Microsoft Azure Architect Design (AZ-304) — Questions and Answers

Question 1: Which Azure VPN Gateway SKU supports active-active configuration for higher availability and redundancy?

VpnGw1
VpnGw2
All SKUs above Basic (Correct answer)
Basic

Correct answer: All SKUs above Basic

Active-active VPN Gateway configuration is supported on all non-Basic SKUs (VpnGw1 and above), allowing both gateway instances to carry traffic simultaneously for higher throughput and resilience.

Question 2: Which Azure networking feature allows you to connect two VNets in different Azure regions so they communicate over the Microsoft backbone network?

VPN Gateway VNet-to-VNet
Global VNet Peering (Correct answer)
ExpressRoute Global Reach
VNet Peering (local)

Correct answer: Global VNet Peering

Global VNet Peering connects VNets in different Azure regions over the Microsoft global backbone, providing low-latency connectivity without the overhead of a VPN gateway.

Question 3: When designing for high availability in Azure, what is the minimum number of Availability Zones recommended to achieve the 99.99% VM SLA?

3 zones
Availability Zones are not required for the SLA
2 zones (Correct answer)
1 zone (single zone deployment)

Correct answer: 2 zones

Deploying VMs across at least 2 Availability Zones qualifies for Azure's 99.99% VM uptime SLA, as Microsoft guarantees connectivity to at least one zone during a single zone failure.

Question 4: Which Azure cost management feature allows you to set spending limits and receive alerts when costs approach or exceed a threshold?

Azure Reservations
Azure Spend Advisor
Azure Budgets (Correct answer)
Azure Cost Analysis

Correct answer: Azure Budgets

Azure Budgets allow you to set spending thresholds and configure email alerts when actual or forecasted costs reach defined percentages, helping prevent unexpected overspending.

Question 5: You have a subscription to Azure, which includes the DB1 Azure SQL database. The execution of several queries that examine the data in DB1 takes a lengthy time. The queries that take the longest to run must be identified, and a remedy must be suggested. What should the recommendation contain?

Performance Recommendations
Query Performance Insight (Correct answer)
Azure Monitor
SQL Database Advisor

Correct answer: Query Performance Insight

Query Performance Insight for Azure SQL Database is specifically designed to identify the top consuming queries, detect performance bottlenecks, and provide actionable recommendations. It offers detailed insights into query execution statistics, helping to pinpoint which queries are taking the longest to run and why. This makes it the most direct and effective tool for identifying and remedying slow queries.

Question 6: Which subnet delegation concept in Azure allows a specific Azure service to inject network interfaces directly into a VNet subnet?

Service Endpoints
Private Link Service
Subnet Delegation (Correct answer)
VNet Integration

Correct answer: Subnet Delegation

Subnet Delegation grants a specific Azure service (e.g., Azure SQL Managed Instance, App Service) the permission to create service-managed resources within a designated subnet.

Question 7: Which Azure service provides a managed runbook-style orchestration engine that automates complex DR workflows including sequencing, dependencies, and custom scripts?

Azure Logic Apps
Azure Automation Runbooks
Azure DevOps Pipelines
Azure Site Recovery Recovery Plans (Correct answer)

Correct answer: Azure Site Recovery Recovery Plans

ASR Recovery Plans allow you to define failover sequences, add manual actions, and inject Azure Automation runbooks into the failover workflow for automated DR orchestration.

Question 8: Which Azure Storage redundancy option replicates data synchronously across three availability zones within a single region?

Locally Redundant Storage (LRS)
Read-Access Geo-Redundant Storage (RA-GRS)
Zone-Redundant Storage (ZRS) (Correct answer)
Geo-Redundant Storage (GRS)

Correct answer: Zone-Redundant Storage (ZRS)

ZRS synchronously replicates data across three Azure availability zones in the same region, providing high availability even if an entire zone fails.

Question 9: Which Azure Cosmos DB partition key selection principle is most important for achieving optimal throughput distribution?

Use the creation timestamp as the partition key
Use a partition key that matches the primary sort order
Use a partition key with few unique values
Use a partition key with high cardinality that evenly distributes data (Correct answer)

Correct answer: Use a partition key with high cardinality that evenly distributes data

A high-cardinality partition key that distributes requests and data evenly across logical partitions prevents hot partitions and maximizes provisioned throughput utilization.

Question 10: You have a storage account in your Azure subscription. Duplicate files can occasionally be written to the storage account by an application. You have a PowerShell script that locates duplicate files in the storage account and removes them. The script is currently executed manually upon operations manager approval. You must suggest a serverless solution that carries out the following tasks: ‥ Checks for duplicate files every hour by executing the script once. ‥ Notifies the operations manager through email and asks for permission to delete the duplicate files. ‥ Handles the Operations Manager's email answer, processing it to determine whether the deletion was authorized. ‥ If the deletion was authorized, runs the script. What should the recommendation contain?

