AZ-305 Practice Test 14 — 15 Questions

Question 1

A company needs a fully managed NoSQL database for a new application with a key-value and document data model. They require single-digit millisecond latency at any scale, multi-region writes with automatic conflict resolution, and a serverless capacity option to handle unpredictable traffic. Which Azure data service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it is a fully managed NoSQL database that supports both key-value and document data models natively. It guarantees single-digit millisecond latency at any scale, offers multi-region writes with automatic conflict resolution via its multi-master replication, and provides a serverless capacity mode that automatically scales based on demand, making it ideal for unpredictable traffic.

Answer

Azure Table Storage

Answer

Azure Cache for Redis

Answer

Azure SQL Database

Question 2

A company uses Microsoft Entra ID. They want to automatically detect sign-ins from anonymous IP addresses, sign-ins from unfamiliar locations, and other risky activities. When such a risk is detected, they want to block the sign-in or require multi-factor authentication. They also need a dashboard to review risk events. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to detect and respond to identity-based risks such as sign-ins from anonymous IP addresses, unfamiliar locations, and other risky activities. It provides a risk-based conditional access policy that can automatically block sign-ins or require multi-factor authentication (MFA) when a risk is detected, and it includes a dashboard for reviewing risk events and reports.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Access Reviews

Question 3

A company has multiple Azure VNets deployed in a hub-spoke topology. They want to inspect all outbound internet traffic from spoke VMs using a central firewall and ensure that traffic from all VNets goes through the firewall before reaching the internet. They also need to log all outbound connections. Which architecture should they implement?

Accepted Answer

Deploy Azure Firewall in the hub VNet and configure a default route (0.0.0.0/0) in each spoke's route table pointing to Azure Firewall as the next hop. Azure Firewall is a managed, stateful firewall-as-a-service that can centrally inspect and log outbound internet traffic. By deploying Azure Firewall in the hub VNet and configuring a default route (0.0.0.0/0) in each spoke's route table with the Azure Firewall private IP as the next hop, all outbound traffic from spoke VMs is forced through the firewall before reaching the internet. This satisfies both the inspection and logging requirements, as Azure Firewall provides built-in outbound connection logging via diagnostic settings.

Answer

Deploy network virtual appliances (NVAs) in each spoke VNet and configure user-defined routes (UDRs) to route internet traffic to the NVAs

Answer

Use Azure Application Gateway with Web Application Firewall (WAF) in the hub VNet to inspect all traffic

Answer

Deploy Azure Firewall in each spoke VNet and use Azure Monitor to aggregate logs

Question 4

A company is building a petabyte-scale data lake for analytics. They need a storage solution that supports a hierarchical namespace, POSIX-like permissions (ACLs), and is optimized for big data analytics workloads using Apache Spark and Hive. The data must be accessible over the Azure Blob Storage API. Which Azure data service should they use?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and is natively optimized for big data analytics workloads like Apache Spark and Hive. It exposes data through the Azure Blob Storage API, meeting all stated requirements for petabyte-scale analytics.

Answer

Azure Blob Storage (with flat namespace)

Answer

Azure NetApp Files

Answer

Azure HPC Cache

Question 5

Match each Azure governance tool to its description.

Accepted Answer

Azure Policy: Enforces rules and compliance across resources.. Azure Policy enforces rules; Azure Blueprints provides repeatable templates; Management Groups organize subscriptions; RBAC controls access. Confusions often arise between policy enforcement and access control, or between blueprints and management groups.

Answer

Azure Policy: Controls access to resources by assigning roles.

Answer

Azure Blueprints: Organizes subscriptions into a hierarchy.

Question 6

A company deploys a web application on Azure VMs. They need to distribute incoming HTTP and HTTPS traffic based on the URL path: requests to /api/* go to one VM pool, requests to /images/* go to another pool. They also need to offload SSL/TLS termination. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer-7 load balancer that can route traffic based on URL path (e.g., /api/* vs /images/*) and provides SSL/TLS termination at the gateway, offloading the decryption from the backend VMs. This matches both requirements exactly, whereas other solutions either lack layer-7 path-based routing or are designed for global traffic distribution.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 7

A company deploys a web application on Azure VMs. The application stores session state and frequently accessed product data. They need a low-latency, in-memory cache to reduce database load and improve response times. The cache must be managed and support data persistence with replication across availability zones within the region. Which Azure service and tier should they choose?

Accepted Answer

Azure Cache for Redis (Premium tier). Azure Cache for Redis Premium tier is the correct choice because it supports data persistence (RDB/AOF), replication across availability zones via zone redundancy, and provides low-latency, in-memory caching for session state and product data. The Basic tier lacks replication and persistence, Standard tier offers replication but not zone redundancy or persistence, and Enterprise tier is overkill for this scenario, adding unnecessary cost and complexity.

Answer

Azure Cache for Redis (Basic tier)

Answer

Azure Cache for Redis (Standard tier)

Answer

Azure Cache for Redis (Enterprise tier)

Question 8

A company needs to store sensor data from IoT devices. Each device sends a message every second. The data is time-series and will be queried for real-time dashboards and historical analysis. The solution must support high ingestion rates and low-latency queries on recent data. Which Azure service should they use?

Accepted Answer

Azure Event Hubs and Azure Data Explorer. Azure Event Hubs is designed for high-throughput data ingestion from millions of IoT devices, capable of handling millions of events per second. Azure Data Explorer (ADX) is optimized for time-series data, providing sub-second query latency on recent data and efficient historical analysis. Together, they form a serverless pipeline that ingests sensor data via Event Hubs and stores it in ADX for real-time dashboards and long-term analytics.

Answer

Azure Blob Storage with Azure Data Lake Storage Gen2

Answer

Azure Cosmos DB with SQL API

Answer

Azure Table Storage

Question 9

A company runs a critical application on Azure virtual machines in the West US region. They need a disaster recovery solution that replicates VMs to East US with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. They also need to perform non-disruptive disaster recovery drills. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions. It supports RPOs as low as 15 minutes (continuous replication with crash-consistent or app-consistent snapshots) and RTOs of 2 hours or less, and it enables non-disruptive disaster recovery drills via test failover that isolates replicated VMs in a separate virtual network without impacting production.

Answer

Azure Backup

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 10

You are designing a disaster recovery strategy for an Azure virtual machine running a SQL Server Always On availability group. The primary region is East US, and the secondary region is West US. You need to ensure minimal data loss and automatic failover. Which Azure service should you use for cross-region replication of the managed disks?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs across regions. For a SQL Server Always On availability group, ASR can replicate the managed disks at the VM level, enabling automatic failover to the West US region with minimal data loss by using crash-consistent or app-consistent recovery points. This meets the requirement for cross-region replication with automatic failover, unlike storage-level replication which does not provide orchestrated failover.

Answer

Azure Traffic Manager

Answer

Azure Backup

Answer

Azure Storage Geo-Redundant Storage (GRS)

Question 11

A company runs critical Azure VMs. They want to protect against accidental deletion or corruption of data by implementing a retention policy for Azure Backup. They need to keep daily backups for 30 days, weekly backups for 12 weeks, and monthly backups for 12 months. Which Azure Backup feature should they configure?

Accepted Answer

Backup policy with long-term retention. A backup policy with long-term retention (LTR) in Azure Backup allows you to define granular retention rules for daily, weekly, monthly, and yearly backup points. This directly meets the requirement to keep daily backups for 30 days, weekly for 12 weeks, and monthly for 12 months by configuring the retention duration for each frequency in the backup policy.

Answer

Immutable vault

Answer

Backup tiering

Answer

Soft delete

Question 12

A multinational company stores large amounts of unstructured data (documents, images) that must be read with low latency from multiple global regions. Data is written primarily in one region but read globally. Cost optimization is a key requirement. Which Azure storage replication option should they use?

Accepted Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS). B is correct because RA-GRS provides geo-redundant storage with read access to the secondary region, enabling low-latency reads from multiple global regions while maintaining cost efficiency. The data is written primarily in one region, but RA-GRS allows read requests to be served from the secondary region without additional compute costs, meeting the global read requirement.

Answer

Azure Blob Storage with geo-redundant storage (GRS)

Answer

Azure Files with premium shares

Answer

Azure NetApp Files

Question 13

You are designing a disaster recovery solution for an Azure IaaS workload. The application runs on Azure VMs in a single region and requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which of the following is the most cost-effective approach to meet these requirements?

Accepted Answer

Deploy Azure Site Recovery to replicate VMs to the secondary region with a replication policy that meets the RPO and RTO.. Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs to a secondary region with configurable RPO (as low as 30 seconds) and supports automated failover, meeting the 15-minute RPO and 4-hour RTO requirements. It is the most cost-effective because it replicates only changed blocks and does not require running standby VMs, unlike multi-region active deployments.

Answer

Configure geo-redundant storage (GRS) for the VM disks and manually attach them to new VMs in the secondary region.

Answer

Use Azure Front Door with a back-end pool containing VMs in both regions, and configure health probes to route traffic on failure.

Answer

Use Azure Backup to back up VMs to a Recovery Services vault in the secondary region and perform restore during failover.

Question 14

A company deploys a web application on multiple Azure virtual machines (VMs) in a single region. The application receives HTTP and HTTPS traffic. They need to distribute the traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Additionally, they need to route requests based on URL paths (e.g., /api/* to one pool, /images/* to another). Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a layer-7 load balancer that supports SSL/TLS termination, URL path-based routing, and session persistence (sticky sessions) via cookies. These features directly match the requirements for distributing HTTP/HTTPS traffic, offloading SSL, routing requests based on URL paths, and maintaining user session affinity to the same backend VM.

Answer

Azure Load Balancer

Answer

Azure Front Door

Answer

Azure Traffic Manager

Question 15

A company has an on-premises data center and wants to connect it to Azure with a dedicated, private network connection that is not routed over the public internet. They also need a higher service-level agreement (SLA) compared to VPN-based connections. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that bypasses the public internet, ensuring lower latency, higher reliability, and a 99.95% SLA (for dedicated circuits) compared to VPN-based connections. This meets the requirement for a private network connection with a higher SLA than VPN Gateway, which relies on internet-based IPSec tunnels with a 99.9% SLA.

Answer

Azure VPN Gateway

Answer

Azure Bastion

Answer

Azure Virtual WAN