AZ-305 Practice Test 20 — 15 Questions

Question 1

A media company needs to store large video files that are frequently accessed for the first month, then infrequently after that. They want to minimize storage costs while ensuring files are instantly accessible when needed. Which storage strategy should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Blob Storage lifecycle management to move files from hot to cool after 30 days. Azure Blob Storage lifecycle management allows you to define rules that automatically transition blobs from the hot tier (frequent access) to the cool tier (infrequent access) after a specified number of days. This meets the requirement of instant accessibility for the first month and cost minimization thereafter, as the cool tier offers lower storage costs with the same low-latency access as the hot tier.

Answer

Store all files in the hot access tier

Answer

Manually move files between tiers using AzCopy

Answer

Store all files in the archive access tier

Question 2

You are reviewing the data protection settings of an Azure Blob Storage container using the above JSON. Which of the following is true?

Accepted Answer

Previous versions of blobs are retained. The JSON shows that the `versioning` property is set to `Enabled` for the Blob Storage container. When versioning is enabled, every modification to a blob creates a new version, and previous versions are retained indefinitely (or until explicitly deleted or a lifecycle management policy removes them). This directly supports the statement that previous versions of blobs are retained.

Answer

Deleted blobs are retained for 30 days

Answer

Blobs can be restored to any point within the last 7 days

Answer

Versioning is disabled

Question 3

A software company hosts 100 small Azure SQL databases for different clients. Each database has low average usage but experiences unpredictable spikes. The company wants to minimize costs while allowing each database to burst up to a maximum resource limit during spikes. They also need to easily add new databases without manual sizing. Which Azure SQL Database deployment option should they use?

Accepted Answer

Elastic pools. Elastic pools allow multiple databases with low average usage and unpredictable spikes to share a fixed pool of resources (eDTUs or eVCores), enabling each database to burst up to a maximum limit while minimizing overall cost. This model also supports easy addition of new databases without manual sizing, as they are simply added to the pool and share its allocated resources.

Answer

Single databases with DTU-based tiers

Answer

Managed Instance

Answer

Hyperscale single database

Question 4

A company runs a critical application using Azure SQL Database in the West US region. They need a disaster recovery solution that automatically fails over to a secondary region (East US) with a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 1 minute. The secondary region must also be able to serve read-only queries for reporting purposes. Which Azure SQL Database feature should they implement?

Accepted Answer

Azure SQL Database active geo-replication with auto-failover group. Active geo-replication with auto-failover groups is the correct choice because it provides automatic, synchronous failover to a secondary region with an RPO of 5 seconds and an RTO of 1 minute. Additionally, the secondary database can be used for read-only reporting by connecting with the 'ApplicationIntent=ReadOnly' connection string, meeting both the disaster recovery and reporting requirements.

Answer

Azure SQL Database geo-restore

Answer

Azure SQL Database copy

Answer

Azure SQL Managed Instance failover group

Question 5

A government agency is designing a solution to store sensitive citizen data. The data must be encrypted at rest and in transit. The agency requires that the encryption keys be managed by the agency and stored in a hardware security module (HSM). Additionally, the solution must comply with regulatory requirements that mandate customer-managed keys. You need to recommend a key management solution. What should you recommend?

Accepted Answer

Use Azure Key Vault Managed HSM with FIPS 140-2 Level 3 validated HSMs.. Azure Key Vault Managed HSM provides a fully managed, FIPS 140-2 Level 3 validated HSM that allows the agency to retain sole control of the encryption keys, meeting the requirement for customer-managed keys. It ensures data is encrypted at rest and in transit while keeping keys within the agency's own HSM boundary, which is essential for regulatory compliance.

Answer

Use Azure Key Vault Standard with software-protected keys.

Answer

Use Microsoft Purview to manage keys and compliance.

Answer

Use Azure Information Protection with a custom protection template.

Question 6

A company uses Microsoft Entra ID to manage identities for employees and partners. They need to allow partners to self-service reset their passwords using a mobile app notification. Which feature should you enable?