Azure Functions and Azure Batch
Azure Logic Apps and Azure Functions (Correct answer)
Azure Logic Apps and Azure Event Grid
Azure Pipelines and Azure Service Fabric

Correct answer: Azure Logic Apps and Azure Functions

This scenario requires workflow orchestration, scheduled execution, conditional logic for approval, and script execution. Azure Logic Apps are ideal for orchestrating complex workflows, handling scheduling, integrating with email for approvals, and managing conditional branching based on responses. Azure Functions are perfect for executing the PowerShell script in a serverless manner, as they can be triggered by Logic Apps and provide a cost-effective way to run code on demand.

Question 11: You need to design a solution that allows Azure Virtual Machines in different virtual networks to communicate privately without traversing the internet. Which feature should you use?

Azure ExpressRoute
VNet peering (Correct answer)
Azure Bastion
VPN Gateway with site-to-site connection

Correct answer: VNet peering

VNet peering allows VMs in different virtual networks to communicate using private IP addresses without internet traversal.

Question 12: Which Azure Service Health feature provides personalized alerts about service outages that specifically impact your Azure resources and subscriptions?

Service Health Alerts (Correct answer)
Azure Status Page
Resource Health
Azure Monitor Service Map

Correct answer: Service Health Alerts

Service Health Alerts send notifications about Azure service incidents, planned maintenance, and health advisories that affect the specific subscriptions and regions your resources use.

Question 13: Which Azure Cosmos DB consistency level provides the strongest consistency guarantee at the cost of higher read latency?

Consistent Prefix
Session
Eventual
Strong (Correct answer)

Correct answer: Strong

Strong consistency ensures that reads always return the most recent committed write, but it requires synchronous replication across all regions, increasing read latency.

Question 14: An organization needs to implement just-in-time VM access to reduce the attack surface of administrator ports. Which Azure service provides this capability?

Network Security Group time-based rules
Azure Firewall with DNAT rules
Azure Bastion with scheduled sessions
Microsoft Defender for Cloud JIT VM access (Correct answer)

Correct answer: Microsoft Defender for Cloud JIT VM access

Microsoft Defender for Cloud's JIT VM access locks down inbound traffic to management ports and opens them only when explicitly requested.

Question 15: A solution requires that in a regional outage, the application automatically fails over to a secondary region with no manual intervention. Which design pattern achieves this?

Active-active with Azure Front Door and auto-failover groups (Correct answer)
Active-passive with Azure Traffic Manager health probes
Cross-region backup restore only
Passive cold standby with manual runbook

Correct answer: Active-active with Azure Front Door and auto-failover groups

Active-active with Azure Front Door and SQL auto-failover groups enables automatic traffic redirection and database failover without human intervention when a region becomes unavailable.

Question 16: Which Azure Storage feature allows you to define rules that automatically transition blobs to cooler tiers or delete them based on last-modified or last-accessed time?

Lifecycle Management Policies (Correct answer)
Storage Access Policies
Blob Versioning
Object Replication

Correct answer: Lifecycle Management Policies

Lifecycle Management Policies in Azure Blob Storage automate tiering and deletion of blobs based on age or last access time, reducing storage costs without manual intervention.

Question 17: A security architect wants to detect when Azure AD accounts are used from anonymous IP addresses or unfamiliar locations. Which feature provides this capability?

Azure Sentinel only
Azure AD Identity Protection risk detections (Correct answer)
Conditional Access named locations only
Azure Monitor Alerts

Correct answer: Azure AD Identity Protection risk detections

Azure AD Identity Protection automatically generates risk detections for suspicious sign-in patterns including anonymous proxies, atypical travel, and unfamiliar sign-in properties.

Question 18: What type of Azure Site Recovery recovery point captures the application state (in-memory data and pending transactions) in addition to disk state?

File-system consistent recovery point
Crash-consistent recovery point
Incremental recovery point
App-consistent recovery point (Correct answer)

Correct answer: App-consistent recovery point

App-consistent recovery points use VSS (Volume Shadow Copy Service) to flush in-memory data and pending I/O, ensuring database and application consistency at the recovery point.

Question 19: Which Azure AD Access Review feature helps organizations ensure that users still need their current group memberships or application access over time?

