AZ-305 Practice Test 24 — 15 Questions

Question 1

Your company has a large Azure environment with thousands of resources. You need to design a solution to track resource ownership and ensure that resources are cleaned up when projects end. You want to use a tag-based approach where each resource has an 'Owner' and 'Project' tag. Additionally, you need to generate a weekly report of resources that are not tagged or have been orphaned (no recent activity). What should you include in the design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Resource Graph queries in an Azure Logic App scheduled to run weekly, and send the report via email.. Azure Resource Graph (ARG) provides fast, queryable access to resource properties across subscriptions, enabling efficient identification of untagged or orphaned resources. Scheduling an Azure Logic App to run ARG queries weekly and email the report meets the requirements for automation and delivery without additional infrastructure. This approach is cost-effective and scales well for thousands of resources.

Answer

Use Azure Policy to audit missing tags and create a custom dashboard in Azure Monitor.

Answer

Use Azure Monitor alerts with a metric alert for unmodified resources.

Answer

Use Azure Automation runbook to inventory resources and store in a SQL database, then use Power BI to report.

Question 2

A company stores petabytes of sensor data in Azure Data Lake Storage Gen2. They need to run complex analytics queries that involve joining multiple datasets and aggregating time-series data. The queries must complete within seconds. Which Azure service should they use for querying?

Accepted Answer

Azure Synapse Analytics. Azure Synapse Analytics (Option C) is correct because it provides a unified analytics platform that can directly query petabyte-scale data in Azure Data Lake Storage Gen2 using T-SQL or Spark, and its distributed query engine (PolyBase or Synapse SQL) can perform complex joins and time-series aggregations with sub-second response times when combined with appropriate indexing and materialized views.

Answer

Azure Stream Analytics

Answer

Azure Data Explorer

Answer

Azure Databricks

Question 3

Your company has a hybrid network with multiple on-premises sites connected to Azure via ExpressRoute. You need to design a DNS resolution strategy that allows Azure resources to resolve on-premises hostnames and on-premises clients to resolve Azure hostnames. The solution must minimize administrative overhead. What should you use?

Accepted Answer

Azure DNS Private Resolver. Azure DNS Private Resolver enables hybrid DNS resolution by forwarding DNS queries between on-premises networks and Azure virtual networks without requiring domain-joined VMs or custom DNS servers. It supports conditional forwarding to on-premises DNS servers via ExpressRoute, allowing Azure resources to resolve on-premises hostnames and vice versa, while minimizing administrative overhead through a managed service.

Answer

Azure Bastion

Answer

Azure DNS public zones with conditional forwarding

Answer

Azure Firewall DNS proxy

Question 4

You are designing a network architecture for a multi-tier application. The front-end tier is an Azure Application Gateway that routes traffic to a web app on Azure App Service. The back-end tier is an Azure SQL Database. You need to ensure that all traffic between the Application Gateway and the web app remains within the Azure backbone network, and that the web app can only be accessed through the Application Gateway. What should you configure?

Accepted Answer

Enable Service Endpoints for the web app and configure the Application Gateway with a private IP.. Enabling Service Endpoints for the web app allows traffic from the Application Gateway to reach the App Service over the Azure backbone network, bypassing the public internet. Configuring the Application Gateway with a private IP and restricting the web app's access to only that private IP ensures the web app can only be accessed through the gateway, meeting both requirements.

Answer

Use Azure Private Link for the web app and disable public access.

Answer

Deploy Azure Firewall in front of the Application Gateway.

Answer

Use a site-to-site VPN between the App Service and Application Gateway.

Question 5

You are designing a solution for a critical application that requires low latency between multiple Azure regions. The application must handle failover automatically if a region becomes unavailable. You need to distribute traffic across regions and ensure that users are directed to the closest healthy endpoint. What should you implement?

