AZ-305 Practice Test 3 — 25 Questions

Question 1

A small business is migrating its on-premises file server to Azure. The file server contains 2 TB of data that is accessed infrequently. The business wants to minimize costs and only pay for storage used. The solution must support SMB protocol and allow for on-premises caching to reduce latency. Which Azure storage solution should the business recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Files Standard tier with Azure File Sync. Azure Files Standard tier with Azure File Sync is correct because it provides fully managed SMB file shares in the cloud, supports the required SMB protocol, and Azure File Sync enables on-premises caching to reduce latency. The Standard tier is cost-effective for infrequently accessed data, and the pay-as-you-go model minimizes costs by charging only for actual storage used.

Answer

Azure Disk Storage Standard HDD with shared disks

Answer

Azure NetApp Files Standard tier with cross-region replication

Answer

Azure Blob Storage Cool tier with Azure Storage Explorer

Question 2

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that automatically blocks sign-ins from risky users and requires multi-factor authentication (MFA) when a sign-in risk is detected. Which TWO services should you use? (Choose two.)

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (B) is the service that detects sign-in risks (e.g., anonymous IP, atypical travel) and labels users or sign-ins as risky. Conditional Access policies (E) then enforce automated responses, such as blocking the sign-in or requiring MFA, based on the risk level from Entra ID Protection. Together, they provide the detection and enforcement mechanism described in the requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 3

Your company runs a Windows-based application on Azure Virtual Machines in the Brazil South region. The application uses Azure Files for shared storage and Azure SQL Database (Hyperscale tier) for the database. The business requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 30 minutes for the entire application. The solution must be cost-effective and leverage Azure-native services. You have been asked to design the disaster recovery strategy. Which option should you recommend?

Accepted Answer

Use Azure Site Recovery to replicate the VMs to a secondary region. Configure geo-redundant storage (GRS) for Azure Files. For Azure SQL Database Hyperscale, enable geo-restore and test restore procedures.. Azure Site Recovery provides VM replication with RPOs as low as 15 minutes and RTOs of minutes, meeting the 15-minute RPO and 30-minute RTO. Geo-redundant storage (GRS) for Azure Files ensures data is replicated to a paired secondary region with an RPO of 15 minutes (typically), and Azure SQL Database Hyperscale’s geo-restore allows restoring from geo-replicated backups, which can achieve the required RPO/RTO when tested and automated. This combination is cost-effective as it uses native Azure services without requiring a pre-provisioned secondary environment.

Answer

Deploy a second set of VMs in a secondary region. Use Azure File Sync to keep Azure Files in sync. Use Azure SQL Database failover groups with a readable secondary.

Answer

Back up the VMs using Azure Backup with a 15-minute frequency. Use Azure File Sync to replicate Azure Files to a secondary region. Use Azure SQL Database backup with point-in-time restore.

Answer

Use Azure Site Recovery for VMs. Use Azure File Sync for Azure Files. Use active geo-replication for Azure SQL Database.

Question 4

A software company hosts multiple small databases for different clients on Azure SQL Database. Each database has low average usage but experiences unpredictable spikes. The company wants to minimize cost by pooling resources across databases while allowing each database to consume resources up to a set limit during spikes. They also need the ability to easily add new databases without manual sizing. Which Azure SQL Database deployment option should they choose?

Accepted Answer

Azure SQL Database elastic pool. Azure SQL Database elastic pool is the correct choice because it allows multiple databases to share a fixed pool of resources (eDTUs or vCores), which minimizes cost by pooling resources across databases with low average usage and unpredictable spikes. Each database can automatically burst up to a configurable per-database resource limit (e.g., max eDTU per database) during spikes, and new databases can be added to the pool without manual sizing, as they simply consume from the shared pool.

Answer

Azure SQL Database single database with reserved capacity

Answer

Azure SQL Managed Instance

Answer

SQL Server on Azure Virtual Machines

Question 5

Which TWO of the following are valid strategies for achieving high availability for Azure SQL Database?

Accepted Answer

Deploy Azure SQL Database in a zone-redundant configuration within a single region.. Azure SQL Database's zone-redundant configuration automatically provisions a primary replica and multiple secondary replicas across different availability zones within the same region. This ensures that if one zone fails, the database automatically fails over to a secondary replica in another zone without data loss, providing an RPO of 0 and an RTO of typically under 60 seconds. Option C is correct because active geo-replication with a readable secondary in the same region creates a synchronous replica that can be used for both high availability and read-scale workloads, though it is more commonly used for cross-region scenarios; within the same region, it offers an additional layer of redundancy beyond the default local redundancy.

