AZ-305 Exam Questions and Answers

Microsoft Entra ID Entitlement Management

Microsoft Entra ID Entitlement Management is the correct choice because it creates access packages that bundle resources—groups, apps, SharePoint sites, and Teams—and define policies for who can request, who must approve, when access expires, and which access reviews are required. It automates the end-to-end lifecycle of access assignments and lets external partners request time-limited access through the Microsoft Entra admin center or a custom portal, satisfying both automation and periodic recertification.

Azure Monitor

Azure Monitor is the comprehensive, unified monitoring service that acts as the single pipeline for collecting platform metrics, activity logs, resource logs, and custom telemetry across all Azure resources. It stores metric data in a time-series database and log data in Log Analytics workspaces, then provides a unified query experience, dashboards, and alerting actions. This centralization is what makes it the correct answer for collecting both metrics and logs from every resource in an Azure environment.

B

Microsoft Entra ID Conditional Access is the comprehensive policy engine that can enforce all the stated requirements during sign-in. A Conditional Access policy can require multi-factor authentication for external B2B users, require the device to be marked as compliant by integrating with Intune, and apply session controls that set sign-in frequency to force periodic reauthentication. These policies can be targeted to guest and external users specifically, making Conditional Access the right tool for controlling access in B2B collaboration scenarios.

Microsoft Entra ID B2C

Microsoft Entra ID B2C is the correct solution because it is a Customer Identity and Access Management (CIAM) service built specifically to handle consumer identities at scale. It natively supports multiple identity providers, including Microsoft, Google, and Facebook, and provides self-service sign-up/sign-in user flows. With the Identity Experience Framework, you can define custom policies that collect custom attributes, perform API-based validation, and create fully branded, tailored registration journeys for customers, which is exactly what this company needs.

Microsoft Entra ID Conditional Access

Conditional Access policies allow you to specify conditions (e.g., IP location, device compliance) and controls (e.g., require MFA, block access). This enables the described scenario: require MFA for sensitive apps, but exclude corporate IP range and require compliant device.

Administrative Units

Administrative Units are the correct approach because they partition a tenant's users, groups, and devices into explicit management boundaries. An administrator can assign a built-in or custom role such as User Administrator or Helpdesk Administrator scoped to a specific Administrative Unit, so regional IT staff see and manage only the objects in their local unit. This gives the desired delegated administration while preventing tenant-wide access.

Azure Blob Storage with read-access geo-redundant storage (RA-GRS)

RA-GRS extends GRS by providing a read-only endpoint at the secondary region, so clients can retrieve data directly from the geo-replicated copy without waiting for a failover. This lets the storage account serve low-latency reads in both the primary and the paired secondary regions while still using standard, cost-effective blob storage rather than premium tiers. Note that the secondary is eventually consistent, and there can be a slight replication delay, but for most unstructured content such as documents and media this is an acceptable trade-off.

Azure Table Storage

Azure Table Storage is a schema-less key-value store where data is addressed by PartitionKey and RowKey, making it a natural fit for IoT-style time-series data. Using a partition key such as device ID and a row key such as inverted timestamp allows efficient range scans for a given device over a time window, while inserts are cheap and highly parallel across partitions. This design delivers low latency at very low cost without the operational complexity of a SQL-based service, which is why it is the correct recommendation.

Azure Event Hubs with Capture to Azure Data Lake Storage.

Event Hubs can handle millions of events per second. The Capture feature automatically writes ingested events to Data Lake Storage in Avro format (or JSON). For real-time dashboards, you can use Stream Analytics to query the Event Hubs stream. This provides a seamless, low-operational-overhead solution.

Azure Cosmos DB

Azure Cosmos DB is the correct choice because it is a fully managed, multi-model NoSQL database with native JSON document support, schema-agnostic indexing, and an SQL-like query engine. It uniquely delivers multi-region writes with automatic failover, elastic horizontal partitioning and tunable consistency, backed by an industry-leading SLA of 99.999% availability and single-digit millisecond read/write latency at the 99th percentile. These capabilities are purpose-built for globally distributed JSON workloads requiring both durability and low-latency access.

B

Azure Data Lake Storage Gen2 is Azure Blob Storage with a hierarchical namespace, enabling directory-level ACLs that integrate with Microsoft Entra ID for fine-grained permission control. It is optimized for large-scale analytics workloads, supports POSIX-like permissions, and integrates natively with Azure Synapse Analytics for in-place querying without data movement. Its ability to organize data into directories and subdirectories while remaining accessible via both Blob and ADLS Gen2 APIs makes it the ideal landing zone for structured and unstructured IoT and social media data.

B

Azure NetApp Files is a high-performance, enterprise-grade file storage service that supports SMB (both Windows and Linux) and can deliver thousands of IOPS with low latency.

