Mixed Deck — All AZ-304 Topics Flashcards

Which Azure tool allows you to visualize and query your entire Azure resource inventory and their relationships using a graph-based query language?

Answer: Azure Resource Graph

Azure Resource Graph enables fast, complex queries across all your Azure subscriptions using the Kusto Query Language (KQL) to explore resource properties and relationships at scale.

A front-end application calls dozens of backend microservices. The architect wants a single entry point that aggregates calls, transforms responses, and enforces authentication. Which pattern should be implemented?

Answer: API Gateway pattern

The API Gateway pattern provides a single entry point for all client requests, handling cross-cutting concerns such as authentication, aggregation, and response transformation.

A company needs to expose internal REST APIs to external partners with rate limiting, authentication policies, and a developer portal. Which Azure service should be used?

Answer: Azure API Management

Azure API Management provides a unified gateway with rate limiting, authentication policies, caching, and a built-in developer portal for exposing APIs to external consumers.

Which Azure networking feature allows you to route traffic between VNets and on-premises networks through a central hub VNet?

Answer: Hub-and-spoke topology with Azure Firewall or NVA

A hub-and-spoke topology centralizes shared services (firewall, VPN gateway) in the hub and connects spoke VNets via peering.

Which Azure Monitor component stores structured log data and allows you to query it using Kusto Query Language (KQL)?

Answer: Log Analytics Workspace

Log Analytics Workspace is the data repository within Azure Monitor that stores logs and enables powerful ad-hoc analysis using the Kusto Query Language.

A company wants to move on-premises virtual machines to Azure with minimal downtime. Which Azure service provides agentless discovery and replication for this migration?

Answer: Azure Migrate with Azure Site Recovery

Azure Migrate with Azure Site Recovery enables agentless replication of on-premises VMs to Azure, minimizing downtime during cutover.

An architect must ensure that Azure Cosmos DB can survive a complete region failure with automatic failover and zero data loss. What must be configured?

Answer: Multi-region writes with automatic failover enabled

Enabling multi-region writes with automatic failover allows Cosmos DB to continue accepting writes from another region automatically if the primary write region fails, with near-zero data loss.

You have a number of tables in your DB1 Azure SQL database. You must enhance DB1's performance. The answer must require the least amount of administration. Which should you employ?

Answer: automatic tuning

Azure SQL Database's automatic tuning feature continuously monitors query performance and automatically applies recommended index and query plan optimizations. It learns from the workload and adapts over time, requiring minimal administrative effort. This makes it the ideal solution for enhancing performance with the least amount of administration, as it automates the optimization process.

Which Azure service allows you to deploy a managed network virtual appliance to inspect and filter all traffic between VNets and on-premises networks?

Answer: Azure Firewall

Azure Firewall is a managed, cloud-native network security service that provides threat intelligence-based filtering and FQDN-based application rules across VNet traffic.

You are designing a solution that requires running batch processing jobs at scale without managing any underlying infrastructure. Which Azure service should you use?

Answer: Azure Batch

Azure Batch enables large-scale parallel and HPC batch processing jobs, automatically managing compute node pools without infrastructure overhead.

A global application must serve users with the lowest possible latency by routing traffic to the nearest healthy endpoint. Which Azure service should you use?

Answer: Azure Front Door with latency-based routing

Azure Front Door uses anycast routing and latency-based load balancing to direct users to the closest healthy backend with the lowest latency.

A solution must decouple a high-throughput data producer from slower consumers to prevent the producer from being blocked. Which pattern addresses this requirement?

Answer: Queue-based load leveling

Queue-based load leveling uses a queue as a buffer between the producer and consumer, decoupling them and smoothing out traffic spikes.

A company requires all Azure VM disk encryption keys to be managed by the customer and stored in a dedicated HSM. Which solution should you implement?

Answer: Azure Disk Encryption with customer-managed keys in Azure Dedicated HSM

Azure Dedicated HSM with customer-managed keys gives full control over encryption keys in a dedicated hardware security module.

An organization needs to implement just-in-time VM access to reduce the attack surface of administrator ports. Which Azure service provides this capability?

Answer: Microsoft Defender for Cloud JIT VM access

Microsoft Defender for Cloud's JIT VM access locks down inbound traffic to management ports and opens them only when explicitly requested.

Which Azure service should an architect choose to cache frequently read data and reduce load on an Azure SQL Database backend?

Answer: Azure Cache for Redis

Azure Cache for Redis provides an in-memory data store that dramatically reduces database query load for frequently accessed data.

An architect must design an orchestration solution that coordinates a sequence of long-running, stateful operations across multiple services with checkpointing support. Which Azure service is best suited?

Answer: Azure Durable Functions

Azure Durable Functions extend Azure Functions with stateful orchestration, checkpointing, and support for long-running workflows through the Orchestrator function pattern.

A solution must allow users from partner organizations (external Azure AD tenants) to access internal Azure applications without creating accounts in the company's directory. Which Azure AD feature supports this?

Answer: Azure AD B2B Collaboration

Azure AD B2B Collaboration lets external users sign in with their own organizational credentials and be granted access to your apps.

Your organization needs to allow customers to sign in using their social identities (Google, Facebook) to access a consumer app. Which Azure AD service should you use?

Answer: Azure AD B2C

Azure AD B2C is a customer identity and access management (CIAM) service that supports social identity providers like Google and Facebook for consumer-facing applications.

An architect needs to ensure that Azure resources can only be deployed to specific regions due to data sovereignty requirements. What should be implemented?

Answer: Azure Policy with 'allowed locations' rule

Azure Policy with an 'allowed locations' built-in policy definition enforces data sovereignty by restricting resource deployment to approved regions.

You want to set up five Azure virtual machines for the App1 application, which will be deployed. To run App1, more virtual machines will be introduced later. You must suggest a method to satisfy each of the conditions for the virtual machines that will run App1: ‥ Check that the virtual machines can access an Azure key vault, instances of Azure Logic Apps, and an Azure SQL database by authenticating to Azure Active Directory (Azure AD). ‥ When you deploy more virtual machines, avoid giving them new roles and permissions for Azure services. ‥ Prevent keeping certificates and secrets on the virtual machines. ‥ Reduce the administrative work required to manage identities. Which identification type ought to be mentioned in the recommendation?

Answer: a user-assigned managed identity

A user-assigned managed identity is the ideal solution here because it is a standalone Azure resource that can be assigned to multiple Azure VMs. This allows you to grant permissions to the identity once, and any VM assigned that identity will inherit those permissions, eliminating the need to configure new roles or store secrets on each VM. This approach significantly reduces administrative overhead and adheres to security best practices for identity management across multiple instances.