Microsoft Designing Microsoft Azure Infrastructure Solutions - AZ-305 Exam Practice Test
Hotspot Question
You have an Azure subscription.
You are designing a Microsoft SQL Server failover cluster instance (FCI) solution. The solution must meet the following requirements:
- Ensure that the FCI contains three virtual machines that run Windows
Server 2025.
- Place the virtual machines and storage resources in three
availability zones to provide an availability SLA of 99.99%.
- Minimize read/write latency for storage without affecting the
availability SLA of the virtual machines.
- Ensure that neither a network load balancer nor a distributed network name (DNN) are required.
- Minimize administrative effort.
You need to recommend which type of storage to use and the minimum number of subnets required for the FCI.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have an Azure subscription.
You are designing a Microsoft SQL Server failover cluster instance (FCI) solution. The solution must meet the following requirements:
- Ensure that the FCI contains three virtual machines that run Windows
Server 2025.
- Place the virtual machines and storage resources in three
availability zones to provide an availability SLA of 99.99%.
- Minimize read/write latency for storage without affecting the
availability SLA of the virtual machines.
- Ensure that neither a network load balancer nor a distributed network name (DNN) are required.
- Minimize administrative effort.
You need to recommend which type of storage to use and the minimum number of subnets required for the FCI.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
The storage can use Fibre Channel, iSCSI, FCoE, or SAS for shared disk storage, or use locally attached storage with Storage Spaces Direct (S2D).
Box 1: Storage Spaces Direct
* Storage Spaces Direct
Storage Spaces Direct requires 2 and up to 16 Microsoft-approved servers with direct-attached SATA, SAS, NVMe, or persistent memory drives that are physically attached to just one server each. Each server must have at least two solid-state drives, and at least four more drives. The SATA and SAS devices should be behind a host-bus adapter (HBA) and SAS expander.
Box 2: 3
For a single application or service requiring high availability across three availability zones, you need a minimum of three subnets, with one subnet in each availability zone. This setup ensures that if one availability zone experiences an outage, your application can still operate from the remaining availability zones, maintaining its availability and fault tolerance.
Reference:
https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/failover-cluster-instance-storage-spaces-direct-manually-configure?
https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-storage
https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-ultra-ssd
https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/availability-group-manually-configure-tutorial-multi-subnet
Hotspot Question
You have the Free edition of a hybrid Azure Active Directory (Azure AD) tenant. The tenant uses password hash synchronization.
You need to recommend a solution to meet the following requirements:
- Prevent Active Directory domain user accounts from being locked out
as the result of brute force attacks targeting Azure AD user accounts.
- Block legacy authentication attempts to Azure AD integrated apps.
- Minimize costs.
What should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have the Free edition of a hybrid Azure Active Directory (Azure AD) tenant. The tenant uses password hash synchronization.
You need to recommend a solution to meet the following requirements:
- Prevent Active Directory domain user accounts from being locked out
as the result of brute force attacks targeting Azure AD user accounts.
- Block legacy authentication attempts to Azure AD integrated apps.
- Minimize costs.
What should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: Smart lockout
Smart lockout helps lock out bad actors that try to guess your users' passwords or use brute- force methods to get in. Smart lockout can recognize sign-ins that come from valid users and treat them differently than ones of attackers and other unknown sources. Attackers get locked out, while your users continue to access their accounts and be productive.
Box 2: Conditional access policies
If your environment is ready to block legacy authentication to improve your tenant's protection, you can accomplish this goal with Conditional Access.
How can you prevent apps using legacy authentication from accessing your tenant's resources?
The recommendation is to just block them with a Conditional Access policy. If necessary, you allow only certain users and specific network locations to use apps that are based on legacy authentication.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-smart-lockout
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure ExpressRoute has been deployed and configured for on-premises to Azure connectivity. Several VMs are exhibiting network connectivity issues. You need to analyze the network traffic to determine whether packets are being allowed or denied to the VMs.
Solution: Use Azure Network Watcher to run IP flow verify to analyze the network traffic.
Does the solution meet the goal?
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure ExpressRoute has been deployed and configured for on-premises to Azure connectivity. Several VMs are exhibiting network connectivity issues. You need to analyze the network traffic to determine whether packets are being allowed or denied to the VMs.
Solution: Use Azure Network Watcher to run IP flow verify to analyze the network traffic.
Does the solution meet the goal?
Correct Answer: B
Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).
Your company has an Azure Web App that runs via the Premium App Service Plan.
A development team will be using the Azure Web App.
You have to configure the Azure Web app so that it can fulfil the below requirements:
- Provide the ability to switch the web app from the current version to a newer version
- Provide developers with the ability to test newer versions of the
application before the switch to the newer version occurs
- Ensure that the application version can be rolled back
- Minimize downtime
Which of the following can be used for this requirement?
