AZ-305 Practice Test 2 — 30 Questions

Question 1

A multinational corporation is designing a disaster recovery strategy for a critical application running on Azure VMs. The application must have a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The primary region is East US, and the secondary region is West US. The solution must minimize costs while meeting the requirements. What should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement Azure Site Recovery for the VMs. Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs from a primary to a secondary region with an RPO as low as 15 minutes (Premium SSD) and RTOs that can be met within 1 hour through planned failover. It is the native Azure service designed for disaster recovery of IaaS workloads, offering cost-effective replication without requiring always-on secondary VMs, as it only incurs storage costs for replicated disks until failover.

Answer

Deploy an active-passive configuration with Azure Front Door and Traffic Manager

Answer

Configure the VMs in an availability zone across East US and West US

Answer

Use Azure Backup with cross-region restore for the VMs

Question 2

A company uses Microsoft Entra ID. They want to grant a user temporary access to the Global Administrator role for a specific task. The access must require approval from a manager and automatically expire after 4 hours. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing users to activate roles like Global Administrator for a limited time. It supports approval workflows (manager approval) and configurable activation duration (e.g., 4 hours), making it the correct choice for temporary, approved, time-bound role elevation.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Access Reviews

Question 3

A company is building a global real-time collaboration platform. The application data is stored as JSON documents and needs to be available for low-latency reads and writes from multiple geographic regions. The application must support multi-region writes so that users can update data from any region with automatic conflict resolution. The company wants a fully managed database service with a guaranteed SLA for availability and throughput. Which Azure data service should they choose?

Accepted Answer

Azure Cosmos DB with SQL API and multiple write regions. Azure Cosmos DB with SQL API and multiple write regions is the correct choice because it is a fully managed, globally distributed NoSQL database that natively supports multi-region writes with automatic conflict resolution. It provides low-latency reads and writes from any region, a guaranteed SLA for availability (99.999% for multi-region writes) and throughput, and is optimized for JSON document storage, making it ideal for a real-time collaboration platform.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Table Storage

Answer

Azure Cache for Redis

Question 4

A company uses Microsoft Entra ID and wants to allow users to sign in using their existing personal Microsoft accounts, Google, and Facebook identities. They also need custom sign-up and sign-in flows with collection of specific user attributes. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID B2C. Microsoft Entra ID B2C (Business-to-Consumer) is the correct choice because it is specifically designed to support external identity providers like personal Microsoft accounts, Google, and Facebook, and it provides a customizable policy framework (user flows) for sign-up and sign-in that can collect custom user attributes. Unlike B2B, which focuses on business partner collaboration, B2C allows you to define attribute collection during registration via built-in or custom policies.

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Conditional Access

Question 5

A company stores JSON documents for a mobile app backend. The data needs to be accessible from multiple global regions with low latency writes from any region. The app uses a client-side library that supports automatic conflict resolution for concurrent updates. Which Azure data service should they choose?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is correct because it provides multi-region writes with automatic conflict resolution, which directly matches the requirement for low-latency writes from any global region. Its multi-master replication model allows any region to accept writes, and the client-side library can use last-writer-wins (LWW) or custom conflict resolution policies to handle concurrent updates seamlessly.

Answer

Azure SQL Database

Answer

Azure Database for PostgreSQL

Answer

Azure Table Storage

Question 6

A company deploys a web application across multiple Azure VMs in a single region. They need to distribute incoming HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools (e.g., /images to one pool, /api to another). Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a Layer 7 load balancer that can distribute HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools. This directly matches the requirements for routing /images and /api traffic to separate pools while handling SSL termination at the gateway.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 7

A global e-commerce company deploys its web application on Azure Kubernetes Service (AKS) clusters in multiple Azure regions. They need a single global endpoint for users, with SSL offloading, web application firewall (WAF) protection, and URL path-based routing to the nearest healthy AKS cluster. Which Azure service should they use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides a single global endpoint with SSL offloading, WAF protection, and URL path-based routing. It uses Anycast-based routing to direct traffic to the nearest healthy AKS cluster, ensuring low latency and high availability across multiple regions.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Question 8

A company is designing a network architecture for a three-tier application hosted on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must not have direct internet access. They also need to encrypt traffic between tiers. Which TWO solutions should they implement?

