AZ-305 Practice Test 31 — 15 Questions

Question 1

Your organization is designing a secure microservices architecture using Azure Kubernetes Service (AKS). The application must be compliant with PCI DSS, which requires strict network segmentation and encryption of data at rest and in transit. You need to design a solution that meets these requirements while minimizing operational overhead. The AKS cluster will be deployed in a virtual network. The application consists of multiple microservices that need to communicate with each other and with an Azure SQL Database. Some microservices are public-facing. Which design should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy AKS with a private API server, enable network policies, and use a service endpoint or private endpoint for Azure SQL Database.. A private API server ensures the AKS control plane is inaccessible from the public internet, satisfying PCI DSS network segmentation. Enabling network policies (e.g., Calico or Azure Network Policy) enforces micro-segmentation between pods, and using a private endpoint for Azure SQL Database encrypts data in transit over the Microsoft backbone and isolates the database to the virtual network, meeting encryption and segmentation requirements with minimal operational overhead.

Answer

Deploy AKS with a public API server and use Network Security Groups (NSGs) to restrict access.

Answer

Deploy AKS with a private API server and use a jump box for administration.

Answer

Deploy AKS with a public API server and disable network policies to simplify management.

Question 2

Your organization is deploying a critical application in Azure that must maintain an uptime SLA of 99.99%. The application runs on Azure Virtual Machines in a single region. You need to design a monitoring solution that alerts the operations team within 5 minutes of any VM unavailability. The solution must minimize false positives and avoid alert fatigue. What should you include in the design?

Accepted Answer

Configure Azure Monitor VM insights with availability metric alerts set to fire when the VM is unavailable for 2 out of the last 5 minutes.. VM insights availability metric alerts use the 'VM Availability' metric (a composite metric from the Azure Monitor agent) that tracks the VM's running state. Configuring it to fire when the VM is unavailable for 2 out of the last 5 minutes provides a 2-minute evaluation window, which balances the 5-minute notification requirement with a tolerance for transient blips, minimizing false positives. This approach directly monitors the VM's availability at the hypervisor level without relying on guest OS signals, ensuring reliable uptime detection for the 99.99% SLA.

Answer

Create an Azure Service Health alert for the 'Virtual machine' service.

Answer

Create an Azure Monitor alert based on the Activity Log for 'Virtual Machine Guest OS Unresponsive' events.

Answer

Deploy the Log Analytics agent on each VM and create an alert for when heartbeat data is missing for 5 minutes.

Question 3

You are a Solutions Architect for an e-commerce company that runs its online store on Azure. The application consists of:
- Azure App Service (Windows) hosting the web frontend
- Azure SQL Database (General Purpose, serverless) for product catalog and orders
- Azure Cache for Redis for session state
- Azure Blob Storage for product images
The application is deployed in the East US region. The company wants to implement a disaster recovery (DR) plan that can fail over to a secondary region (West US) with minimal data loss. The requirements are:
- RPO: 5 minutes for the database
- RTO: 30 minutes for the entire application
- The solution must be cost-effective and not require manual intervention during failover.
Which of the following is the BEST course of action to meet these requirements?

Accepted Answer

Configure Azure SQL Database active geo-replication with auto-failover group, deploy App Service in West US with a separate App Service plan, enable geo-replication for Cache for Redis, and use RA-GRS for Blob Storage. Use Azure Traffic Manager with priority routing for the web app.. It meets all requirements: Azure SQL Database active geo-replication with auto-failover groups provides an RPO of 5 seconds (well within the 5-minute requirement) and automated failover without manual intervention. Deploying App Service in West US with a separate App Service plan ensures capacity for failover, and geo-replication for Cache for Redis preserves session state to avoid data loss. RA-GRS for Blob Storage provides read access in the secondary region, and Azure Traffic Manager with priority routing enables automatic failover of the web frontend within the 30-minute RTO.

Answer

Use Azure Backup for the SQL database with 5-minute backup frequency, deploy App Service in West US with staging slots, and use Azure Traffic Manager with priority routing.

Answer

Configure Azure SQL Database geo-replication with readable secondary, deploy App Service in West US with deployment slots, and use Azure Front Door with health probes. Cache for Redis is not critical and can be rebuilt.

Answer

Deploy the entire application in an active-active configuration using Azure Front Door, with Azure SQL Database using failover groups and manual failover. Use Azure Backup for the database with 1-hour backup frequency.

Question 4

A global e-commerce company runs a product catalog application that requires low-latency reads and writes from multiple geographic regions. The data is key-value structured and must be replicated with multi-region write capability. The company needs a fully managed NoSQL database service with guaranteed 99th percentile latency and automatic conflict resolution. Which Azure data service should they choose?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it is a fully managed NoSQL database that supports multi-region writes with automatic conflict resolution, guarantees 99th percentile latency, and provides low-latency reads and writes globally. Its multi-master replication and tunable consistency models meet the key-value structured data requirements and the need for high availability across geographic regions.

