AZ-305 Practice Test 11 — 15 Questions

Question 1

A company plans to deploy multiple virtual machines (VMs) across two Azure regions for high availability. The VMs will host a stateless web application that must be accessible via a single DNS endpoint. The solution must automatically route traffic to the nearest region with available capacity and provide failover if a region becomes unhealthy. Which Azure service should they use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that distributes traffic to the nearest region with available capacity using the Performance traffic-routing method, and it automatically fails over to the next healthy endpoint when a region becomes unhealthy. It operates at the DNS level, returning the appropriate endpoint IP based on the client's DNS resolver location and endpoint health probes, making it ideal for stateless web applications requiring a single DNS endpoint across regions.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 2

A company runs a critical line-of-business application on Azure VMs within a single region. The application tier is deployed across multiple VMs. They need to protect against a failure of an entire Azure datacenter within that region. The solution should automatically distribute the VMs across physically separate locations with independent power, cooling, and networking. The company also requires the lowest possible latency between application and database tiers within the same location. Which deployment strategy should they use?

Accepted Answer

Deploy the VMs across multiple availability zones. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the application tier VMs across multiple zones protects against an entire datacenter failure while keeping all resources within the same region, ensuring the lowest possible latency between application and database tiers when they are placed in the same zone.

Answer

Deploy the VMs in an availability set

Answer

Use Azure Site Recovery to replicate VMs to a paired region

Answer

Use Azure Proximity Placement Groups

Question 3

A company runs several Azure virtual machines (VMs) that host SQL Server databases. The databases are stored on data disks attached to the VMs. The company needs to back up the databases and VMs separately. They require application-consistent backups for SQL Server to ensure transactional integrity. Additionally, they need to retain backups for up to 7 years to meet compliance requirements. The solution must minimize administrative overhead and support long-term retention of database backups. Which Azure service or feature should they use for the database backups?

Accepted Answer

Azure Backup for SQL Server in Azure VMs. Azure Backup for SQL Server in Azure VMs is the correct choice because it provides native, application-consistent backups specifically for SQL Server databases running on Azure VMs. It integrates directly with SQL Server VSS writer to ensure transactional integrity, supports long-term retention up to 10 years (exceeding the 7-year requirement), and minimizes administrative overhead by automating backup scheduling, retention management, and point-in-time restore. This service is purpose-built for SQL Server database backups, separate from VM-level backups.

Answer

Azure Backup for Azure VMs with application-consistent snapshots

Answer

Azure Site Recovery

Answer

Azure Files

Question 4

A company uses Microsoft Entra ID (Microsoft Entra ID) for identity management. They want to automatically detect sign-in risks such as sign-ins from unfamiliar locations, anonymous IP addresses, or leaked credentials. Based on the risk level, they want to apply different controls: for low-risk sign-ins, show a message but allow access; for medium-risk sign-ins, require multi-factor authentication (MFA); for high-risk sign-ins, block the sign-in. They also need to receive a weekly summary report of risk events. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Conditional Access policies with sign-in risk conditions. Microsoft Entra ID Conditional Access policies can integrate sign-in risk conditions from Identity Protection to enforce granular controls based on risk levels. This allows you to configure actions such as showing a message for low risk, requiring MFA for medium risk, and blocking access for high risk, while Identity Protection provides the weekly summary report of risk events.

Answer

Microsoft Entra ID Identity Protection policies

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 5

A company has Azure virtual networks (VNets) in three different Azure regions and an on-premises data center connected via ExpressRoute. They need to connect all VNets to each other and to on-premises over the Microsoft global backbone. They also require centralized management of routing and the ability to enforce security policies such as forced tunneling for internet-bound traffic. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the correct choice because it provides a hub-and-spoke architecture that connects VNets across regions and on-premises via the Microsoft global backbone, with built-in centralized routing management and the ability to enforce security policies like forced tunneling through integrated Azure Firewall or third-party NVAs. It meets all requirements: multi-region VNet connectivity, ExpressRoute integration, and centralized policy control.

