Question 600
Consider this Azure design: A stateful application runs across two Azure VMs in a region without support for availability zones and needs separation from host update domains. To address the recurring incident (Both VMs restart for one planned host-maintenance event.), select THREE complementary actions: the direct design remedy, a direct acceptance test, and one ongoing protective control. Do not count a remedy for another workload as equivalent.
- Inspect VM fault/update domain placement and test the expected maintenance/failure behavior.
- Deploy an availability set with suitable fault and update domains where availability zones aren't used.
- Simulate a host failure and verify service continues without manual recovery orchestration.
- Review placement constraints when VM SKUs or region capabilities change.
- Deploy instances across supported availability zones behind a zone-redundant Standard Load Balancer.
- Audit topology-spread rules and capacity reservations after node pool upgrades.
Explanation
Correct Answers
A:The decisive evidence is: Inspect VM fault/update domain placement and test the expected maintenance/failure behavior. This measures the mechanism of the planned change, not an unrelated Azure service: Deploy an availability set with suitable fault and update domains where availability zones aren't used.
B:This option addresses the actual design defect: The VMs were not distributed across suitable update/fault domains. The correction is: Deploy an availability set with suitable fault and update domains where availability zones aren't used. Confirm the outcome with: Inspect VM fault/update domain placement and test the expected maintenance/failure behavior.
D:The key follow-up control is: Review placement constraints when VM SKUs or region capabilities change. It avoids recurrence of the scenario in which: Both VMs restart for one planned host-maintenance event. It addresses: The VMs were not distributed across suitable update/fault domains.
Incorrect Answers
C:That observation pertains to a separate failure: Routine host outages cause long interruptions while region recovery replication remains healthy. Its cause is: Disaster recovery orchestration does not substitute for continuous local high availability. It does not confirm the result of this design. The direct proof would be: Inspect VM fault/update domain placement and test the expected maintenance/failure behavior.
E:That design instead addresses another observed condition: All stateless app instances are placed in one zone and fail together. Its technical cause is: The compute deployment lacks redundant zonal placement and health-based load balancing. The current workload exhibits: Both VMs restart for one planned host-maintenance event. Its targeted remedy is: Deploy an availability set with suitable fault and update domains where availability zones aren't used.
F:This is a reasonable safeguard for a different fault: Every application replica is scheduled onto nodes in one availability zone. That different mechanism is: Workload scheduling and node-pool placement lack zonal diversity. The original incident here instead arises from: The VMs were not distributed across suitable update/fault domains. The directly relevant safeguard is: Review placement constraints when VM SKUs or region capabilities change.
Question 601
A design workshop has this requirement: A global HTTP application must perform TLS termination and path-based web routing within one Azure region with web application firewall protections. Operators currently observe: A single self-managed reverse-proxy VM fails and all regional web routes stop. Select the ONE design remedy that best addresses the root cause.
- Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools.
- Use App Service zone redundancy with a supporting plan and region where available, then configure sufficient instances.
- Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups.
- Enable the supported zone-redundant configuration for the Azure SQL tier and region.
Explanation
Correct Answer
A:This option addresses the actual design defect: L7 regional routing was deployed without managed gateway zone resilience. The correction is: Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools. Confirm the outcome with: Test URI-path routing and zone outage behavior while WAF inspects requests.
Incorrect Answers
B:This choice mitigates an alternative scenario, where: Both instances are unavailable when their single shared zone has an incident. The underlying issue there is: Scale-out count was confused with physical availability-zone placement. Here the root issue is: L7 regional routing was deployed without managed gateway zone resilience. Choose the corresponding action: Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools.
C:The option belongs to a different failure mechanism: There is no global HTTP edge entry point with origin health-based routing. That situation exhibits: Regional failure leaves global browsers stuck on the dead web endpoint. For the stated case, the remedy is: Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools.
D:That design instead addresses another observed condition: Single-zone database deployment becomes unavailable during a zonal outage. Its technical cause is: Zone redundancy was not enabled for an eligible database deployment. The current workload exhibits: A single self-managed reverse-proxy VM fails and all regional web routes stop. Its targeted remedy is: Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools.
Question 602
The planned architecture is: Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools. Workload context: A global HTTP application must perform TLS termination and path-based web routing within one Azure region with web application firewall protections. Which acceptance test demonstrates that the required behavior works?
- Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS.
- Verify distribution across zones and sustained service under one-zone failure test conditions.
- Test URI-path routing and zone outage behavior while WAF inspects requests.
- Validate zone redundancy setting and failover behavior under the service's supported test methods.