Accepted Answer

Deploy a network virtual appliance (NVA) as a reverse proxy for the web tier. Deploying a network virtual appliance (NVA) as a reverse proxy for the web tier allows the web tier to be exposed to the internet while the application and database tiers remain isolated without direct internet access. The NVA can terminate inbound traffic and forward it to the web tier, and it can also enforce encryption (e.g., TLS) between tiers by acting as a secure gateway, meeting the requirement to encrypt traffic between tiers.

Answer

Use Azure Application Gateway with WAF

Answer

Use Azure Front Door

Answer

Use VNet peering to connect the tiers

Question 9

A global e-commerce company runs a web application in multiple Azure regions. They need to distribute incoming HTTPS traffic across regional deployments to provide low latency and high availability. The solution must support SSL offloading, Web Application Firewall (WAF) policies, and content caching to reduce backend load. They also need to route users to the nearest healthy backend region. Which Azure service should they use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it is a global, scalable entry point that provides HTTPS traffic distribution across multiple Azure regions with low latency, SSL offloading, WAF policies, and content caching. It uses Anycast-based routing to direct users to the nearest healthy backend region, meeting all the requirements for high availability and performance.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Content Delivery Network (CDN)

Question 10

Your company uses Microsoft Entra ID and has recently deployed Microsoft Sentinel. You need to design a monitoring solution to detect brute-force attacks against user accounts. The solution should use built-in analytics rules where possible and must trigger an automated response to temporarily disable the affected account. What should you include in the design?

Accepted Answer

Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user.. Microsoft Sentinel includes a built-in analytics rule specifically for detecting brute-force attacks against Microsoft Entra ID accounts. By connecting a playbook to this rule, you can automate the response to temporarily disable the affected user account, meeting the requirement for an automated response without custom development.

Answer

Use Microsoft Entra Identity Protection to detect brute-force and configure a conditional access policy to block sign-ins.

Answer

Stream sign-in logs to Log Analytics and create a scheduled query that alerts on multiple failures, then manually disable accounts.

Answer

Create a custom KQL query in Microsoft Sentinel and configure an automation rule to disable the account.

Question 11

A company plans to migrate a legacy web application to Azure. The application runs on multiple Windows virtual machines (VMs) in an availability set. The VMs must be exposed to the internet via a single endpoint that performs SSL termination and health checks. The load-balancing solution must preserve the original client IP address for logging purposes. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports SSL termination, health probes, and provides a single public endpoint. It preserves the original client IP address by inserting the X-Forwarded-For header in the HTTP request, which the backend VMs can read for logging. This meets all requirements: single internet-facing endpoint, SSL offload, health checks, and client IP preservation.

Answer

Azure Load Balancer (Standard)

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 12

A company is designing a virtual network architecture for a three-tier application (web, application, database). They want network isolation between tiers and secure access from the internet to the web tier only. Which Azure networking solution should they use?

Accepted Answer

Azure Virtual Network with subnets for each tier and Network Security Groups.. Deploying each tier in its own subnet within an Azure Virtual Network and applying Network Security Groups (NSGs) allows granular inbound/outbound rule enforcement. NSGs can restrict traffic so that only the web tier is reachable from the internet (via a public IP or Azure Load Balancer), while the application and database tiers are isolated from direct internet access and can only communicate with the adjacent tier as defined by NSG rules.

Answer

Azure Virtual Network with a single subnet and application security groups.

Answer

Azure Virtual Network with subnets and Azure Firewall.

Answer

Azure Virtual Network with subnets and a network virtual appliance (NVA).

