AZ-305 Practice Test 30 — 15 Questions

Question 1

A company runs a critical line-of-business application on Azure VMs within a single region. The application tier is deployed across multiple VMs. They need to protect against a failure of an entire Azure datacenter within that region. The solution should automatically distribute the VMs across physically separate locations with independent power, cooling, and networking. The company also requires the lowest possible latency between application and database tiers within the same location. Which deployment strategy should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the VMs across multiple availability zones. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the application tier VMs across multiple zones protects against an entire datacenter failure while keeping all resources within the same region, ensuring the lowest possible latency between application and database tiers when they are placed in the same zone.

Answer

Deploy the VMs in an availability set

Answer

Use Azure Site Recovery to replicate VMs to a paired region

Answer

Use Azure Proximity Placement Groups

Question 2

A company stores petabytes of image files for a content delivery network. The images are accessed frequently for the first week, then rarely afterward. They must be retained for 5 years for compliance. The company wants to minimize storage costs while maintaining performance for frequently accessed data. Which storage solution and tier strategy should they recommend?

Accepted Answer

Azure Blob Storage with a lifecycle policy: Hot for 7 days, Cool for the remainder of 5 years. Azure Blob Storage with a lifecycle policy is the correct solution because it automatically transitions blobs from the Hot tier (for frequent access during the first week) to the Cool tier (for rare access over the remaining 5 years), minimizing storage costs while maintaining low-latency performance for the initial high-access period. The Hot tier provides high throughput and low access costs for frequently read data, while the Cool tier offers lower storage costs for infrequently accessed data, meeting both performance and compliance retention requirements.

Answer

Azure Files with premium tier

Answer

Azure Data Lake Storage Gen2 with hot tier only

Answer

Azure Blob Storage with archive tier from day 1

Question 3

Your company has a global application deployed across multiple Azure regions. You need to design a disaster recovery solution that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The solution should use Azure-native services and minimize costs. Which option should you choose?

Accepted Answer

Azure Site Recovery with 15-minute replication. Azure Site Recovery (ASR) with 15-minute replication is the correct choice because it provides application-consistent replication for Azure VMs with a configurable RPO as low as 15 minutes and supports failover within the 1-hour RTO. ASR is an Azure-native disaster recovery service that orchestrates replication, failover, and failback across regions, making it the most cost-effective option for meeting the stated RPO and RTO requirements for a multi-region application.

Answer

Azure Traffic Manager with priority routing

Answer

Active geo-replication for Azure SQL Database

Answer

Azure Backup with cross-region restore

Question 4

Refer to the exhibit. You are analyzing a deployment of Azure Storage account with customer-managed key encryption. The deployment fails with an error indicating that the key vault is not accessible. Which of the following is the most likely cause?

Accepted Answer

The user-assigned managed identity does not have permissions to access the key. When using customer-managed keys (CMK) with Azure Storage encryption, the storage account must authenticate to the key vault to retrieve the key. If a user-assigned managed identity is specified in the encryption policy, that identity must have at least 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the key vault. Without these permissions, the storage account cannot access the key, resulting in a deployment failure with a 'key vault not accessible' error.

Answer

The key vault name is misspelled in the keyUri

Answer

The key vault has a firewall enabled and does not allow access from the storage account

Answer

The key vault is in a different Azure region than the storage account

Question 5

Your company runs a web application on Azure App Service (Standard tier) in a single region. You need to design a disaster recovery solution that can fail over to another region within 30 minutes. The application uses Azure SQL Database (General Purpose tier) and Azure Blob Storage. What should you implement?

Accepted Answer

Configure App Service backup to a secondary region, use Azure SQL Database active geo-replication with auto-failover group, and use geo-redundant storage (GRS) for Blob Storage.. It meets the 30-minute RTO by using Azure SQL Database active geo-replication with auto-failover groups, which provides automated, rapid failover to a secondary region. App Service backup to a secondary region ensures the web app can be restored quickly, and geo-redundant storage (GRS) for Blob Storage provides durable replication across regions, enabling failover within the required time frame.

