AZ-305 Practice Test 32 — 15 Questions

Question 1

A company deploys a web application on multiple Azure VMs within an availability set. They need to distribute incoming HTTP traffic evenly across the VMs and provide health probe monitoring. The solution must support SSL termination and source IP affinity (session persistence). Which Azure load balancing solution should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports SSL termination, source IP affinity (session persistence), and health probe monitoring. It can distribute HTTP traffic evenly across VMs in an availability set while offloading SSL processing from the backend VMs.

Answer

Azure Load Balancer (Basic)

Answer

Azure Load Balancer (Standard)

Answer

Azure Traffic Manager

Question 2

You are designing a storage strategy for a data analytics solution that processes large volumes of streaming data. The data must be stored in a cost-effective manner with low latency for hot data and infrequent access for cold data after 30 days. The solution must support both batch and interactive queries. Which combination of Azure storage services should you recommend?

Accepted Answer

Azure Data Lake Storage Gen2 with lifecycle management. Azure Data Lake Storage Gen2 (ADLS Gen2) combines the scalability and cost benefits of object storage with a hierarchical namespace, enabling both batch and interactive queries via services like Azure Synapse Analytics and Apache Spark. Lifecycle management policies can automatically transition hot data to cooler tiers (e.g., cool or archive) after 30 days, reducing costs for infrequently accessed cold data while maintaining low-latency access for hot data. This makes ADLS Gen2 the ideal choice for streaming data analytics that requires cost-effective tiered storage and supports diverse query patterns.

Answer

Azure SQL Database with geo-replication

Answer

Azure Blob Storage with hot and cool access tiers

Answer

Azure Cosmos DB with multiple consistency levels

Question 3

You are designing a monitoring solution for a critical application that runs on Azure Virtual Machines. The application generates custom performance counters. You need to alert when the custom counter exceeds a threshold and trigger an Azure Automation runbook to remediate. Which two Azure services should you combine? (Select TWO.)

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it collects and analyzes custom performance counters from Azure VMs, enabling metric-based alert rules. When a threshold is exceeded, Azure Monitor can trigger an action group that invokes an Azure Automation runbook, providing automated remediation. This combination directly addresses the requirement to alert on custom counters and execute a runbook in response.

Answer

Azure Event Grid

Answer

Log Analytics

Question 4

You are designing identity governance for a company that uses Microsoft Entra ID. The company wants to grant external partners access to an internal application for 90 days. After 90 days, access must be automatically removed. Additionally, the application requires that users have multi-factor authentication (MFA) and a compliant device. You need to design a solution that meets these requirements with minimal administrative effort. What should you do?

Accepted Answer

Create an access package in Microsoft Entra entitlement management with a 90-day policy and conditional access policies for MFA and device compliance.. Microsoft Entra entitlement management allows you to create an access package that automatically grants external partners access to the application for exactly 90 days, after which access is automatically removed via an expiration policy. Additionally, you can enforce multi-factor authentication (MFA) and device compliance by configuring conditional access policies that are applied to the access package, meeting all requirements with minimal administrative effort through automation.

Answer

Manually create guest user accounts, assign app, and set calendar reminder to delete after 90 days.

Answer

Create a dynamic group in Microsoft Entra ID that includes partners and assign the app; use a scheduled script to remove membership after 90 days.

Answer

Use Microsoft Entra Privileged Identity Management to grant just-in-time access for 90 days.

Question 5

Your company needs to store configuration data (key-value pairs) for applications in a highly scalable and low-latency manner. The data is accessed frequently. Which Azure service should you choose?

Accepted Answer

Azure Cache for Redis.. Azure Cache for Redis is the correct choice because it provides an in-memory data store that delivers extremely low-latency access (typically sub-millisecond) and high throughput for frequently accessed key-value configuration data. It supports common data structures like strings, hashes, and lists, and can be used as a distributed cache or session store, making it ideal for high-frequency read workloads where persistence is not the primary concern.

Answer

Azure Cosmos DB.

Answer

Azure SQL Database.

Answer

Azure Table Storage.