Accepted Answer

Azure Traffic Manager with geographic routing and endpoint monitoring. Azure Traffic Manager with geographic routing and endpoint monitoring is the correct choice because it operates at the DNS level, directing users to the closest healthy endpoint based on geographic location. This ensures low latency by routing traffic to the nearest region and provides automatic failover by continuously monitoring endpoint health and rerouting traffic if a region becomes unavailable.

Answer

Azure Standard Load Balancer with cross-region load balancing

Answer

Azure Front Door with priority routing

Answer

Azure Application Gateway with autoscaling

Question 6

Which THREE of the following are valid methods to secure access to Azure Storage accounts? (Choose three.)

Accepted Answer

Generate Shared Access Signatures (SAS) with limited permissions and expiry. Shared Access Signatures (SAS) allow you to grant time-limited, delegated access to specific storage resources (e.g., blobs, queues) with granular permissions (read, write, delete) and an expiry time, without exposing the account key. This is a key security method for controlling access at the resource level.

Answer

Enable Azure Front Door to authenticate requests

Answer

Use storage account access keys for authentication

Question 7

A company is designing a backup and disaster recovery solution for an on-premises SQL Server database that will be migrated to Azure. The solution must meet the following requirements: 1) Point-in-time restore up to 30 days. 2) Cross-region restore in case of a regional disaster. 3) Long-term retention of backups for 7 years for compliance. Which THREE Azure services or features should the company use? (Choose three.)

Accepted Answer

Azure Site Recovery. Azure Site Recovery (B) is correct because it provides cross-region replication and orchestrated failover for SQL Server, enabling disaster recovery with the ability to restore in a secondary Azure region. This directly meets the requirement for cross-region restore in case of a regional disaster.

Answer

Azure Backup Server

Answer

Azure Blob Storage

Question 8

Match each Azure service to its primary function.

Accepted Answer

Azure Virtual Network: Enables private connectivity between Azure resources.. Correct matches: Azure Virtual Network provides private connectivity; Azure Load Balancer distributes traffic. Common confusions mix layer-4 and layer-7 services, and regional vs. global routing.

Answer

Azure VPN Gateway: Provides application-layer load balancing and web application firewall.

Answer

Azure Application Gateway: Routes incoming traffic across global Azure regions based on routing methods.

Answer

Azure Traffic Manager: Connects on-premises networks to Azure via encrypted tunnels.

Question 9

You need to design a data storage solution for a mobile app that requires low-latency reads and writes globally. The data is JSON documents with varying schemas. Which Azure service should you choose?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it provides native global distribution with multi-region writes and single-digit-millisecond latency at the 99th percentile, making it ideal for a mobile app requiring low-latency reads and writes worldwide. It natively supports JSON documents with varying schemas through its document model and offers multiple consistency levels to balance performance and data integrity.

Answer

Azure Cache for Redis

Answer

Azure SQL Database

Answer

Azure Table Storage

Question 10

Your organization runs a critical application on Azure VMs that must be highly available within a region. The application is stateful and requires shared storage. You need to design a solution that can automatically recover from a VM failure with minimal downtime. What should you include in the design?

Accepted Answer

Deploy the VMs in an availability set and use Azure Shared Disks for the stateful data.. An availability set distributes VMs across fault domains and update domains within a datacenter, providing redundancy for VM failures. Azure Shared Disks enable multiple VMs to attach and access the same managed disk, fulfilling the shared storage requirement for stateful applications. Option A is incorrect because a single VM with Azure Backup does not provide automatic failover; backup is for data recovery, not high availability. Option B is incorrect because Azure NetApp Files is a shared storage service, but deploying VMs in different Availability Zones introduces cross-zone latency and is not necessary for intra-region HA; an availability set is more suitable for stateful apps requiring shared disks. Option C is incorrect because Azure Site Recovery replicates to a secondary region for disaster recovery, not for automatic recovery within a region.

Answer

Deploy a single VM with premium storage and Azure Backup for recovery.

