instance. VMSS (C) has minimum instance counts. AKS (D) requires always-running nodes.
See more: Compute Strategy
Question 16MEDIUM
You need to inspect and filter outbound traffic from Azure VMs to the internet, blocking access to malicious domains while allowing business-required sites.
Which service should you deploy?
Azure Firewall provides FQDN-based filtering for outbound traffic, threat intelligence-based filtering, and TLS inspection. NSGs (B) filter by IP/port only, not domain. DDoS (C) protects inbound. Private Link (D) provides private connectivity to services.
See more: Networking Strategy
Question 17MEDIUM
You need to create an alert that fires when the average response time of your web application exceeds 3 seconds for 5 consecutive minutes.
Which alert type and configuration should you use?
A metric alert with a static threshold monitors the response time metric, evaluating every minute with a 5-minute aggregation window. Activity log alerts (A) detect management operations. Service Health (B) monitors Azure platform. Log alerts (D) work but are more complex for this scenario.
See more: Logging and Monitoring
Question 18HARD
You are designing FIDO2 security key authentication for privileged administrators. The keys must work across multiple devices and not be tied to a specific machine.
Which authentication method should you implement?
FIDO2 security keys are portable, roaming authenticators that work across multiple devices without being tied to a specific machine. Windows Hello TPM (A) is device-specific. Authenticator push (C) requires a phone. SMS (D) is less secure and device-dependent.
See more: Design Authentication
Question 19MEDIUM
You need to implement Azure AD access reviews to periodically verify that group memberships and role assignments are still appropriate.
Which stakeholder should typically be configured as the reviewer?
Resource owners or direct managers have the best context to determine whether access is still needed. Subscription owners (B) may not know individual access needs. Microsoft support (C) doesn't review access. Global Admin (D) creates bottleneck and lacks context.
See more: Design Authorization
Question 20MEDIUM
You need to ensure subscription owners cannot exceed a monthly spending limit. When the budget threshold is reached, specific resource groups should be shut down automatically.
Which combination provides this?
Cost Management budgets can trigger action groups when thresholds are reached, which in turn can invoke an Azure Automation runbook to shut down resource groups. Advisor (A) only recommends. Policy (B) doesn't handle spending. Reserved Instances (C) are for commitment discounts.
See more: Design Governance
Question 21MEDIUM
You need to design a data solution that handles both real-time analytics on incoming IoT data and historical batch processing on the same dataset.
Which architecture pattern should you use?
Lambda architecture combines a speed layer (for real-time analytics) and a batch layer (for historical processing), merging results in a serving layer. CQRS (A) separates reads/writes. Event Sourcing (B) stores state changes. Microservices (D) is an app architecture.
See more: Data Management Strategy
Question 22MEDIUM
You need to encrypt sensitive columns in Azure SQL Database so that even database administrators cannot read the plaintext values. The encryption keys should be managed by the application.
Which feature should you use?
Always Encrypted keeps data encrypted at rest, in transit, and in use. The column master key resides in the client application, so DBAs cannot decrypt. TDE (A) encrypts at rest but DBAs can still read data. DDM (C) masks display. RLS (D) filters rows.
See more: Data Protection Strategy
Question 23MEDIUM
You need to monitor Cosmos DB request unit (RU) consumption and automatically alert the operations team when RU consumption exceeds the provisioned throughput.
Which monitoring approach should you use?
Azure Monitor metric alerts on the Normalized RU Consumption metric provide real-time alerting when RU usage approaches or exceeds provisioned throughput. Change feed (B) tracks data changes. Advisor (C) gives recommendations. Diagnostic logs (D) are for post-analysis.
See more: Monitoring Strategy for the Data Platform
Question 24MEDIUM
You need to replicate on-premises VMware VMs to Azure using ASR. The replication should use minimal bandwidth and provide application-consistent recovery points.
Which ASR component should be deployed on-premises?
The ASR configuration server orchestrates replication and the process server compresses and encrypts data before sending to Azure, minimizing bandwidth. Azure Monitor agent (A) collects logs. AD Connect (B) syncs identities. DevOps agent (C) runs pipelines.
See more: Site Recovery Strategy
Question 25MEDIUM
You need to ensure your Azure SQL Database survives an availability zone failure within a region with automatic failover.
