AZ-305 Practice Test 4 — 25 Questions

Question 1

A company needs to store and analyze petabytes of IoT telemetry data. The data is append-only and rarely updated. They require SQL-based querying and columnar storage for fast analytics. Which Azure storage solution should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Data Lake Storage Gen2 with Azure Synapse SQL pool. Azure Data Lake Storage Gen2 (ADLS Gen2) provides hierarchical namespace and petabyte-scale storage optimized for big data analytics. When combined with Azure Synapse SQL pool (formerly SQL DW), it enables SQL-based querying over columnar storage (using PolyBase or CETAS) for fast analytics on append-only IoT telemetry data. This combination supports massive data volumes, append-only workloads, and columnar storage for high-performance analytical queries.

Answer

Azure Cosmos DB with analytical store

Answer

Azure SQL Database with columnstore indexes

Answer

Azure Blob Storage with Azure Cognitive Search

Question 2

Your company runs a mission-critical application on Azure Virtual Machines in a single region. You need to design a monitoring solution that provides proactive alerts for performance degradation and allows the operations team to analyze historical trends. The solution must minimize cost and operational overhead. You have an existing Log Analytics workspace. What should you include in the design?

Accepted Answer

Enable Azure Monitor on all VMs using the Azure Monitor agent. Create metric alerts for high CPU and memory usage. Use Log Analytics to query and analyze historical performance data.. It uses the Azure Monitor agent to collect performance data from VMs, enabling metric alerts for proactive notification of high CPU and memory usage, while leveraging the existing Log Analytics workspace for cost-effective historical analysis. This approach minimizes operational overhead by using a single agent and native Azure Monitor features without additional services or complex configurations.

Answer

Enable VM insights in Azure Monitor and use its live map and performance views for historical analysis.

Answer

Configure Azure Autoscale for the VMs based on CPU metrics and use Azure Monitor for logging.

Answer

Deploy Application Insights on each VM and use its built-in alerts for performance.

Question 3

You run the above PowerShell script to upload a blob to Azure Storage. The script fails with an error: 'The specified container does not exist.' What should you do first to resolve the issue?

Accepted Answer

Create the container using New-AzStorageContainer.. The error 'The specified container does not exist' indicates that the target container has not been created in the Azure Storage account. The PowerShell script uses the `Set-AzStorageBlobContent` cmdlet, which requires an existing container as the destination. Therefore, the first corrective action is to create the container using `New-AzStorageContainer` before uploading the blob.

Answer

Use a different connection string with a SAS token.

Answer

Grant the storage account key access to the user.

Answer

Change the -StandardBlobTier parameter to Cool.

Question 4

A small business is migrating its on-premises file server to Azure. The file server contains 2 TB of data that is accessed infrequently. The business wants to minimize costs and only pay for storage used. The solution must support SMB protocol and allow for on-premises caching to reduce latency. Which Azure storage solution should the business recommend?

Accepted Answer

Azure Files Standard tier with Azure File Sync. Azure Files Standard tier with Azure File Sync is correct because it provides fully managed SMB file shares in the cloud, supports the required SMB protocol, and Azure File Sync enables on-premises caching to reduce latency. The Standard tier is cost-effective for infrequently accessed data, and the pay-as-you-go model minimizes costs by charging only for actual storage used.

Answer

Azure Disk Storage Standard HDD with shared disks

Answer

Azure NetApp Files Standard tier with cross-region replication

Answer

Azure Blob Storage Cool tier with Azure Storage Explorer

Question 5

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that automatically blocks sign-ins from risky users and requires multi-factor authentication (MFA) when a sign-in risk is detected. Which TWO services should you use? (Choose two.)

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (B) is the service that detects sign-in risks (e.g., anonymous IP, atypical travel) and labels users or sign-ins as risky. Conditional Access policies (E) then enforce automated responses, such as blocking the sign-in or requiring MFA, based on the risk level from Entra ID Protection. Together, they provide the detection and enforcement mechanism described in the requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 6

Your company runs a Windows-based application on Azure Virtual Machines in the Brazil South region. The application uses Azure Files for shared storage and Azure SQL Database (Hyperscale tier) for the database. The business requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 30 minutes for the entire application. The solution must be cost-effective and leverage Azure-native services. You have been asked to design the disaster recovery strategy. Which option should you recommend?

