AZ-305 Practice Test 3 — 30 Questions

Question 1

Contoso Ltd. runs a mission-critical application on Azure Virtual Machines in the East US region. The application uses Azure SQL Database (Business Critical tier) and stores files in Azure Blob Storage (hot tier). The business requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes for the application. For SQL Database, they need the ability to fail over to a secondary region with no data loss. For Blob Storage, they need to maintain read access to data even if the primary region fails. The solution must be cost-optimized and not exceed the RTO/RPO. Which combination of services should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Azure SQL Database active geo-replication with a secondary in a paired region, and use read-access geo-redundant storage (RA-GRS) for Blob Storage.. Active geo-replication for Azure SQL Database supports an RPO of 5 minutes with no data loss during failover to a secondary paired region, meeting the business-critical requirement. Read-access geo-redundant storage (RA-GRS) provides read access to data in the secondary region even if the primary fails, satisfying the Blob Storage requirement. This combination is cost-optimized as it avoids unnecessary services like Site Recovery for VMs, which are not required for the stated RTO/RPO.

Answer

Configure Azure SQL Database failover groups with automatic failover, and use geo-redundant storage (GRS) for Blob Storage.

Answer

Deploy Azure Site Recovery for VMs, configure Azure SQL Database failover groups, and use geo-zone-redundant storage (GZRS) for Blob Storage.

Answer

Configure Azure SQL Database geo-restore for the database, and use zone-redundant storage (ZRS) for Blob Storage.

Question 2

A large enterprise is designing a data lake solution for its analytics platform. The data lake will store petabytes of structured and unstructured data from various sources, including IoT devices, logs, and transactional databases. The solution must support: - Multi-protocol access (ABFS, REST, and NFS 3.0) - Hierarchical namespace for folder-level permissions - Optimized for analytical workloads (Parquet format) - Cost-effective storage for cold data that is accessed less than once a year. Which Azure storage solution should the enterprise recommend for the data lake?

Accepted Answer

Azure Data Lake Storage Gen2 with Archive tier for cold data. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct foundation because it natively supports the required multi-protocol access (ABFS, REST, and NFS 3.0), a hierarchical namespace for folder-level permissions, and is optimized for analytical workloads using Parquet format. The Archive tier for cold data provides the lowest storage cost for data accessed less than once a year, meeting the cost-effectiveness requirement while retaining the ADLS Gen2 capabilities.

Answer

Azure NetApp Files Ultra tier

Answer

Azure Files Premium tier

Answer

Azure Blob Storage with hierarchical namespace enabled

Question 3

A gaming company is developing a multiplayer online game that requires a low-latency data store for player profiles, inventory, and session state. The data is accessed globally, and the solution must support millions of concurrent players. The company expects write-heavy workloads with occasional reads. The solution must provide single-digit millisecond latency for reads and writes. The company also needs to run analytics on the data to understand player behavior, but analytics queries can tolerate higher latency (minutes). Which Azure data storage solution should the company recommend for the transactional data?

Accepted Answer

Azure Cosmos DB with multiple write regions. Azure Cosmos DB with multiple write regions is the correct choice because it provides global distribution with multi-master writes, delivering single-digit millisecond latency for both reads and writes at any scale. It supports millions of concurrent players via automatic and elastic scaling, and its change feed enables analytics with higher latency tolerance by streaming data to Azure Synapse or HDInsight without impacting transactional performance.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Redis Cache with persistence

Answer

Azure Table Storage with geo-redundancy

Question 4

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to implement a solution that automatically detects identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via API. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. It provides risk event reports and integrates with SIEM systems via the Microsoft Graph API, enabling automated risk data export for centralized monitoring.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Entitlement Management

Question 5

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

Accepted Answer

A. Azure ExpressRoute provides a private, high-bandwidth, and reliable connection from on-premises data centers to Azure, bypassing the public internet. To meet the low-cost backup requirement, Azure VPN Gateway (Site-to-Site VPN) offers a secure, encrypted connection over the internet as a failover path, which is significantly cheaper than a second ExpressRoute circuit. This combination ensures primary connectivity via ExpressRoute and cost-effective redundancy via VPN.

Answer

B

Answer

C

Answer

D

Question 6

A company is designing a disaster recovery strategy for a mission-critical Azure SQL Database. They require a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 1 hour. Which replication option should they use?

Accepted Answer

Failover groups with active geo-replication. Failover groups with active geo-replication provide the lowest RPO (typically 5 seconds or less) and RTO (under 1 hour) for Azure SQL Database. Active geo-replication asynchronously replicates transactions to a secondary region, and failover groups orchestrate a coordinated, application-transparent failover that meets the stringent RTO requirement.

Answer

Zone-redundant deployment

Answer

Auto-failover groups with active geo-replication

Answer

Geo-restore

Question 7

A company deploys a stateless web application on Azure VMs in a single region. They need to distribute incoming HTTP traffic across multiple VMs and perform health checks. The solution should be highly available within the region. Which Azure load balancing solution should they use?

Accepted Answer

Azure Load Balancer (Standard) with HTTP health probe.. Azure Load Balancer (Standard) operates at Layer 4 (TCP/UDP) and can distribute HTTP traffic across VMs in a single region while performing health checks via HTTP health probes. It provides high availability within a region by distributing traffic across availability zones or availability sets, meeting the requirement for a stateless web application without needing Layer 7 features.

Answer

Azure Application Gateway v2.

Answer

Azure Traffic Manager.

Answer

Azure Front Door.

Question 8

A financial services company runs a critical application on Azure VMs with SQL Server Always On availability groups. The primary region is East US, and the secondary region is West US. The business requires automatic failover with zero data loss in case of a regional disaster. Which configuration should you recommend for the availability group?

Accepted Answer

Use synchronous commit mode with automatic failover. The requirement for automatic failover with zero data loss in a disaster recovery scenario necessitates synchronous commit mode, which ensures that transactions are committed on both the primary and secondary replicas before the primary acknowledges the commit. Automatic failover is only supported with synchronous commit mode when both replicas are in a healthy state, allowing the secondary to automatically become the primary without manual intervention. This configuration meets the business need for zero data loss (RPO=0) and minimal downtime (RTO) during a regional disaster.

Answer

Use synchronous commit mode with manual failover

Answer

Use asynchronous commit mode with automatic failover

Answer

Use asynchronous commit mode with manual failover

Question 9

A company uses Microsoft Entra ID B2B collaboration for external partners. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from devices that are compliant with Intune policies. Additionally, they need to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

Accepted Answer

Configure cross-tenant access settings to trust MFA and device compliance from external organizations, and then create a Conditional Access policy that requires MFA, compliant device, and a session sign-in frequency of 1 hour.. Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA and device compliance claims from external organizations, which is necessary when external users bring their own devices. Then, a Conditional Access policy targeting external users can enforce MFA, require compliant device, and set a session sign-in frequency of 1 hour using session controls. This combination ensures that the company's security requirements are met without relying on the external tenant's policies.

Answer

Create a Conditional Access policy for external users that requires MFA and compliant device, and set session controls for sign-in frequency. Trusting MFA from external tenants is automatic.

Answer

Use Microsoft Entra ID Identity Protection to detect risky sessions for external users and require MFA only when risk is high. This will also enforce device compliance automatically.

Answer

Configure Microsoft Entra ID Privileged Identity Management (PIM) for external users to activate MFA and require compliant device. PIM is for role activation, not for external user access policies.

Question 10

Your company has a hybrid identity environment using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to authenticate to Azure services using their on-premises credentials and enforce conditional access policies for sensitive applications. The solution must support multi-factor authentication (MFA) using the Microsoft Authenticator app. Which components should you include?

Accepted Answer

Microsoft Entra Connect Sync, Microsoft Entra ID, and Conditional Access policies with MFA.. Microsoft Entra Connect Sync synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials. Conditional Access policies in Microsoft Entra ID can then enforce MFA using the Microsoft Authenticator app for sensitive applications, meeting all requirements without additional infrastructure.

Answer

Microsoft Entra Connect Health, Microsoft Entra ID with cloud sync, and Azure AD Identity Protection.

Answer

Active Directory Federation Services (AD FS), Web Application Proxy, and Azure AD Conditional Access.

Answer

Azure AD Pass-through Authentication, Azure AD Application Proxy, and Azure AD Identity Protection.