Answer

Enable read scale-out to distribute read queries to a secondary replica.

Answer

Use Azure Backup to copy database backups to another region.

Answer

Configure auto-failover groups with a secondary in another region.

Question 6

A company runs SQL Server on Azure VMs using SQL Server Standard Edition. They need a disaster recovery solution that replicates the database to a secondary Azure region with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. They cannot use Always On Availability Groups due to licensing constraints. They also need to perform non-disruptive disaster recovery drills. Which Azure service should they implement?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) replicates entire SQL Server VMs (including their databases) to a secondary Azure region, supporting RPOs as low as 30 seconds and RTOs of 2 hours or less. It allows non-disruptive disaster recovery drills by performing test failovers in an isolated network without affecting the production environment. This solution avoids the licensing constraints of Always On Availability Groups and works with SQL Server Standard Edition.

Answer

Azure Backup for SQL Server

Answer

SQL Server Log Shipping to an Azure VM

Answer

Geo-replication for Azure SQL Database

Question 7

Refer to the exhibit. You deploy this Azure Network Watcher connection monitor to test TCP connectivity on port 443 between two VMs. The test consistently shows 'Unreachable' status. Both VMs are running and have correct NSG rules allowing inbound port 443 from the source VM's IP. What is the most likely cause?

Accepted Answer

The source VM does not have the Network Watcher Agent installed.. Azure Network Watcher connection monitor relies on the Network Watcher Agent extension installed on both source and destination VMs to collect and report connectivity data. Without the agent on the source VM, the test cannot initiate the TCP probes, resulting in a persistent 'Unreachable' status regardless of NSG rules or VM health.

Answer

The destination VM's NSG is blocking the traffic despite the rule.

Answer

The destination VM's private IP address is incorrect.

Answer

A firewall on the destination VM is blocking TCP port 443.

Question 8

A company wants to store log data from multiple applications for up to 30 days for analysis. The data is append-only, and queries are infrequent but need to be fast when run. Which Azure data storage solution should you recommend?

Accepted Answer

Azure Log Analytics Workspace. Azure Log Analytics Workspace is the correct choice because it is purpose-built for ingesting, storing, and querying log data from multiple sources. It supports append-only log ingestion, retains data for up to 30 days in its interactive retention tier (configurable), and provides fast Kusto Query Language (KQL) queries for infrequent analysis. The workspace integrates natively with Azure Monitor and other services, making it ideal for centralized log analysis.

Answer

Azure Table Storage

Answer

Azure Data Lake Storage Gen2

Answer

Azure Blob Storage (archive tier)

Question 9

A company ingests millions of IoT events per second from sensors around the world. Each event is a JSON message with timestamp, device ID, and readings. They need to support real-time analytics dashboards and also store all raw data for long-term historical analysis. They want to minimize operational overhead. Which Azure data storage solution should they recommend?

Accepted Answer

Azure Event Hubs with Capture to Azure Data Lake Storage.. Azure Event Hubs is designed for high-throughput data ingestion, capable of handling millions of events per second. By enabling the Capture feature, data is automatically and durably persisted to Azure Data Lake Storage in Avro format, providing a serverless, low-latency pipeline for real-time dashboards while storing raw data for long-term analytics. This minimizes operational overhead by eliminating the need to manage separate ingestion and storage infrastructure.

Answer

Azure Data Lake Storage Gen2 for all data.

Answer

Azure Cosmos DB for both real-time and historical data.

Answer

Azure Time Series Insights (TSI) Standard.

Question 10

A company uses Azure Backup to protect on-premises Windows servers. The backup data is stored in a Recovery Services vault. They want to ensure that backup data is protected even if the entire Azure region fails. What should they configure?

Accepted Answer

Enable Cross-region restore (CRR) for the Recovery Services vault.. Cross-region restore (CRR) is the correct feature to protect backup data against an entire Azure region failure. When enabled on a Recovery Services vault with geo-redundant storage (GRS), CRR allows you to restore backup data to a paired secondary Azure region even if the primary region is unavailable. This ensures business continuity by providing a secondary restore point in a different region.