Which deployment option should you configure?
Business Critical tier with zone-redundant deployment places replicas across availability zones with automatic failover. Basic (A) has no zone redundancy. General Purpose (B) uses remote storage. Hyperscale with no replicas (D) has no zone protection.
See more: High Availability
Question 26MEDIUM
You need to configure blob storage for a data lake solution. The storage account must support hierarchical namespace for efficient file system operations.
Which storage account type should you select?
Azure Data Lake Storage Gen2 is built on GPv2 with Hierarchical Namespace (HNS) enabled, providing efficient directory operations, POSIX-style ACLs, and integration with big data frameworks. GPv2 without HNS (A) uses flat namespace. Premium Block Blobs (C) are for high-performance scenarios. Classic (D) is deprecated.
See more: Storage Strategy
Question 27MEDIUM
You need a container orchestration solution that supports custom autoscaling based on queue length, HTTP traffic, and CPU usage using Kubernetes Event-Driven Autoscaling (KEDA).
Which service should you use?
Azure Container Apps has built-in KEDA support for autoscaling based on various event sources including queue lengths, HTTP traffic, and custom metrics. ACI (B) doesn't support KEDA. App Service (C) has limited autoscaling triggers. Batch (D) is for HPC.
See more: Compute Strategy
Question 28MEDIUM
You need to ensure that traffic between Azure VMs in the same virtual network is encrypted at the network layer without application changes.
Which feature provides this?
Azure Virtual Network Encryption encrypts traffic between VMs in the same VNet transparently at the network layer. NSGs (A) filter traffic. DDoS (B) protects against volumetric attacks. Service endpoints (C) route traffic to Azure services.
See more: Networking Strategy
Question 29MEDIUM
You need to centralize logging from multiple Azure subscriptions into a single workspace. Each subscription has different Log Analytics workspaces.
Which feature enables cross-workspace queries?
The workspace() function in KQL enables cross-workspace queries, allowing you to query data from multiple Log Analytics workspaces in a single query. Data Explorer (A) is a separate service. Metrics Explorer (B) is for metrics. Lighthouse (D) enables cross-tenant management but not direct query joining.
See more: Logging and Monitoring
Question 30MEDIUM
You need to enable self-service password reset (SSPR) for all users. Users should verify their identity using at least two methods.
Where should you configure the number of methods required?
SSPR authentication methods settings allow you to configure the number of methods required (1 or 2) and which methods are available (phone, email, security questions, app notification, etc.). Conditional Access (A) controls sign-in. RBAC (C) manages permissions. PIM (D) manages privileged roles.
See more: Authentication and Authorization
Question 31HARD
You are designing a multi-tenant SaaS application. Each tenant's data must be physically isolated in separate databases while sharing the application tier.
Which data architecture pattern is this?
Database-per-tenant provides physical isolation with separate databases while sharing compute resources via elastic pools for cost optimization. Shared database with RLS (B) is logical isolation. Shared schema (C) uses column-level isolation. Single database (D) has no isolation.
See more: Data Management Strategy
Question 32MEDIUM
You need to implement a disaster recovery solution where the secondary region's database is available for read-only queries to offload reporting workloads.
Which feature provides this?
Auto-failover groups provide a readable secondary endpoint that can serve read-only queries for reporting workloads while also serving as a DR target. Backup restore (A, B) creates a new database. Point-in-time restore (C) is for data recovery, not ongoing reads.
See more: Site Recovery Strategy
Question 33MEDIUM
You need to create Azure infrastructure using a CI/CD pipeline. The infrastructure definition should be version-controlled, reviewed via pull requests, and automatically deployed.
Which practice does this describe?
GitOps uses Git as the source of truth for infrastructure definitions, with CI/CD pipelines automatically deploying changes after code review. Monitoring (A) tracks production. Testing (B) validates code. CI only (D) doesn't include deployment.
See more: Design Deployments
Question 34MEDIUM
Your company needs to migrate 10 TB of data from AWS S3 to Azure Blob Storage. The transfer should be automated and occur on a recurring schedule.
Which service should you use?
Azure Data Factory provides managed data movement with scheduling, monitoring, and direct AWS S3 to Blob Storage connectors. Data Box (A) is for offline physical transfer. AzCopy (C) is manual CLI. Storage Explorer (D) is a GUI tool without scheduling.