Question 13

A company wants to allow remote users to access an internal web application hosted on-premises without opening inbound firewall ports. They need seamless single sign-on (SSO) using Microsoft Entra ID credentials. Which Azure service should they use?

Accepted Answer

Microsoft Entra ID Application Proxy. Microsoft Entra ID Application Proxy provides secure remote access to on-premises web applications without requiring inbound firewall ports. It works by establishing an outbound connection from the on-premises Application Proxy connector to the Entra ID service, then routing user traffic through that tunnel. It integrates with Entra ID for pre-authentication and supports seamless SSO using the user's existing Entra ID credentials via Kerberos constrained delegation (KCD) or header-based authentication.

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Connect

Question 14

A company runs a critical application on Azure VMs in the West US region. They need to protect against a regional disaster using Azure Site Recovery. The VMs use unmanaged disks. The recovery point objective (RPO) must be 15 minutes and the recovery time objective (RTO) must be 1 hour. Additionally, they must be able to perform quarterly disaster recovery drills that do not affect the production environment. Which configuration should they use in Azure Site Recovery?

Accepted Answer

Set up replication with a 15-minute snapshot frequency and perform test failover for drills.. Azure Site Recovery supports replication of Azure VMs with unmanaged disks, and a 15-minute snapshot frequency meets the RPO requirement. Test failover allows quarterly disaster recovery drills without impacting the production environment, as it creates isolated copies of VMs in a separate network for validation.

Answer

Use Azure Backup for VM replication and perform restore drills.

Answer

Configure a recovery plan with a pre-script to take a snapshot every 15 minutes.

Answer

Enable multi-VM consistency group with a 15-minute consistency frequency.

Question 15

Your company, Fabrikam Inc., operates a global Software-as-a-Service (SaaS) application that provides real-time analytics. The application runs on Azure Kubernetes Service (AKS) with a microservices architecture. The data tier uses Azure Cosmos DB (Core SQL API) with multi-region writes. The application also uses Azure Event Hubs for event ingestion. The business requires a Recovery Time Objective (RTO) of 10 seconds and a Recovery Point Objective (RPO) of 0 for the entire platform. The solution must support active-active configuration across multiple Azure regions. You have been asked to recommend the disaster recovery design. Which option should you recommend?

Accepted Answer

Deploy AKS in three regions with Azure Front Door. Use Azure Cosmos DB with multi-region writes. Use Azure Event Hubs with geo-disaster recovery and active-active pattern. Use Azure Cache for Redis Enterprise with active geo-replication.. It meets the strict RTO of 10 seconds and RPO of 0 by using Azure Front Door for global load balancing with health probes, Azure Cosmos DB multi-region writes for zero data loss, Azure Event Hubs with geo-disaster recovery and active-active pattern for continuous event ingestion, and Azure Cache for Redis Enterprise with active geo-replication for synchronized caching across regions. This combination ensures that all components support active-active configuration and can fail over instantly without data loss.

Answer

Deploy AKS in three regions with Azure Traffic Manager. Use Azure Cosmos DB with multi-region writes. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Answer

Deploy AKS in two regions with Azure Front Door. Use Azure Cosmos DB with single write region and auto-failover. Use Azure Service Bus with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Answer

Deploy AKS in two regions with Azure Front Door. Use Azure SQL Database with auto-failover groups. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Question 16

You are designing a connectivity solution for a hybrid network. The company has an on-premises network connected to an Azure virtual network via ExpressRoute. They also have a site-to-site VPN to the same Azure virtual network as a backup. When the ExpressRoute connection fails, traffic should automatically fail over to the VPN. How should you configure the routes to ensure automatic failover?

Accepted Answer

Ensure the ExpressRoute connection has a lower BGP metric than the VPN connection; Azure automatically prefers lower metric.. B is correct because when both ExpressRoute and VPN connections use BGP to advertise routes to Azure, Azure automatically selects the route with the lowest BGP metric (MED). By configuring the ExpressRoute connection with a lower BGP metric than the VPN connection, Azure will prefer the ExpressRoute path under normal conditions. If the ExpressRoute fails, its routes are withdrawn, and Azure falls back to the VPN routes, providing automatic failover.