Answer

Configure backup replication across two Recovery Services vaults in different regions.

Answer

Enable geo-redundant storage (GRS) for the Recovery Services vault.

Answer

Use zone-redundant storage (ZRS) for the Recovery Services vault.

Question 11

Contoso Ltd. runs a mission-critical application on Azure Virtual Machines in the East US region. The application uses Azure SQL Database (Business Critical tier) and stores files in Azure Blob Storage (hot tier). The business requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes for the application. For SQL Database, they need the ability to fail over to a secondary region with no data loss. For Blob Storage, they need to maintain read access to data even if the primary region fails. The solution must be cost-optimized and not exceed the RTO/RPO. Which combination of services should you recommend?

Accepted Answer

Configure Azure SQL Database active geo-replication with a secondary in a paired region, and use read-access geo-redundant storage (RA-GRS) for Blob Storage.. Active geo-replication for Azure SQL Database supports an RPO of 5 minutes with no data loss during failover to a secondary paired region, meeting the business-critical requirement. Read-access geo-redundant storage (RA-GRS) provides read access to data in the secondary region even if the primary fails, satisfying the Blob Storage requirement. This combination is cost-optimized as it avoids unnecessary services like Site Recovery for VMs, which are not required for the stated RTO/RPO.

Answer

Configure Azure SQL Database failover groups with automatic failover, and use geo-redundant storage (GRS) for Blob Storage.

Answer

Deploy Azure Site Recovery for VMs, configure Azure SQL Database failover groups, and use geo-zone-redundant storage (GZRS) for Blob Storage.

Answer

Configure Azure SQL Database geo-restore for the database, and use zone-redundant storage (ZRS) for Blob Storage.

Question 12

A large enterprise is designing a data lake solution for its analytics platform. The data lake will store petabytes of structured and unstructured data from various sources, including IoT devices, logs, and transactional databases. The solution must support: - Multi-protocol access (ABFS, REST, and NFS 3.0) - Hierarchical namespace for folder-level permissions - Optimized for analytical workloads (Parquet format) - Cost-effective storage for cold data that is accessed less than once a year. Which Azure storage solution should the enterprise recommend for the data lake?

Accepted Answer

Azure Data Lake Storage Gen2 with Archive tier for cold data. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct foundation because it natively supports the required multi-protocol access (ABFS, REST, and NFS 3.0), a hierarchical namespace for folder-level permissions, and is optimized for analytical workloads using Parquet format. The Archive tier for cold data provides the lowest storage cost for data accessed less than once a year, meeting the cost-effectiveness requirement while retaining the ADLS Gen2 capabilities.

Answer

Azure NetApp Files Ultra tier

Answer

Azure Files Premium tier

Answer

Azure Blob Storage with hierarchical namespace enabled

Question 13

A gaming company is developing a multiplayer online game that requires a low-latency data store for player profiles, inventory, and session state. The data is accessed globally, and the solution must support millions of concurrent players. The company expects write-heavy workloads with occasional reads. The solution must provide single-digit millisecond latency for reads and writes. The company also needs to run analytics on the data to understand player behavior, but analytics queries can tolerate higher latency (minutes). Which Azure data storage solution should the company recommend for the transactional data?

Accepted Answer

Azure Cosmos DB with multiple write regions. Azure Cosmos DB with multiple write regions is the correct choice because it provides global distribution with multi-master writes, delivering single-digit millisecond latency for both reads and writes at any scale. It supports millions of concurrent players via automatic and elastic scaling, and its change feed enables analytics with higher latency tolerance by streaming data to Azure Synapse or HDInsight without impacting transactional performance.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Redis Cache with persistence

Answer

Azure Table Storage with geo-redundancy

Question 14

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to implement a solution that automatically detects identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via API. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. It provides risk event reports and integrates with SIEM systems via the Microsoft Graph API, enabling automated risk data export for centralized monitoring.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Entitlement Management

Question 15

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

Accepted Answer

A. Azure ExpressRoute provides a private, high-bandwidth, and reliable connection from on-premises data centers to Azure, bypassing the public internet. To meet the low-cost backup requirement, Azure VPN Gateway (Site-to-Site VPN) offers a secure, encrypted connection over the internet as a failover path, which is significantly cheaper than a second ExpressRoute circuit. This combination ensures primary connectivity via ExpressRoute and cost-effective redundancy via VPN.