Answer

Azure Table Storage

Answer

Azure Redis Cache

Answer

Azure SQL Database

Question 5

A company is deploying a multi-tier web application on Azure. The web tier must be accessible from the internet. The application tier and database tier must be isolated within the virtual network and not directly accessible from the internet. The solution must provide SSL termination, URL-based routing, and Web Application Firewall (WAF) capabilities. Which Azure service should they use to expose the web tier?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer-7 load balancer that provides SSL termination, URL-based routing, and a built-in Web Application Firewall (WAF). It can expose the web tier to the internet while keeping the application and database tiers isolated within the virtual network, as it routes traffic to backend pools using HTTP/HTTPS rules without exposing those backends directly.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 6

Your organization uses Microsoft Entra ID. You need to allow external users to sign in using their own identity providers (e.g., Google, Facebook) to access a custom application. What should you configure?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) is the correct solution because it is specifically designed to allow external users to authenticate using their own social identity providers (e.g., Google, Facebook) via OAuth 2.0 and OpenID Connect protocols. This configuration enables a custom application to accept sign-ins from these external identities without requiring them to have a Microsoft Entra ID account, using a dedicated external tenant or identity experience.

Answer

Microsoft Entra Connect

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra ID (tenant)

Question 7

A company needs to store video files for a media streaming application. The files are accessed frequently for the first 30 days, then rarely after that. The solution must minimize storage costs while ensuring low-latency access during the initial period. Which storage tier should be used for the first 30 days?

Accepted Answer

Azure Blob Storage Hot tier. Azure Blob Storage Hot tier is designed for data that is accessed frequently, offering low-latency access (typically under 10 milliseconds for first-byte read) and the highest storage cost but lowest access cost. Since the video files require low-latency access during the first 30 days, the Hot tier meets the performance requirement while minimizing overall cost compared to Premium Blob Storage, which is optimized for sub-millisecond latency and higher IOPS scenarios.

Answer

Azure Blob Storage Cool tier

Answer

Azure Premium Blob Storage

Answer

Azure Blob Storage Archive tier

Question 8

A company uses Microsoft Entra ID and wants to automate the lifecycle management of user accounts in their SaaS applications, such as Salesforce and ServiceNow. The solution should automatically create, update, and deactivate accounts when users join, move, or leave the organization. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Provisioning. Microsoft Entra ID Provisioning (specifically, HR-driven provisioning) automates the creation, update, and deactivation of user accounts in SaaS applications like Salesforce and ServiceNow based on changes in the organization's HR system or directory. It uses SCIM (System for Cross-domain Identity Management) protocol to synchronize identity lifecycle events, ensuring accounts are automatically created when users join, updated when they move, and deactivated when they leave.

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID Entitlement Management

Question 9

Your organization has a containerized application running on Azure Kubernetes Service (AKS). You need to design a solution to securely store and manage secrets (e.g., database passwords, API keys) that the application consumes. The solution must integrate with AKS and support automatic rotation of secrets. What should you use?

Accepted Answer

Azure Key Vault with the Secrets Store CSI driver. Azure Key Vault with the Secrets Store CSI driver is the correct choice because it provides a dedicated, secure vault for storing secrets and mounts them directly into AKS pods as volumes or environment variables without exposing them in application code. The CSI driver integrates natively with AKS and supports automatic rotation by periodically polling Key Vault for updated secret versions, ensuring pods consume the latest values without requiring a restart.

Answer

Azure App Configuration

Answer

Azure Managed Identity

Answer

Azure Container Registry

Question 10

A financial services company is designing a data platform on Azure that must comply with strict regulatory requirements. The platform will store sensitive customer data in Azure SQL Database. The company needs to prevent data exfiltration and ensure that only authorized Microsoft Entra ID users can access the data. The solution must also encrypt data at rest and in transit. Which combination of Azure services should the company implement?

Accepted Answer

Azure SQL Database with Managed Identity, Azure Private Link, and Transparent Data Encryption (TDE). It combines Managed Identity for secure, password-free authentication to Azure SQL Database, Azure Private Link to eliminate public internet exposure and prevent data exfiltration, and Transparent Data Encryption (TDE) to encrypt data at rest. This trio directly addresses the regulatory requirements for access control, network isolation, and encryption without relying on less secure firewall rules or client-side encryption.

