AZ-304 Microsoft Azure Architect Design 4 — Questions and Answers
Question 1: An architect needs to design authentication for a mobile app that accesses multiple Azure services (Blob Storage, Cosmos DB, Key Vault) without embedding credentials in the app. Which identity approach is recommended?
- Store credentials in Azure Key Vault and retrieve at startup
- Use Azure AD app registration with client credentials flow
- Use Azure AD B2C with user delegation tokens scoped to each service (Correct answer)
- Assign a managed identity to the app and grant RBAC roles on each service
Correct answer: Use Azure AD B2C with user delegation tokens scoped to each service
Azure AD B2C authenticates end users who then receive delegated tokens scoped per resource, enabling the mobile app to access Azure services on behalf of the user without storing credentials.
Question 2: A company needs to design a disaster recovery solution for an Azure VM workload with an RTO of 1 hour and RPO of 15 minutes. Which service and configuration meets these requirements?
- Azure Backup with hourly snapshots
- Azure Site Recovery with replication interval set to 5 minutes (Correct answer)
- Azure VM scale sets with cross-region autoscaling
- Azure Backup with geo-redundant storage and instant restore
Correct answer: Azure Site Recovery with replication interval set to 5 minutes
Azure Site Recovery provides continuous replication with RPO as low as 30 seconds for Hyper-V and 1-5 minutes for VMware/Azure VMs, and automated recovery plans can achieve RTO under 1 hour.
Question 3: An architect is designing a solution where multiple Azure Functions need to share state without a database. The state must be consistent and the functions run in sequence. Which Azure service provides this?
- Azure Cache for Redis
- Durable Functions with orchestrator pattern (Correct answer)
- Azure Service Bus with session state
- Azure Table Storage with optimistic concurrency
Correct answer: Durable Functions with orchestrator pattern
Durable Functions (Azure Functions extension) provides stateful orchestration with built-in state management, checkpointing, and sequential activity execution without external state stores.
Question 4: A globally distributed application requires a NoSQL database with multi-master writes in all regions and automatic conflict resolution. Which Azure service supports this natively?
- Azure SQL Hyperscale with geo-replication
- Azure Cosmos DB with multi-region writes enabled (Correct answer)
- Azure Cache for Redis with geo-replication
- Azure Table Storage with RA-GZRS replication
Correct answer: Azure Cosmos DB with multi-region writes enabled
Azure Cosmos DB supports multi-region writes (multi-master) with five configurable consistency levels and automatic or custom conflict resolution policies.
Question 5: A company needs to control egress traffic from Azure VMs to the internet and block specific categories of malicious URLs. Which Azure service provides FQDN-based outbound filtering?
- Network Security Groups with service tags
- Azure Firewall with Application Rules using FQDN filtering (Correct answer)
- Azure Web Application Firewall on Application Gateway
- Azure DDoS Protection Standard
Correct answer: Azure Firewall with Application Rules using FQDN filtering
Azure Firewall Application Rules allow FQDN-based filtering with built-in threat intelligence that can block known malicious FQDNs and URL categories for outbound internet traffic.
Question 6: A workload runs on Azure VMs and requires Premium SSD storage with a guaranteed latency of less than 1 ms for 99.9% of I/O operations. Which storage option should the architect select?
- Premium SSD (P30 or higher)
- Ultra Disk with I/O configured to meet latency SLA (Correct answer)
- Premium SSD v2 with performance tier adjustment
- Azure NetApp Files with Ultra tier
Correct answer: Ultra Disk with I/O configured to meet latency SLA
Azure Ultra Disk provides sub-millisecond latency (typically 0.1–0.2ms) with configurable IOPS and throughput, and is the only Azure managed disk type with a sub-1ms latency guarantee.
Question 7: An architect must design an Azure AD Conditional Access policy that requires MFA only when users access sensitive applications from outside the corporate network. Which conditions should be configured?
- Target app + 'Any location' condition with MFA grant control
- Target app + Named location exclusion for corporate IPs + MFA grant control (Correct answer)
- Target app + Device compliance requirement + MFA grant control
- All apps + Sign-in risk 'High' + MFA grant control
Correct answer: Target app + Named location exclusion for corporate IPs + MFA grant control
By targeting the sensitive app, defining a named location for corporate IP ranges, excluding that named location, and requiring MFA as the grant control, MFA is enforced only for external access.
AZ-304 Microsoft Azure Architect Design 4
An architect needs to design authentication for a mobile app that accesses multiple Azure services (Blob Storage, Cosmos DB, Key Vault) without embedding credentials in the app.
Which identity approach is recommended?