AZ-301 Case Studies & Practical Application 5 — Questions and Answers
Question 1: A bank must archive transaction logs older than 90 days to cold storage automatically while keeping recent logs immediately accessible for audits. Which Azure Blob Storage feature implements this with no custom code?
- Azure Blob soft delete with a 90-day retention window
- Azure Blob Storage lifecycle management policies that transition blobs to Archive tier after 90 days (Correct answer)
- Azure Data Factory pipeline that copies blobs older than 90 days to a cold storage account
- Azure Backup with a tiered retention policy
Correct answer: Azure Blob Storage lifecycle management policies that transition blobs to Archive tier after 90 days
Blob Storage lifecycle management policies automatically transition blobs to cooler tiers (Cool, Cold, Archive) based on last-modified age without custom code.
Question 2: A company runs a monolithic application on Azure VMs and wants to break it into microservices. They need service discovery, load balancing between services, and secure mTLS communication without changing application code. Which Azure service provides this?
- Azure Application Gateway with path-based routing
- Azure Service Fabric with reliable services
- Azure Kubernetes Service with a service mesh (e.g., Istio or Linkerd) (Correct answer)
- Azure API Management with subscription-based routing
Correct answer: Azure Kubernetes Service with a service mesh (e.g., Istio or Linkerd)
A service mesh on AKS provides transparent mTLS, service discovery, and load balancing as infrastructure-level capabilities without application code changes.
Question 3: An architect must ensure that a critical Azure Resource Manager template deployment is rolled back automatically if any resource in the deployment fails. Which deployment mode achieves this?
- Incremental mode with a manual rollback script
- Complete mode with a pre-deployment backup
- ARM template deployment with a rollback-on-failure linked to a last-successful deployment (Correct answer)
- Azure Blueprints with locked assignments
Correct answer: ARM template deployment with a rollback-on-failure linked to a last-successful deployment
ARM deployments support automatic rollback on failure by specifying `rollbackOnError` to redeploy the last successful deployment state.
Question 4: A company needs to expose an on-premises REST API to Azure services securely without opening inbound firewall rules on their corporate network. Which Azure hybrid connectivity option achieves this?
- Azure VPN Gateway with site-to-site VPN
- Azure ExpressRoute with private peering
- Azure API Management with Azure Relay (Hybrid Connections) (Correct answer)
- Azure Application Gateway with backend pool pointing to on-premises IP
Correct answer: Azure API Management with Azure Relay (Hybrid Connections)
Azure Relay Hybrid Connections establish an outbound connection from on-premises to Azure, allowing Azure services to call on-premises APIs without inbound firewall rules.
Question 5: A media company stores large video files in Azure Blob Storage and must prevent accidental deletion by operations staff while still allowing authorized updates. Which approach provides the right balance?
- Enable Azure Blob soft delete with a 30-day retention period and restrict delete permissions via RBAC
- Apply a resource lock of type 'ReadOnly' on the storage account
- Apply a resource lock of type 'CanNotDelete' and use RBAC to limit who holds the Storage Blob Data Contributor role (Correct answer)
- Enable immutable storage with a locked time-based retention policy
Correct answer: Apply a resource lock of type 'CanNotDelete' and use RBAC to limit who holds the Storage Blob Data Contributor role
A CanNotDelete resource lock prevents deletion while RBAC controls which principals can write updates, balancing protection with operational flexibility.
Question 6: An organization needs centralized logging for all Azure resources across 10 subscriptions with the ability to run cross-subscription queries and set alerts. What is the recommended architecture?
- Deploy a Log Analytics workspace per subscription and query each independently
- Deploy a centralized Log Analytics workspace and configure diagnostic settings in all subscriptions to send data to it (Correct answer)
- Use Azure Monitor Metrics only, as it aggregates across subscriptions by default
- Deploy Azure Security Center and use its built-in log aggregation
Correct answer: Deploy a centralized Log Analytics workspace and configure diagnostic settings in all subscriptions to send data to it
A centralized Log Analytics workspace allows all subscriptions to forward diagnostics logs, enabling unified querying and alerting across the entire organization.
Question 7: A company deploys a containerized application to AKS and must ensure that container images are scanned for vulnerabilities before being deployed to production. Which solution integrates into the CI/CD pipeline and blocks vulnerable images at admission?
- Azure Security Center (Defender for Containers) with AKS admission controller integration (Correct answer)
- Manual review of Docker image layers before deployment
- Azure Container Registry geo-replication with content trust enabled
- Azure Policy 'deny' effect on AKS deployments referencing untagged images
Correct answer: Azure Security Center (Defender for Containers) with AKS admission controller integration
Defender for Containers scans images in ACR and integrates with AKS admission control to block deployments of images with critical vulnerabilities.
AZ-301 Case Studies & Practical Application 5
A bank must archive transaction logs older than 90 days to cold storage automatically while keeping recent logs immediately accessible for audits.
Which Azure Blob Storage feature implements this with no custom code?