A development team will be using the Azure Web App.
You have to configure the Azure Web app so that it can fulfil the below requirements:
- Provide the ability to switch the web app from the current version to a newer version
- Provide developers with the ability to test newer versions of the
application before the switch to the newer version occurs
- Ensure that the application version can be rolled back
- Minimize downtime
Which of the following can be used for this requirement?
Correct Answer: A
You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping.
You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages.
What should you include in the recommendation?
You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages.
What should you include in the recommendation?
Correct Answer: C
Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).
Drag and Drop Question
A company is modernizing its infrastructure by moving workloads to the cloud. These workloads comprise virtual machines, databases, and applications.
You need to identify the appropriate phases of workload migration.
Which three steps should you identify in sequence? To answer, move the appropriate actions from the list of possible actions to the answer area and arrange them in the correct order.
A company is modernizing its infrastructure by moving workloads to the cloud. These workloads comprise virtual machines, databases, and applications.
You need to identify the appropriate phases of workload migration.
Which three steps should you identify in sequence? To answer, move the appropriate actions from the list of possible actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation:
You should identify the following migration steps in order:
1. Assess
2. Deploy
3. Release
The Microsoft Adoption Framework for Cloud provides you with guidelines to construct a plan for your journey into the cloud. The Microsoft Cloud Adoption Framework envisages the following main methodologies: Define strategy, Plan, Ready, Migrate, and Innovate.
First, during the assessment step of the Migrate methodology, you should assess your workloads in terms of calculating the migration costs and determining the required modernization effort and deployment tools.
Next, you should deploy your workloads by moving them, either without modernizing (lift-and- shift) or modernized, into the cloud.
Finally, you should test, optimize, and document your migrated workloads and, if the result is as expected, then you can release the workloads to your users. During this phase you should hand over workloads and documentation to your operation, security, and governance teams.
You should not identify Plan as one of the Migration steps. According to the Microsoft Adoption Framework for Cloud, during the Plan step you assess your digital estate (which workloads you can move as they are, which have to be modernized or rebuilt, which workloads you do not need anymore), align it with the business outcomes, evaluate skill gaps, and plan for adoption & change management. As such, the Plan step has to be carried out before you start your migration.
You should not identify Ready as one of the Migration steps. According to the Microsoft Adoption Framework for Cloud, during the Ready step you need to create your target environment, called the landing zone. As soon as your landing zone is in place, you are ready to start migration.
Hotspot Question
You have an on-premises file server that stores 2 TB of data files.
You plan to move the data files to Azure Blob storage in the Central Europe region.
You need to recommend a storage account type to store the data files and a replication solution for the storage account. The solution must meet the following requirements:
- Be available if a single Azure datacenter fails.
- Support storage tiers.
- Minimize cost.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have an on-premises file server that stores 2 TB of data files.
You plan to move the data files to Azure Blob storage in the Central Europe region.
You need to recommend a storage account type to store the data files and a replication solution for the storage account. The solution must meet the following requirements:
- Be available if a single Azure datacenter fails.
- Support storage tiers.
- Minimize cost.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: Blob storage
Blob storage supports storage tiers
Note: Azure offers three storage tiers to store data in blob storage: Hot Access tier, Cool Access tier, and Archive tier. These tiers target data at different stages of its lifecycle and offer cost- effective storage options for different use cases.
Box 2: Zone-redundant storage (ZRS)
Data in an Azure Storage account is always replicated three times in the primary region. Azure Storage offers two options for how your data is replicated in the primary region:
Zone-redundant storage (ZRS) copies your data synchronously across three Azure availability zones in the primary region.
Locally redundant storage (LRS) copies your data synchronously three times within a single physical location in the primary region. LRS is the least expensive replication option, but is not recommended for applications requiring high availability.
References:
https://cloud.netapp.com/blog/storage-tiers-in-azure-blob-storage-find-the-best-for-your-data
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy
Your company, named Contoso, Ltd., implements several Azure logic apps that have HTTP triggers. The logic apps provide access to an on-premises web service. Contoso establishes a partnership with another company named Fabrikam. IncL Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0 identity management to authenticate its users. Developers at Fabrikam plan to use a subset of the logic apps to build applications that will integrate with the on-premises web service of Contoso.
You need to design a solution to provide the Fabrikam developers with access to the logic apps.
The solution must meet the following requirements:
- Requests to the logic apps from the developers must be limited to
lower rates than the requests from the users at Contoso.
- The developers must be able to rely on their existing OAuth 2.0
provider to gain access to the logic apps.
- The solution must NOT require changes to the logic apps.
