AZ-304 Microsoft AZ-304 4 — Questions and Answers
Question 1: You need to ensure that sensitive data in Azure Blob Storage is automatically classified and protected. Which solution should be part of your design?
- Azure Information Protection with Microsoft Purview (Correct answer)
- Azure Security Center with storage scanning
- Shared Access Signatures with IP restrictions
- Azure Private Endpoint with service tags
Correct answer: Azure Information Protection with Microsoft Purview
Microsoft Purview with Azure Information Protection automatically discovers, classifies, and applies protection labels to sensitive data in storage.
Question 2: An architect must design a solution where Azure Functions can securely access Azure Key Vault secrets without storing credentials. Which approach should be used?
- Store Key Vault URI in app settings and use connection strings
- Enable system-assigned managed identity on the Function App and grant Key Vault access (Correct answer)
- Use a service principal with certificate stored in deployment slots
- Embed Key Vault access keys in function code
Correct answer: Enable system-assigned managed identity on the Function App and grant Key Vault access
System-assigned managed identity eliminates the need to manage credentials by automatically providing an Azure AD identity for the Function App.
Question 3: A company needs a data warehouse that can scale compute and storage independently and pause compute during off-hours to save costs. Which service should you recommend?
- Azure SQL Database Hyperscale
- Azure Synapse Analytics dedicated SQL pool (Correct answer)
- Azure SQL Managed Instance
- Azure Database for PostgreSQL Flexible Server
Correct answer: Azure Synapse Analytics dedicated SQL pool
Azure Synapse Analytics dedicated SQL pool supports independent scaling of compute and storage, and compute can be paused when not in use.
Question 4: You need to implement a hub-and-spoke network topology in Azure where all traffic between spokes is inspected by a central firewall. What should you deploy in the hub?
- Azure Application Gateway with WAF
- Azure Firewall with user-defined routes in spoke VNets (Correct answer)
- Network Security Groups on all subnets
- Azure DDoS Protection Standard
Correct answer: Azure Firewall with user-defined routes in spoke VNets
Azure Firewall in the hub VNet with UDRs configured in spoke VNets forces all inter-spoke traffic through the central firewall for inspection.
Question 5: An application uses Azure Cosmos DB and requires guaranteed single-digit millisecond reads globally. Which consistency level should you choose?
- Strong consistency
- Bounded staleness
- Session consistency
- Eventual consistency (Correct answer)
Correct answer: Eventual consistency
Eventual consistency offers the lowest latency and highest throughput globally, appropriate when the application tolerates temporarily stale reads.
Question 6: You are designing a solution that requires running batch processing jobs at scale without managing any underlying infrastructure. Which Azure service should you use?
- Azure HDInsight
- Azure Batch (Correct answer)
- Azure Databricks
- Azure VM Scale Sets
Correct answer: Azure Batch
Azure Batch enables large-scale parallel and HPC batch processing jobs, automatically managing compute node pools without infrastructure overhead.
Question 7: A company needs to provide secure remote access to Azure VMs without exposing RDP/SSH ports to the public internet. Which service should you implement?
- Azure VPN Gateway with point-to-site VPN
- Azure Bastion (Correct answer)
- Azure Application Gateway with SSL termination
- Network Security Group with IP allowlisting
Correct answer: Azure Bastion
Azure Bastion provides browser-based RDP/SSH connectivity to VMs directly through the Azure portal without exposing management ports publicly.
AZ-304 Microsoft AZ-304 4
You need to ensure that sensitive data in Azure Blob Storage is automatically classified and protected.
Which solution should be part of your design?