Explanation
Correct Answer
C:The decisive evidence is: Test URI-path routing and zone outage behavior while WAF inspects requests. This measures the mechanism of the planned change, not an unrelated Azure service: Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools.
Incorrect Answers
A:This check validates a different workload: Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS. Its associated design is: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups. The required acceptance test here is: Test URI-path routing and zone outage behavior while WAF inspects requests.
B:That observation pertains to a separate failure: Both instances are unavailable when their single shared zone has an incident. Its cause is: Scale-out count was confused with physical availability-zone placement. It does not confirm the result of this design. The direct proof would be: Test URI-path routing and zone outage behavior while WAF inspects requests.
D:This check validates a different workload: Validate zone redundancy setting and failover behavior under the service's supported test methods. Its associated design is: Enable the supported zone-redundant configuration for the Azure SQL tier and region. The required acceptance test here is: Test URI-path routing and zone outage behavior while WAF inspects requests.
Question 603
The customer states: A global HTTP application must perform TLS termination and path-based web routing within one Azure region with web application firewall protections. An incident reveals: A single self-managed reverse-proxy VM fails and all regional web routes stop. What cause best accounts for this evidence?
- L7 regional routing was deployed without managed gateway zone resilience.
- Scale-out count was confused with physical availability-zone placement.
- There is no global HTTP edge entry point with origin health-based routing.
- Zone redundancy was not enabled for an eligible database deployment.
Explanation
Correct Answer
A:The incident is explained by: L7 regional routing was deployed without managed gateway zone resilience. The reported symptom is: A single self-managed reverse-proxy VM fails and all regional web routes stop. The corresponding design fix is: Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools.
Incorrect Answers
B:The proposed diagnosis fits another scenario: Scale-out count was confused with physical availability-zone placement. It would typically be reflected by: Both instances are unavailable when their single shared zone has an incident. The current evidence instead supports: L7 regional routing was deployed without managed gateway zone resilience.
C:The alternative weakness is: There is no global HTTP edge entry point with origin health-based routing. Its associated failure is: Regional failure leaves global browsers stuck on the dead web endpoint. Neither explains the present observation: A single self-managed reverse-proxy VM fails and all regional web routes stop. The direct cause here is: L7 regional routing was deployed without managed gateway zone resilience.
D:This cause would explain a different symptom: Single-zone database deployment becomes unavailable during a zonal outage. The mechanism for that event is: Zone redundancy was not enabled for an eligible database deployment. Here the stated symptom is: A single self-managed reverse-proxy VM fails and all regional web routes stop. Its cause is: L7 regional routing was deployed without managed gateway zone resilience.
Question 604
Workload context: A global HTTP application must perform TLS termination and path-based web routing within one Azure region with web application firewall protections. The implemented remedy is: Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools. Which ongoing practice most specifically prevents recurrence of this failure: A single self-managed reverse-proxy VM fails and all regional web routes stop.?
- Monitor backend health, WAF logs and certificate expiry for the gateway.
- Monitor plan eligibility and zonal capacity when changing app service plans.
- Review Front Door health probes and origin priority before application releases.
- Review the tier and region's zone support before database scaling or migration.
Explanation
Correct Answer
A:The preventive control is: Monitor backend health, WAF logs and certificate expiry for the gateway. It targets the earlier cause: L7 regional routing was deployed without managed gateway zone resilience. Confirm ongoing effectiveness by: Test URI-path routing and zone outage behavior while WAF inspects requests.
Incorrect Answers
B:This is a reasonable safeguard for a different fault: Both instances are unavailable when their single shared zone has an incident. That different mechanism is: Scale-out count was confused with physical availability-zone placement. The original incident here instead arises from: L7 regional routing was deployed without managed gateway zone resilience. The directly relevant safeguard is: Monitor backend health, WAF logs and certificate expiry for the gateway.
C:The proposed control focuses on: There is no global HTTP edge entry point with origin health-based routing. For the design in the question, recurrence comes from: L7 regional routing was deployed without managed gateway zone resilience. A precise prevention step is: Monitor backend health, WAF logs and certificate expiry for the gateway.
D:That safeguard manages another risk: Zone redundancy was not enabled for an eligible database deployment. Its scenario is: Single-zone database deployment becomes unavailable during a zonal outage. The present recurring risk is: L7 regional routing was deployed without managed gateway zone resilience. The proper ongoing control is: Monitor backend health, WAF logs and certificate expiry for the gateway.
Question 605
A solution architect is reviewing a workload: An application serves worldwide users from several Azure regions and needs rapid global HTTP failover and web acceleration. The observed incident is: Regional failure leaves global browsers stuck on the dead web endpoint. Which architecture choice most directly removes the identified weakness?
- Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations.
- Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools.
- Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups.
- Use Azure SQL failover group endpoints and supported read-only listener routing with region-appropriate replication.
Explanation
Correct Answer
C:This option addresses the actual design defect: There is no global HTTP edge entry point with origin health-based routing. The correction is: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups. Confirm the outcome with: Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS.
Incorrect Answers
A:This choice mitigates an alternative scenario, where: Clients resolve the former primary indefinitely despite a healthy secondary endpoint. The underlying issue there is: DNS-based endpoint health/priority policy was not configured to handle region loss. Here the root issue is: There is no global HTTP edge entry point with origin health-based routing. Choose the corresponding action: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups.
B:The option belongs to a different failure mechanism: L7 regional routing was deployed without managed gateway zone resilience. That situation exhibits: A single self-managed reverse-proxy VM fails and all regional web routes stop. For the stated case, the remedy is: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups.
D:This choice mitigates an alternative scenario, where: Users remain connected to a decommissioned fixed-region SQL server hostname. The underlying issue there is: Client connection configuration bypasses the service's failover-group listener. Here the root issue is: There is no global HTTP edge entry point with origin health-based routing. Choose the corresponding action: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups.
Question 606
An architect proposes this change: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups. The workload context is: An application serves worldwide users from several Azure regions and needs rapid global HTTP failover and web acceleration. Which evidence would most directly validate the change?
- Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS.
- Fail the primary endpoint and observe DNS resolution transition to the secondary according to TTL.
- Test URI-path routing and zone outage behavior while WAF inspects requests.
- Verify connections follow the failover-group listener after planned failover, with read-only workloads on intended replicas.
Explanation
Correct Answer
A:The acceptance test is specific: Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS. Its purpose is to establish that the proposed architecture works: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups.
Incorrect Answers
B:The alternative test targets: Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations. The scenario's actual proposed remedy is: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups. Verify that one by: Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS.
C:This check validates a different workload: Test URI-path routing and zone outage behavior while WAF inspects requests. Its associated design is: Use Azure Application Gateway v2 with supported zone redundancy and WAF policy, plus healthy backend pools. The required acceptance test here is: Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS.
D:That observation pertains to a separate failure: Users remain connected to a decommissioned fixed-region SQL server hostname. Its cause is: Client connection configuration bypasses the service's failover-group listener. It does not confirm the result of this design. The direct proof would be: Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS.
Question 607
During architecture troubleshooting, a team reports: Regional failure leaves global browsers stuck on the dead web endpoint. Context: An application serves worldwide users from several Azure regions and needs rapid global HTTP failover and web acceleration. Which underlying design mistake explains the observed behavior most precisely?
- L7 regional routing was deployed without managed gateway zone resilience.
- DNS-based endpoint health/priority policy was not configured to handle region loss.
- Client connection configuration bypasses the service's failover-group listener.
- There is no global HTTP edge entry point with origin health-based routing.
Explanation
Correct Answer
D:This is the failure mechanism rather than an incidental symptom: There is no global HTTP edge entry point with origin health-based routing. It accounts for: Regional failure leaves global browsers stuck on the dead web endpoint. The architectural repair is: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups.
Incorrect Answers
A:The proposed diagnosis fits another scenario: L7 regional routing was deployed without managed gateway zone resilience. It would typically be reflected by: A single self-managed reverse-proxy VM fails and all regional web routes stop. The current evidence instead supports: There is no global HTTP edge entry point with origin health-based routing.
B:The alternative weakness is: DNS-based endpoint health/priority policy was not configured to handle region loss. Its associated failure is: Clients resolve the former primary indefinitely despite a healthy secondary endpoint. Neither explains the present observation: Regional failure leaves global browsers stuck on the dead web endpoint. The direct cause here is: There is no global HTTP edge entry point with origin health-based routing.
C:This cause would explain a different symptom: Users remain connected to a decommissioned fixed-region SQL server hostname. The mechanism for that event is: Client connection configuration bypasses the service's failover-group listener. Here the stated symptom is: Regional failure leaves global browsers stuck on the dead web endpoint. Its cause is: There is no global HTTP edge entry point with origin health-based routing.
Question 608
The design change is: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups. The original failure was: Regional failure leaves global browsers stuck on the dead web endpoint. Which ongoing control best prevents recurrence of the same root cause?
- Monitor replication lag and exercise listener failover after major releases.
- Test DNS caching and probe behavior for client resolvers during drills.
- Monitor backend health, WAF logs and certificate expiry for the gateway.