Answer

Configure Azure Traffic Manager with a priority routing method to direct traffic to ExpressRoute first.

Answer

Set the BGP metrics (local preference) on the ExpressRoute connection to be higher than the VPN connection.

Answer

Configure Azure Route Server to propagate routes with a lower metric for the VPN connection.

Question 17

Your company plans to migrate a large number of on-premises virtual machines to Azure. You need to assess the current environment and migrate the workloads with minimal downtime. Which THREE Azure services or tools should you use? (Choose three.)

Accepted Answer

Azure Data Box. Azure Data Box is correct because it enables large-scale offline data transfer for environments with limited network bandwidth, allowing you to migrate terabytes of VM data to Azure without relying on slow or unstable connections. This service is ideal for the initial bulk copy of on-premises VM disks, which can then be used with Azure Migrate for assessment and Azure Site Recovery for ongoing replication with minimal downtime.

Answer

Azure App Service

Answer

Azure Import/Export Service

Question 18

A company is designing a disaster recovery solution for a critical application that runs on Azure VMs in a single region. The RTO is 4 hours, and the RPO is 1 hour. The application uses Azure SQL Database. The company wants to minimize the cost of the disaster recovery solution while meeting the RTO and RPO. You need to recommend a solution. What should you recommend?

Accepted Answer

Use Azure Site Recovery to replicate VMs to a secondary region and Azure SQL Database geo-replication for the database.. Azure Site Recovery provides orchestrated replication and failover for Azure VMs, meeting the 4-hour RTO with automated recovery plans. Azure SQL Database active geo-replication (or failover groups) enables continuous data synchronization with an RPO of 1 hour. This combination minimizes cost by using only the necessary replication services without over-provisioning resources.

Answer

Use Azure SQL Database active geo-replication for the database and Azure Backup for VMs.

Answer

Use Azure Backup to back up VMs and Azure SQL Database to a secondary region.

Answer

Use Azure Traffic Manager to distribute traffic to VMs in multiple regions and Azure SQL Database failover groups.

Question 19

Your company runs a mission-critical application on Azure Virtual Machines in a single region. You need to design a monitoring solution that provides proactive alerts for performance degradation and allows the operations team to analyze historical trends. The solution must minimize cost and operational overhead. You have an existing Log Analytics workspace. What should you include in the design?

Accepted Answer

Enable Azure Monitor on all VMs using the Azure Monitor agent. Create metric alerts for high CPU and memory usage. Use Log Analytics to query and analyze historical performance data.. It uses the Azure Monitor agent to collect performance data from VMs, enabling metric alerts for proactive notification of high CPU and memory usage, while leveraging the existing Log Analytics workspace for cost-effective historical analysis. This approach minimizes operational overhead by using a single agent and native Azure Monitor features without additional services or complex configurations.

Answer

Enable VM insights in Azure Monitor and use its live map and performance views for historical analysis.

Answer

Configure Azure Autoscale for the VMs based on CPU metrics and use Azure Monitor for logging.

Answer

Deploy Application Insights on each VM and use its built-in alerts for performance.

Question 20

You run the above PowerShell script to upload a blob to Azure Storage. The script fails with an error: 'The specified container does not exist.' What should you do first to resolve the issue?

Accepted Answer

Create the container using New-AzStorageContainer.. The error 'The specified container does not exist' indicates that the target container has not been created in the Azure Storage account. The PowerShell script uses the `Set-AzStorageBlobContent` cmdlet, which requires an existing container as the destination. Therefore, the first corrective action is to create the container using `New-AzStorageContainer` before uploading the blob.

Answer

Use a different connection string with a SAS token.

Answer

Grant the storage account key access to the user.

Answer

Change the -StandardBlobTier parameter to Cool.