Answer

Azure Virtual Network Manager

Answer

Azure Firewall

Answer

Azure Route Server

Question 6

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center connected via ExpressRoute. They need to implement a hub-and-spoke topology where a hub VNet hosts shared network virtual appliances (NVAs) for traffic inspection. All traffic between spokes and between spokes and on-premises must be routed through the hub. The company wants to minimize the administrative overhead of configuring and maintaining routing. Which Azure solution should they implement?

Accepted Answer

Use Azure Virtual WAN with a secured virtual hub.. Azure Virtual WAN with a secured virtual hub is the correct choice because it provides a managed hub-and-spoke topology with built-in routing, eliminating the need for manual user-defined routes (UDRs) and route tables. The secured virtual hub includes Azure Firewall for traffic inspection, and all inter-spoke and on-premises traffic is automatically routed through the hub via the Virtual WAN routing engine, which uses the Border Gateway Protocol (BGP) to propagate routes dynamically. This minimizes administrative overhead by centralizing routing and security management.

Answer

Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.

Answer

Create a single large VNet and use network security groups (NSGs) to isolate traffic.

Answer

Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.

Question 7

A company is designing a solution to store and analyze petabytes of IoT sensor data. The data is written once, rarely accessed, and must be retained for 10 years for compliance. The data must be queryable using SQL. Which combination of Azure services would be MOST cost-effective?

Accepted Answer

Azure Data Lake Storage Gen2 with Azure Synapse Serverless SQL. Azure Data Lake Storage Gen2 (ADLS Gen2) provides cost-effective, scalable storage for petabytes of data at low cost, while Azure Synapse Serverless SQL enables on-demand SQL querying directly over the data in ADLS Gen2 without provisioning dedicated compute. This combination meets the write-once, rare-access, 10-year retention, and SQL queryability requirements at the lowest cost because storage is cheap and compute is only billed per query executed.

Answer

Azure Cosmos DB with analytical store

Answer

Azure SQL Database with Hyperscale tier

Answer

Azure Databricks with Delta Lake

Question 8

Your company runs a critical workload on Azure Virtual Machines in a single region. You need to design a disaster recovery solution that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The solution should minimize cost. What should you recommend?

Accepted Answer

Implement Azure Site Recovery with replication to a secondary region.. Azure Site Recovery (ASR) provides continuous replication of Azure VMs to a secondary region, enabling failover within minutes. With replication intervals as low as 30 seconds for crash-consistent and 5 minutes for app-consistent snapshots, it comfortably meets the 15-minute RPO, and the orchestrated failover process can achieve the 1-hour RTO. ASR is the native Azure service designed for this exact scenario, minimizing cost by only charging for replication traffic and storage in the secondary region.

Answer

Configure Azure Backup with geo-redundant storage.

Answer

Deploy an active-passive pair of VMs using SQL Server Always On availability groups.

Answer

Use Azure Storage with read-access geo-redundant storage (RA-GRS) and failover the VMs.

Question 9

A software company runs 50 small Azure SQL databases for different clients. Each database has low average usage but unpredictable spikes. The company wants to minimize cost while providing resources for peak loads and easily adding new databases without manual sizing. Which Azure data service should they use?

Accepted Answer

Azure SQL Database elastic pool. Azure SQL Database elastic pool is ideal for multiple databases with low average usage and unpredictable spikes because it allows them to share a fixed set of resources (eDTUs or vCores). This pooling model minimizes cost by only paying for the aggregate peak usage across all databases, not each database's individual peak, and automatically handles resource allocation without manual sizing for new databases.

Answer

Azure SQL Database single databases

Answer

Azure SQL Managed Instance

Answer

SQL Server on Azure Virtual Machines

Question 10

A startup is building a social media analytics platform that processes streaming data. They need a data store for time-series events with high write throughput and fast timestamp-based range queries. Which Azure data store is most suitable for this workload?

Accepted Answer

Azure Table Storage. Azure Table Storage is a NoSQL key-value store that supports high-volume, low-latency writes and efficient range queries on the PartitionKey and RowKey, which can be structured as a timestamp for time-series data. Its schema-less design and ability to scale to massive throughput without sharding overhead make it ideal for streaming event ingestion and timestamp-based retrieval.

Answer

Azure Cosmos DB with SQL API

Answer

Azure SQL Database with columnstore index

Answer

Azure Data Lake Storage Gen2

Question 11

A company runs a critical OLTP application on Azure SQL Database in the West US region. They need to ensure business continuity if a regional outage occurs. The solution must have a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of less than 1 hour. They also want to use the secondary region for read-only query offloading. Which Azure SQL Database feature should they enable?

Accepted Answer

Active geo-replication with automatic failover group. Active geo-replication with automatic failover groups is the correct choice because it provides continuous asynchronous data replication to a secondary Azure SQL Database in a paired region, achieving an RPO of 5 seconds and an RTO of under 1 hour. The automatic failover group enables coordinated failover of multiple databases and allows the secondary region to be used for read-only query offloading by connecting with ApplicationIntent=ReadOnly.

Answer

Geo-restore

Answer

Azure Site Recovery

Answer

Read scale-out with manual regional failover

Question 12

A company deploys a web application across multiple Azure VMs in a single region. They want to distribute incoming HTTP traffic evenly across the VMs, offload SSL encryption, and provide a fixed public IP address for clients. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports HTTP/HTTPS traffic, SSL termination, and cookie-based session affinity. It can distribute incoming HTTP traffic evenly across VMs, offload SSL encryption to reduce backend processing, and provide a fixed public IP address (VIP) for client access. This aligns with all three requirements: load balancing, SSL offload, and a static public IP.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 13

A multinational company uses Microsoft Entra ID. The company has regional IT teams that need to manage users and groups within their respective regions. Each region has a distinct set of users in specific organizational units. The company wants to assign the User Administrator role to regional IT staff, but limit their scope to only the users in their region. Which Microsoft Entra ID feature should they use?

Accepted Answer

Administrative Units. Administrative Units in Microsoft Entra ID allow you to delegate administrative roles, such as User Administrator, to a specific subset of users and groups defined by organizational boundaries (e.g., region). By creating an Administrative Unit for each region and adding the regional users and groups to it, you can assign the User Administrator role scoped to that unit, ensuring regional IT staff can only manage their own region's identities.

Answer

Dynamic Groups

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection

Question 14

A company has multiple Azure virtual networks (VNets) spread across three Azure regions (West US, East US, and West Europe). They also have an on-premises network connected to East US via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. They require centralized management of routing and the ability to enforce security policies such as forcing all internet-bound traffic from any VNet to pass through a central firewall in East US. Which Azure solution should they implement?

Accepted Answer

Azure Virtual WAN with a secured hub in East US.. Azure Virtual WAN with a secured hub in East US provides a centralized hub-and-spoke architecture that connects all VNets and the on-premises network via ExpressRoute. The secured hub includes Azure Firewall, enabling forced tunneling of all internet-bound traffic from any VNet through the central firewall in East US, while Virtual WAN automatically manages routing between all spokes and the on-premises network.

Answer

VNet peering between all VNets and use route tables for forced tunneling.

Answer

ExpressRoute Global Reach with VNet peering to connect all VNets.

Answer

VPN gateways with BGP to connect all VNets.

Question 15

Your organization uses Microsoft Entra ID. You need to enforce multifactor authentication (MFA) for all guest users accessing a specific SharePoint Online site. What is the most efficient way to achieve this?

Accepted Answer

Create a Conditional Access policy targeting guest users and the SharePoint Online app.. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA specifically for guest users when they access the SharePoint Online app. This is the most efficient approach as it targets the exact user group (guests) and the specific application (SharePoint Online) without requiring per-user configuration or additional licensing overhead.

Answer

Use SharePoint site permissions to require MFA.

Answer

Enable MFA per-user for each guest account.

Answer

Configure Microsoft Entra Entitlement Management to require MFA.