Accepted Answer

Microsoft Entra ID Self-Service Password Reset (SSPR). Microsoft Entra ID Self-Service Password Reset (SSPR) is the correct feature because it allows users, including partners configured as external users in the tenant, to reset their own passwords without administrator intervention. SSPR supports multiple authentication methods, including mobile app notification via the Microsoft Authenticator app, which satisfies the requirement for a mobile app notification-based reset. This feature is specifically designed for password reset scenarios and can be scoped to include guest users when properly configured.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Intune

Answer

Microsoft Entra ID Privileged Identity Management

Question 7

Refer to the exhibit. Your team deploys this ARM template to a resource group in West US. After deployment, you need to ensure the storage account is geo-redundant. What is the most efficient way to modify the template to achieve this?

Accepted Answer

Change the 'sku.name' property from 'Standard_LRS' to 'Standard_GRS'.. Changing the 'sku.name' property from 'Standard_LRS' to 'Standard_GRS' directly modifies the replication type of the existing storage account to geo-redundant storage (GRS). This is the most efficient approach as it updates the single resource in-place without adding extra resources or altering the storage account's kind or API version.

Answer

Add a second storage account resource with Geo-redundant replication.

Answer

Change the 'kind' property to 'BlobStorage'.

Answer

Change the 'apiVersion' to a newer version.

Question 8

A company uses Microsoft Entra ID (Microsoft Entra ID). External partners need temporary access to an internal application. The process must be self-service: partners request access, the request goes through an approval workflow managed by a manager from the partner's organization, and access automatically expires after 30 days. The company also wants to send reminder emails 7 days before expiration. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Governance - Entitlement Management. Microsoft Entra ID Identity Governance - Entitlement Management is specifically designed to manage access for external users through self-service access packages. It supports approval workflows with external managers, automatic time-bound access (e.g., 30-day expiration), and lifecycle notifications like reminder emails 7 days before expiry. This aligns perfectly with the requirement for partner-managed, temporary, self-service access.

Answer

Microsoft Entra ID Identity Governance - Access Reviews

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Question 9

A company runs a web application on Azure App Service with a Standard tier plan. The application uses an Azure SQL Database (DTU-based) for storage. The business requires that the application remain available in the event of a single Azure region outage. Which solution meets the requirement with the least administrative effort?

Accepted Answer

Deploy an additional App Service in a secondary region and use Azure SQL Database active geo-replication. Deploying an additional App Service in a secondary region and using Azure SQL Database active geo-replication ensures that both the compute and data tiers can fail over to a different Azure region during a regional outage. Active geo-replication creates readable secondary replicas of the SQL Database in the paired region, and with App Service, you can use Azure Front Door or Traffic Manager to route traffic to the secondary instance. This solution meets the availability requirement with minimal administrative overhead, as geo-replication is managed by Azure and does not require complex manual synchronization.

Answer

Use an App Service Environment (ASE) in a single region with App Service plans in multiple availability zones

Answer

Use Azure Front Door to route traffic to a secondary App Service in the same region

Answer

Configure Azure Backup for the App Service and SQL Database

Question 10

You are designing a storage solution for a globally distributed application that requires low-latency read access from multiple regions. Which Azure storage solution should you recommend?

Accepted Answer

Azure Cosmos DB with multi-region writes and multiple read regions. Azure Cosmos DB with multi-region writes and multiple read regions is the correct choice because it provides turnkey global distribution with single-digit-millisecond latency for reads and writes from any Azure region. This solution directly addresses the requirement for low-latency read access from multiple regions, as Cosmos DB automatically replicates data to all configured regions and offers multiple consistency models to balance performance and data freshness.

Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS)

Answer

Azure SQL Database with active geo-replication

Answer

Azure Files with Azure File Sync

Question 11

Your company has a Azure subscription with multiple resource groups. You need to ensure that all resources are tagged with a 'CostCenter' tag. What should you use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it enforces organizational standards and compliance by evaluating resources for non-compliance with defined rules, such as requiring a specific tag. You can create a policy that audits or denies resources missing the 'CostCenter' tag, ensuring all resources are tagged automatically or during deployment.

Answer

Azure Blueprints

Answer

Management Groups

Answer

Azure RBAC

Question 12

A company runs a legacy on-premises application that relies on a SQL Server database. They want to use Azure as a disaster recovery site with a recovery point objective of less than 15 minutes. They need to be able to fail back to the on-premises environment after a disaster. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of on-premises SQL Server workloads to Azure, supporting a Recovery Point Objective (RPO) of less than 15 minutes through continuous replication. It enables failback to the original on-premises environment after a disaster, which is a critical requirement for this scenario.

