AZ-305 Practice Exam 3 — 20 Questions

Question 1

A company manages a fleet of millions of IoT devices that send telemetry data every minute. The data must be stored for 10 years to meet compliance requirements. For the first 30 days, data is accessed frequently for real-time dashboards and alerting. After 30 days, data is only accessed occasionally for historical analysis and reporting. The solution must be cost-effective and support high ingestion rates. Which Azure service should the company use to store and query this data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Data Explorer. Azure Data Explorer (ADX) is designed for high-ingestion, time-series telemetry data and supports real-time dashboards and alerting on fresh data, while also providing cost-effective long-term storage for historical queries. Its columnar storage and indexing enable fast analytics on billions of records, making it ideal for IoT scenarios with millions of devices sending data every minute and a 10-year retention requirement.

Answer

Azure Blob Storage with Azure Data Lake Storage Gen2

Answer

Azure SQL Database

Answer

Azure Cosmos DB with SQL API

Question 2

A company has virtual machines in Azure that need to be grouped across multiple fault domains and update domains to ensure high availability. They plan to deploy three VMs running the same application tier. Which Azure feature should they use to provide redundancy within a single region?

Accepted Answer

Availability Set. An Availability Set distributes VMs across multiple fault domains (shared hardware, power, and networking) and update domains (planned maintenance) within a single Azure datacenter. This ensures that at least one VM remains available during both hardware failures and Azure patching cycles. For three VMs running the same application tier, an Availability Set provides the required redundancy without the complexity of zone-level isolation.

Answer

Availability Zone

Answer

Virtual Machine Scale Set with manual scaling

Answer

Azure Site Recovery

Question 3

A company runs a stateless web application on Azure VMs. They need to ensure the application remains available in the event of an entire Azure datacenter failure. They want to achieve a 99.99% SLA. Which deployment option should they recommend?

Accepted Answer

B. To survive an entire Azure datacenter failure and achieve a 99.99% SLA, the stateless web application must be deployed across at least two Azure Availability Zones within a region. Availability Zones are physically separate datacenters within the same region, each with independent power, cooling, and networking. Deploying VMs in a zone-redundant configuration ensures that if one datacenter fails, the application continues running in another zone, meeting the 99.99% SLA (which requires a minimum of two zones).

Answer

A

Answer

C

Answer

D

Question 4

A company runs a critical SQL Server database on an Azure virtual machine. They need a backup strategy that supports point-in-time restore down to the second and long-term retention of backups for 7 years to meet compliance. They want to offload backup management to Azure. Which backup solution should they use?

Accepted Answer

Azure Backup for SQL Server on Azure VM. Azure Backup for SQL Server on Azure VM provides native integration that supports point-in-time restore down to the second for SQL Server databases and allows configuring long-term retention (LTR) for up to 10 years, meeting the 7-year compliance requirement. It offloads backup management to Azure by automating backup schedules, retention policies, and restore operations without requiring manual scripting or third-party tools.

Answer

Azure Site Recovery

Answer

SQL Server managed backup to Azure

Answer

Azure Disk Backup

Question 5

A company runs a critical Azure SQL Database in the West US region. They need a disaster recovery solution that automatically fails over to a secondary region (East US) with a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of less than 1 hour. Additionally, they want to offload read-only workloads to the secondary database during normal operations. Which Azure SQL Database feature should they enable?

Accepted Answer

Active geo-replication with failover groups. Active geo-replication with failover groups is the correct choice because it provides automatic, asynchronous replication of an Azure SQL Database to a secondary region (East US) with an RPO of up to 5 seconds and an RTO of less than 1 hour. Additionally, it supports readable secondary replicas, allowing read-only workloads to be offloaded to the secondary database during normal operations, meeting all stated requirements.

Answer

Point-in-time restore

Answer

Long-term backup retention

Answer

Always On availability groups (self-managed)

Question 6

A company has Azure virtual networks (VNets) in three different Azure regions (West US, East US, and West Europe). They also have an on-premises data center connected to the East US region via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. The solution must support transitive routing between all sites and provide centralized management of connectivity and routing policies. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is correct because it provides a hub-and-spoke architecture with built-in transitive routing between all VNets and on-premises sites. It supports automatic connectivity through Virtual Hub routers, which use BGP to propagate routes across all spokes and branches, meeting the requirement for centralized management of connectivity and routing policies.

