AZ-304 Microsoft Azure Solutions Architect Expert 4 — Questions and Answers
Question 1: A company needs a recovery point objective (RPO) of near-zero and a recovery time objective (RTO) of under 15 minutes for its Azure SQL Database. Which configuration meets these requirements?
- Active geo-replication with auto-failover group (Correct answer)
- Azure SQL Database automatic backups with LTR
- Zone-redundant deployment without geo-replication
- Azure Site Recovery for SQL workloads
Correct answer: Active geo-replication with auto-failover group
Auto-failover groups with active geo-replication provide near-zero RPO with asynchronous replication and sub-15-minute automated failover.
Question 2: Which Azure Monitor feature should an architect configure to automatically notify the operations team when CPU utilization exceeds 90% for more than 5 minutes?
- Azure Monitor Diagnostic Settings
- Azure Monitor Metric Alert (Correct answer)
- Azure Monitor Activity Log Alert
- Log Analytics workspace query
Correct answer: Azure Monitor Metric Alert
Azure Monitor Metric Alerts evaluate metric values on defined frequency and fire when thresholds are breached for the configured window.
Question 3: An architect needs to ensure that secrets stored in Azure Key Vault are rotated automatically. Which Azure feature supports automatic secret rotation?
- Key Vault firewall rules
- Key Vault soft-delete and purge protection
- Key Vault Event Grid integration with Azure Functions (Correct answer)
- Key Vault access policies with RBAC
Correct answer: Key Vault Event Grid integration with Azure Functions
Azure Key Vault emits events via Event Grid when secrets are near expiry, which can trigger an Azure Function to rotate and update the secret.
Question 4: A company wants to control egress traffic from Azure VMs to the internet, with full Layer 7 filtering and threat intelligence. Which Azure service provides this?
- Network Security Groups
- Azure Application Gateway WAF
- Azure Firewall Premium (Correct answer)
- Azure DDoS Protection Standard
Correct answer: Azure Firewall Premium
Azure Firewall Premium provides Layer 7 filtering with IDPS, TLS inspection, and threat intelligence for egress traffic control.
Question 5: Which Azure service allows an architect to run containerized workloads without managing Kubernetes control plane or nodes?
- Azure Kubernetes Service (AKS)
- Azure Container Instances (ACI) (Correct answer)
- Azure App Service for Containers
- Azure Service Fabric
Correct answer: Azure Container Instances (ACI)
Azure Container Instances runs containers on-demand without any cluster or node management, ideal for simple or burst workloads.
Question 6: An architect is designing a data pipeline where large amounts of IoT telemetry must be ingested and processed in real time. Which combination of Azure services is most appropriate?
- Azure Blob Storage + Azure Data Factory
- Azure Event Hubs + Azure Stream Analytics (Correct answer)
- Azure Service Bus + Azure Logic Apps
- Azure Queue Storage + Azure Batch
Correct answer: Azure Event Hubs + Azure Stream Analytics
Azure Event Hubs handles high-throughput telemetry ingestion while Azure Stream Analytics processes the stream in real time with SQL-like queries.
Question 7: A solution must allow users from partner organizations (external Azure AD tenants) to access internal Azure applications without creating accounts in the company's directory. Which Azure AD feature supports this?
- Azure AD Domain Services
- Azure AD B2C
- Azure AD B2B Collaboration (Correct answer)
- Azure AD Application Proxy
Correct answer: Azure AD B2B Collaboration
Azure AD B2B Collaboration lets external users sign in with their own organizational credentials and be granted access to your apps.
AZ-304 Microsoft Azure Solutions Architect Expert 4
A company needs a recovery point objective (RPO) of near-zero and a recovery time objective (RTO) of under 15 minutes for its Azure SQL Database.
Which configuration meets these requirements?