Designing Microsoft Azure Infrastructure Solutions (AZ-305) — All Questions

An application running on an Azure VM must call Azure Key Vault and Azure Storage without any credentials stored in code or configuration. What should the architect design?

• a.A shared access key embedded in app settings
• b.A service principal with a client secret in code
• c.A managed identity for the VM granted access to Key Vault and Storage✓
• d.A local administrator account on the VM

A managed identity lets the VM authenticate to Entra ID-integrated services with no stored secrets, and you grant it least-privilege access via RBAC. Embedded keys or a client secret in code store credentials that can leak, and a local admin account does not authenticate to Azure services.

An organization wants administrators to have elevated privileges only when needed, with time-bound access, approval, and auditing. Which capability should be designed in?

• a.Microsoft Entra Privileged Identity Management (PIM)✓
• b.Standing Owner role assignments for all admins
• c.A single shared admin account
• d.Resource locks

PIM provides just-in-time, time-bound role elevation with approval workflows and auditing, minimizing standing privilege. Permanent Owner assignments and shared accounts increase risk, and resource locks prevent deletion but do not manage privileged access.

An architect must enforce that all resources across many subscriptions are tagged with a cost center and can only use approved VM SKUs. Which design element enforces this at scale?

• a.Manual review in each subscription
• b.A single resource group
• c.RBAC role assignments only
• d.Azure Policy initiatives applied at the management group scope✓

Azure Policy (grouped into initiatives) applied at a management group enforces and audits rules like required tags and allowed SKUs across all child subscriptions. Manual review does not scale, a resource group is too narrow, and RBAC controls who can act, not resource configuration.

To centralize platform and resource logs from many subscriptions for querying and alerting, which design should an architect choose?

• a.Store logs on each VM's local disk
• b.Send diagnostic logs to a central Log Analytics workspace in Azure Monitor✓
• c.Email logs to administrators
• d.Disable logging to reduce cost

Routing diagnostic and platform logs to a central Log Analytics workspace lets you query with KQL, correlate across resources, and configure alerts. Local disk logs are siloed and lost with the VM, emailing logs does not scale, and disabling logging removes observability.

A retail company needs to manage sign-in and profiles for millions of external consumer customers of its app. Which identity design is appropriate?

• a.Azure AD B2C / Microsoft Entra External ID for customers✓
• b.Creating a member user in the corporate tenant for each customer
• c.A single shared guest account
• d.Local application accounts with plaintext passwords

Azure AD B2C (Microsoft Entra External ID) is purpose-built for customer identity at scale, supporting social and local sign-in and custom flows. Creating internal member users per customer does not scale or isolate consumers, a shared account is insecure, and plaintext local accounts are unacceptable.

An application team needs to monitor request rates, dependency failures, and response times inside a web application. Which service should the architect design in?

• a.Azure Policy
• b.Network Watcher
• c.Application Insights✓
• d.Azure Blueprints

Application Insights, part of Azure Monitor, instruments applications to collect telemetry such as request rates, dependencies, exceptions, and latency. Azure Policy governs configuration, Network Watcher diagnoses networking, and Blueprints deploy governed environments.

A workload requires near-full SQL Server compatibility, including SQL Agent and cross-database queries, for a lift-and-shift migration. Which Azure service best fits?

• a.Azure SQL Database single database
• b.Azure SQL Managed Instance✓
• c.Azure Cosmos DB
• d.Azure Table storage

SQL Managed Instance provides near-100% SQL Server engine compatibility, including SQL Agent and cross-database queries, making it ideal for lift-and-shift. A single database lacks some instance-level features, and Cosmos DB and Table storage are non-relational.

An application needs a globally distributed database with single-digit-millisecond reads in multiple regions and tunable consistency. Which service should the architect select?

• a.Azure Cosmos DB✓
• b.Azure SQL Database Basic tier
• c.Azure Files
• d.Azure Queue storage

Azure Cosmos DB is globally distributed with low-latency reads and offers five tunable consistency levels. A Basic-tier SQL Database is regional and not designed for global low latency, and Files and Queue storage are not databases.

To automatically move blob data to cooler, cheaper tiers as it ages and delete it after a retention period, what should the architect configure?

• a.Manual monthly tier changes
• b.A separate storage account per tier
• c.Geo-redundant storage only
• d.Blob lifecycle management policies✓

Lifecycle management policies automatically transition blobs between hot, cool, cold, and archive tiers and delete them based on age rules, optimizing cost without manual work. Manual changes do not scale, separate accounts add overhead, and GRS controls redundancy, not tiering.

An architect must ensure a storage account's data is protected with encryption keys that the organization controls and can rotate. What should be designed?

• a.Rely only on platform-managed keys with no control
• b.Disable encryption and use network rules
• c.Customer-managed keys stored in Azure Key Vault✓
• d.Store keys in application configuration files

Customer-managed keys in Azure Key Vault give the organization control over key lifecycle and rotation while encrypting storage at rest. Platform-managed keys offer no customer control, disabling encryption is insecure, and storing keys in config files exposes them.

A big-data analytics platform needs object storage with a hierarchical namespace optimized for analytics workloads. Which service should be chosen?

• a.Azure Data Lake Storage Gen2✓
• b.Azure Queue storage
• c.Azure Table storage
• d.Azure Cache for Redis

Azure Data Lake Storage Gen2 adds a hierarchical namespace on top of Blob storage, optimizing directory operations and analytics access patterns. Queue and Table storage serve messaging and key-value data, and Redis is an in-memory cache.