Entitlement Management
Access Reviews (Correct answer)
Identity Protection
PIM role activation

Correct answer: Access Reviews

Access Reviews periodically prompt reviewers or users themselves to confirm whether access is still needed, helping remediate stale permissions and maintain compliance.

Question 20: Which Azure networking service provides private connectivity from an on-premises network to Azure services over a dedicated private connection, bypassing the public internet?

Azure Virtual WAN
Azure ExpressRoute (Correct answer)
Azure Bastion
Azure VPN Gateway

Correct answer: Azure ExpressRoute

ExpressRoute creates dedicated private connections between on-premises infrastructure and Azure data centers through a connectivity provider, offering predictable latency and higher security than VPN.

Question 21: Which Azure Private DNS Zone feature allows VMs in a VNet to automatically register their DNS records without manual configuration?

Auto-registration (Correct answer)
DNS forwarder
DNS delegation
Conditional forwarding

Correct answer: Auto-registration

Auto-registration in Azure Private DNS Zones automatically creates and removes DNS A records when VMs in a linked VNet are created or deleted.

Question 22: You need to migrate a large on-premises SQL Server database (10 TB) to Azure SQL Managed Instance with minimal downtime. Which migration method should you use?

Transactional replication from on-premises to Managed Instance
Azure Data Factory with SQL connector bulk copy
Azure Database Migration Service online migration with log replay (Correct answer)
Backup to Azure Blob Storage and restore on Managed Instance

Correct answer: Azure Database Migration Service online migration with log replay

Azure Database Migration Service online migration uses log replay to continuously apply changes, enabling cutover with near-zero downtime.

Question 23: Which Azure AD feature enables employees to request access packages containing multiple resource access rights (groups, apps, SharePoint) through a self-service portal?

Access Reviews
Conditional Access
Privileged Identity Management
Entitlement Management (Correct answer)

Correct answer: Entitlement Management

Entitlement Management lets you bundle access to multiple resources into access packages that users can request through a governed, approval-based self-service portal.

Question 24: An architect needs a fully managed, serverless SQL data warehouse service for analytical workloads. Which Azure service is most appropriate?

Azure Database for PostgreSQL Hyperscale
Azure SQL Database
Azure Synapse Analytics (serverless SQL pool) (Correct answer)
Azure SQL Managed Instance

Correct answer: Azure Synapse Analytics (serverless SQL pool)

Azure Synapse Analytics serverless SQL pool allows querying data in Azure Data Lake using T-SQL without provisioning infrastructure, paying only per TB processed.

Question 25: Which role-based access control scope is the HIGHEST level in the Azure RBAC hierarchy?

Resource Group
Resource
Management Group (Correct answer)
Subscription

Correct answer: Management Group

Management Groups sit at the top of the Azure RBAC hierarchy, allowing policy and access assignments that cascade down to subscriptions, resource groups, and resources.

Question 26: An organization needs to back up on-premises servers and Azure VMs to a centralized vault. Which Azure service manages this?

Azure Backup with Recovery Services Vault (Correct answer)
Azure Storage Archive tier
Azure Blob Storage with LRS
Azure Site Recovery only

Correct answer: Azure Backup with Recovery Services Vault

Azure Backup with Recovery Services Vault provides centralized backup management for Azure VMs, on-premises servers, SQL Server, SAP HANA, and Azure Files.

Question 27: Which Azure SQL Database feature automatically tunes query performance by identifying and applying index recommendations?

Query Store
Active Geo-Replication
Elastic Pools
Automatic Tuning (Correct answer)

Correct answer: Automatic Tuning

Automatic Tuning in Azure SQL Database uses AI to monitor query performance, create or drop indexes, and force good query plans without manual intervention.

Question 28: Which Azure feature enables you to access Azure PaaS services (like Azure Storage and SQL) from a VNet using a private IP address, keeping traffic off the public internet?

VNet Service Endpoints
Azure NAT Gateway
Azure Private Link / Private Endpoints (Correct answer)
VNet Peering

Correct answer: Azure Private Link / Private Endpoints

Azure Private Endpoints assign a private IP from your VNet to a PaaS service, ensuring all traffic to that service traverses the Azure backbone network rather than the public internet.

Question 29: An architect needs to ensure that all Azure resources across an enterprise have required tags (e.g., CostCenter, Owner). Which policy effect automatically adds missing tags?

Append
Deny
Audit
Modify (Correct answer)

Correct answer: Modify

The Modify effect in Azure Policy can add, update, or remove resource tags on existing and newly created resources, enabling automated tag governance across the environment.

Question 30: What is the purpose of diagnostic settings in Azure Monitor?