Accepted Answer

Use Azure Site Recovery to replicate the VMs to a secondary region. Configure geo-redundant storage (GRS) for Azure Files. For Azure SQL Database Hyperscale, enable geo-restore and test restore procedures.. Azure Site Recovery provides VM replication with RPOs as low as 15 minutes and RTOs of minutes, meeting the 15-minute RPO and 30-minute RTO. Geo-redundant storage (GRS) for Azure Files ensures data is replicated to a paired secondary region with an RPO of 15 minutes (typically), and Azure SQL Database Hyperscale’s geo-restore allows restoring from geo-replicated backups, which can achieve the required RPO/RTO when tested and automated. This combination is cost-effective as it uses native Azure services without requiring a pre-provisioned secondary environment.

Answer

Deploy a second set of VMs in a secondary region. Use Azure File Sync to keep Azure Files in sync. Use Azure SQL Database failover groups with a readable secondary.

Answer

Back up the VMs using Azure Backup with a 15-minute frequency. Use Azure File Sync to replicate Azure Files to a secondary region. Use Azure SQL Database backup with point-in-time restore.

Answer

Use Azure Site Recovery for VMs. Use Azure File Sync for Azure Files. Use active geo-replication for Azure SQL Database.

Question 7

A multinational corporation is designing a data storage solution for its global customer data. The data must be stored in the Azure region closest to each customer to minimize latency, but all data must be accessible from a central analytics platform for reporting. The solution must also comply with data residency regulations that require customer data to remain in the country of origin. Which Azure storage solution should the company recommend?

Accepted Answer

Azure SQL Database with active geo-replication. Azure SQL Database with active geo-replication allows the creation of a primary database in a central region and readable secondary databases in other regions. This enables low-latency reads for customers by serving data from the closest secondary while respecting data residency because the primary remains in the country of origin and replicas can be limited to the same country. The central analytics platform can query the primary database for reporting. This solution avoids the global replication that would violate residency requirements.

Answer

Azure Cosmos DB with multi-master writes and conflict resolution

Answer

Azure Data Lake Storage Gen2 with geo-zone-redundant storage (GZRS)

Answer

Azure Blob Storage with geo-redundant storage (GRS)

Question 8

Your company has a large number of unstructured files (images, videos) that need to be stored cost-effectively in Azure. The data is accessed infrequently but must be available within minutes when needed. Which storage tier should you recommend?

Accepted Answer

Cool tier.. The Cool tier is designed for data that is infrequently accessed but requires immediate availability when needed. It offers lower storage costs than the Hot tier while maintaining low-latency access (within minutes), making it ideal for unstructured files like images and videos that are accessed rarely but must be retrievable on demand.

Answer

Premium tier.

Answer

Archive tier.

Answer

Hot tier.

Question 9

Your company is designing a new cloud-native application on Azure that consists of multiple microservices running on Azure Kubernetes Service (AKS). The application must be accessible from the internet via a custom domain name (app.contoso.com) and must support SSL/TLS termination. You need to design a secure ingress solution that provides Web Application Firewall (WAF) capabilities, SSL offloading, and automatic scaling. The solution should also support path-based routing to different microservices (e.g., /api, /web). You have the following options: Option A: Deploy an Azure Application Gateway v2 with WAF in front of the AKS cluster. Configure Application Gateway Ingress Controller (AGIC) to route traffic to the services. Option B: Deploy an Azure Load Balancer with a public IP and install an NGINX ingress controller on AKS. Configure SSL termination on NGINX and use a third-party WAF. Option C: Deploy an Azure Front Door with WAF policy in front of the AKS cluster. Use Azure Private Link to connect Front Door to the internal load balancer of AKS. Option D: Deploy an Azure API Management instance with WAF and expose the microservices through API endpoints. Use Azure Application Gateway as a reverse proxy. Which option best meets the requirements for a high-performance, integrated, and managed solution with minimal operational overhead?

Accepted Answer

Deploy an Azure Application Gateway v2 with WAF in front of the AKS cluster. Configure Application Gateway Ingress Controller (AGIC) to route traffic to the services.. Azure Application Gateway v2 with WAF provides a fully managed, integrated ingress solution that natively supports SSL/TLS offloading, path-based routing, and Web Application Firewall capabilities. By using the Application Gateway Ingress Controller (AGIC), traffic is automatically routed to the appropriate AKS microservices based on URL paths (e.g., /api, /web), and the gateway can scale automatically based on load. This minimizes operational overhead while meeting all stated requirements.

Answer

Deploy an Azure Front Door with WAF policy in front of the AKS cluster. Use Azure Private Link to connect Front Door to the internal load balancer of AKS.

Answer

Deploy an Azure Load Balancer with a public IP and install an NGINX ingress controller on AKS. Configure SSL termination on NGINX and use a third-party WAF.

Answer

Deploy an Azure API Management instance with WAF and expose the microservices through API endpoints. Use Azure Application Gateway as a reverse proxy.

Question 10

A software company hosts multiple small databases for different clients on Azure SQL Database. Each database has low average usage but experiences unpredictable spikes. The company wants to minimize cost by pooling resources across databases while allowing each database to consume resources up to a set limit during spikes. They also need the ability to easily add new databases without manual sizing. Which Azure SQL Database deployment option should they choose?

Accepted Answer

Azure SQL Database elastic pool. Azure SQL Database elastic pool is the correct choice because it allows multiple databases to share a fixed pool of resources (eDTUs or vCores), which minimizes cost by pooling resources across databases with low average usage and unpredictable spikes. Each database can automatically burst up to a configurable per-database resource limit (e.g., max eDTU per database) during spikes, and new databases can be added to the pool without manual sizing, as they simply consume from the shared pool.

Answer

Azure SQL Database single database with reserved capacity

Answer

Azure SQL Managed Instance

Answer

SQL Server on Azure Virtual Machines

Question 11

A company plans to migrate on-premises applications to Azure. They require users to authenticate using their existing on-premises Active Directory credentials without syncing password hashes to the cloud. Which Microsoft Entra ID authentication method should they use?

Accepted Answer

Microsoft Entra ID Pass-through Authentication. Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud. A lightweight agent on-premises forwards authentication requests to the local domain controller, meeting the requirement to avoid password hash synchronization.

Answer

Microsoft Entra ID Password Hash Sync

Answer

Microsoft Entra ID Federation Services (AD FS)

Answer

Microsoft Entra ID Connect with Seamless SSO

Question 12

A company runs SQL Server on Azure VMs using SQL Server Standard Edition. They need a disaster recovery solution that replicates the database to a secondary Azure region with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. They cannot use Always On Availability Groups due to licensing constraints. They also need to perform non-disruptive disaster recovery drills. Which Azure service should they implement?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) replicates entire SQL Server VMs (including their databases) to a secondary Azure region, supporting RPOs as low as 30 seconds and RTOs of 2 hours or less. It allows non-disruptive disaster recovery drills by performing test failovers in an isolated network without affecting the production environment. This solution avoids the licensing constraints of Always On Availability Groups and works with SQL Server Standard Edition.

Answer

Azure Backup for SQL Server

Answer

SQL Server Log Shipping to an Azure VM

Answer

Geo-replication for Azure SQL Database

Question 13

You need to design a solution to store configuration data for a cloud-native application. The configuration must be centrally managed, versioned, and accessible to multiple services without hard-coding values. Which Azure service should you use?

Accepted Answer

Azure App Configuration. Azure App Configuration is the correct choice because it is a fully managed service specifically designed for central management of application configuration and feature flags. It supports versioning of configuration key-values, provides instant access to multiple services via SDKs or REST API, and eliminates the need to hard-code values by allowing dynamic updates without redeployment.

Answer

Azure Cosmos DB

Answer

Azure Blob Storage

Answer

Azure Key Vault

Question 14

Refer to the exhibit. You are reviewing a Bicep template for a storage account. You need to ensure that the storage account is only accessible via HTTPS and uses TLS 1.2. Which property validates this requirement?

Accepted Answer

supportsHttpsTrafficOnly: true and minimumTlsVersion: TLS1_2. The `supportsHttpsTrafficOnly` property enforces that all traffic to the storage account must use HTTPS, and the `minimumTlsVersion` property set to `TLS1_2` ensures that only TLS 1.2 or higher is accepted. Together, these two properties satisfy the requirement of HTTPS-only access with TLS 1.2, as defined in the Azure Storage security baseline.

Answer

type: Microsoft.Storage/storageAccounts

Answer

accessTier: Hot

Answer

name: stprod001

Question 15

Which TWO of the following are features of Azure SQL Database that help ensure high availability? (Select two.)

Accepted Answer

Active geo-replication. Active geo-replication (Option A) creates readable secondary replicas of an Azure SQL Database in a paired Azure region, enabling manual or automatic failover to maintain availability during a regional outage. This feature ensures high availability by providing disaster recovery capabilities with a Recovery Point Objective (RPO) of up to 5 seconds and a Recovery Time Objective (RTO) of less than 1 hour, depending on the failover group configuration.

Answer

Long-term retention (LTR) backups

Answer

Automatic tuning

Answer

Transparent Data Encryption (TDE)

Question 16

You are designing a high-availability solution for a stateful application that uses Azure NetApp Files (ANF) for persistent storage. The application must withstand a zonal failure within a region. What should you do?

Accepted Answer

Use Azure NetApp Files cross-zone replication to replicate data between availability zones.. Azure NetApp Files cross-zone replication asynchronously replicates volume data from a source zone to a destination zone within the same region, enabling failover if the primary zone fails. This meets the requirement for zonal failure tolerance while preserving the stateful application's persistent storage. Other options either lack native zone-redundant support for ANF or provide only backup, not continuous replication.

Answer

Use Azure Files with zone-redundant storage (ZRS) and SMB multi-channel.

Answer

Use Azure Backup for ANF with daily snapshots stored in a different zone.

Answer

Deploy the application in an Availability Set and use ANF volumes with zone-redundant storage (ZRS).

Question 17

A company runs a critical application on Azure VMs. They need to ensure that if an entire Azure region fails, the application can be recovered in another region with minimal data loss. They have a recovery point objective (RPO) of 1 hour and a recovery time objective (RTO) of 4 hours. What should they implement?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs to a secondary region, meeting the RPO of 1 hour (typically 30 seconds to 15 minutes for Azure-to-Azure replication) and RTO of 4 hours (failover can be completed in minutes to a few hours, depending on VM count and data size). It is the correct service for full disaster recovery with minimal data loss across regions.

Answer

Azure Traffic Manager

Answer

Azure Front Door

Answer

Azure Backup

Question 18

Refer to the exhibit. An administrator runs the PowerShell script to enable replication for a VM. The script fails with an error that the VM is not found. What is the most likely cause?

Accepted Answer

The Azure PowerShell context is not set to the subscription that contains the VM.. The PowerShell script uses `Get-AzRecoveryServicesBackupItem` and `Enable-AzRecoveryServicesBackupProtection` to enable replication for a VM. If the Azure PowerShell context (set via `Set-AzContext` or `Connect-AzAccount`) is not targeting the subscription containing the VM, the cmdlets will not find the VM resource, resulting in a 'VM not found' error. This is the most likely cause because the script otherwise references a valid vault, container, and policy.

Answer

The Recovery Services vault does not exist.

Answer

The protection container is not available.

Answer

The replication policy is not valid.

Question 19

Which TWO Azure services can be used to provide cross-region disaster recovery for Azure App Service web applications with a custom domain? (Select TWO.)

Accepted Answer

Azure Front Door. Azure Front Door (B) provides global load balancing and traffic routing based on latency or priority, enabling cross-region failover for App Service web applications. It supports custom domains with TLS termination and health probes to automatically redirect traffic to a secondary region during a disaster. Azure Traffic Manager (E) also offers DNS-based traffic routing with priority or performance profiles, allowing failover to a secondary App Service instance in another region, and works with custom domains via CNAME records.

Answer

Azure DNS

Answer

Azure CDN

Answer

Azure Application Gateway

Question 20

You are a solutions architect for a large healthcare organization that uses Microsoft 365 and Azure. The organization has a Microsoft Entra ID tenant with 15,000 users. The security team requires that all users use multi-factor authentication (MFA) when accessing cloud applications. Currently, only 60% of users have registered for MFA. The organization wants to enforce MFA registration for all users within 30 days. The solution must minimize user disruption and allow users to register their MFA methods during their normal work hours. The organization uses Microsoft Intune for mobile device management and has a conditional access policy that requires MFA for all cloud apps. You need to design a solution to enforce MFA registration. What should you do?

Accepted Answer

Configure a Microsoft Entra ID MFA registration campaign to target all users and require registration within 14 days.. A Microsoft Entra ID MFA registration campaign is specifically designed to nudge users to register for MFA with a configurable deadline (up to 14 days) without immediately blocking access. This minimizes disruption by allowing users to register during normal work hours, and it integrates with existing Conditional Access policies that require MFA for cloud apps.

Answer

Modify the existing conditional access policy to require MFA for all cloud apps and block access if MFA is not registered.

Answer

Deploy an Intune compliance policy that requires MFA enrollment on mobile devices.

Answer

Use Microsoft Entra ID password reset policy to force users to register MFA during password reset.