Answer

VNet peering

Answer

VPN Gateway

Answer

ExpressRoute Direct

Question 7

A media company stores large video files that are accessed once a month for audits. When needed, they must be available for download immediately (within seconds). The company wants to minimize storage costs. Which Azure Blob Storage access tier should they use?

Accepted Answer

Cool tier. The Cool tier is optimal for this scenario because it balances low storage cost with high availability and low latency access. Video files accessed once a month for audits require immediate download (within seconds), which Cool tier supports with the same millisecond latency as Hot tier, but at a lower storage price. Archive tier would introduce a multi-hour rehydration delay, making it unsuitable for on-demand access within seconds.

Answer

Hot tier

Answer

Cold tier

Answer

Archive tier

Question 8

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to require multi-factor authentication (MFA) for all users accessing the Azure portal, but do not want MFA to be required for other applications like Office 365. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Conditional Access. Conditional Access in Microsoft Entra ID allows granular control over authentication requirements based on conditions such as application, user, location, or device state. By creating a Conditional Access policy targeting the Azure Portal application and requiring MFA, the company can enforce MFA specifically for Azure Portal access without affecting other applications like Office 365, which can be excluded from the policy.

Answer

Microsoft Entra ID Security defaults

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 9

A company deploys a web application on multiple Azure VMs. They need to distribute incoming HTTP traffic across the VMs, offload SSL/TLS termination, and maintain session persistence (sticky sessions) so that all requests from a user session go to the same backend VM. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a Layer 7 load balancer that can route HTTP/HTTPS traffic, offload SSL/TLS termination, and support session persistence using cookie-based affinity. This makes it the correct choice for distributing incoming HTTP traffic across multiple VMs while maintaining sticky sessions and handling SSL termination at the gateway.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 10

A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They need to automatically block sign-ins from anonymous IP addresses (e.g., Tor) and force users from risky sign-ins to reset their password. They want to minimize administrative effort and use built-in features. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Microsoft Entra ID Identity Protection risk policies (sign-in risk and user risk).. Microsoft Entra ID Identity Protection provides built-in risk policies that automatically detect and block sign-ins from anonymous IP addresses (e.g., Tor) via the sign-in risk policy, and force password reset for users flagged with high user risk via the user risk policy. These policies operate without manual intervention, minimizing administrative effort while leveraging Premium P2 capabilities.

Answer

Conditional Access policies with locations and grant controls.

Answer

Microsoft Entra ID Privileged Identity Management (PIM).

Answer

Microsoft Entra ID Access Reviews.

Question 11

A company wants to collect metrics and logs from all Azure resources in their subscription, including custom metrics from their applications, and create dashboards and alerts. Which Azure service should they use as the primary monitoring platform?

Accepted Answer

Azure Monitor. Azure Monitor is the correct primary monitoring platform because it serves as the single, unified ingestion and analysis service for all metrics and logs across Azure resources, including custom metrics from applications via the Application Insights SDK or the custom metrics API. It provides a consolidated workspace for creating dashboards, setting alerts, and querying data, making it the foundational service for observability in Azure.

Answer

Azure Log Analytics

Answer

Azure Application Insights

Answer

Azure Service Health

Question 12

A company is designing a hub-spoke network topology in Azure. The hub contains a third-party network virtual appliance (NVA) for inspection. Spokes need to communicate with each other, and all inter-spoke traffic must be routed through the NVA in the hub. Which configuration should they use?

Accepted Answer

Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA. User-defined routes (UDRs) allow you to explicitly override Azure's default system routes. By adding a route in each spoke subnet with the hub NVA's private IP as the next hop for inter-spoke traffic (e.g., 10.1.0.0/16 -> 10.0.0.4), all traffic between spokes is forced through the NVA for inspection. This ensures the hub-spoke topology meets the requirement without relying on Azure Firewall or Internet routing.

Answer

Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet

Answer

Configure Azure Firewall in the hub with forced tunneling to on-premises

Answer

Use VNet peering with gateway transit enabled

Question 13

A company runs a critical SQL Server database on Azure Virtual Machines in a single region. They need a disaster recovery solution across regions with a recovery point objective (RPO) of zero. The database is update-intensive with frequent writes. Which configuration should they implement?

Accepted Answer

SQL Server Always On Availability Group with synchronous commit across regions.. SQL Server Always On Availability Group with synchronous commit across regions ensures zero data loss because transactions are committed on both the primary and secondary replicas before the primary acknowledges the commit. This meets the RPO of zero, even though it introduces latency due to cross-region synchronization. For an update-intensive workload, synchronous commit is the only option that guarantees no data loss at the cost of increased write latency.