- The solution must NOT use Azure AD guest accounts.
What should you include in the solution?
You need to design a solution to provide the Fabrikam developers with access to the logic apps.
The solution must meet the following requirements:
- Requests to the logic apps from the developers must be limited to
lower rates than the requests from the users at Contoso.
- The developers must be able to rely on their existing OAuth 2.0
provider to gain access to the logic apps.
- The solution must NOT require changes to the logic apps.
- The solution must NOT use Azure AD guest accounts.
What should you include in the solution?
Correct Answer: C
Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).
Case Study 1 - Litware
Existing Environment
Azure Environment
Litware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are linked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).
The litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that grants the DataActions read permission to the blobs and files in Azure Storage.
On-Premises Environment
The on-premises network of Litware contains the resources shown in the following table.
Network Environment
Litware has ExpressRoute connectivity to Azure.
Planned Changes and Requirements
Litware plans to implement the following changes:
* Migrate DB1 and DB2 to Azure.
* Migrate App1 to Azure virtual machines.
* Migrate the external storage used by App1 to Azure Storage.
* Deploy the Azure virtual machines that will host App1 to Azure dedicated hosts.
Authentication and Authorization Requirements
Litware identifies the following authentication and authorization requirements:
* Only users that manage the production environment by using the Azure portal must connect from a hybrid Azure AD-joined device and authenticate by using Azure Multi-Factor Authentication (MFA).
* The Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for all the virtual networks in all the Azure subscriptions.
* To access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the app.
* RBAC roles must be applied at the highest level possible.
Resiliency Requirements
Litware identifies the following resiliency requirements:
* Once migrated to Azure, DB1 and DB2 must meet the following requirements:
- Maintain availability if two availability zones in the local Azure region fail.
- Fail over automatically.
- Minimize I/O latency.
* App1 must meet the following requirements:
- Be hosted in an Azure region that supports availability zones.
- Be hosted on Azure virtual machines that support automatic scaling.
- Maintain availability if two availability zones in the local Azure region fail.
Security and Compliance Requirements
Litware identifies the following security and compliance requirements:
* Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.
* On-premises users and services must be able to access the Azure Storage account that will host the data in App1.
* Access to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.
* All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.
* App1 must NOT share physical hardware with other workloads.
Business Requirements
Litware identifies the following business requirements:
* Minimize administrative effort.
* Minimize costs.
Hotspot Question
You plan to migrate App1 to Azure.
You need to estimate the compute costs for App1 in Azure. The solution must meet the security and compliance requirements.
What should you use to estimate the costs, and what should you implement to minimize the costs? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Existing Environment
Azure Environment
Litware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are linked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).
The litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that grants the DataActions read permission to the blobs and files in Azure Storage.
On-Premises Environment
The on-premises network of Litware contains the resources shown in the following table.
Network Environment
Litware has ExpressRoute connectivity to Azure.
Planned Changes and Requirements
Litware plans to implement the following changes:
* Migrate DB1 and DB2 to Azure.
* Migrate App1 to Azure virtual machines.
* Migrate the external storage used by App1 to Azure Storage.
* Deploy the Azure virtual machines that will host App1 to Azure dedicated hosts.
Authentication and Authorization Requirements
Litware identifies the following authentication and authorization requirements:
* Only users that manage the production environment by using the Azure portal must connect from a hybrid Azure AD-joined device and authenticate by using Azure Multi-Factor Authentication (MFA).
* The Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for all the virtual networks in all the Azure subscriptions.
* To access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the app.
* RBAC roles must be applied at the highest level possible.
Resiliency Requirements
Litware identifies the following resiliency requirements:
* Once migrated to Azure, DB1 and DB2 must meet the following requirements:
- Maintain availability if two availability zones in the local Azure region fail.
- Fail over automatically.
- Minimize I/O latency.
* App1 must meet the following requirements:
- Be hosted in an Azure region that supports availability zones.
- Be hosted on Azure virtual machines that support automatic scaling.
- Maintain availability if two availability zones in the local Azure region fail.
Security and Compliance Requirements
Litware identifies the following security and compliance requirements:
* Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.
* On-premises users and services must be able to access the Azure Storage account that will host the data in App1.
* Access to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.
* All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.
* App1 must NOT share physical hardware with other workloads.
Business Requirements
Litware identifies the following business requirements:
* Minimize administrative effort.
* Minimize costs.
Hotspot Question
You plan to migrate App1 to Azure.
You need to estimate the compute costs for App1 in Azure. The solution must meet the security and compliance requirements.
What should you use to estimate the costs, and what should you implement to minimize the costs? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: The Azure Total Cost of Ownership (TCO) Calculator The Total Cost of Ownership (TCO) Calculator estimates the cost savings you can realize by migrating your workloads to Azure.
