AZ-304 Microsoft Azure Architect Design 3 — Questions and Answers
Question 1: A company's Azure environment has 50 subscriptions. The security team needs a unified view of security posture and compliance across all subscriptions. Which service provides this?
- Azure Monitor Workbooks
- Microsoft Defender for Cloud with management group scope (Correct answer)
- Azure Policy dashboard per subscription
- Azure Security Benchmark reports
Correct answer: Microsoft Defender for Cloud with management group scope
Microsoft Defender for Cloud (formerly Azure Security Center) can be configured at the management group level to provide a unified security posture score and compliance view across all child subscriptions.
Question 2: An architect must design an Azure Virtual Network with spoke VNets in multiple regions. Traffic between spokes must pass through a centralized firewall. Which topology implements this?
- VNet peering with user-defined routes pointing to Azure Firewall in a hub VNet
- Virtual WAN with secured virtual hub (Correct answer)
- ExpressRoute with gateway transit
- Application Gateway in each spoke
Correct answer: Virtual WAN with secured virtual hub
Azure Virtual WAN with secured virtual hub (Azure Firewall integrated) provides managed hub-spoke routing where all inter-spoke and internet traffic transits through the centralized firewall automatically.
Question 3: A critical workload requires 99.99% SLA. The application is deployed to two Azure regions in an active-active configuration. Which Azure service enables intelligent traffic routing with automatic failover?
- Azure Load Balancer with geo-routing
- Azure Traffic Manager with priority routing
- Azure Front Door with health probes and failover (Correct answer)
- Azure Application Gateway with multi-region support
Correct answer: Azure Front Door with health probes and failover
Azure Front Door provides global HTTP/HTTPS load balancing with anycast routing, health probes, and automatic failover at the edge, supporting active-active configurations with sub-second failover.
Question 4: A company needs to store 10 years of audit logs in Azure with guaranteed immutability and tamper-proof storage for regulatory compliance. Which Azure Blob Storage feature should be configured?
- Soft delete with 365-day retention
- Immutable storage with time-based retention policies (WORM) (Correct answer)
- Azure Backup with long-term retention
- Storage account replication to a secondary region
Correct answer: Immutable storage with time-based retention policies (WORM)
Azure Blob Storage immutable storage with time-based retention policies implements WORM (Write Once, Read Many) semantics, preventing modification or deletion of blobs for a specified period.
Question 5: An architect needs to design a solution for processing IoT telemetry from 100,000 devices. Messages must be processed in order per device, and the system must retain messages for 7 days. Which service fits best?
- Azure Service Bus with sessions enabled
- Azure Event Hubs with partition key set to device ID (Correct answer)
- Azure IoT Hub with message routing
- Azure Storage Queue with visibility timeout
Correct answer: Azure Event Hubs with partition key set to device ID
Azure Event Hubs partitions messages by partition key (device ID), ensuring ordered processing per device, supports up to 7-day message retention, and scales to millions of events per second.
Question 6: A design requires that developers can deploy to a staging slot and swap to production with zero downtime. After a swap, the previous production state must be recoverable within 10 minutes. Which Azure App Service configuration achieves this?
- Deployment slots with auto swap enabled
- Deployment slots without auto swap, with swap with preview (Correct answer)
- Blue-green deployment using Azure Traffic Manager
- Container Apps revisions with traffic splitting
Correct answer: Deployment slots without auto swap, with swap with preview
Deployment slots allow manual swap with preview (multi-phase swap), and Azure App Service supports swapping back to the previous slot within minutes, restoring the prior production state.
Question 7: A company wants to enforce that all Azure resources must have specific tags (e.g., CostCenter, Environment) at creation time. Untagged resources must be blocked. Which Azure service enforces this?
- Azure Blueprints with tag artifact
- Azure Policy with 'deny' effect using the 'Require a tag' built-in policy (Correct answer)
- Azure Resource Manager locks
- Azure Management Groups with tag inheritance
Correct answer: Azure Policy with 'deny' effect using the 'Require a tag' built-in policy
Azure Policy with the 'deny' effect and a 'Require a tag on resources' definition blocks resource creation if the specified tags are absent.
AZ-304 Microsoft Azure Architect Design 3
A company's Azure environment has 50 subscriptions.
The security team needs a unified view of security posture and compliance across all subscriptions.
Which service provides this?