SQL Server Always On Availability Groups

SQL Server Always On Availability Groups is correct because, with synchronous-commit mode, every transaction committed on the primary replica is hardened on a secondary replica before acknowledgment, yielding an RPO of zero. The secondary is kept in a continuously recovered state, and automatic failover with a listener can be completed within seconds to minutes, comfortably satisfying both sub-15-second RPO and sub-1-hour RTO. This is a database-level, application-aware solution that maintains transaction consistency, unlike storage or VM-level alternatives.

SQL Server Always On Availability Group with synchronous commit across regions.

Synchronous commit ensures all transactions are committed on both the primary and secondary replicas before acknowledging the commit to the application. If configured across regions, this provides zero data loss (RPO=0). But network latency can affect write performance.

Azure Site Recovery to another region.

Azure Site Recovery replicates VMs continuously to a secondary region. It can achieve RPO as low as 15 seconds (with app-consistent snapshots) and RTO of minutes (30 minutes is typical). It supports planned and unplanned failover.

Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault

Azure Backup offers VM-level application-consistent backups, supports GRS for cross-region durability, and allows file-level restore from recovery points.

A

Azure Backup for SQL Server in an Azure VM securely stores full, differential, and transaction log backups in a Recovery Services vault. You can configure the vault in West Europe as the primary region and enable the Cross-Region Restore (CRR) feature, which replicates the backup data to the paired North Europe region using geo-redundant storage (GRS). This design provides automated SQL-aware backup management, point-in-time restore capability, and the ability to restore databases in North Europe without deploying any additional backup infrastructure or vaults, making it the optimized, cost-effective approach.

B

Placing at least two VM instances across two or more Azure availability zones in the same region gives each zone independent power, cooling, and network paths, so a failure of one entire zone or datacenter leaves the other zone(s) serving traffic. This architecture satisfies the Azure Compute SLA of 99.99% connectivity to at least one instance during monthly uptime, and, because the application is stateless, traffic can be load-balanced between zones with no session-stickiness concerns.

Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA

The correct approach is to create user-defined routes on each spoke subnet with a route for the other spoke's address space and the next hop set to the private IP address of the hub NVA. Because VNet peering is non-transitive, spoke-to-spoke traffic will not automatically flow through the hub; the UDR overrides the system route to force that path. You must also enable IP forwarding on the NVA network interface and ensure the NVA is in a hub subnet so return traffic takes a symmetric path. This gives precise, deterministic control of inter-spoke inspection and is the standard hub-spoke design pattern.

Azure Application Gateway with WAF.

Application Gateway is a regional Layer 7 load balancer that integrates WAF. It can be placed directly in front of App Service to inspect all incoming traffic. This is a cost-effective solution for a single-region application.

Azure Virtual WAN

Azure Virtual WAN is a managed networking service that creates a hub-and-spoke architecture with integrated routing, automatically interconnecting branches, Azure VNets, and on-premises locations. It natively supports Site-to-Site VPN, Point-to-Site VPN, and ExpressRoute, and it performs automatic route table generation and propagation across all spokes. Virtual WAN also enables branch-to-branch connectivity without manual peering, making it the only option here that delivers a scalable, zero-touch global transit network.

Azure Virtual Machine Scale Sets with a Proximity Placement Group

Azure Virtual Machine Scale Sets with a Proximity Placement Group (PPG) is the correct choice for tightly coupled HPC workloads because a PPG co-locates all VM instances within the same Azure datacenter, minimizing network latency to the sub-10 microseconds required by MPI applications. VMSS integrates with PPG by allowing you to scale the compute cluster out while ensuring every new instance remains within the placement group, preserving low-latency inter-node communication. This combination also enables the use of high-throughput, low-latency networking such as InfiniBand on supported HPC VM SKUs, which is essential for parallel jobs that need frequent, low-latency message passing.

A

This is the correct design because each data center establishes its own dedicated ExpressRoute circuit as the primary path, ensuring predictable, high-bandwidth, and low-latency connectivity to Azure with an SLA-backed private link. The site-to-site VPN for each data center acts as an IPsec-based backup over the internet, providing a cost-effective failover path that automatically kicks in if the ExpressRoute circuit fails. This active/passive redundancy model is a best practice for hybrid networking, as it avoids a single point of failure while keeping operational costs reasonable.

Use Azure Application Gateway with WAF, and configure NSGs to restrict traffic between tiers.

Azure Application Gateway is a Layer 7 regional load balancer that provides SSL termination, WAF, URL-based routing, and cookie-based session affinity, making it the appropriate entry point for the web tier. By enabling WAF, it actively blocks common web vulnerabilities such as SQL injection and cross-site scripting before they reach the backend. Complementing this with NSGs on each subnet enforces network-level isolation, ensuring that only the web tier can communicate with the app tier on specific ports (e.g., 8080/tcp) and that the app tier cannot initiate outbound connections to the internet. This combination of application-layer protection and subnet-level access control exactly matches the requirement to restrict traffic between tiers while securely exposing the web tier.