Answer

SQL Server Always On Availability Group with asynchronous commit.

Answer

Azure Site Recovery to another region.

Answer

Deploy the VMs in a different availability zone within the same region.

Question 14

A company runs a custom analytics application that reads data using the NFS 3.0 protocol. The data consists of large files organized in a directory structure. The application also requires POSIX-like access control lists (ACLs) for fine-grained permissions. The solution must be fully managed and support high throughput for parallel reads. Which Azure data service should they use?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and supports the NFS 3.0 protocol for high-throughput parallel reads. It is fully managed and designed for big data analytics workloads that require fine-grained permissions and directory structure management.

Answer

Azure Blob Storage

Answer

Azure Files

Answer

Azure NetApp Files

Question 15

A multinational corporation is designing a disaster recovery strategy for a critical application running on Azure VMs. The application must have a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The primary region is East US, and the secondary region is West US. The solution must minimize costs while meeting the requirements. What should you recommend?

Accepted Answer

Implement Azure Site Recovery for the VMs. Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs from a primary to a secondary region with an RPO as low as 15 minutes (Premium SSD) and RTOs that can be met within 1 hour through planned failover. It is the native Azure service designed for disaster recovery of IaaS workloads, offering cost-effective replication without requiring always-on secondary VMs, as it only incurs storage costs for replicated disks until failover.

Answer

Deploy an active-passive configuration with Azure Front Door and Traffic Manager

Answer

Configure the VMs in an availability zone across East US and West US

Answer

Use Azure Backup with cross-region restore for the VMs

Question 16

A company uses Microsoft Entra ID. They want to grant a user temporary access to the Global Administrator role for a specific task. The access must require approval from a manager and automatically expire after 4 hours. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing users to activate roles like Global Administrator for a limited time. It supports approval workflows (manager approval) and configurable activation duration (e.g., 4 hours), making it the correct choice for temporary, approved, time-bound role elevation.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Access Reviews

Question 17

A company is building a global real-time collaboration platform. The application data is stored as JSON documents and needs to be available for low-latency reads and writes from multiple geographic regions. The application must support multi-region writes so that users can update data from any region with automatic conflict resolution. The company wants a fully managed database service with a guaranteed SLA for availability and throughput. Which Azure data service should they choose?

Accepted Answer

Azure Cosmos DB with SQL API and multiple write regions. Azure Cosmos DB with SQL API and multiple write regions is the correct choice because it is a fully managed, globally distributed NoSQL database that natively supports multi-region writes with automatic conflict resolution. It provides low-latency reads and writes from any region, a guaranteed SLA for availability (99.999% for multi-region writes) and throughput, and is optimized for JSON document storage, making it ideal for a real-time collaboration platform.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Table Storage

Answer

Azure Cache for Redis

Question 18

A company uses Microsoft Entra ID and wants to allow users to sign in using their existing personal Microsoft accounts, Google, and Facebook identities. They also need custom sign-up and sign-in flows with collection of specific user attributes. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID B2C. Microsoft Entra ID B2C (Business-to-Consumer) is the correct choice because it is specifically designed to support external identity providers like personal Microsoft accounts, Google, and Facebook, and it provides a customizable policy framework (user flows) for sign-up and sign-in that can collect custom user attributes. Unlike B2B, which focuses on business partner collaboration, B2C allows you to define attribute collection during registration via built-in or custom policies.

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Conditional Access

Question 19

A company stores JSON documents for a mobile app backend. The data needs to be accessible from multiple global regions with low latency writes from any region. The app uses a client-side library that supports automatic conflict resolution for concurrent updates. Which Azure data service should they choose?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is correct because it provides multi-region writes with automatic conflict resolution, which directly matches the requirement for low-latency writes from any global region. Its multi-master replication model allows any region to accept writes, and the client-side library can use last-writer-wins (LWW) or custom conflict resolution policies to handle concurrent updates seamlessly.

Answer

Azure SQL Database

Answer

Azure Database for PostgreSQL

Answer

Azure Table Storage

Question 20

A company deploys a web application across multiple Azure VMs in a single region. They need to distribute incoming HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools (e.g., /images to one pool, /api to another). Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a Layer 7 load balancer that can distribute HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools. This directly matches the requirements for routing /images and /api traffic to separate pools while handling SSL termination at the gateway.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door