Answer

Azure SQL Database firewall rules, Transparent Data Encryption (TDE), and Always Encrypted

Answer

Azure SQL Database with IP firewall rules, TLS 1.2, and Azure Information Protection

Answer

Azure SQL Database with Microsoft Entra ID authentication, Azure Key Vault, and Azure Storage Service Encryption

Question 11

A company runs a data analytics workload that processes large amounts of unstructured data (images and videos). The data is accessed frequently for the first month, then rarely. They need to store the data cost-effectively for 7 years to meet compliance. The solution must support fast retrieval of data within the first month. Which Azure storage solution should they recommend?

Accepted Answer

Azure Blob Storage with hot tier for 30 days, then lifecycle management to cool tier for 6 months, then archive tier. Azure Blob Storage with hot tier for the first 30 days meets the fast retrieval requirement for frequently accessed data, while lifecycle management automatically moves data to cool tier for 6 months and then to archive tier for the remaining 7-year compliance period, minimizing cost. The archive tier offers the lowest storage cost for rarely accessed data, and lifecycle policies ensure seamless transitions without manual intervention.

Answer

Azure Blob Storage with premium tier for 30 days, then lifecycle to archive tier

Answer

Azure Files with lifecycle management

Answer

Azure Disk Storage with snapshots

Question 12

Your company runs a stateless web application on Azure Kubernetes Service (AKS). You need to design a disaster recovery solution that ensures the application is available in another Azure region within 30 minutes of a regional failure. The solution must balance cost and complexity. What should you recommend?

Accepted Answer

Use Azure Traffic Manager to distribute traffic across two AKS clusters in different regions.. Azure Traffic Manager can distribute traffic across two AKS clusters in different regions using DNS-based routing, such as priority or performance routing, enabling failover within the required 30-minute RTO. This approach balances cost and complexity by avoiding the need for active-active replication or complex multi-region pod configurations, while still meeting the stateless application's DR requirements.

Answer

Use Azure SQL Database active geo-replication for the application's database.

Answer

Use Azure Front Door to route traffic to a single AKS cluster with pods running in multiple regions.

Answer

Deploy a single AKS cluster with nodes in multiple availability zones.

Question 13

Your organization is planning to migrate a large number of on-premises file servers to Azure. The data includes millions of small files. You need to select a storage solution that supports SMB protocol and can handle high file counts. Which TWO Azure services meet these requirements?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB file shares in the cloud, supporting the SMB protocol natively and capable of handling high file counts (up to 100 million files per share with large shares enabled). This makes it a direct match for migrating on-premises file servers with millions of small files.

Answer

Azure Stack Edge

Answer

Azure Blob Storage with NFS 3.0

Answer

Azure Disk Storage

Question 14

You are tasked with ensuring that all VMs in the subscription have Azure Hybrid Benefit enabled for Windows Server. You create the Azure Policy shown in the exhibit. However, after assignment, the compliance report shows that some D-series VMs are still non-compliant. What is the most likely cause?

Accepted Answer

The policy does not apply to existing resources; it only blocks new or updated ones.. Azure Policy with the 'deny' effect only blocks new or updated resources that violate the policy; it does not automatically remediate existing non-compliant resources. The D-series VMs were likely created before the policy was assigned, so they remain non-compliant until they are redeployed or a remediation task is triggered. To enforce compliance on existing resources, you would need to use a 'deployIfNotExists' or 'modify' effect with a remediation task.

Answer

The 'deny' effect is incorrectly configured; it should be 'audit' to show compliance.

Answer

The 'like' operator does not match standard D-series SKUs.

Answer

The policy is scoped to a management group that excludes the resource group containing the VMs.

Question 15

A company runs a multi-tier application on Azure VMs in the West US region. The application has web, application, and database tiers. They want to use Azure Site Recovery for disaster recovery to East US. They need to ensure that after failover, the web tier starts first, then the application tier, and finally the database tier after a consistency check. They also need to be able to perform non-disruptive DR drills. Which Azure Site Recovery capabilities should they use together?

Accepted Answer

Create a recovery plan with custom groups and scripts for startup order, and use test failover for DR drills. Azure Site Recovery (ASR) recovery plans allow you to define custom groups and scripts to control the startup order of VMs after failover. By placing the web, application, and database tiers into separate groups with pre- and post-actions (e.g., PowerShell scripts), you can ensure the web tier starts first, then the application tier, and finally the database tier after a consistency check. ASR's test failover capability performs a non-disruptive DR drill by creating isolated copies of VMs in a separate VNet without impacting the production environment.

Answer

Use Azure Backup for the VMs and restore them in order after failover

Answer

Use an availability set to control startup order and use disaster recovery drills in a separate VNet

Answer

Use Azure Traffic Manager to route traffic after failover and manually start VMs in order