AZ-305 Practice Test 10 — 10 Questions

Question 1

Your company runs a mission-critical application on Azure Virtual Machines that requires a Recovery Time Objective (RTO) of 5 minutes and a Recovery Point Objective (RPO) of 1 minute. The application uses a single VM with a managed disk. You need to design a disaster recovery solution that meets these requirements with minimal cost. What should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Site Recovery to replicate the VM to a secondary region with a recovery plan.. Azure Site Recovery (ASR) provides continuous replication with RPO as low as 30 seconds and RTO of minutes when using a recovery plan, meeting the 5-minute RTO and 1-minute RPO requirements. ASR replicates the VM to a secondary region and allows orchestrated failover with minimal cost compared to running a standby VM. This is the only option that satisfies both the RTO and RPO targets for a mission-critical application.

Answer

Configure Azure Backup for the VM with a 1-minute backup frequency.

Answer

Store the managed disk in geo-redundant storage and use Azure Resource Manager templates to redeploy.

Answer

Deploy a second VM in a secondary region and use continuous replication with Azure Migrate.

Question 2

A company is designing a hybrid network solution connecting an on-premises data center to Azure. They require high availability with active-active routing and need to support up to 10 Gbps throughput. Which Azure service should they include in the design?

Accepted Answer

ExpressRoute Direct. ExpressRoute Direct provides dedicated, private connections from on-premises to Azure, supporting bandwidths up to 100 Gbps (10 Gbps easily). It enables active-active routing by using two circuits with BGP, meeting high availability and throughput requirements. ExpressRoute FastPath is a performance feature that reduces latency but is not a standalone service and does not itself provide active-active routing or guaranteed throughput; it requires an ExpressRoute circuit and does not replace the need for Direct when dedicated throughput is required.

Answer

Site-to-Site VPN Gateway

Answer

Azure Virtual WAN

Answer

ExpressRoute FastPath

Question 3

A company runs a mission-critical application on Azure VMs in West US. They need a disaster recovery plan with an RPO of 5 minutes and an RTO of 30 minutes. The application consists of multiple VMs that must be recovered in a specific order: the database VM first, then the front-end VMs. They also need to ensure that after failover, the IP addresses of the VMs are retained to avoid DNS propagation delays. The company wants to test the recovery process periodically without affecting production. Which Azure Site Recovery features should they use?

Accepted Answer

Use recovery plans with virtual machine group ordering and failover network settings to assign static IPs.. Azure Site Recovery recovery plans allow you to define the order of VM recovery using groups, and you can assign static IP addresses via failover network settings to retain IPs after failover. This meets the RPO of 5 minutes (via continuous replication) and RTO of 30 minutes (via orchestrated failover), while test failover can be performed without impacting production.

Answer

Use failover settings with retention IP and test failover.

Answer

Use recovery plans with custom scripts for ordering and Azure Traffic Manager for IP retention.

Answer

Use Azure Site Recovery with Application Consistent Snapshots and ignore IP retention.

Question 4

A company runs a critical application using Azure SQL Database in the West US region. They need a disaster recovery solution that automatically fails over to a secondary region (East US) with a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 1 minute. The secondary region must also be able to serve read-only queries for reporting purposes. Which Azure SQL Database feature should they implement?

Accepted Answer

Azure SQL Database active geo-replication with auto-failover group. Active geo-replication with auto-failover groups is the correct choice because it provides automatic, synchronous failover to a secondary region with an RPO of 5 seconds and an RTO of 1 minute. Additionally, the secondary database can be used for read-only reporting by connecting with the 'ApplicationIntent=ReadOnly' connection string, meeting both the disaster recovery and reporting requirements.

Answer

Azure SQL Database geo-restore

Answer

Azure SQL Database copy

Answer

Azure SQL Managed Instance failover group

Question 5

A company uses Microsoft Entra ID (Microsoft Entra ID). External partners need temporary access to an internal application. The process must be self-service: partners request access, the request goes through an approval workflow managed by a manager from the partner's organization, and access automatically expires after 30 days. The company also wants to send reminder emails 7 days before expiration. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Governance - Entitlement Management. Microsoft Entra ID Identity Governance - Entitlement Management is specifically designed to manage access for external users through self-service access packages. It supports approval workflows with external managers, automatic time-bound access (e.g., 30-day expiration), and lifecycle notifications like reminder emails 7 days before expiry. This aligns perfectly with the requirement for partner-managed, temporary, self-service access.

Answer

Microsoft Entra ID Identity Governance - Access Reviews

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Question 6

A company wants to monitor sign-in activity for their Microsoft Entra ID-integrated applications. They need to detect risky sign-ins, such as sign-ins from anonymous IP addresses or unfamiliar locations, and automatically block or require multi-factor authentication. They also need a dashboard showing risk events and the ability to investigate and remediate. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it specifically detects and responds to risky sign-ins, such as those from anonymous IP addresses or unfamiliar locations, by automatically blocking access or requiring multi-factor authentication. It provides a dashboard of risk events (e.g., leaked credentials, impossible travel) and supports investigation and remediation workflows, directly matching the requirements for monitoring sign-in activity and enforcing conditional access policies.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Self-Service Password Reset (SSPR)

Question 7

A company runs a legacy on-premises application that relies on a SQL Server database. They want to use Azure as a disaster recovery site with a recovery point objective of less than 15 minutes. They need to be able to fail back to the on-premises environment after a disaster. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of on-premises SQL Server workloads to Azure, supporting a Recovery Point Objective (RPO) of less than 15 minutes through continuous replication. It enables failback to the original on-premises environment after a disaster, which is a critical requirement for this scenario.