See more: Design Migrations
Question 35MEDIUM
You need to implement an event-driven architecture where changes to Azure Blob Storage trigger processing in an Azure Function.
Which service provides the most reliable event delivery for this scenario?
Event Grid provides push-based, near-real-time event delivery for Blob Storage events (created, deleted) with retry and dead-lettering. Queue polling (B) adds latency. Timer trigger (C) is not event-driven. Logic Apps schedule (D) is polling-based.
See more: API Integration Strategy
Question 36EASY
You need to move large amounts of data (100 TB) to Azure when network bandwidth is limited. What is the recommended approach?
Azure Data Box provides physical storage devices shipped to your location, loaded with data, and shipped to Azure for import. It's ideal for large data transfers when bandwidth is limited. AzCopy (A) and ADF (B) require network. ExpressRoute (D) alone doesn't move data.
See more: Storage Strategy
Question 37MEDIUM
Your application needs to run Windows containers with GPU support in Azure without managing the underlying infrastructure.
Which compute service should you recommend?
Azure Container Instances supports Windows containers with GPU resources without infrastructure management. Container Apps (A) doesn't support Windows containers with GPU. App Service (B) has limited GPU support. Functions (C) doesn't support GPU.
See more: Compute Strategy
Question 38MEDIUM
You need to allow Azure PaaS services (Azure SQL, Storage) to be accessed only from your virtual network, removing public endpoint exposure.
Which feature should you implement?
Azure Private Link with Private Endpoints assigns a private IP from your VNet to the PaaS service, completely removing public endpoint exposure. Service endpoints (A) route traffic over backbone but the service still has a public endpoint. NSGs (C) filter IP/port. Firewall (D) filters traffic.
See more: Networking Strategy
Question 39MEDIUM
You are implementing Conditional Access policies. Users connecting from trusted corporate IP ranges should skip MFA, while users from unknown locations must always use MFA.
Which Conditional Access component defines the trusted IP ranges?
Named locations define trusted IP address ranges or countries that can be referenced in Conditional Access policies. Device compliance (B) checks device health. Session controls (C) limit sessions. Client apps (D) filter by app type.
See more: Design Authorization
Question 40MEDIUM
You need to manage costs for development and testing environments. These environments should use lower-cost licensing and be easily identifiable.
What should you create?
Azure Dev/Test subscription offers provide discounted rates for development and testing, including no license costs for Windows VMs and reduced rates for other services. Tags (A) help identify but don't reduce cost. Reservations (B) are for production commitments. Separate tenant (C) adds complexity.
See more: Design Governance
Question 41MEDIUM
You are designing a solution where secrets used by applications must be stored centrally, rotated automatically, and accessed without hardcoding credentials.
Which combination should you implement?
Azure Key Vault provides centralized secret management with automatic rotation, and managed identities allow applications to access secrets without any credentials in code. App Configuration (A) is for feature flags. SAS (B) is storage-specific. Client secrets (D) still require secret storage.
See more: Data Protection Strategy
Question 42MEDIUM
You need to monitor the end-to-end user experience for a web application, including page load times, AJAX call performance, and browser exceptions.
Which Application Insights feature provides this?
The JavaScript SDK collects client-side telemetry including page load times, AJAX performance, and browser exceptions from the user's browser. Server-side SDK (A) monitors backend. Profiler (C) analyzes code-level performance. Snapshot Debugger (D) captures exception snapshots.
See more: Monitoring Strategy for the Data Platform
Question 43EASY
You need to use managed identities for an Azure Function to access Azure Key Vault. The identity should be automatically managed and deleted with the resource.
Which type of managed identity should you use?
System-assigned managed identity is created and deleted with the resource, automatically managed by Azure with no credential maintenance. User-assigned (B) is independent and shared across resources. Service principals (C, D) require credential management.
See more: Authentication and Authorization
Question 44HARD
You are designing a data archiving solution. Legal hold must prevent data deletion indefinitely until the hold is explicitly removed, even if a time-based retention policy has expired.
Which Azure Blob Storage feature supports this?
