AZ-301 Professional Standards & Competencies 2 — Questions and Answers
Question 1: An architect must ensure a multi-region Azure deployment meets a 99.99% SLA. Which combination best achieves this?
- Single region with Availability Zones only
- Active-active across two regions with Traffic Manager (Correct answer)
- Active-passive with manual failover
- Single region with Premium tier services
Correct answer: Active-active across two regions with Traffic Manager
Active-active across two regions with Traffic Manager provides geographic redundancy and automatic failover to meet 99.99% composite SLA.
Question 2: A solutions architect is reviewing a design where application secrets are stored in app configuration files committed to a Git repository. What is the correct recommendation?
- Encrypt the config files before committing
- Use Azure Key Vault with managed identity access (Correct answer)
- Store secrets in Azure Blob Storage with SAS tokens
- Use environment variables in the pipeline only
Correct answer: Use Azure Key Vault with managed identity access
Azure Key Vault with managed identity eliminates secret exposure in code and provides centralized, audited secret management.
Question 3: During a design review, a stakeholder requests that all data at rest be encrypted with customer-managed keys. Which Azure service handles this requirement?
- Azure Disk Encryption with platform-managed keys
- Azure Key Vault with customer-managed keys (CMK) (Correct answer)
- Azure Security Center encryption policies
- Azure Active Directory encryption roles
Correct answer: Azure Key Vault with customer-managed keys (CMK)
Azure Key Vault with CMK lets customers control and rotate their own encryption keys for data at rest across Azure services.
Question 4: An architect needs to validate that a proposed solution meets enterprise governance standards before deployment. What is the recommended Azure-native approach?
- Run ARM template validation in the portal
- Apply Azure Policy with deny effects and use Compliance dashboard (Correct answer)
- Manually review all resource configurations post-deployment
- Use Azure Advisor recommendations after deployment
Correct answer: Apply Azure Policy with deny effects and use Compliance dashboard
Azure Policy with deny effects prevents non-compliant resources from being created and the Compliance dashboard tracks organizational standards proactively.
Question 5: A company requires that only approved VM SKUs be deployed across all subscriptions. Which approach enforces this at scale?
- Create a custom Azure RBAC role limiting VM sizes
- Apply an Azure Policy definition at the Management Group level (Correct answer)
- Use ARM templates with hardcoded SKU values per team
- Set subscription spending limits in Azure Cost Management
Correct answer: Apply an Azure Policy definition at the Management Group level
Azure Policy at the Management Group level applies governance rules across all child subscriptions in a consistent, auditable manner.
Question 6: An architect documents that a workload requires RPO of 15 minutes. Which DR strategy aligns with this requirement?
- Backup and restore with daily snapshots
- Pilot light with cold standby resources
- Warm standby with continuous async replication (Correct answer)
- Active-active with synchronous replication
Correct answer: Warm standby with continuous async replication
A warm standby with continuous async replication maintains a near-current replica, enabling recovery within 15 minutes (RPO).
Question 7: A design review reveals that an API exposes internal microservice endpoints directly to the internet. What architectural correction should the architect recommend?
- Add SSL certificates to each microservice endpoint
- Place Azure API Management in front of all microservices (Correct answer)
- Move microservices to a private subnet only
- Implement Azure DDoS Protection Standard
Correct answer: Place Azure API Management in front of all microservices
Azure API Management abstracts internal microservice endpoints, providing authentication, rate limiting, and a single public facade.
AZ-301 Professional Standards & Competencies 2
An architect must ensure a multi-region Azure deployment meets a 99.99% SLA.
Which combination best achieves this?