Answer

Azure Backup

Answer

Azure SQL Database

Answer

Azure Traffic Manager

Question 13

Your company has Azure virtual machines running a critical application. You need to back up these VMs daily and retain backups for 7 years. The solution must be cost-effective and support application-consistent backups. What should you use?

Accepted Answer

Azure Backup. Azure Backup is the correct choice because it provides a native, cost-effective backup solution for Azure VMs that supports application-consistent backups via the Volume Shadow Copy Service (VSS) for Windows and file-system-consistent backups for Linux. It allows you to configure a backup policy with daily backups and a retention duration of up to 99 years, easily meeting the 7-year requirement. Azure Backup also integrates with Azure Recovery Services vault, offering centralized management and long-term retention at a lower cost than other disaster recovery or snapshot-based approaches.

Answer

Azure Files backup

Answer

Azure Site Recovery

Answer

Azure VM snapshots stored in Azure Storage

Question 14

A company wants to store raw data from IoT devices, social media feeds, and transactional databases for analytics. They need a storage solution that supports a hierarchical namespace for organizing data into directories and allows fine-grained access control at the directory and file level. They also need to query the data using Azure Synapse Analytics in-place. Which Azure storage solution should they use?

Accepted Answer

B. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it provides a hierarchical namespace that organizes data into directories and subdirectories, supports POSIX-like fine-grained access control at the directory and file level via ACLs, and can be queried in-place by Azure Synapse Analytics using its built-in serverless SQL pool or dedicated SQL pool. This combination of hierarchical namespace, granular security, and direct analytics integration makes it ideal for the described raw data storage and analytics scenario.

Answer

A

Answer

C

Answer

D

Question 15

You are a solutions architect for a financial services company. The company is deploying a new critical application on Azure that processes sensitive customer transactions. The application consists of an ASP.NET Core web app (Azure App Service), a REST API (Azure Kubernetes Service), and an Azure SQL Database. The requirements are:

- All data at rest must be encrypted using customer-managed keys (CMK) stored in a managed HSM.
- All network traffic between components must be encrypted and traverse the Microsoft backbone network.
- The web app must be protected against common web attacks (SQL injection, XSS).
- The solution must automatically scale the API based on CPU utilization.
- All API calls must be authenticated using OAuth 2.0 with Microsoft Entra ID.
- Logs from all components must be sent to a central Log Analytics workspace for analysis.
- The solution must have a recovery time objective (RTO) of 1 hour and recovery point objective (RPO) of 5 minutes for the database.

Which combination of Azure services should you recommend to meet ALL requirements?

Accepted Answer

Azure Application Gateway with WAF, Azure SQL Database failover groups, Azure Key Vault Managed HSM, Azure App Service with service endpoint, AKS with HPA, Azure Monitor Agent, Microsoft Entra ID. Meets all requirements: Azure Application Gateway with WAF protects against SQL injection and XSS; Azure SQL Database failover groups provide an RPO of 5 seconds and an RTO of 1 hour (auto-failover); Azure Key Vault Managed HSM stores customer-managed keys for encryption at rest; App Service with service endpoint ensures traffic to other Azure services stays on the Microsoft backbone network (combined with AKS in a VNet, internal traffic stays on backbone); AKS with Horizontal Pod Autoscaler (HPA) scales pods based on CPU utilization; Azure Monitor Agent sends logs to Log Analytics; Microsoft Entra ID authenticates API calls via OAuth 2.0. Option A uses point-in-time restore, which cannot guarantee RPO of 5 minutes and RTO of 1 hour. Option B uses Key Vault Standard instead of Managed HSM. Option C uses cluster autoscaler, which scales nodes, not pods, failing the CPU-based scaling requirement.

Answer

Azure Front Door with WAF, Azure SQL Database point-in-time restore, Azure Key Vault Managed HSM, Azure App Service with private endpoint, AKS with HPA, Azure Log Analytics agent, Microsoft Entra ID

Answer

Azure Front Door with WAF, Azure SQL Database geo-replication, Azure Key Vault (Standard), Azure App Service with private endpoint, AKS with HPA, Azure Diagnostics extension, Microsoft Entra ID

Answer

Azure Application Gateway with WAF, Azure SQL Database active geo-replication, Azure Key Vault Managed HSM, Azure App Service with VNet integration, AKS with cluster autoscaler, Azure Monitor Agent, Microsoft Entra ID