Question 6

Your company operates in a highly regulated industry and must retain all sign-in logs for 7 years. The logs must be immutable and cannot be modified or deleted by administrators. You need to design a monitoring solution that stores sign-in logs in a cost-effective manner while meeting compliance requirements. The solution should also allow for real-time analysis of sign-in activity. What should you include in the design?

Accepted Answer

Stream sign-in logs to Log Analytics for real-time analysis and simultaneously archive them to an Azure Storage account with immutable blob policy (WORM).. It meets both compliance and real-time analysis requirements. Streaming sign-in logs to Log Analytics enables real-time monitoring and querying, while simultaneously archiving them to an Azure Storage account with an immutable blob policy (WORM) ensures the logs cannot be modified or deleted for the required 7-year retention period. This combination provides cost-effective long-term storage (Azure Blob is cheaper than Log Analytics for long-term retention) and satisfies regulatory immutability mandates.

Answer

Stream sign-in logs to Azure Event Hubs and then to cold storage in Azure Blob with lifecycle management.

Answer

Stream sign-in logs to Log Analytics workspace with 7-year retention and use Azure Policy to restrict deletion.

Answer

Use Azure Data Explorer to store logs for 7 years and configure a purge policy to prevent deletion.

Question 7

Drag and drop the steps to deploy a web app using Azure App Service with a custom domain and SSL certificate into the correct order.

Accepted Answer

Create the App Service app, then map the custom domain, then upload the SSL certificate, then bind the certificate to the domain, then enforce HTTPS.. The correct order for deploying a web app using Azure App Service with a custom domain and SSL certificate is: create the App Service app, map the custom domain, upload the SSL certificate, bind the certificate to the domain, and finally enforce HTTPS. This sequence ensures that each step has the necessary prerequisites: the app exists before domain mapping, the domain is mapped before certificate upload and binding, and the certificate is bound before enforcing HTTPS.

Answer

Create the App Service app, then upload the SSL certificate, then map the custom domain, then bind the certificate to the domain, then enforce HTTPS.

Answer

Create the App Service app, then map the custom domain, then bind the certificate to the domain, then upload the SSL certificate, then enforce HTTPS.

Answer

Map the custom domain, then create the App Service app, then upload the SSL certificate, then bind the certificate to the domain, then enforce HTTPS.

Question 8

A multinational corporation needs to store and analyze petabytes of historical data for regulatory reporting. The data is rarely accessed but must be available for queries within 5 minutes. Which Azure storage solution should they choose to minimize cost?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with Azure Blob Storage's massive scalability, enabling petabyte-scale storage at low cost. It supports fast queries via tools like Azure Synapse or PolyBase, meeting the 5-minute query SLA for cold data, while its tiered storage (e.g., Cool or Archive access tiers) minimizes cost for rarely accessed historical data.

Answer

Azure SQL Database

Answer

Azure Files

Answer

Azure Cosmos DB

Question 9

A healthcare organization needs to store patient records that must be immutable and auditable for compliance purposes. The records should be stored in a cost-effective manner with the ability to set retention policies. Which Azure storage solution should they implement?

Accepted Answer

Azure Blob Storage with immutable storage. Azure Blob Storage with immutable storage (WORM policy) is the correct solution because it provides time-based retention policies and legal hold capabilities that make data non-erasable and non-modifiable, meeting compliance requirements for patient records. It is cost-effective for large volumes of data and integrates with Azure Policy for audit logging, making it ideal for healthcare compliance scenarios like HIPAA.

Answer

Azure NetApp Files

Answer

Azure SQL Database

Answer

Azure Files

Question 10

A company plans to migrate an on-premises application with strict low-latency requirements to Azure. The application must communicate with an Azure SQL Database. Which of the following is the best design to minimize latency?

Accepted Answer

Deploy the application and Azure SQL Database in the same Azure region, and connect via Azure Private Link.. The best design because deploying both the application and Azure SQL Database in the same Azure region minimizes network distance and latency. Using Azure Private Link creates a private endpoint for the SQL Database within the application's virtual network, eliminating internet routing and reducing latency further by keeping traffic entirely within the Microsoft backbone network.