Answer

Deploy the VMs in different Availability Zones and use Azure NetApp Files for storage.

Answer

Use Azure Site Recovery to replicate the VM to a secondary region.

Question 11

Your company is deploying a web application on Azure App Service. The application must be able to read secrets from Azure Key Vault without storing credentials in application code. Which feature should you enable?

Accepted Answer

Managed Identity. Managed Identity (C) is correct because it allows the App Service to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity lifecycle, and the app uses the Azure Identity SDK to obtain tokens for Key Vault access via the IMDS endpoint (169.254.169.254). This eliminates the need for secrets or certificates in the application.

Answer

Key Vault access policies

Answer

Azure AD Application Registration with client secret

Answer

App Service Authentication / Authorization

Question 12

You are designing a backup and disaster recovery strategy for an Azure SQL Database instance that runs a critical business application. The database is 500 GB and experiences high transaction rates. The recovery point objective (RPO) is 1 minute and recovery time objective (RTO) is 1 hour. What should you recommend?

Accepted Answer

Configure active geo-replication to a secondary region in the same Azure geography.. Active geo-replication for Azure SQL Database provides a continuously synchronized readable secondary replica in a different Azure region, enabling failover with an RPO of 1 minute (due to synchronous replication) and an RTO of 1 hour (since failover is manual or can be automated). This meets the critical business application's requirements for high transaction rates and low data loss.

Answer

Enable geo-redundant backup storage and use geo-restore in the secondary region.

Answer

Configure automated backups with locally-redundant storage (LRS) and enable point-in-time restore.

Answer

Export the database to a bacpac file daily and store it in Azure Blob Storage.

Question 13

You are designing a solution to monitor a hybrid environment consisting of Azure VMs and on-premises servers. The solution must provide centralized log analytics, security threat detection, and the ability to run custom queries across all logs. Which TWO Azure services should you include? (Choose two.)

Accepted Answer

Azure Log Analytics workspace. A Log Analytics workspace is the central repository in Azure that ingests and stores log data from various sources, including Azure VMs and on-premises servers. It enables you to run custom Kusto Query Language (KQL) queries across all collected logs, which directly satisfies the requirement for centralized log analytics and custom querying.

Answer

Azure Monitor Agent

Answer

Azure Arc

Answer

Azure Update Manager

Question 14

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to ensure that an alert is generated when an Azure VM is created with an open inbound SSH port (22) from the internet. The solution should use existing Azure resources and minimize administrative overhead. What should you use?

Accepted Answer

Create a Microsoft Sentinel analytics rule using the Azure Activity data connector.. Microsoft Sentinel's Azure Activity data connector ingests resource logs from Azure's control plane (Azure Resource Manager). By creating an analytics rule that detects a 'Microsoft.Compute/virtualMachines/write' operation with a network security group rule allowing inbound SSH (port 22) from 'Internet' (any IP), you can generate an alert without deploying additional agents or infrastructure. This minimizes administrative overhead by using existing Sentinel resources and the built-in Activity log connector.

Answer

Create an Azure Policy with audit effect and configure a Sentinel data connector for Azure Policy.

Answer

Create an Azure Monitor metric alert on the 'Network In' metric.

Answer

Enable Microsoft Defender for Cloud and configure a continuous export to Sentinel.

Question 15

Your organization has a large number of virtual machines running in Azure. You need to centrally manage backup policies, monitor backup jobs, and ensure compliance with retention requirements. Which Azure service should you use?

Accepted Answer

Azure Backup Center. Azure Backup Center provides a single, unified management experience for backup estates, enabling centralized policy management, monitoring of backup jobs and alerts, and compliance reporting across multiple vaults and subscriptions. It is specifically designed to address the need for a central console to govern backup operations at scale, unlike other services that focus on policy enforcement, disaster recovery, or general monitoring.

Answer

Azure Policy

Answer

Azure Site Recovery

Answer

Azure Monitor