Answer

B

Answer

C

Answer

D

Question 16

A company is designing a disaster recovery strategy for a mission-critical Azure SQL Database. They require a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 1 hour. Which replication option should they use?

Accepted Answer

Failover groups with active geo-replication. Failover groups with active geo-replication provide the lowest RPO (typically 5 seconds or less) and RTO (under 1 hour) for Azure SQL Database. Active geo-replication asynchronously replicates transactions to a secondary region, and failover groups orchestrate a coordinated, application-transparent failover that meets the stringent RTO requirement.

Answer

Zone-redundant deployment

Answer

Auto-failover groups with active geo-replication

Answer

Geo-restore

Question 17

A company deploys a stateless web application on Azure VMs in a single region. They need to distribute incoming HTTP traffic across multiple VMs and perform health checks. The solution should be highly available within the region. Which Azure load balancing solution should they use?

Accepted Answer

Azure Load Balancer (Standard) with HTTP health probe.. Azure Load Balancer (Standard) operates at Layer 4 (TCP/UDP) and can distribute HTTP traffic across VMs in a single region while performing health checks via HTTP health probes. It provides high availability within a region by distributing traffic across availability zones or availability sets, meeting the requirement for a stateless web application without needing Layer 7 features.

Answer

Azure Application Gateway v2.

Answer

Azure Traffic Manager.

Answer

Azure Front Door.

Question 18

A financial services company runs a critical application on Azure VMs with SQL Server Always On availability groups. The primary region is East US, and the secondary region is West US. The business requires automatic failover with zero data loss in case of a regional disaster. Which configuration should you recommend for the availability group?

Accepted Answer

Use synchronous commit mode with automatic failover. The requirement for automatic failover with zero data loss in a disaster recovery scenario necessitates synchronous commit mode, which ensures that transactions are committed on both the primary and secondary replicas before the primary acknowledges the commit. Automatic failover is only supported with synchronous commit mode when both replicas are in a healthy state, allowing the secondary to automatically become the primary without manual intervention. This configuration meets the business need for zero data loss (RPO=0) and minimal downtime (RTO) during a regional disaster.

Answer

Use synchronous commit mode with manual failover

Answer

Use asynchronous commit mode with automatic failover

Answer

Use asynchronous commit mode with manual failover

Question 19

A company uses Microsoft Entra ID B2B collaboration for external partners. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from devices that are compliant with Intune policies. Additionally, they need to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

Accepted Answer

Configure cross-tenant access settings to trust MFA and device compliance from external organizations, and then create a Conditional Access policy that requires MFA, compliant device, and a session sign-in frequency of 1 hour.. Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA and device compliance claims from external organizations, which is necessary when external users bring their own devices. Then, a Conditional Access policy targeting external users can enforce MFA, require compliant device, and set a session sign-in frequency of 1 hour using session controls. This combination ensures that the company's security requirements are met without relying on the external tenant's policies.

Answer

Create a Conditional Access policy for external users that requires MFA and compliant device, and set session controls for sign-in frequency. Trusting MFA from external tenants is automatic.

Answer

Use Microsoft Entra ID Identity Protection to detect risky sessions for external users and require MFA only when risk is high. This will also enforce device compliance automatically.

Answer

Configure Microsoft Entra ID Privileged Identity Management (PIM) for external users to activate MFA and require compliant device. PIM is for role activation, not for external user access policies.

Question 20

Your company has a hybrid identity environment using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to authenticate to Azure services using their on-premises credentials and enforce conditional access policies for sensitive applications. The solution must support multi-factor authentication (MFA) using the Microsoft Authenticator app. Which components should you include?

Accepted Answer

Microsoft Entra Connect Sync, Microsoft Entra ID, and Conditional Access policies with MFA.. Microsoft Entra Connect Sync synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials. Conditional Access policies in Microsoft Entra ID can then enforce MFA using the Microsoft Authenticator app for sensitive applications, meeting all requirements without additional infrastructure.

Answer

Microsoft Entra Connect Health, Microsoft Entra ID with cloud sync, and Azure AD Identity Protection.

Answer

Active Directory Federation Services (AD FS), Web Application Proxy, and Azure AD Conditional Access.

Answer

Azure AD Pass-through Authentication, Azure AD Application Proxy, and Azure AD Identity Protection.