Question 11

A company is building a petabyte-scale data lake for analytics. The workload includes Apache Spark and Hive jobs that read and write large files. The storage solution must support a hierarchical namespace for efficient directory operations, POSIX-like access control lists (ACLs) for fine-grained permissions, and must be accessible via the Azure Blob Storage API for compatibility with existing tools. Furthermore, the solution should be optimized for analytics workloads with high throughput. Which Azure data service should they choose?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and is accessible via the Azure Blob Storage API. This service is specifically optimized for analytics workloads like Apache Spark and Hive, providing high throughput for petabyte-scale data lakes. The hierarchical namespace enables efficient directory operations, while the Blob Storage API ensures compatibility with existing tools.

Answer

Azure Data Lake Storage Gen1

Answer

Azure Blob Storage

Answer

Azure Files

Question 12

A company has a hub-spoke network topology in Azure. They have multiple spoke VNets connected to a hub VNet via peering. They need to ensure that all east-west traffic between spoke VNets goes through a network virtual appliance (NVA) in the hub for inspection. Additionally, all outbound internet traffic from spoke VMs must use a single public IP address. What should they configure?

Accepted Answer

Configure VNet peering with 'Allow forwarded traffic' enabled, add user-defined routes in each spoke pointing to the NVA IP for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet with a default route in spokes.. It combines two critical configurations: user-defined routes (UDRs) in each spoke VNet force inter-spoke traffic through the NVA in the hub by specifying the NVA's IP as the next hop, and 'Allow forwarded traffic' on the VNet peering enables the hub NVA to forward packets between spokes. For outbound internet traffic, Azure Firewall in the hub provides a single public IP, and a default route (0.0.0.0/0) in the spoke UDRs directs all internet-bound traffic to the Azure Firewall's private IP, ensuring centralized inspection and egress.

Answer

Configure spoke VNets with a default route to the NVA IP, and deploy a NAT gateway in the hub for outbound traffic.

Answer

Configure a route table in each spoke with a route to the hub NVA for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet traffic.

Answer

Enable 'Allow gateway transit' on the hub VNet and 'Use remote gateways' on the spoke VNets for the NVA.

Question 13

A company wants to migrate its on-premises file server to Azure with minimal application changes. The application accesses files over the SMB protocol and requires identity-based access using the existing on-premises Active Directory Domain Services (AD DS). They need the solution to be fully managed with low latency. Which Azure storage solution should they choose?

Accepted Answer

Azure Files. Azure Files is the correct choice because it provides fully managed SMB file shares that can be accessed over the SMB protocol with identity-based authentication using on-premises AD DS via Azure Files AD DS integration. This allows the application to connect with minimal changes, as it continues to use SMB and existing domain credentials, while Azure Files offers low-latency access when deployed in the same region as the application.

Answer

Azure NetApp Files

Answer

Azure Blob Storage with NFS 3.0

Answer

Azure Disk Storage

Question 14

A company ingests IoT sensor data into Azure Blob Storage. Data is written frequently and is accessed rarely after the first 24 hours. The company must retain the data for exactly 90 days for compliance. They want to minimize storage costs by automatically moving data to the cheapest possible storage tier as soon as possible. Which Azure Blob Storage lifecycle management policy should they implement?

Accepted Answer

Move to Cool tier after 1 day, delete after 90 days. The data is rarely accessed after 24 hours, so moving it to Cool tier after 1 day minimizes cost while still allowing low-latency access. The 90-day deletion aligns with the compliance retention requirement. Cool tier is the cheapest online tier, and moving data there as soon as possible (after 1 day) reduces costs without incurring the early deletion penalty or retrieval latency of Archive tier.

Answer

Move to Archive tier after 1 day, delete after 90 days

Answer

Move to Cool tier after 30 days, delete after 90 days

Answer

Move to Archive tier after 30 days, delete after 90 days

Question 15

A company is deploying a web application on Azure App Service. They need to guarantee that all traffic from the internet goes through a Web Application Firewall (WAF) before reaching the app. The solution must be cost-effective for a single application. Which Azure service should they place in front of the App Service?

Accepted Answer

Azure Application Gateway with WAF.. Azure Application Gateway with WAF is the correct choice because it provides a regional, layer-7 load balancer with built-in Web Application Firewall capabilities, designed to protect web applications from common exploits and vulnerabilities. For a single application, it is more cost-effective than Azure Front Door, which is a global service with higher minimum costs and additional features not required here. Application Gateway can be deployed directly in front of App Service to inspect and filter all internet traffic before it reaches the app.

Answer

Azure Front Door with WAF policy.

Answer

Azure Firewall with application rules.

Answer

Azure Traffic Manager.

Question 16

A company runs a mission-critical multi-tier application on Azure VMs in West US. The application consists of database VMs, application VMs, and web VMs. During a disaster, the VMs must be recovered in a specific order: database tier first, then application tier, then web tier. The recovery point objective (RPO) is 5 minutes and recovery time objective (RTO) is 15 minutes. The company wants to periodically test the recovery process without impacting production. After failover to East US, the VMs must retain their private IP addresses to avoid DNS propagation delays. Which combination of Azure Site Recovery features should they configure?

Accepted Answer

A recovery plan, test failover, and static IP address assignment. A recovery plan enforces the required startup order (database → application → web), test failover allows non-disruptive validation of the recovery process, and static IP address assignment ensures VMs retain their private IP addresses after failover to East US, avoiding DNS propagation delays. This combination meets the RPO of 5 minutes and RTO of 15 minutes while satisfying the requirement for periodic testing without impacting production.

Answer

A recovery plan, planned failover, and network mapping

Answer

A recovery plan, test failover, and network mapping

Answer

A recovery plan, planned failover, and static IP address assignment

Question 17

A company is deploying a web application that must be accessible from the internet. The application is hosted on Azure virtual machines in a virtual network. The solution must provide SSL termination, web application firewall (WAF) protection, and URL path-based routing (e.g., /api/* to one backend pool, /app/* to another). The web tier must not be directly exposed to the internet. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL path-based routing. It can route traffic to different backend pools based on URL paths (e.g., /api/* and /app/*) while keeping the web tier isolated within the virtual network, as the gateway itself is exposed to the internet.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 18

A company runs a critical application on Azure Kubernetes Service (AKS) in a single region. The application is stateless and uses an Azure SQL Database with active geo-replication for database DR. They need to ensure the AKS cluster can failover to a secondary region with an RTO of 15 minutes and an RPO of 5 seconds for the database. What should they recommend for the AKS cluster?

Accepted Answer

Deploy AKS clusters in two regions and use Azure Traffic Manager to route traffic.. Deploying AKS clusters in two regions with Azure Traffic Manager enables active-passive or active-active failover. Traffic Manager uses DNS-based routing to direct traffic to the secondary region when the primary fails, meeting the RTO of 15 minutes. The stateless application can be redeployed or scaled in the secondary cluster, while the Azure SQL Database with active geo-replication ensures an RPO of 5 seconds by continuously replicating transactions.

Answer

Deploy a single AKS cluster with pods spread across availability zones within the region.

Answer

Use Azure Site Recovery to replicate the AKS cluster to another region.

Answer

Back up the AKS cluster configuration and container images to a geo-redundant storage account.

Question 19

A company deploys a web application on Azure VMs across availability zones. They need to distribute HTTPS traffic, offload SSL termination, and maintain session persistence. They do not require traffic inspection. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway v2.. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports HTTPS traffic distribution, SSL termination (offloading the decryption burden from backend VMs), and session persistence via cookie-based affinity. It meets all requirements without needing traffic inspection, which is optional and can be disabled.

Answer

Azure Load Balancer (Standard).

Answer

Azure Traffic Manager.

Answer

Azure Front Door.

Question 20

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to grant specific IT administrators just-in-time (JIT) access to Azure virtual machines for troubleshooting. The access must be time-bound, require approval from a senior manager, and be automatically revoked after the granted time period. The company also needs an audit log of all access requests and assignments. Which Azure service or feature should they use?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources. Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources provides just-in-time (JIT) access with time-bound activation, approval workflows, and automatic revocation. It also includes full audit logging of all requests and assignments, meeting all the specified requirements for granting temporary access to Azure VMs.

Answer

Azure Bastion

Answer

Just-in-Time VM access (Microsoft Defender for Cloud)

Answer

Microsoft Entra ID Application Proxy