A mission-critical application must resume in a second Azure region within an hour if the primary region fails, with orchestrated failover of multi-tier VMs. Which service should the architect design in?

• a.Azure Backup only
• b.Azure Site Recovery✓
• c.A single Availability Zone deployment
• d.Azure Policy

Azure Site Recovery replicates VMs to a secondary region and orchestrates failover and failback with recovery plans, meeting a low RTO for regional outages. Backup restores data but is not fast orchestrated regional failover, a single zone does not survive a regional failure, and Policy governs configuration.

A design requires that backups cannot be deleted or altered by an attacker who compromises an admin account. Which backup design feature addresses this?

• a.Storing backups on the source VM
• b.Reducing retention to one day
• c.Disabling soft delete
• d.Immutable/soft-delete-protected Recovery Services vault✓

Immutability and soft delete on the Recovery Services vault prevent backups from being permanently deleted or tampered with, defending against malicious or accidental deletion. Keeping backups on the source VM, shortening retention, or disabling soft delete all weaken protection.

A business states that after a failure it can lose at most five minutes of data. Which objective does this define, and what does it drive?

• a.RPO, which drives backup/replication frequency✓
• b.RTO, which drives datacenter location
• c.SLA, which drives support plan
• d.Latency, which drives region choice

The maximum acceptable data loss is the recovery point objective (RPO); a five-minute RPO drives how frequently data must be backed up or replicated. RTO concerns downtime, an SLA is a service commitment, and latency is a performance measure.

To maximize availability of a stateless web tier within a single region against a datacenter failure, which design should the architect use?

• a.Deploy all instances to one datacenter
• b.Use a single large VM
• c.Distribute instances across Availability Zones behind a zone-redundant load balancer✓
• d.Rely on nightly backups only

Spreading instances across Availability Zones behind a zone-redundant load balancer keeps the tier available if one datacenter (zone) fails. A single datacenter or single VM is a single point of failure, and nightly backups aid recovery but do not provide high availability.

A team is building a microservices application and wants managed Kubernetes orchestration with autoscaling and rolling updates. Which compute platform should the architect choose?

• a.A single large virtual machine
• b.Azure Functions consumption plan
• c.Azure Kubernetes Service (AKS)✓
• d.Azure Blob storage

AKS provides managed Kubernetes with autoscaling, rolling updates, and integration with Azure identity and networking, fitting orchestrated microservices. A single VM lacks orchestration, Functions targets event-driven code rather than full microservice orchestration, and Blob storage is not compute.

An architect wants to decouple an order-processing system so components communicate reliably with ordering and transactional messaging. Which service fits best?

• a.Azure Service Bus✓
• b.Azure Blob storage
• c.Azure DNS
• d.Azure Bastion

Azure Service Bus is an enterprise message broker supporting queues, topics, ordering (sessions), and transactions, ideal for decoupling reliable business processes. Blob storage stores objects, DNS resolves names, and Bastion provides secure VM access.

A web application on Azure App Service must be released with zero downtime and the ability to quickly roll back. Which feature should the architect use?

• a.Editing files directly on the production instance
• b.A single production slot only
• c.Scaling up the plan during deployment
• d.Deployment slots with slot swap✓

Deployment slots let you deploy and warm up a new version in a staging slot, then swap it into production instantly with the ability to swap back, achieving zero-downtime releases and fast rollback. Editing production directly, using one slot, or scaling up does not provide safe swap-based releases.

An architect needs high-throughput ingestion of millions of telemetry events per second for streaming analytics. Which service is designed for this?

• a.Azure Service Bus queues
• b.Azure Event Hubs✓
• c.Azure Files
• d.Azure SQL Database

Azure Event Hubs is built for high-throughput event streaming and ingestion at massive scale, feeding analytics pipelines. Service Bus targets enterprise messaging at lower throughput with richer semantics, Files is a file share, and SQL Database is relational storage.

An architect needs to provide private, high-bandwidth connectivity from an on-premises datacenter to Azure that does not traverse the public internet. Which service should be designed in?

• a.Azure ExpressRoute✓
• b.A site-to-site VPN over the internet
• c.Azure Front Door
• d.A public IP on each VM

ExpressRoute provides a private, dedicated, high-bandwidth connection to Azure that bypasses the public internet, meeting reliability and throughput requirements. A site-to-site VPN traverses the internet, Front Door accelerates public HTTP traffic, and public IPs expose resources.

A global web application needs HTTP(S) acceleration, path-based routing, and a web application firewall at the edge across regions. Which service should the architect choose?

• a.Azure Load Balancer
• b.Azure Traffic Manager
• c.Azure Front Door✓
• d.Azure Bastion

Azure Front Door provides global layer-7 HTTP(S) acceleration, path-based routing, and an integrated Web Application Firewall at the edge. Azure Load Balancer is regional layer-4, Traffic Manager is DNS-based routing without acceleration or WAF, and Bastion is for secure VM access.

To let application VMs reach Azure SQL Database over a private IP inside the virtual network, keeping traffic off the public internet, what should the architect design?

• a.A public endpoint with firewall rules
• b.A private endpoint for Azure SQL Database✓
• c.A NAT gateway
• d.A Traffic Manager profile

A private endpoint projects the Azure SQL Database into the VNet with a private IP so traffic stays on the Microsoft backbone and off the public internet. A public endpoint still exposes the service publicly, a NAT gateway handles outbound egress, and Traffic Manager does DNS routing.