Answer

Use Azure Traffic Manager with priority routing to a second App Service instance, use Azure SQL Database backup to a secondary region, and use Azure Storage zone-redundant storage (ZRS).

Answer

Configure App Service auto-scaling, use Azure SQL Database geo-replication with readable secondary, and use Azure Storage read-access geo-redundant storage (RA-GRS).

Answer

Configure App Service deployment slots, use Azure SQL Database geo-restore, and use Azure Storage locally-redundant storage (LRS).

Question 6

A company wants to cache frequently accessed session state and product data for their e-commerce website. They need the cache to be highly available with a 99.9% SLA and provide fast read and write access. The solution must be fully managed. Which Azure Cache tier should they choose?

Accepted Answer

Azure Redis Cache Standard tier. The Standard tier of Azure Redis Cache provides a 99.9% SLA through built-in replication with two nodes (primary and replica) in the same region, ensuring high availability. It is fully managed, supports fast read/write access for session state and product data, and meets the requirement without the additional cost or complexity of the Premium tier.

Answer

Azure Redis Cache Basic tier

Answer

Azure Redis Cache Premium tier

Answer

Azure Content Delivery Network

Question 7

A company ingests millions of IoT sensor data points per second. They need a fully managed analytics service optimized for time-series data that can ingest high-velocity data, perform real-time analytics, and store data for historical analysis. The solution must integrate with Azure Stream Analytics for stream processing. Which Azure data service should they choose?

Accepted Answer

Azure Data Explorer (ADX). Azure Data Explorer (ADX) is the correct choice because it is a fully managed, high-performance analytics service optimized for time-series and log data. It can ingest millions of IoT sensor data points per second, perform real-time analytics with sub-second query latency, and store data for historical analysis. ADX natively integrates with Azure Stream Analytics for stream processing, making it ideal for this scenario.

Answer

Azure Cosmos DB

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 8

A company is building a new application that requires a fully managed relational database. The application has varying workloads across different databases. The company wants to pool resources to optimize cost and allow each database to scale as needed. They also need automated backups with point-in-time restore and geo-replication for disaster recovery. Which Azure data service should they use?

Accepted Answer

Azure SQL Database. Azure SQL Database is a fully managed relational database service that supports elastic pools, which allow you to pool resources across multiple databases to optimize cost and enable each database to scale independently based on demand. It also provides automated backups with point-in-time restore (PITR) and active geo-replication for disaster recovery, meeting all the stated requirements.

Answer

Azure SQL Managed Instance

Answer

Azure Database for MySQL

Answer

Azure Database for PostgreSQL

Question 9

Your company plans to store sensitive customer data in Azure Blob Storage. The data must be encrypted at rest and in transit. Additionally, access must be audited and restricted based on user identity. Which configuration meets these requirements?

Accepted Answer

Use Azure RBAC for access and Azure Monitor logs for auditing.. Azure RBAC provides identity-based access control using Microsoft Entra ID, which meets the requirement to restrict access based on user identity. Azure Monitor logs (specifically the Azure Activity Log and Storage Analytics logs) capture all read/write operations for auditing. Encryption at rest is automatically provided by Azure Storage Service Encryption (SSE) using Microsoft-managed keys by default, and encryption in transit is enforced via HTTPS when accessing Blob Storage. Together, these satisfy all stated requirements without additional configuration.

Answer

Use shared access signatures (SAS) for access control.

Answer

Configure network firewalls and use private endpoints.

Answer

Enable customer-managed keys (CMK) and use SAS.

Question 10

Your company runs a mission-critical application on Azure VMs. You need to design a cross-region disaster recovery solution that meets a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 5 minutes. The solution must minimize costs. What should you recommend?

Accepted Answer

Use Azure Site Recovery with replication frequency set to 30 seconds.. Azure Site Recovery (ASR) can replicate Azure VMs to a secondary region with a replication frequency as low as 30 seconds, enabling an RPO of 5 minutes and an RTO of 15 minutes when combined with a planned failover. This meets the mission-critical requirements while minimizing costs compared to always-on active-active solutions, as ASR only incurs costs for replication traffic and storage in the secondary region.

Answer

Use Azure SQL Database active geo-replication with a failover group.

Answer

Use Azure Storage with read-access geo-redundant storage (RA-GRS) and Azure Traffic Manager.

Answer

Use Azure Backup with geo-redundant storage.

Question 11

You are designing a disaster recovery strategy for an Azure virtual machine running a critical application. The VM is in the East US region. Your recovery point objective (RPO) is 15 minutes, and your recovery time objective (RTO) is 1 hour. Which Azure service should you use to replicate the VM to the West US region?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions. It supports continuous replication with an RPO as low as 30 seconds and can meet your 15-minute RPO, while automated failover and recovery plans can achieve a 1-hour RTO by spinning up replicated VMs in the West US region.

Answer

Azure Traffic Manager

Answer

Azure Backup

Answer

Azure Migrate

Question 12

You are designing a web application that will be hosted on Azure App Service. The application must authenticate users from your company's Microsoft Entra ID tenant. You need to implement authentication without writing any authentication code. What should you use?

Accepted Answer

App Service Authentication (EasyAuth). App Service Authentication (also known as EasyAuth) is the correct choice because it provides built-in authentication for Azure App Service without requiring any custom code. It integrates directly with Microsoft Entra ID (formerly Azure AD) and automatically handles token validation, session management, and redirects by intercepting HTTP requests before they reach your application code.

Answer

Azure API Management with OAuth 2.0 policy

Answer

Microsoft Authentication Library (MSAL) integrated into the application code

Answer

Azure Front Door with authentication rules

Question 13

A large enterprise has a management group hierarchy with 50 subscriptions. They need to enforce that every resource group must have a 'CostCenter' tag and that any new resource group without that tag is automatically denied creation. Additionally, they need to ensure that only the Finance team can modify tags on any resource. They also want to generate monthly compliance reports showing which resources are non-compliant. Which combination of Azure services should they use?

Accepted Answer

Azure Policy for tag enforcement, Azure RBAC for scoping tag modification to Finance, and Azure Policy for compliance reporting. Azure Policy can enforce the 'CostCenter' tag on resource groups via a 'deny' effect policy, Azure RBAC can restrict tag modification to the Finance team by assigning the 'Tag Contributor' role at the appropriate scope, and Azure Policy's compliance reporting (via the Azure Policy Compliance dashboard or export to Log Analytics) provides monthly reports on non-compliant resources without needing additional services.

Answer

Azure Blueprints with tag policy and Azure RBAC, and Azure Security Center for compliance

Answer

Azure Policy for tag enforcement, Azure Management Groups for governance, and Azure Monitor for compliance reports

Answer

Azure Policy for tag enforcement, Azure RBAC for tag modification, and Azure Security Center for compliance

Question 14

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to ensure that users who access sensitive cloud applications from untrusted networks (e.g., public Wi-Fi) are prompted for multi-factor authentication (MFA). Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow administrators to define conditions (e.g., network location, device state) under which access to cloud applications is granted. By configuring a policy that targets sensitive applications and requires MFA when the user's IP address is from an untrusted network (such as public Wi-Fi), the company can enforce MFA only when the risk condition is met, without affecting access from trusted corporate networks.

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID B2C

Question 15

Your organization uses Microsoft Entra ID and has a hybrid identity deployment with Active Directory Domain Services (AD DS) on-premises. You need to synchronize user identities to Microsoft Entra ID, but you must ensure that password hashes are never stored in the cloud. Which synchronization method should you use?

Accepted Answer

Pass-through Authentication (PTA). Pass-through Authentication (PTA) is the correct choice because it validates user passwords directly against on-premises Active Directory without ever storing password hashes in Microsoft Entra ID. This meets the requirement that password hashes are never stored in the cloud, as PTA uses an agent on-premises to authenticate users, and only the validation result is sent to Microsoft Entra ID.

Answer

Password Hash Sync

Answer

Federation with AD FS

Answer

Azure AD Connect Cloud Sync