Legal hold policies prevent data deletion indefinitely until all holds are cleared, regardless of retention policies. They are used for litigation or investigation holds. Soft delete (A) allows recovery. Time-based (B) has an expiry. Versioning (C) tracks changes.
See more: Data Archiving Strategy
Question 45MEDIUM
You are implementing a deployment pipeline that gradually shifts traffic from the old version to the new version while monitoring for errors.
Which deployment strategy is this?
Canary deployment gradually shifts traffic (e.g., 5%, 25%, 50%, 100%) while monitoring health metrics, allowing quick rollback if issues arise. Blue-green (A) does instant swap. Rolling (B) replaces instances sequentially. Recreate (D) stops old before starting new.
See more: Design Deployments
Question 46MEDIUM
You are migrating an on-premises Oracle database to Azure. The application code must be rewritten to support a new database engine. Budget is limited.
Which migration target offers the best cost-to-feature ratio for a PostgreSQL-compatible workload?
Azure Database for PostgreSQL Flexible Server provides full PostgreSQL compatibility with cost-effective pricing, burstable compute tiers, and managed service benefits. SQL Database (A) requires SQL Server syntax. Cosmos DB (C) is NoSQL. SQL Server VM (D) requires SQL licensing.
See more: Design Migrations
Question 47MEDIUM
You need to transform incoming API requests in Azure API Management. The backend expects XML but clients send JSON.
Which APIM policy should you apply?
The json-to-xml policy in the inbound section converts the JSON request body to XML before forwarding to the backend. xml-to-json (B) does the opposite. set-body outbound (C) transforms responses. rewrite-uri (D) changes URL path.
See more: API Integration Strategy
Question 48MEDIUM
You need to ensure data written to Azure Blob Storage is replicated to a secondary region for disaster recovery but also want read access to the secondary region at all times.
Which redundancy option should you choose?
RA-GRS (Read-Access Geo-Redundant Storage) replicates to a secondary region and provides read access to the secondary at all times. LRS (A) is single datacenter. GRS (B) replicates but doesn't allow reads from secondary. ZRS (D) is zone-redundant in one region.
See more: Storage Strategy
Question 49MEDIUM
You need to implement a hub-and-spoke network topology at scale across multiple Azure regions with transitive routing and integrated security services.
Which service simplifies this architecture?
Azure Virtual WAN provides managed hub-and-spoke architecture with transitive routing, integrated VPN/ExpressRoute, and Azure Firewall. VNet peering (A) requires manual routing. DNS Resolver (C) handles DNS. Route Server (D) enables BGP routing with NVAs.
See more: Networking Strategy
Question 50MEDIUM
You need to implement data residency requirements ensuring that all customer data stays within a specific geographic boundary.
Which Azure governance feature helps enforce this?
Azure Policy with the allowed locations constraint prevents resources from being deployed outside specified regions, enforcing data residency. RBAC (B) controls who can do what. Conditional Access (C) controls sign-in. Cost Management (D) tracks spending.
See more: Design Governance
← Back to all AZ-305 Practice Tests
Popular Posts
1Z0-830 Java SE 21 Developer Certification
1Z0-819 Java SE 11 Developer Certification
1Z0-829 Java SE 17 Developer Certification
AWS AI Practitioner Certification
AZ-204 Azure Developer Associate Certification
AZ-305 Azure Solutions Architect Expert Certification
AZ-400 Azure DevOps Engineer Expert Certification
DP-100 Azure Data Scientist Associate Certification
AZ-900 Azure Fundamentals Certification
PL-300 Power BI Data Analyst Certification
Spring Professional Certification
Azure AI Foundry Hello World
Azure AI Agent Hello World
Foundry vs Hub Projects
Build Agents with SDK
Bing Web Search Agent
Function Calling Agent
Spring Boot + Azure Key Vault Hello World Example
Spring Boot + Elasticsearch + Azure Key Vault Example
Spring Boot Azure AD (Entra ID) OAuth 2.0 Authentication
Deploy Spring Boot App to Azure App Service
Secure Azure App Service using Azure API Management
Deploy Spring Boot JAR to Azure App Service
Deploy Spring Boot + MySQL to Azure App Service
Spring Boot + Azure Managed Identity Example
Secure Spring Boot Azure Web App with Managed Identity + App Registration
Elasticsearch 8 Security - Integrate Azure AD OIDC