AZ-304 Microsoft Azure Solutions Architect Expert 3 — Questions and Answers
Question 1: An architect needs to design a hybrid network connection between on-premises and Azure that provides consistent low latency with guaranteed bandwidth. Which service should be used?
- Azure VPN Gateway (Site-to-Site)
- Azure ExpressRoute (Correct answer)
- Azure Virtual WAN
- Azure Bastion
Correct answer: Azure ExpressRoute
Azure ExpressRoute provides a private, dedicated connection with predictable latency and guaranteed bandwidth SLAs.
Question 2: Which Azure service should an architect choose to cache frequently read data and reduce load on an Azure SQL Database backend?
- Azure CDN
- Azure Cache for Redis (Correct answer)
- Azure Service Bus
- Azure Blob Storage
Correct answer: Azure Cache for Redis
Azure Cache for Redis provides an in-memory data store that dramatically reduces database query load for frequently accessed data.
Question 3: A multi-tier application needs to scale its web tier independently from its business logic tier. Which design pattern best addresses this in Azure?
- Deploy all tiers in a single App Service Plan
- Use Azure Service Bus to decouple tiers and scale independently (Correct answer)
- Run all tiers in a single Azure VM Scale Set
- Use Azure Front Door to distribute traffic across tiers
Correct answer: Use Azure Service Bus to decouple tiers and scale independently
Using Azure Service Bus decouples tiers so each can be scaled independently based on its own demand.
Question 4: An organization must ensure that Azure resources are deployed only to approved regions. Which governance tool enforces this at scale across all subscriptions?
- Azure Blueprints
- Azure Policy assigned at the Management Group level (Correct answer)
- Azure RBAC with custom roles
- Azure Cost Management budgets
Correct answer: Azure Policy assigned at the Management Group level
Azure Policy assigned at the Management Group level propagates the allowed-locations policy to all child subscriptions automatically.
Question 5: A company runs a stateless web application that must handle unpredictable traffic spikes automatically. Which Azure compute option provides the best auto-scaling without managing infrastructure?
- Azure Virtual Machine Scale Sets
- Azure App Service with auto-scale rules
- Azure Kubernetes Service (AKS)
- Azure Functions with Consumption plan (Correct answer)
Correct answer: Azure Functions with Consumption plan
Azure Functions on the Consumption plan automatically scales to zero and out based on events with no infrastructure management required.
Question 6: Which Azure networking feature allows you to route traffic between VNets and on-premises networks through a central hub VNet?
- VNet Peering
- Hub-and-spoke topology with Azure Firewall or NVA (Correct answer)
- Azure Private Link
- Azure NAT Gateway
Correct answer: Hub-and-spoke topology with Azure Firewall or NVA
A hub-and-spoke topology centralizes shared services (firewall, VPN gateway) in the hub and connects spoke VNets via peering.
Question 7: An architect needs to provide secure, browser-based RDP and SSH access to Azure VMs without exposing public IP addresses. Which service should be used?
- Azure VPN Gateway point-to-site
- Just-in-time VM access
- Azure Bastion (Correct answer)
- Azure Firewall DNAT rules
Correct answer: Azure Bastion
Azure Bastion provides browser-based RDP/SSH directly in the Azure portal without requiring VMs to have public IPs.
AZ-304 Microsoft Azure Solutions Architect Expert 3
An architect needs to design a hybrid network connection between on-premises and Azure that provides consistent low latency with guaranteed bandwidth.
Which service should be used?