Note: The TCO Calculator recommends a set of equivalent services in Azure that will support your applications. Our analysis will show each cost area with an estimate of your on-premises spend versus your spend in Azure. There are several cost categories that either decrease or go away completely when you move workloads to the cloud.
Box 2: Azure Hybrid Benefit
Azure Hybrid Benefit is a licensing benefit that helps you to significantly reduce the costs of running your workloads in the cloud. It works by letting you use your on-premises Software Assurance-enabled Windows Server and SQL Server licenses on Azure. And now, this benefit applies to RedHat and SUSE Linux subscriptions, too.
Scenario:
Litware identifies the following security and compliance requirements:
Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years. On-premises users and services must be able to access the Azure Storage account that will host the data in App1.
Access to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.
All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.
App1 must not share physical hardware with other workloads.
Reference:
https://azure.microsoft.com/en-us/pricing/tco/
https://azure.microsoft.com/en-us/pricing/hybrid-benefit/
Hotspot Question
Your on-premises network contains an Active Directory Domain Services (AD DS) forest. The forest contains a top-level domain, three child domains, and an on-premises server named Server1.
You have a Microsoft Entra tenant. Server1 uses Microsoft Entra Connect Sync to replicate all the user objects from the three child domains to the tenant.
New contractors and employees are onboarded manually by using the Workday cloud-based human resources (HR) application.
You plan to automatically provision accounts for new users in one of the on-premises child domains and the Microsoft Entra tenant. The provisioning logic for the employees will be distinct from the provisioning logic for the contractors.
You need to identify the following:
- The minimum number of apps to register in the Microsoft Entra tenant
- The minimum number of Microsoft Entra Connect provisioning agents to
deploy
The solution must minimize implementation effort.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Your on-premises network contains an Active Directory Domain Services (AD DS) forest. The forest contains a top-level domain, three child domains, and an on-premises server named Server1.
You have a Microsoft Entra tenant. Server1 uses Microsoft Entra Connect Sync to replicate all the user objects from the three child domains to the tenant.
New contractors and employees are onboarded manually by using the Workday cloud-based human resources (HR) application.
You plan to automatically provision accounts for new users in one of the on-premises child domains and the Microsoft Entra tenant. The provisioning logic for the employees will be distinct from the provisioning logic for the contractors.
You need to identify the following:
- The minimum number of apps to register in the Microsoft Entra tenant
- The minimum number of Microsoft Entra Connect provisioning agents to
deploy
The solution must minimize implementation effort.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: 3
One app per child domain. We have three child domains.
Box 2: 2
Two for each disjoint forest. We have one forest.
Note: Microsoft Entra, Microsoft Entra ID, App provisioning, Cloud HR application to Microsoft Entra user provisioning Scenario: Single cloud HR app tenant -> target multiple child domains in a disjoint Active Directory forest
This scenario involves provisioning users from the cloud HR app to domains in disjoint Active Directory forests.
We recommend the following production configuration:
* Number of Microsoft Entra Connect provisioning agents to deploy on-premises Two per disjoint Active Directory forest.
* Number of provisioning connector apps to configure
One app per child domain.
Reference:
https://learn.microsoft.com/en-us/entra/identity/app-provisioning/plan-cloud-hr-provision
Hotspot Question
You have an Azure web app named App1 and an Azure key vault named KV1.
App1 stores database connection strings in KV1.
App1 performs the following types of requests to KV1:
* Get
* List
* Wrap
* Delete
* Unwrap
* Backup
* Decrypt
* Encrypt
You are evaluating the continuity of service for App1.
You need to identify the following if the Azure region that hosts KV1 becomes unavailable:
- To where will KV1 fail over?
- During the failover, which request type will be unavailable?
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have an Azure web app named App1 and an Azure key vault named KV1.
App1 stores database connection strings in KV1.
App1 performs the following types of requests to KV1:
* Get
* List
* Wrap
* Delete
* Unwrap
* Backup
* Decrypt
* Encrypt
You are evaluating the continuity of service for App1.
You need to identify the following if the Azure region that hosts KV1 becomes unavailable:
- To where will KV1 fail over?
- During the failover, which request type will be unavailable?
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: A server in the same paired region
The contents of your key vault are replicated within the region and to a secondary region at least
150 miles away, but within the same geography to maintain high durability of your keys and secrets.
Box 2: Delete
During failover, your key vault is in read-only mode. Requests that are supported in this mode are:
* List certificates
* Get certificates
* List secrets
* Get secrets
* List keys
* Get (properties of) keys
* Encrypt
* Decrypt
* Wrap
* Unwrap
* Verify
* Sign
* Backup
Reference:
https://docs.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance