AZ-304 Microsoft Azure Solutions Architect Expert 2 — Questions and Answers
Question 1: A company needs to ensure that Azure VMs in a production subscription cannot be created without a specific tag. Which Azure feature enforces this?
- Azure RBAC deny assignment
- Azure Policy with deny effect (Correct answer)
- Azure Blueprints lock
- Management group access control
Correct answer: Azure Policy with deny effect
Azure Policy with a 'deny' effect blocks resource creation that doesn't meet defined tag requirements.
Question 2: Which Azure storage redundancy option provides the highest availability by replicating data across two regions and three availability zones in the primary region?
- Zone-redundant storage (ZRS)
- Geo-redundant storage (GRS)
- Geo-zone-redundant storage (GZRS) (Correct answer)
- Read-access geo-redundant storage (RA-GRS)
Correct answer: Geo-zone-redundant storage (GZRS)
GZRS combines zone-redundant replication in the primary region with geo-replication to a secondary region for maximum durability.
Question 3: An architect must design a solution where Azure Functions can securely access Azure Key Vault without storing credentials in code. What is the recommended approach?
- Store the Key Vault URL in application settings
- Use a system-assigned managed identity (Correct answer)
- Use a service principal with a client secret
- Embed the access key in the function code
Correct answer: Use a system-assigned managed identity
A system-assigned managed identity allows Azure Functions to authenticate to Key Vault without any stored credentials.
Question 4: A solution requires a globally distributed NoSQL database with multi-region writes and automatic failover. Which Azure service best fits this requirement?
- Azure SQL Database Hyperscale
- Azure Table Storage
- Azure Cosmos DB (Correct answer)
- Azure Database for PostgreSQL Flexible Server
Correct answer: Azure Cosmos DB
Azure Cosmos DB supports multi-region writes with configurable consistency levels and automatic failover.
Question 5: When designing an Azure Virtual Network, which component is used to control inbound and outbound traffic at the subnet level?
- Azure Firewall
- Network Security Group (NSG) (Correct answer)
- Application Security Group (ASG)
- User-Defined Route (UDR)
Correct answer: Network Security Group (NSG)
Network Security Groups are applied at the subnet or NIC level to filter traffic using allow/deny rules.
Question 6: A company wants to migrate 200 on-premises VMs to Azure with minimal downtime. Which Azure service replicates VMs continuously and enables a cutover with minimal data loss?
- Azure Backup
- Azure Database Migration Service
- Azure Site Recovery (Correct answer)
- Azure Migrate Assessment
Correct answer: Azure Site Recovery
Azure Site Recovery provides continuous replication and orchestrated failover, minimizing downtime during migration.
Question 7: Which Azure Active Directory feature allows an architect to require MFA only when a sign-in is flagged as risky?
- Azure AD Privileged Identity Management
- Azure AD Conditional Access with risk-based policies
- Azure AD Identity Protection sign-in risk policy (Correct answer)
- Azure AD Multi-Factor Authentication per-user enforcement
Correct answer: Azure AD Identity Protection sign-in risk policy
Azure AD Identity Protection's sign-in risk policy evaluates risk signals and can require MFA for risky sign-ins automatically.
AZ-304 Microsoft Azure Solutions Architect Expert 2
A company needs to ensure that Azure VMs in a production subscription cannot be created without a specific tag.
Which Azure feature enforces this?