To enable Azure Advisor recommendations
To route resource logs and metrics to a Log Analytics Workspace, Event Hub, or Storage Account (Correct answer)
To enable Azure Policy compliance evaluation
To configure alerting thresholds on VMs

Correct answer: To route resource logs and metrics to a Log Analytics Workspace, Event Hub, or Storage Account

Diagnostic settings configure where Azure resource platform logs and metrics are sent — to a Log Analytics Workspace for querying, an Event Hub for streaming, or a Storage Account for archival.

Question 31: A company needs to ensure that Azure VMs in a production subscription cannot be created without a specific tag. Which Azure feature enforces this?

Azure Blueprints lock
Azure RBAC deny assignment
Management group access control
Azure Policy with deny effect (Correct answer)

Correct answer: Azure Policy with deny effect

Azure Policy with a 'deny' effect blocks resource creation that doesn't meet defined tag requirements.

Question 32: What is the recommended approach to assign Azure built-in roles to groups rather than individual users at scale?

Dynamic group membership with RBAC assignment (Correct answer)
Azure Policy assignment
Attribute-based access control only
Direct user assignment

Correct answer: Dynamic group membership with RBAC assignment

Using dynamic groups based on user attributes combined with RBAC role assignments to those groups enables scalable, automated access management without manual per-user assignments.

Question 33: Which Azure Monitor feature captures a complete picture of an application's performance including request rates, failures, and dependencies across distributed microservices?

Application Insights (Correct answer)
Azure Metrics Explorer
Log Analytics Workspace queries
Azure Monitor Workbooks

Correct answer: Application Insights

Application Insights provides distributed tracing, live metrics, dependency tracking, and performance analytics for application code running on Azure or on-premises.

Question 34: You need to store relational data that requires multi-region writes with low latency. Which Azure service should you choose?

Azure SQL Database with geo-replication
Azure Cosmos DB with multi-region writes (Correct answer)
Azure Database for MySQL Flexible Server
Azure Synapse Analytics

Correct answer: Azure Cosmos DB with multi-region writes

Azure Cosmos DB natively supports multi-region writes, enabling active-active architectures with configurable consistency levels and guaranteed low latency globally.

Question 35: A company wants to migrate 200 on-premises VMs to Azure with minimal downtime. Which Azure service replicates VMs continuously and enables a cutover with minimal data loss?

Azure Migrate Assessment
Azure Backup
Azure Site Recovery (Correct answer)
Azure Database Migration Service

Correct answer: Azure Site Recovery

Azure Site Recovery provides continuous replication and orchestrated failover, minimizing downtime during migration.

Question 36: Which Azure service allows you to extend your on-premises Active Directory domain to Azure virtual machines without deploying domain controllers?

Azure AD B2B
Azure AD Domain Services (Correct answer)
Managed Identity
Azure AD Connect

Correct answer: Azure AD Domain Services

Azure AD Domain Services provides managed domain services (LDAP, Kerberos, NTLM) without requiring you to deploy, manage, or patch domain controllers.

Question 37: Which Azure data service is best suited for ingesting millions of events per second from IoT devices for real-time stream processing?

Azure Queue Storage
Azure Service Bus
Azure Event Hubs (Correct answer)
Azure Notification Hubs

Correct answer: Azure Event Hubs

Azure Event Hubs is a highly scalable event streaming platform capable of ingesting millions of events per second, designed for big data telemetry and IoT scenarios.

Question 38: A solution architect needs to design archival storage for compliance data that will not be accessed for at least one year but must be retrievable within hours. Which storage tier should be used?

Archive with Standard Priority rehydration (Correct answer)
Cool
Cold
Archive with High Priority rehydration

Correct answer: Archive with Standard Priority rehydration

Archive tier with Standard priority rehydration is appropriate for data that is rarely accessed; Standard rehydration can take 1–15 hours, suitable when same-day retrieval is acceptable.

Question 39: Which authentication method in Azure AD provides passwordless sign-in using a private key stored on a hardware device?

SMS verification
App passwords
OATH software tokens
FIDO2 security keys (Correct answer)

Correct answer: FIDO2 security keys

FIDO2 security keys enable passwordless authentication by using cryptographic credentials stored on a physical hardware device, eliminating password-based attacks.

Question 40: A company's Azure environment has 50 subscriptions. The security team needs a unified view of security posture and compliance across all subscriptions. Which service provides this?

Azure Security Benchmark reports
Azure Monitor Workbooks
Azure Policy dashboard per subscription
Microsoft Defender for Cloud with management group scope (Correct answer)

Correct answer: Microsoft Defender for Cloud with management group scope

Microsoft Defender for Cloud (formerly Azure Security Center) can be configured at the management group level to provide a unified security posture score and compliance view across all child subscriptions.

