AZ-304 Microsoft Azure Architect Design 2 — Questions and Answers
Question 1: A company needs to ensure their Azure SQL Database can failover to a secondary region within 30 seconds with zero data loss. Which feature should the architect configure?
- Active geo-replication
- Auto-failover groups with synchronous commit (Correct answer)
- Azure Site Recovery
- Read-scale replicas
Correct answer: Auto-failover groups with synchronous commit
Auto-failover groups support automatic failover with a configurable grace period, and when configured with synchronous replication, they provide zero data loss (RPO=0).
Question 2: An architect must design a solution where an Azure Function triggers whenever a blob is added to Azure Storage. The solution must handle millions of events daily with guaranteed delivery. Which approach is best?
- Use Azure Storage trigger directly on the Function
- Use Event Grid with Azure Functions as the subscriber (Correct answer)
- Poll the storage account on a timer trigger
- Use Service Bus with a storage queue adapter
Correct answer: Use Event Grid with Azure Functions as the subscriber
Event Grid provides near-real-time event delivery with at-least-once delivery guarantees and scales to millions of events per second, making it ideal for large-scale blob event processing.
Question 3: A design requires that only users from a specific Azure AD group can access an Azure API Management API during business hours. Which APIM policy combination achieves this?
- validate-jwt + check-header policies (Correct answer)
- validate-jwt + rate-limit-by-key policies
- ip-filter + authenticate-basic policies
- validate-jwt + restrict-caller-ips combined with a custom policy
Correct answer: validate-jwt + check-header policies
The validate-jwt policy validates the AAD token and checks group membership claims, while check-header can enforce time-of-day restrictions via custom headers injected upstream.
Question 4: You are designing a multi-tenant SaaS application on Azure. Each tenant requires data isolation with separate encryption keys. Which Azure storage approach best satisfies this requirement?
- Single Azure SQL database with row-level security
- Separate Azure SQL databases per tenant with customer-managed keys in Azure Key Vault (Correct answer)
- Azure Cosmos DB with partition key per tenant
- Azure Table Storage with separate storage accounts
Correct answer: Separate Azure SQL databases per tenant with customer-managed keys in Azure Key Vault
Separate databases per tenant with customer-managed keys (CMK) in Azure Key Vault provides true data isolation and independent key management per tenant.
Question 5: An architect needs to design a solution that caches API responses for 5 minutes globally but invalidates the cache immediately when data changes. Which Azure services should be combined?
- Azure API Management with built-in cache + Event Grid for invalidation (Correct answer)
- Azure CDN with custom rules + Logic Apps for purge
- Azure Front Door with caching rules + Azure Functions for purge
- Azure Redis Cache + Azure Functions as a proxy
Correct answer: Azure API Management with built-in cache + Event Grid for invalidation
Azure API Management's built-in cache can store responses, and Event Grid events can trigger cache invalidation policies via APIM's external cache invalidation capabilities.
Question 6: A company wants to migrate 500 TB of on-premises data to Azure Blob Storage. The internet connection is 1 Gbps and the migration must complete within 2 weeks. Which service should the architect recommend?
- Azure Data Box (Correct answer)
- AzCopy over ExpressRoute
- Azure Import/Export service
- Azure Data Factory with self-hosted IR
Correct answer: Azure Data Box
At 1 Gbps, transferring 500 TB over the internet would take approximately 46 days; Azure Data Box allows physical shipment of up to 80 TB per device, completing the migration within the 2-week window.
Question 7: An architect is designing a microservices solution on AKS. Services must communicate securely without managing certificates manually. Which approach provides mutual TLS with automatic certificate rotation?
- Deploy Azure Application Gateway with SSL termination
- Implement a service mesh such as Istio or Open Service Mesh (Correct answer)
- Use Azure Key Vault certificates mounted as Kubernetes secrets
- Configure network policies with TLS in each service's code
Correct answer: Implement a service mesh such as Istio or Open Service Mesh
A service mesh like Istio or Open Service Mesh (OSM) provides automatic mTLS between pods with automatic certificate issuance and rotation without application code changes.
AZ-304 Microsoft Azure Architect Design 2
A company needs to ensure their Azure SQL Database can failover to a secondary region within 30 seconds with zero data loss.
Which feature should the architect configure?