- Review Front Door health probes and origin priority before application releases.
Explanation
Correct Answer
D:This is an ongoing protection specific to the fault: Review Front Door health probes and origin priority before application releases. The recurrence risk is: There is no global HTTP edge entry point with origin health-based routing. It should be checked using: Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS.
Incorrect Answers
A:This is a reasonable safeguard for a different fault: Users remain connected to a decommissioned fixed-region SQL server hostname. That different mechanism is: Client connection configuration bypasses the service's failover-group listener. The original incident here instead arises from: There is no global HTTP edge entry point with origin health-based routing. The directly relevant safeguard is: Review Front Door health probes and origin priority before application releases.
B:The proposed control focuses on: DNS-based endpoint health/priority policy was not configured to handle region loss. For the design in the question, recurrence comes from: There is no global HTTP edge entry point with origin health-based routing. A precise prevention step is: Review Front Door health probes and origin priority before application releases.
C:That safeguard manages another risk: L7 regional routing was deployed without managed gateway zone resilience. Its scenario is: A single self-managed reverse-proxy VM fails and all regional web routes stop. The present recurring risk is: There is no global HTTP edge entry point with origin health-based routing. The proper ongoing control is: Review Front Door health probes and origin priority before application releases.
Question 609
A design workshop has this requirement: A service uses non-HTTP TCP endpoints and needs DNS-based priority failover between independent regional endpoints. Operators currently observe: Clients resolve the former primary indefinitely despite a healthy secondary endpoint. Select the ONE design remedy that best addresses the root cause.
- Design multi-region entry routing, compatible identity dependencies and replicated application configuration/secrets for the failover region.
- Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups.
- Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations.
- Use Azure SQL failover group endpoints and supported read-only listener routing with region-appropriate replication.
Explanation
Correct Answer
C:The evidence (Clients resolve the former primary indefinitely despite a healthy secondary endpoint.) identifies the following cause: DNS-based endpoint health/priority policy was not configured to handle region loss. The design that removes it is: Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations. The acceptance check is: Fail the primary endpoint and observe DNS resolution transition to the secondary according to TTL.
Incorrect Answers
A:The option belongs to a different failure mechanism: Regional failover planning omitted shared identity/configuration dependencies and allowed network paths. That situation exhibits: The secondary web app serves static pages but authentication and configuration retrieval fail. For the stated case, the remedy is: Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations.
B:That design instead addresses another observed condition: Regional failure leaves global browsers stuck on the dead web endpoint. Its technical cause is: There is no global HTTP edge entry point with origin health-based routing. The current workload exhibits: Clients resolve the former primary indefinitely despite a healthy secondary endpoint. Its targeted remedy is: Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations.
D:The option belongs to a different failure mechanism: Client connection configuration bypasses the service's failover-group listener. That situation exhibits: Users remain connected to a decommissioned fixed-region SQL server hostname. For the stated case, the remedy is: Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations.
Question 610
The planned architecture is: Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations. Workload context: A service uses non-HTTP TCP endpoints and needs DNS-based priority failover between independent regional endpoints. Which acceptance test demonstrates that the required behavior works?
- Deactivate primary DNS/routing and verify secondary web login and Key Vault configuration still function.
- Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS.
- Fail the primary endpoint and observe DNS resolution transition to the secondary according to TTL.
- Verify connections follow the failover-group listener after planned failover, with read-only workloads on intended replicas.
Explanation
Correct Answer
C:The acceptance test is specific: Fail the primary endpoint and observe DNS resolution transition to the secondary according to TTL. Its purpose is to establish that the proposed architecture works: Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations.
Incorrect Answers
A:The alternative test targets: Design multi-region entry routing, compatible identity dependencies and replicated application configuration/secrets for the failover region. The scenario's actual proposed remedy is: Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations. Verify that one by: Fail the primary endpoint and observe DNS resolution transition to the secondary according to TTL.
B:This check validates a different workload: Disable one regional origin and verify global clients are routed to a healthy origin over HTTPS. Its associated design is: Use Azure Front Door with health-based global endpoint routing and suitable backend origin groups. The required acceptance test here is: Fail the primary endpoint and observe DNS resolution transition to the secondary according to TTL.
D:The alternative test targets: Use Azure SQL failover group endpoints and supported read-only listener routing with region-appropriate replication. The scenario's actual proposed remedy is: Use Azure Traffic Manager priority routing with appropriate endpoint health probes and DNS TTL expectations. Verify that one by: Fail the primary endpoint and observe DNS resolution transition to the secondary according to TTL.
Designing Microsoft Azure Infrastructure Solutions (AZ-305) Practice Tests