AZ-301 Case Studies & Practical Application 4 — Questions and Answers
Question 1: A SaaS company serves multiple enterprise customers and must ensure each customer's data is completely isolated at the database level while minimizing management overhead. Which Azure SQL approach is best?
- Single Azure SQL Database per tenant with separate server per customer
- Azure SQL Elastic Pool with one database per tenant and row-level security (Correct answer)
- Azure SQL Managed Instance per tenant
- A single Azure SQL Database with tenant_id column and application-level isolation
Correct answer: Azure SQL Elastic Pool with one database per tenant and row-level security
Elastic Pools share compute resources cost-effectively while providing database-level isolation per tenant, reducing management overhead versus per-tenant servers.
Question 2: An architect is designing a solution where Azure Functions must access a SQL database without storing connection strings in application settings or code. What is the recommended approach?
- Store the connection string in Azure Key Vault and reference it via Key Vault references in App Settings (Correct answer)
- Hardcode the connection string in the function code and deploy via CI/CD
- Store the connection string in Azure Blob Storage and read it at startup
- Use Azure API Management to proxy all database calls
Correct answer: Store the connection string in Azure Key Vault and reference it via Key Vault references in App Settings
Key Vault references in App Settings allow Azure Functions to retrieve secrets from Key Vault at runtime without exposing them in configuration files.
Question 3: A gaming company needs a globally distributed, low-latency data store for player session state. Reads must return data within 10ms from any region, and writes must be accepted in multiple regions simultaneously. Which Azure service is appropriate?
- Azure SQL Database with active geo-replication
- Azure Cosmos DB with multi-region writes enabled (Correct answer)
- Azure Cache for Redis with geo-replication
- Azure Table Storage with replication
Correct answer: Azure Cosmos DB with multi-region writes enabled
Cosmos DB with multi-region writes (multi-master) allows writes and reads in any configured region with single-digit millisecond latency guarantees.
Question 4: A company's architecture review identifies that their Azure Kubernetes Service cluster nodes are running at 90% CPU during peak hours, causing pod evictions. What is the correct remediation at the infrastructure level?
- Increase pod resource limits to allow pods to use more CPU
- Enable cluster auto-scaler to add nodes when resource pressure is detected (Correct answer)
- Switch to a higher-SKU node pool and disable auto-scaling
- Increase the number of replicas for all deployments
Correct answer: Enable cluster auto-scaler to add nodes when resource pressure is detected
The cluster auto-scaler monitors for unschedulable pods or resource pressure and automatically provisions additional nodes to accommodate load.
Question 5: An insurance company must ensure all data in transit between Azure services within their VNet is encrypted and that API endpoints are never exposed to the public internet. Which design pattern achieves this?
- Deploy services with public endpoints and use TLS encryption
- Use Azure Private Endpoints for all PaaS services and deploy within a VNet, disabling public access (Correct answer)
- Enable Azure Firewall on the subscription to block inbound traffic
- Use service endpoints with NSG rules to restrict traffic
Correct answer: Use Azure Private Endpoints for all PaaS services and deploy within a VNet, disabling public access
Private Endpoints bring PaaS services into the VNet with a private IP, eliminating public internet exposure, while disabling public access ensures no alternative path exists.
Question 6: A logistics company needs to process order events in the exact sequence they are placed and ensure that order events for the same customer are always processed by the same consumer instance. Which Event Hubs feature supports this?
- Event Hubs Capture to Azure Blob Storage
- Event Hubs partition key set to customer ID with a dedicated consumer group per service (Correct answer)
- Event Hubs with multiple consumer groups all reading from partition 0
- Azure Service Bus topics with message sessions
Correct answer: Event Hubs partition key set to customer ID with a dedicated consumer group per service
Setting the partition key to customer ID ensures all events for a customer land in the same partition, which is consumed sequentially by the same consumer instance.
Question 7: A company's security team requires that all privileged role assignments in Azure AD last no longer than 8 hours and require MFA at the time of activation. Which feature enforces this?
- Azure AD Conditional Access with session lifetime limits
- Azure AD Privileged Identity Management (PIM) with time-bound activation and MFA requirement (Correct answer)
- Azure AD Role assignments with expiration dates set manually
- Azure Policy denying permanent role assignments
Correct answer: Azure AD Privileged Identity Management (PIM) with time-bound activation and MFA requirement
PIM enables just-in-time privileged access with configurable activation duration limits and MFA enforcement at activation time.
AZ-301 Case Studies & Practical Application 4
A SaaS company serves multiple enterprise customers and must ensure each customer's data is completely isolated at the database level while minimizing management overhead.
Which Azure SQL approach is best?