AZ-304 Microsoft Azure Architect Design 5 — Questions and Answers
Question 1: A company needs to migrate an on-premises SQL Server 2019 database to Azure with minimal changes, full PaaS management, and support for Always On availability groups. Which Azure service is the best fit?
- Azure SQL Database (single database)
- Azure SQL Managed Instance (Correct answer)
- SQL Server on Azure VM (IaaS)
- Azure Synapse Analytics dedicated SQL pool
Correct answer: Azure SQL Managed Instance
Azure SQL Managed Instance provides near 100% compatibility with SQL Server including support for SQL Agent, linked servers, and Always On AG in a fully managed PaaS deployment.
Question 2: An architect needs to design cost optimization for Azure VMs running predictable 24/7 production workloads that will be needed for at least 3 years. Which pricing model minimizes cost?
- Pay-as-you-go with Azure Spot Instances
- Reserved Virtual Machine Instances (3-year term) (Correct answer)
- Azure Hybrid Benefit with pay-as-you-go
- Azure Dev/Test pricing
Correct answer: Reserved Virtual Machine Instances (3-year term)
3-year Reserved Instances provide up to 72% savings compared to pay-as-you-go pricing and are ideal for predictable, long-running production workloads.
Question 3: A solution must process large-scale batch analytics on structured data stored in Azure Data Lake Storage Gen2. The processing requires SQL-based transformations. Which Azure service should be used?
- Azure Databricks with PySpark
- Azure Synapse Analytics with serverless SQL pool (Correct answer)
- Azure HDInsight with Hive
- Azure Data Factory with data flows
Correct answer: Azure Synapse Analytics with serverless SQL pool
Azure Synapse Analytics serverless SQL pool enables T-SQL queries directly against ADLS Gen2 files with no infrastructure to manage, optimized for large-scale ad-hoc and batch analytics.
Question 4: An architect must ensure that a new Azure resource group deployment complies with corporate standards including specific VM SKUs, allowed regions, and required tags. Which Azure service enforces these standards at deployment time?
- Azure Resource Manager template validation
- Azure Policy with 'deny' and 'append' effects (Correct answer)
- Azure Blueprints with resource group artifact
- Azure Cost Management budgets with alerts
Correct answer: Azure Policy with 'deny' and 'append' effects
Azure Policy with 'deny' effects blocks non-compliant SKUs and regions, while 'append' effects automatically add required tags, enforcing all three standards at deployment time.
Question 5: A company stores sensitive customer data in Azure Blob Storage. The security team requires that all data be encrypted with keys the company controls and that key access be logged and auditable. Which approach should the architect implement?
- Microsoft-managed keys (default encryption)
- Customer-managed keys (CMK) stored in Azure Key Vault with audit logging enabled (Correct answer)
- Client-side encryption with keys stored on-premises
- Double encryption with infrastructure encryption enabled
Correct answer: Customer-managed keys (CMK) stored in Azure Key Vault with audit logging enabled
Customer-managed keys in Azure Key Vault give the company full control over encryption keys, and enabling Key Vault diagnostic logs provides a complete audit trail of every key access operation.
Question 6: An architect needs to design a solution where an Azure AD application can access Microsoft Graph API without user interaction (daemon service). Which OAuth 2.0 flow should be used?
- Authorization code flow with PKCE
- Client credentials flow (Correct answer)
- Device authorization flow
- On-behalf-of flow
Correct answer: Client credentials flow
The OAuth 2.0 client credentials flow enables a service or daemon application to authenticate with its own identity (client ID + secret or certificate) to access APIs without user interaction.
Question 7: A company needs to expose an on-premises web API to Azure-hosted services without opening inbound firewall ports on the corporate network. Which Azure service enables this secure outbound-only connectivity?
- Azure VPN Gateway with site-to-site connection
- Azure Relay Hybrid Connections (Correct answer)
- Azure API Management with self-hosted gateway
- Azure ExpressRoute with private peering
Correct answer: Azure Relay Hybrid Connections
Azure Relay Hybrid Connections uses an outbound WebSocket connection from on-premises to Azure, enabling Azure services to reach on-premises APIs without any inbound firewall rule changes.
AZ-304 Microsoft Azure Architect Design 5
A company needs to migrate an on-premises SQL Server 2019 database to Azure with minimal changes, full PaaS management, and support for Always On availability groups.
Which Azure service is the best fit?