AZ-305 Exam Questions and Answers

Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA

The correct approach is to create user-defined routes on each spoke subnet with a route for the other spoke's address space and the next hop set to the private IP address of the hub NVA. Because VNet peering is non-transitive, spoke-to-spoke traffic will not automatically flow through the hub; the UDR overrides the system route to force that path. You must also enable IP forwarding on the NVA network interface and ensure the NVA is in a hub subnet so return traffic takes a symmetric path. This gives precise, deterministic control of inter-spoke inspection and is the standard hub-spoke design pattern.

Azure Application Gateway with WAF.

Application Gateway is a regional Layer 7 load balancer that integrates WAF. It can be placed directly in front of App Service to inspect all incoming traffic. This is a cost-effective solution for a single-region application.

Azure Virtual WAN

Azure Virtual WAN is a managed networking service that creates a hub-and-spoke architecture with integrated routing, automatically interconnecting branches, Azure VNets, and on-premises locations. It natively supports Site-to-Site VPN, Point-to-Site VPN, and ExpressRoute, and it performs automatic route table generation and propagation across all spokes. Virtual WAN also enables branch-to-branch connectivity without manual peering, making it the only option here that delivers a scalable, zero-touch global transit network.

Azure Virtual Machine Scale Sets with a Proximity Placement Group

Azure Virtual Machine Scale Sets with a Proximity Placement Group (PPG) is the correct choice for tightly coupled HPC workloads because a PPG co-locates all VM instances within the same Azure datacenter, minimizing network latency to the sub-10 microseconds required by MPI applications. VMSS integrates with PPG by allowing you to scale the compute cluster out while ensuring every new instance remains within the placement group, preserving low-latency inter-node communication. This combination also enables the use of high-throughput, low-latency networking such as InfiniBand on supported HPC VM SKUs, which is essential for parallel jobs that need frequent, low-latency message passing.

C

Azure Application Gateway can be deployed as an internal (private) application gateway with a private frontend IP address inside the VNet, keeping the application fully internal. It offers native Layer 7 features including SSL termination (offloading), cookie-based session affinity, and URL path-based routing through listener and rule configurations. This makes it the only option that satisfies all three requirements—SSL offloading, session stickiness, and URL-based routing—within an internal network boundary.

A

This is the correct design because each data center establishes its own dedicated ExpressRoute circuit as the primary path, ensuring predictable, high-bandwidth, and low-latency connectivity to Azure with an SLA-backed private link. The site-to-site VPN for each data center acts as an IPsec-based backup over the internet, providing a cost-effective failover path that automatically kicks in if the ExpressRoute circuit fails. This active/passive redundancy model is a best practice for hybrid networking, as it avoids a single point of failure while keeping operational costs reasonable.

Microsoft Entra ID Identity Protection and Conditional Access

Identity Protection evaluates millions of signals per sign-in to calculate user and sign-in risk, detecting anomalies such as leaked credential use, impossible travel, and anomalous token behavior. Conditional Access then consumes those risk signals in real time to enforce step-up authentication (e.g., MFA or password change) or block access entirely, operationalizing zero trust at the identity plane with adaptive, context-aware policies.

Microsoft Entra ID Entitlement Management.

Entitlement Management is an identity governance feature that lets administrators create access packages containing SharePoint Online sites, Teams, and other resources, and publish them to internal or external users. Policies within an access package define who can request access, who must approve, and when the access expires, enabling time-limited collaboration. For external partners, it supports Connected Organizations and identity providers including Google and Microsoft accounts, automatically removing access when the policy ends. This directly provides the request/approval/expiration workflow needed for the scenario.

Microsoft Entra ID Entitlement Management

Microsoft Entra ID Entitlement Management is the correct choice because it creates access packages that bundle resources—groups, apps, SharePoint sites, and Teams—and define policies for who can request, who must approve, when access expires, and which access reviews are required. It automates the end-to-end lifecycle of access assignments and lets external partners request time-limited access through the Microsoft Entra admin center or a custom portal, satisfying both automation and periodic recertification.

Privileged Identity Management (PIM) and Microsoft Entra ID Access Reviews

PIM is the correct core service because it provides just-in-time, time-bound activation of privileged Microsoft Entra roles with approval workflows and audit trails, which directly satisfies the requirement to ensure privileged access is controlled. Access Reviews complements PIM by enabling recurring recertification of role assignments, so administrators can automatically remove or keep access based on attestation. Together they fulfill both activation governance and periodic review, making this combination the only one that fully addresses the stated requirement.

Azure Monitor

Azure Monitor is the comprehensive, unified monitoring service that acts as the single pipeline for collecting platform metrics, activity logs, resource logs, and custom telemetry across all Azure resources. It stores metric data in a time-series database and log data in Log Analytics workspaces, then provides a unified query experience, dashboards, and alerting actions. This centralization is what makes it the correct answer for collecting both metrics and logs from every resource in an Azure environment.

B

Microsoft Entra ID Conditional Access is the comprehensive policy engine that can enforce all the stated requirements during sign-in. A Conditional Access policy can require multi-factor authentication for external B2B users, require the device to be marked as compliant by integrating with Intune, and apply session controls that set sign-in frequency to force periodic reauthentication. These policies can be targeted to guest and external users specifically, making Conditional Access the right tool for controlling access in B2B collaboration scenarios.