Question 41: Which Azure AD feature enables you to define and enforce organizational policies for application access based on conditions like device compliance?

Identity Governance
Application Proxy
Conditional Access (Correct answer)
Access Reviews

Correct answer: Conditional Access

Conditional Access policies evaluate signals like user location, device compliance, and application sensitivity to grant, block, or require additional verification for access.

Question 42: You need to grant an application access to Azure Key Vault secrets without storing credentials in code. What should you use?

Service Principal with client secret
Managed Identity (Correct answer)
Azure AD Application Proxy
Shared Access Signature

Correct answer: Managed Identity

Managed Identities provide Azure services with an automatically managed identity in Azure AD, eliminating the need to store credentials in application code.

Question 43: A company needs to provide external partners with access to Azure resources without managing their identities in Azure AD. Which solution should you recommend?

Azure AD Connect
Azure AD DS
Azure AD B2C
Azure AD B2B (Correct answer)

Correct answer: Azure AD B2B

Azure AD B2B allows external users to sign in with their own organizational identities, eliminating the need to manage their credentials in your tenant.

Question 44: A design requires that only users from a specific Azure AD group can access an Azure API Management API during business hours. Which APIM policy combination achieves this?

ip-filter + authenticate-basic policies
validate-jwt + rate-limit-by-key policies
validate-jwt + check-header policies (Correct answer)
validate-jwt + restrict-caller-ips combined with a custom policy

Correct answer: validate-jwt + check-header policies

The validate-jwt policy validates the AAD token and checks group membership claims, while check-header can enforce time-of-day restrictions via custom headers injected upstream.

Question 45: What is the maximum number of objects that can be synchronized from on-premises AD to Azure AD Connect with a single Azure AD tenant?

No hard limit — scales to millions (Correct answer)
50,000
100,000
300,000

Correct answer: No hard limit — scales to millions

Azure AD Connect has no fixed upper limit for the number of synchronized objects; the Azure AD tenant itself can hold up to 500,000 objects by default, expandable on request.

Question 46: What is the purpose of Azure Management Groups in a large enterprise?

To manage virtual network peering
To organize storage accounts by region
To group VMs into availability sets
To apply policies and access controls hierarchically across multiple subscriptions (Correct answer)

Correct answer: To apply policies and access controls hierarchically across multiple subscriptions

Management Groups provide a hierarchy above subscriptions where Azure Policy and RBAC assignments can be applied once and inherited by all subscriptions and resources in the hierarchy.

Question 47: A company requires a Recovery Point Objective (RPO) of near zero for a mission-critical Azure SQL Database. Which feature should be used?

Long-Term Retention backups
Auto-failover groups with grace period
Point-in-Time Restore
Active Geo-Replication (Correct answer)

Correct answer: Active Geo-Replication

Active Geo-Replication synchronously replicates transactions to up to four secondary replicas in real time, achieving near-zero RPO for Azure SQL Database.

Question 48: You need to enforce that all administrator accounts in your organization use phishing-resistant MFA. Which Azure AD policy type should you configure?

Conditional Access policy with authentication strength (Correct answer)
Azure Policy
Security Defaults
Per-user MFA settings

Correct answer: Conditional Access policy with authentication strength

Conditional Access with Authentication Strength allows you to require specific MFA methods (e.g., FIDO2, Certificate-based) for privileged roles, enforcing phishing-resistant authentication.

Question 49: Which identity model allows users to sign in to Azure resources using the same credentials as their on-premises AD without password hash sync to Azure AD?

Pass-through Authentication
Federation with ADFS (Correct answer)
Azure AD Seamless SSO
Password Hash Synchronization

Correct answer: Federation with ADFS

Federation with ADFS redirects authentication to on-premises ADFS servers so credentials are validated locally and never sent to Azure AD, which is the model that avoids password hash sync.

Question 50: What is the purpose of Privileged Identity Management (PIM) in Azure AD?

To audit all sign-in events
To enforce password complexity policies
To provide just-in-time privileged access to Azure resources (Correct answer)
To synchronize on-premises AD with Azure AD

Correct answer: To provide just-in-time privileged access to Azure resources

PIM enables just-in-time activation of privileged roles, reducing standing access and requiring justification and approval for elevated permissions.

Microsoft Azure Architect Design (AZ-304)

The AZ-304 exam measures your ability to design monitoring, identity and security, data storage, business continuity, and infrastructure solutions on Microsoft Azure. It is one of two exams required for the Azure Solutions Architect Expert certification (retired March 2022, succeeded by AZ-305).

Questions

150 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds