Microsoft Azure Architect Design (AZ-304) — Questions and Answers

Question 1: Which Azure governance feature bundles Azure Policy assignments, RBAC assignments, and ARM templates into a repeatable, version-controlled package for deploying compliant environments?

Azure Policy Initiative
Management Groups
Azure Resource Manager templates only
Azure Blueprints (Correct answer)

Correct answer: Azure Blueprints

Azure Blueprints compose policy assignments, role assignments, resource groups, and ARM templates into a tracked package that can be deployed and updated across multiple subscriptions.

Question 2: You have a tenant called contoso.com in Azure Active Directory (Azure AD). Group1 is one of the tenants' groups. All of the administrative user accounts are in Group1. You find many attempts to enter into the Azure portal coming from nations where administrative users are NOT employed. You must make sure that Azure Multi-Factor Authentication (MFA) is required for all attempts to enter into the Azure portal from certain nations. Solution: Construct a Group1 Access Review. Is the goal achieved by this solution?

Maybe
Yes
No (Correct answer)

Correct answer: No

An Azure AD Access Review is used to manage group membership and ensure only authorized users have access to resources, not to enforce Multi-Factor Authentication (MFA) based on location. To require MFA for sign-ins from specific nations, you would need to implement Azure AD Conditional Access policies. Conditional Access allows you to define conditions (like user location) and grant controls (like requiring MFA) for access to cloud apps.

Question 3: An organization needs to route traffic globally to the nearest healthy endpoint with failover capability using DNS-based routing. Which Azure service should be used?

Azure Load Balancer
Azure Application Gateway
Azure Traffic Manager (Correct answer)
Azure Front Door

Correct answer: Azure Traffic Manager

Azure Traffic Manager uses DNS-based routing policies (performance, geographic, priority, weighted) to direct clients to the nearest or healthiest endpoint globally.

Question 4: Which Azure feature protects Azure Blob Storage data from accidental deletion by retaining deleted data for a configurable retention period?

Immutable Storage
Blob Versioning
Soft Delete for Blobs (Correct answer)
Lifecycle Management

Correct answer: Soft Delete for Blobs

Soft Delete for Blobs retains deleted blobs and snapshots for a configurable period (1–365 days), allowing recovery from accidental or malicious deletions.

Question 5: Which Azure SQL Database feature provides automatic failover with a configurable grace period and maintains read/write DNS endpoints that automatically redirect after failover?

Active Geo-Replication
Auto-Failover Groups (Correct answer)
Long-Term Retention
Elastic Jobs

Correct answer: Auto-Failover Groups

Auto-Failover Groups provide a single connection endpoint that automatically redirects to the secondary after failover, enabling application connectivity without DNS changes.

Question 6: Which Azure Backup feature allows you to retain database backups for up to 10 years to meet long-term compliance requirements?

Soft Delete
Long-Term Retention (LTR) (Correct answer)
Point-in-Time Restore
Geo-Redundant Backup

Correct answer: Long-Term Retention (LTR)

Long-Term Retention (LTR) for Azure SQL Database stores full backups in geo-redundant storage for up to 10 years, supporting compliance and auditing requirements.

Question 7: You must design storage for an application that reads and writes petabytes of unstructured data with frequent access and requires millisecond response times. Which tier should you use?

Azure File Storage with NFS protocol
Azure Blob Storage Cool tier
Azure Blob Storage Archive tier
Azure Blob Storage Hot tier (Correct answer)

Correct answer: Azure Blob Storage Hot tier

Blob Storage Hot tier is optimized for data that is accessed frequently, offering the lowest access latency and highest transaction performance.

Question 8: You need to store relational data that requires multi-region writes with low latency. Which Azure service should you choose?

Azure SQL Database with geo-replication
Azure Cosmos DB with multi-region writes (Correct answer)
Azure Database for MySQL Flexible Server
Azure Synapse Analytics

Correct answer: Azure Cosmos DB with multi-region writes

Azure Cosmos DB natively supports multi-region writes, enabling active-active architectures with configurable consistency levels and guaranteed low latency globally.

Question 9: A company wants to migrate 500 TB of on-premises data to Azure Blob Storage. The internet connection is 1 Gbps and the migration must complete within 2 weeks. Which service should the architect recommend?

AzCopy over ExpressRoute
Azure Data Box (Correct answer)
Azure Import/Export service
Azure Data Factory with self-hosted IR

Correct answer: Azure Data Box

At 1 Gbps, transferring 500 TB over the internet would take approximately 46 days; Azure Data Box allows physical shipment of up to 80 TB per device, completing the migration within the 2-week window.

Question 10: An architect needs to provide secure, browser-based RDP and SSH access to Azure VMs without exposing public IP addresses. Which service should be used?

Azure Firewall DNAT rules
Just-in-time VM access
Azure Bastion (Correct answer)
Azure VPN Gateway point-to-site

Correct answer: Azure Bastion

Azure Bastion provides browser-based RDP/SSH directly in the Azure portal without requiring VMs to have public IPs.

Question 11: Which Azure Backup feature prevents backup data from being deleted even if the vault is accidentally deleted by an unauthorized user?

Geo-Redundant Storage backup
Resource Lock on vault
Multi-User Authorization (MUA) (Correct answer)
Soft Delete for Azure Backup

Correct answer: Multi-User Authorization (MUA)

Multi-User Authorization (MUA) for Azure Backup requires a second approver from a designated Resource Guard to perform destructive backup operations, protecting against insider threats.

Question 12: You need to grant an application access to Azure Key Vault secrets without storing credentials in code. What should you use?

Shared Access Signature
Service Principal with client secret
Azure AD Application Proxy
Managed Identity (Correct answer)

Correct answer: Managed Identity

Managed Identities provide Azure services with an automatically managed identity in Azure AD, eliminating the need to store credentials in application code.

Question 13: An architect wants to inspect all outbound internet traffic from Azure VMs through a centralized appliance. Which routing technique must be configured?

Azure Traffic Manager policy
BGP route advertisement
VNet Peering with gateway transit
User-Defined Routes (UDR) with a next hop to the appliance (Correct answer)

Correct answer: User-Defined Routes (UDR) with a next hop to the appliance

User-Defined Routes (UDRs) override Azure system routes, allowing you to redirect traffic (e.g., 0.0.0.0/0) through a specific next hop such as a Network Virtual Appliance (NVA) or Azure Firewall.

Question 14: What is the recommended approach to assign Azure built-in roles to groups rather than individual users at scale?

Attribute-based access control only
Dynamic group membership with RBAC assignment (Correct answer)
Azure Policy assignment
Direct user assignment

Correct answer: Dynamic group membership with RBAC assignment

Using dynamic groups based on user attributes combined with RBAC role assignments to those groups enables scalable, automated access management without manual per-user assignments.

Question 15: An architect needs a fully managed, serverless SQL data warehouse service for analytical workloads. Which Azure service is most appropriate?

Azure Database for PostgreSQL Hyperscale
Azure SQL Database
Azure Synapse Analytics (serverless SQL pool) (Correct answer)
Azure SQL Managed Instance

Correct answer: Azure Synapse Analytics (serverless SQL pool)

Azure Synapse Analytics serverless SQL pool allows querying data in Azure Data Lake using T-SQL without provisioning infrastructure, paying only per TB processed.

Question 16: Your organization needs to allow customers to sign in using their social identities (Google, Facebook) to access a consumer app. Which Azure AD service should you use?

Azure AD B2B
Conditional Access
Azure AD Domain Services
Azure AD B2C (Correct answer)

Correct answer: Azure AD B2C

Azure AD B2C is a customer identity and access management (CIAM) service that supports social identity providers like Google and Facebook for consumer-facing applications.

Question 17: A hybrid organization wants to sync on-premises Active Directory users to Azure AD. Which tool should you deploy?

Azure AD Connect (Correct answer)
Azure AD B2B
ADFS only
Azure AD Connect Cloud Sync

Correct answer: Azure AD Connect

Azure AD Connect is the primary tool for synchronizing on-premises AD identities, groups, and attributes to Azure AD in a hybrid identity scenario.

Question 18: What is the purpose of Privileged Identity Management (PIM) in Azure AD?

To audit all sign-in events
To provide just-in-time privileged access to Azure resources (Correct answer)
To enforce password complexity policies
To synchronize on-premises AD with Azure AD

Correct answer: To provide just-in-time privileged access to Azure resources

PIM enables just-in-time activation of privileged roles, reducing standing access and requiring justification and approval for elevated permissions.

Question 19: Which authentication method in Azure AD provides passwordless sign-in using a private key stored on a hardware device?

SMS verification
FIDO2 security keys (Correct answer)
App passwords
OATH software tokens

Correct answer: FIDO2 security keys

FIDO2 security keys enable passwordless authentication by using cryptographic credentials stored on a physical hardware device, eliminating password-based attacks.

Question 20: Which Azure AD feature enables employees to request access packages containing multiple resource access rights (groups, apps, SharePoint) through a self-service portal?

Privileged Identity Management
Entitlement Management (Correct answer)
Access Reviews
Conditional Access

Correct answer: Entitlement Management

Entitlement Management lets you bundle access to multiple resources into access packages that users can request through a governed, approval-based self-service portal.

Question 21: Which Azure service provides centralized, scalable management of routing and security for a large number of branch offices connecting to Azure?

Azure Route Server
Azure VPN Gateway with multiple connections
Azure Virtual WAN (Correct answer)
Hub-and-spoke with Azure Firewall

Correct answer: Azure Virtual WAN

Azure Virtual WAN is a networking service that provides optimized, automated branch-to-branch and branch-to-Azure connectivity with integrated routing, security, and SD-WAN integration.

Question 22: Which Microsoft Defender for Cloud feature provides a security posture score and prioritized recommendations based on the Azure Security Benchmark?

Adaptive Application Controls
Cloud Security Posture Management (CSPM) (Correct answer)
Workload Protection Plans
Just-in-Time VM Access

Correct answer: Cloud Security Posture Management (CSPM)

CSPM in Microsoft Defender for Cloud continuously assesses your Azure resources against the Azure Security Benchmark and provides a Secure Score reflecting your overall security posture.

Question 23: A DDoS protection plan is required for all production virtual networks in an enterprise. Which DDoS Protection tier provides adaptive tuning and attack analytics?

DDoS Network Protection (Correct answer)
DDoS Basic (default platform protection)
DDoS IP Protection
Azure Firewall Premium

Correct answer: DDoS Network Protection

DDoS Network Protection provides adaptive real-time tuning, attack telemetry, diagnostics, and rapid response support — going beyond the baseline platform protection available to all Azure resources.

Question 24: A web application tier must scale horizontally without maintaining server-side session state. Which approach best enables this design?

Use sticky sessions on Azure Load Balancer
Increase VM size to handle more concurrent sessions
Store sessions in local disk on each VM
Offload session state to Azure Cache for Redis (Correct answer)

Correct answer: Offload session state to Azure Cache for Redis

Offloading session state to Azure Cache for Redis makes the web tier stateless, allowing any instance to handle any request and enabling true horizontal scaling.

Question 25: Which Azure Storage feature allows you to define rules that automatically transition blobs to cooler tiers or delete them based on last-modified or last-accessed time?

Object Replication
Blob Versioning
Storage Access Policies
Lifecycle Management Policies (Correct answer)

Correct answer: Lifecycle Management Policies

Lifecycle Management Policies in Azure Blob Storage automate tiering and deletion of blobs based on age or last access time, reducing storage costs without manual intervention.

Question 26: What Azure Storage feature prevents accidental or malicious deletion of blobs by requiring a delete lock to be held for a defined retention period?

Blob Versioning
Object Replication
Soft Delete
Immutable Storage with WORM policy (Correct answer)

Correct answer: Immutable Storage with WORM policy

Immutable Blob Storage with WORM (Write Once, Read Many) policies prevents deletion or modification of data for a configured interval, satisfying regulatory retention requirements.

Question 27: Which Azure AD Access Review feature helps organizations ensure that users still need their current group memberships or application access over time?

Identity Protection
Entitlement Management
Access Reviews (Correct answer)
PIM role activation

Correct answer: Access Reviews

Access Reviews periodically prompt reviewers or users themselves to confirm whether access is still needed, helping remediate stale permissions and maintain compliance.

Question 28: Which Azure cost management feature allows you to set spending limits and receive alerts when costs approach or exceed a threshold?

Azure Cost Analysis
Azure Spend Advisor
Azure Reservations
Azure Budgets (Correct answer)

Correct answer: Azure Budgets

Azure Budgets allow you to set spending thresholds and configure email alerts when actual or forecasted costs reach defined percentages, helping prevent unexpected overspending.

Question 29: Which Azure Blob Storage access tier is most cost-effective for data that is accessed less than once per month and requires a 30-day minimum storage duration?

Cold (Correct answer)
Archive
Hot
Cool

Correct answer: Cold

The Cold tier offers lower storage costs than Cool with a 90-day minimum retention, but Cool (30-day minimum) is more cost-effective for data accessed less than once a month versus Hot.

Question 30: What is the purpose of Azure Management Groups in a large enterprise?

To group VMs into availability sets
To manage virtual network peering
To apply policies and access controls hierarchically across multiple subscriptions (Correct answer)
To organize storage accounts by region

Correct answer: To apply policies and access controls hierarchically across multiple subscriptions

Management Groups provide a hierarchy above subscriptions where Azure Policy and RBAC assignments can be applied once and inherited by all subscriptions and resources in the hierarchy.

Microsoft Azure Architect Design (AZ-304)

The AZ-304 exam measures your ability to design monitoring, identity and security, data storage, business continuity, and infrastructure solutions on Microsoft Azure. It is one of two exams required for the Azure Solutions Architect Expert certification (retired March 2022, succeeded by AZ-305).

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds