AZ-305 Practice Test 15 — 15 Questions

Question 1

A company is deploying a web application that must be accessible from the internet. The application is hosted on Azure virtual machines in a virtual network. The solution must provide SSL termination, web application firewall (WAF) protection, and URL path-based routing (e.g., /api/* to one backend pool, /app/* to another). The web tier must not be directly exposed to the internet. Which Azure load balancing solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL path-based routing. It can route traffic to different backend pools based on URL paths (e.g., /api/* and /app/*) while keeping the web tier isolated within the virtual network, as the gateway itself is exposed to the internet.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 2

A company runs a critical application on Azure Kubernetes Service (AKS) in a single region. The application is stateless and uses an Azure SQL Database with active geo-replication for database DR. They need to ensure the AKS cluster can failover to a secondary region with an RTO of 15 minutes and an RPO of 5 seconds for the database. What should they recommend for the AKS cluster?

Accepted Answer

Deploy AKS clusters in two regions and use Azure Traffic Manager to route traffic.. Deploying AKS clusters in two regions with Azure Traffic Manager enables active-passive or active-active failover. Traffic Manager uses DNS-based routing to direct traffic to the secondary region when the primary fails, meeting the RTO of 15 minutes. The stateless application can be redeployed or scaled in the secondary cluster, while the Azure SQL Database with active geo-replication ensures an RPO of 5 seconds by continuously replicating transactions.

Answer

Deploy a single AKS cluster with pods spread across availability zones within the region.

Answer

Use Azure Site Recovery to replicate the AKS cluster to another region.

Answer

Back up the AKS cluster configuration and container images to a geo-redundant storage account.

Question 3

A company deploys a web application on Azure VMs across availability zones. They need to distribute HTTPS traffic, offload SSL termination, and maintain session persistence. They do not require traffic inspection. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway v2.. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports HTTPS traffic distribution, SSL termination (offloading the decryption burden from backend VMs), and session persistence via cookie-based affinity. It meets all requirements without needing traffic inspection, which is optional and can be disabled.

Answer

Azure Load Balancer (Standard).

Answer

Azure Traffic Manager.

Answer

Azure Front Door.

Question 4

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to grant specific IT administrators just-in-time (JIT) access to Azure virtual machines for troubleshooting. The access must be time-bound, require approval from a senior manager, and be automatically revoked after the granted time period. The company also needs an audit log of all access requests and assignments. Which Azure service or feature should they use?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources. Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources provides just-in-time (JIT) access with time-bound activation, approval workflows, and automatic revocation. It also includes full audit logging of all requests and assignments, meeting all the specified requirements for granting temporary access to Azure VMs.

Answer

Azure Bastion

Answer

Just-in-Time VM access (Microsoft Defender for Cloud)

Answer

Microsoft Entra ID Application Proxy

Question 5

You are designing a disaster recovery solution for a multi-tier application. The application consists of a web tier, an application tier, and a database tier running SQL Server on Azure VMs. The RPO must be 5 seconds, and the RTO must be 15 minutes. You need to recommend a SQL Server availability solution that meets these requirements. What should you use?

Accepted Answer

SQL Server Always On Availability Groups with synchronous commit and automatic failover. SQL Server Always On Availability Groups with synchronous commit and automatic failover provides near-zero data loss (RPO of 5 seconds) and rapid automatic failover (RTO of 15 minutes) by replicating data synchronously across replicas. This solution meets the stringent RPO/RTO requirements for a multi-tier application running SQL Server on Azure VMs, as it ensures transactions are committed on both primary and secondary replicas before acknowledging success, and automatic failover occurs within seconds if the primary fails.

Answer

Azure SQL Database Managed Instance automatic backups

Answer

Azure Site Recovery with replication of SQL Server VMs

Answer

SQL Server log shipping

Question 6

A company plans to store operational logs from Azure App Services in a scalable and cost-effective way. The logs must be retained for 90 days and then automatically deleted. Which Azure data storage solution should you recommend?

Accepted Answer

Azure Log Analytics Workspace. Azure Log Analytics Workspace is the correct choice because it natively ingests operational logs from Azure App Services via diagnostic settings, provides a scalable and cost-effective storage tier with a 90-day retention policy that can be configured to automatically delete data after the retention period expires. It also supports Kusto Query Language (KQL) for analysis and integrates with Azure Monitor for alerting, making it purpose-built for log storage and management.

Answer

Azure Blob Storage with lifecycle management

Answer

Azure SQL Database with retention policy

Answer

Azure Cosmos DB with TTL

Question 7

You need to monitor the sign-in activities of users in Microsoft Entra ID and detect risky sign-ins, such as those from anonymous IP addresses. Which service should you use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct service because it is specifically designed to detect and respond to risky sign-in activities, including sign-ins from anonymous IP addresses, using machine learning-based risk detection policies. It integrates directly with Microsoft Entra ID to evaluate sign-in risk in real time and can automatically block or require multi-factor authentication based on configured risk thresholds.

Answer

Microsoft Defender XDR

Answer

Azure Monitor

Answer

Microsoft Sentinel

Question 8

You are designing a landing zone in Azure for a regulated financial services company. They require that all storage accounts be restricted to specific virtual networks and have encryption using customer-managed keys (CMK). Additionally, they want to ensure that any storage account creation outside of the approved network boundaries is prevented. Which combination of Azure Policy and Network Security controls should you recommend?

Accepted Answer

Use Azure Policy to enforce service endpoints on storage accounts and deny creation if not present, along with a policy requiring CMK encryption.. It combines Azure Policy to enforce service endpoints on storage accounts (denying creation if not present) with a policy requiring customer-managed keys (CMK) for encryption. Service endpoints restrict storage account access to specific virtual networks at the network layer, while the CMK policy ensures compliance with encryption requirements. This directly addresses the company's need to prevent storage account creation outside approved network boundaries and enforce encryption.

Answer

Use Azure Policy to require storage account encryption with CMK, and use network security groups (NSGs) to restrict storage account access to specific subnets.

Answer

Deploy Azure Firewall in the hub virtual network and configure application rules to allow only approved storage accounts.

Answer

Use Azure Policy to require storage accounts to use private endpoints, and use Azure Private Link to restrict access from specific virtual networks.

Question 9

A company has an on-premises Hyper-V environment with 20 virtual machines running various workloads. They want to use Azure as a disaster recovery site. The required recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. They want to automate failover and failback. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct service because it provides orchestrated replication, failover, and failback for Hyper-V VMs to Azure as a DR site. It supports the required RPO of 15 minutes (using near-synchronous replication with change tracking) and RTO of 2 hours (via automated recovery plans), and it natively automates both failover and failback processes without additional scripting.

Answer

Azure Migrate

Answer

Azure Backup

Answer

Azure Recovery Services Vault

Question 10

A global company is deploying a microservices application on AKS clusters in multiple Azure regions. They need to provide a single endpoint for users worldwide with SSL offloading, web application firewall, and URL path-based routing to the nearest healthy AKS cluster. They also need global load balancing with automatic failover. Which Azure service should they use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides global HTTP/HTTPS load balancing with SSL offloading, web application firewall (WAF) integration, and URL path-based routing. It uses Anycast-based routing to direct users to the nearest healthy AKS cluster, ensuring low latency and automatic failover across regions.

Answer

Azure Application Gateway

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Question 11

A company wants to monitor sign-in failures for their Microsoft Entra ID-integrated applications. They need a dashboard in Azure Monitor showing sign-in failures by application and user location. Which data source should they stream to a Log Analytics workspace?

Accepted Answer

Microsoft Entra ID Sign-in logs. Microsoft Entra ID Sign-in logs contain detailed information about every sign-in attempt, including success or failure status, application name, user location (IP address), and failure reasons. Streaming these logs to a Log Analytics workspace enables you to build custom dashboards in Azure Monitor that visualize sign-in failures by application and user location. Audit logs track configuration changes, not authentication events; Provisioning logs cover user/group synchronization; and Office 365 Activity logs focus on workload-specific actions, not general sign-in failures.

Answer

Microsoft Entra ID Audit logs

Answer

Microsoft Entra ID Provisioning logs

Answer

Office 365 Activity logs

Question 12

A company needs to store large amounts of unstructured data (log files) for analytics. The data is accessed frequently for the first 30 days, then occasionally for the next 90 days, and rarely after that but must be retained for 7 years for compliance. The data must not be modified or deleted during the retention period, and administrative access must not be able to bypass this restriction. They want to minimize storage costs. Which combination of Azure Blob Storage features should they configure?

Accepted Answer

Configure a lifecycle management policy to move blobs to Cool tier after 30 days and to Archive tier after 120 days. Apply a time-based retention policy with a retention period of 2,555 days and lock it.. It combines a lifecycle management policy to automatically transition blobs from Hot to Cool after 30 days and to Archive after 120 days, minimizing storage costs. The time-based retention policy with a locked retention period of 2,555 days (7 years) ensures that blobs cannot be modified or deleted during the retention period, and locking the policy prevents administrative bypass, meeting the compliance requirement.

Answer

Enable soft delete and versioning on the storage account, and use a custom script to delete blobs after 7 years. Manually move blobs to Cool and Archive tiers using Azure PowerShell.

Answer

Set each blob's access tier to Cool on upload, then manually change to Archive after 30 days. Enable Azure Backup on the storage account for retention.

Answer

Apply a legal hold on the container to prevent deletion, and configure a lifecycle policy to move blobs to Archive after 30 days.

Question 13

A company runs large-scale analytics workloads using Apache Hadoop and Spark. They need a cloud storage solution that is fully compatible with the Hadoop Distributed File System (HDFS) and provides unlimited storage with high throughput for parallel processing. They also want to take advantage of tiered storage to reduce costs for older data. Which Azure data service should they use?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with Azure Blob Storage, providing full HDFS compatibility. This allows Apache Hadoop and Spark workloads to use the `wasbs://` or `abfss://` driver for unlimited storage and high throughput parallel processing, while also supporting tiered storage (hot, cool, archive) to reduce costs for older data.

Answer

Azure Blob Storage

Answer

Azure Files

Answer

Azure Disk Storage

Question 14

A company has multiple Azure virtual networks (VNets) in different Azure regions and an on-premises data center connected via ExpressRoute. They want to connect all VNets to each other and to the on-premises network securely over the Microsoft global backbone. They also want to simplify management by using a single orchestration interface. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is correct because it provides a hub-and-spoke architecture that connects branch offices, VNets, and on-premises networks over the Microsoft global backbone. It offers a single orchestration interface for managing connectivity, routing, and security policies across multiple regions and ExpressRoute circuits, meeting the requirement for secure, global connectivity with simplified management.

Answer

VNet peering

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 15

A company is building a customer-facing web application. They want to allow users to sign in using their existing social accounts (Microsoft, Google, Facebook) or create a local account. The solution must be fully managed and support custom branding. Which Azure service should they use?

Accepted Answer

Microsoft Entra ID B2C (Business to Consumer). Microsoft Entra ID B2C (Business to Consumer) is the correct choice because it is a fully managed identity service designed specifically for customer-facing applications. It supports social identity providers (Microsoft, Google, Facebook) via OAuth 2.0 and OpenID Connect, allows local account creation, and provides extensive custom branding capabilities through customizable user flows and page layouts.

Answer

Microsoft Entra ID External Identities

Answer

Microsoft Entra ID B2B collaboration

Answer

Microsoft Entra ID Application Proxy