AZ-301 Case Studies & Practical Application 3 — Questions and Answers
Question 1: A startup needs to build a serverless API that handles variable traffic, with each function executing up to 10 minutes. Which Azure Function plan is required?
- Consumption plan
- Premium plan (Correct answer)
- Dedicated (App Service) plan
- Flex Consumption plan
Correct answer: Premium plan
The Premium plan supports execution durations up to 60 minutes, whereas the Consumption plan caps at 10 minutes only if configured, but Premium also provides VNET integration and no cold-start penalties.
Question 2: An architect must design a solution where multiple microservices communicate asynchronously, but each message must be processed exactly once even if the consumer fails midway. Which service meets this requirement?
- Azure Event Grid with dead-letter queues
- Azure Service Bus queues with peek-lock mode (Correct answer)
- Azure Event Hubs with consumer groups
- Azure Storage Queues with at-least-once delivery
Correct answer: Azure Service Bus queues with peek-lock mode
Service Bus peek-lock holds a message invisible to other consumers until explicitly completed or abandoned, enabling exactly-once processing semantics.
Question 3: A law firm stores sensitive documents in Azure Blob Storage. Regulatory requirements mandate that documents cannot be deleted or modified for 7 years. Which feature enforces this?
- Azure Blob soft delete with a 7-year retention window
- Azure Storage immutability policies with time-based retention locks (Correct answer)
- Azure Backup with a 7-year retention policy
- Azure Policy denying delete operations on the storage account
Correct answer: Azure Storage immutability policies with time-based retention locks
Immutable storage with time-based retention and locked policies prevents blob deletion or modification for the defined retention period, satisfying WORM compliance.
Question 4: A company wants to allow developers to deploy resources to Azure but prevent them from creating resources in regions outside of East US and West US. What is the most efficient enforcement mechanism?
- Assign a custom RBAC role that restricts deployment to specific regions
- Apply an Azure Policy with an 'allowed locations' effect at the subscription or management group level (Correct answer)
- Configure a resource lock on resources outside the allowed regions
- Create a management group with manual approval workflows for out-of-region deployments
Correct answer: Apply an Azure Policy with an 'allowed locations' effect at the subscription or management group level
Azure Policy with the 'allowed locations' built-in definition enforces region restrictions at scale across the subscription or management group.
Question 5: An organization needs to federate identities from an on-premises Active Directory to Azure AD so users can sign in to Azure portal with their corporate credentials without password sync. Which solution is correct?
- Azure AD Connect with password hash synchronization
- Azure AD Connect with pass-through authentication
- Azure AD Connect with AD FS federation (Correct answer)
- Azure AD B2C with local accounts
Correct answer: Azure AD Connect with AD FS federation
AD FS federation with Azure AD allows authentication to remain on-premises without any password hash or credential data leaving the corporate network.
Question 6: A company deploys a multi-region active-active web application. Users must always be routed to the nearest healthy region, and the solution must detect unhealthy endpoints within 30 seconds. Which service should be used?
- Azure Traffic Manager with performance routing and health probes (Correct answer)
- Azure Application Gateway with multi-region backend pools
- Azure Load Balancer with geo-based rules
- Azure CDN with origin failover
Correct answer: Azure Traffic Manager with performance routing and health probes
Traffic Manager uses performance routing to direct users to the lowest-latency endpoint and health probes to detect and bypass unhealthy regions within seconds.
Question 7: An architect must design a solution that automatically remediates non-compliant Azure resources (e.g., adding missing tags) without manual intervention. Which combination achieves this?
- Azure Policy with a 'deny' effect and a remediation task using a 'modify' effect policy (Correct answer)
- Azure Automation runbook triggered by Azure Monitor alerts
- Azure Logic App polling Azure Resource Graph for non-compliant resources
- Azure Blueprints with locked assignments
Correct answer: Azure Policy with a 'deny' effect and a remediation task using a 'modify' effect policy
Azure Policy with a 'modify' effect and associated remediation tasks can automatically add or update tags on existing non-compliant resources.
AZ-301 Case Studies & Practical Application 3
A startup needs to build a serverless API that handles variable traffic, with each function executing up to 10 minutes.
Which Azure Function plan is required?