Azure Blob Storage with read-access geo-redundant storage (RA-GRS)

RA-GRS extends GRS by providing a read-only endpoint at the secondary region, so clients can retrieve data directly from the geo-replicated copy without waiting for a failover. This lets the storage account serve low-latency reads in both the primary and the paired secondary regions while still using standard, cost-effective blob storage rather than premium tiers. Note that the secondary is eventually consistent, and there can be a slight replication delay, but for most unstructured content such as documents and media this is an acceptable trade-off.

Azure Table Storage

Azure Table Storage is a schema-less key-value store where data is addressed by PartitionKey and RowKey, making it a natural fit for IoT-style time-series data. Using a partition key such as device ID and a row key such as inverted timestamp allows efficient range scans for a given device over a time window, while inserts are cheap and highly parallel across partitions. This design delivers low latency at very low cost without the operational complexity of a SQL-based service, which is why it is the correct recommendation.

Azure Event Hubs with Capture to Azure Data Lake Storage.

Event Hubs can handle millions of events per second. The Capture feature automatically writes ingested events to Data Lake Storage in Avro format (or JSON). For real-time dashboards, you can use Stream Analytics to query the Event Hubs stream. This provides a seamless, low-operational-overhead solution.

Azure Cosmos DB

Azure Cosmos DB is the correct choice because it is a fully managed, multi-model NoSQL database with native JSON document support, schema-agnostic indexing, and an SQL-like query engine. It uniquely delivers multi-region writes with automatic failover, elastic horizontal partitioning and tunable consistency, backed by an industry-leading SLA of 99.999% availability and single-digit millisecond read/write latency at the 99th percentile. These capabilities are purpose-built for globally distributed JSON workloads requiring both durability and low-latency access.

Azure Data Explorer

Azure Data Explorer is a purpose-built analytics engine for petabyte-scale, time-series data that arrives continuously from IoT sources. It ingests semi-structured payloads (JSON, Avro, etc.) without requiring a predefined schema, then applies columnar storage and a distributed sharding architecture that accelerates real-time aggregation and time-window queries. Its Kusto Query Language (KQL) is designed for slicing, rolling averages, and anomaly detection on streaming telemetry, which makes it the correct choice here.

Azure Data Lake Storage Gen2

Azure Data Lake Storage Gen2 is the correct choice because it combines the scalability and cost-effectiveness of Blob Storage with a hierarchical namespace that organizes data into directories, enabling efficient atomic operations and fast path-based access. It also supports POSIX-compliant ACLs at both file and directory levels, allowing fine-grained security that matches the needs of multi-tenant analytics workloads. Its native integration with Hadoop, Spark, Databricks, and Azure Synapse makes it the optimal storage layer for big data analytics, as it provides high throughput and parallel processing capabilities.

SQL Server Always On Availability Groups

SQL Server Always On Availability Groups is correct because, with synchronous-commit mode, every transaction committed on the primary replica is hardened on a secondary replica before acknowledgment, yielding an RPO of zero. The secondary is kept in a continuously recovered state, and automatic failover with a listener can be completed within seconds to minutes, comfortably satisfying both sub-15-second RPO and sub-1-hour RTO. This is a database-level, application-aware solution that maintains transaction consistency, unlike storage or VM-level alternatives.

SQL Server Always On Availability Group with synchronous commit across regions.

Synchronous commit ensures all transactions are committed on both the primary and secondary replicas before acknowledging the commit to the application. If configured across regions, this provides zero data loss (RPO=0). But network latency can affect write performance.

Azure Site Recovery to another region.

Azure Site Recovery replicates VMs continuously to a secondary region. It can achieve RPO as low as 15 seconds (with app-consistent snapshots) and RTO of minutes (30 minutes is typical). It supports planned and unplanned failover.

Azure Site Recovery

Azure Site Recovery is the correct DRaaS solution for this scenario. It performs continuous replication of on-premises VMware VMs, Hyper-V VMs, and physical servers to Azure storage, and it tracks application state so that a failover can start a replica in Azure. Site Recovery supports orchestrated failover and test failover through recovery plans that sequence application dependencies, and it provides precise RPO/RPO control. This makes it the only option that actively replicates on-premises workloads for automated disaster recovery rather than just protecting data or migrating once.

Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault

Azure Backup with GRS replicates backup data to a paired secondary region, satisfying the regional disaster requirement. Volume Shadow Copy Service (VSS) provides application-consistent snapshots of Windows Server workloads, and the Recovery Services vault supports file-level recovery from those snapshots.

A

Azure Backup for SQL Server in an Azure VM securely stores full, differential, and transaction log backups in a Recovery Services vault. You can configure the vault in West Europe as the primary region and enable the Cross-Region Restore (CRR) feature, which replicates the backup data to the paired North Europe region using geo-redundant storage (GRS). This design provides automated SQL-aware backup management, point-in-time restore capability, and the ability to restore databases in North Europe without deploying any additional backup infrastructure or vaults, making it the optimized, cost-effective approach.