Answer

Azure Backup

Answer

Azure SQL Database

Answer

Azure Traffic Manager

Question 8

A company wants to store raw data from IoT devices, social media feeds, and transactional databases for analytics. They need a storage solution that supports a hierarchical namespace for organizing data into directories and allows fine-grained access control at the directory and file level. They also need to query the data using Azure Synapse Analytics in-place. Which Azure storage solution should they use?

Accepted Answer

B. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it provides a hierarchical namespace that organizes data into directories and subdirectories, supports POSIX-like fine-grained access control at the directory and file level via ACLs, and can be queried in-place by Azure Synapse Analytics using its built-in serverless SQL pool or dedicated SQL pool. This combination of hierarchical namespace, granular security, and direct analytics integration makes it ideal for the described raw data storage and analytics scenario.

Answer

A

Answer

C

Answer

D

Question 9

You are a solutions architect for a financial services company. The company is deploying a new critical application on Azure that processes sensitive customer transactions. The application consists of an ASP.NET Core web app (Azure App Service), a REST API (Azure Kubernetes Service), and an Azure SQL Database. The requirements are:

- All data at rest must be encrypted using customer-managed keys (CMK) stored in a managed HSM.
- All network traffic between components must be encrypted and traverse the Microsoft backbone network.
- The web app must be protected against common web attacks (SQL injection, XSS).
- The solution must automatically scale the API based on CPU utilization.
- All API calls must be authenticated using OAuth 2.0 with Microsoft Entra ID.
- Logs from all components must be sent to a central Log Analytics workspace for analysis.
- The solution must have a recovery time objective (RTO) of 1 hour and recovery point objective (RPO) of 5 minutes for the database.

Which combination of Azure services should you recommend to meet ALL requirements?

Accepted Answer

Azure Application Gateway with WAF, Azure SQL Database failover groups, Azure Key Vault Managed HSM, Azure App Service with service endpoint, AKS with HPA, Azure Monitor Agent, Microsoft Entra ID. Meets all requirements: Azure Application Gateway with WAF protects against SQL injection and XSS; Azure SQL Database failover groups provide an RPO of 5 seconds and an RTO of 1 hour (auto-failover); Azure Key Vault Managed HSM stores customer-managed keys for encryption at rest; App Service with service endpoint ensures traffic to other Azure services stays on the Microsoft backbone network (combined with AKS in a VNet, internal traffic stays on backbone); AKS with Horizontal Pod Autoscaler (HPA) scales pods based on CPU utilization; Azure Monitor Agent sends logs to Log Analytics; Microsoft Entra ID authenticates API calls via OAuth 2.0. Option A uses point-in-time restore, which cannot guarantee RPO of 5 minutes and RTO of 1 hour. Option B uses Key Vault Standard instead of Managed HSM. Option C uses cluster autoscaler, which scales nodes, not pods, failing the CPU-based scaling requirement.

Answer

Azure Front Door with WAF, Azure SQL Database point-in-time restore, Azure Key Vault Managed HSM, Azure App Service with private endpoint, AKS with HPA, Azure Log Analytics agent, Microsoft Entra ID

Answer

Azure Front Door with WAF, Azure SQL Database geo-replication, Azure Key Vault (Standard), Azure App Service with private endpoint, AKS with HPA, Azure Diagnostics extension, Microsoft Entra ID

Answer

Azure Application Gateway with WAF, Azure SQL Database active geo-replication, Azure Key Vault Managed HSM, Azure App Service with VNet integration, AKS with cluster autoscaler, Azure Monitor Agent, Microsoft Entra ID

Question 10

A global e-commerce platform uses Azure Cosmos DB for its product catalog. The application requires multi-region writes to provide low-latency updates from any geographic location. Two users may update the same product item concurrently, so the solution must automatically resolve conflicts. For real-time inventory checks, reads must be strongly consistent, while product description reads can be eventually consistent. Which Cosmos DB configuration should they choose?

Accepted Answer

SQL API with multi-region writes, last-writer-wins conflict resolution, and per-request strong consistency. The SQL API in Cosmos DB supports multi-region writes with last-writer-wins (LWW) conflict resolution using a timestamp or custom property, which automatically resolves concurrent updates to the same product item. Per-request strong consistency allows inventory reads to achieve linearizability by setting the consistency level at the request level, while product description reads can use the default session or eventual consistency for performance. This combination meets all requirements: multi-region writes, automatic conflict resolution, and the ability to mix strong and eventual consistency on a per-request basis.

Answer

MongoDB API with multi-region writes and automatic conflict resolution

Answer

Table API with multi-region writes and strong consistency

Answer

Cassandra API with multi-region writes and strong consistency