Answer

Deploy the application in one region and Azure SQL Database in a different region, using Azure Traffic Manager.

Answer

Deploy the application on-premises and use a Point-to-Site VPN to connect to Azure SQL Database.

Answer

Deploy the application on-premises and use ExpressRoute to connect to Azure SQL Database.

Question 11

Your company has a hybrid identity environment with 10,000 on-premises users synchronized to Microsoft Entra ID using Microsoft Entra Connect. You plan to implement a modern access control strategy for all cloud applications. The requirements are: enforce multifactor authentication (MFA) for all users when accessing sensitive applications, allow users to self-remediate risky sign-ins via a mobile app, and minimize infrastructure complexity. You need to design the identity and governance solution. What should you do?

Accepted Answer

Configure Microsoft Entra ID Protection to detect risky sign-ins and create a conditional access policy that requires MFA for sensitive apps. Enable the risky user policy to require password change, and use Microsoft Authenticator for self-remediation.. It uses Microsoft Entra ID Protection to detect risky sign-ins and a Conditional Access policy to require MFA for sensitive applications, meeting the MFA enforcement requirement. The risky user policy requiring a password change combined with Microsoft Authenticator for self-remediation allows users to resolve their own risk without admin intervention, satisfying the self-remediation requirement. This approach minimizes infrastructure complexity by relying entirely on cloud-native services rather than on-premises components.

Answer

Deploy Azure AD Domain Services and configure Kerberos authentication for cloud apps. Use Azure MFA Server on-premises for MFA enforcement.

Answer

Implement Microsoft Defender for Identity to monitor on-premises AD and require MFA via on-premises NPS extension.

Answer

Use Microsoft Entra Permissions Management to enforce MFA policies and manage user permissions.

Question 12

A company is migrating on-premises Windows applications that require LDAP, NTLM, or Kerberos authentication to Azure VMs. They want to provide domain services for these applications without deploying and managing domain controllers. Which Azure service should they use?

Accepted Answer

Microsoft Entra ID Domain Services. Microsoft Entra ID Domain Services (formerly Azure AD DS) provides managed domain services such as LDAP, NTLM, and Kerberos authentication without requiring you to deploy, patch, or manage domain controllers. It integrates with your existing Microsoft Entra tenant and supports group policy, domain join, and legacy authentication protocols needed by the on-premises Windows applications being migrated to Azure VMs.

Answer

Microsoft Entra ID

Answer

Active Directory on Azure VMs

Answer

Microsoft Entra ID B2C

Question 13

You need to design a networking solution for a multi-tier application that includes a web front-end, an API layer, and a database. The web and API tiers must be accessible from the internet, while the database tier must be isolated. What is the most secure and efficient design?

Accepted Answer

Deploy all tiers in the same VNet with separate subnets, and use NSGs to restrict traffic. Place an Azure Application Gateway with WAF in front of the web tier.. It uses a single VNet with separate subnets for each tier, allowing Network Security Groups (NSGs) to enforce micro-segmentation and restrict traffic between tiers. The Azure Application Gateway with Web Application Firewall (WAF) provides Layer 7 protection and SSL termination for internet-facing web traffic, while the database tier remains isolated with no public endpoint. This design minimizes latency by keeping all tiers within the same VNet and avoids the complexity of VNet peering or unnecessary firewall inspection.

Answer

Place all VMs in the same subnet and use a single Azure Load Balancer to distribute traffic.

Answer

Use separate VNets for each tier and connect them with VNet peering.

Answer

Deploy all VMs in a single subnet and use Azure Firewall to inspect all inbound and outbound traffic.

Question 14

Refer to the exhibit. You have an Azure Storage account with hierarchical namespace enabled. You create this JSON policy to assign to a container. Users report that they can access the container from any IP, not just the specified range. What is the most likely reason?

Accepted Answer

IP address conditions are not supported in RBAC for Azure Storage data plane operations. RBAC roles for Azure Storage data plane operations do not support IP address conditions in role assignments. IP address conditions are only supported for Azure Resource Manager (control plane) RBAC roles, not for data plane operations like accessing blob or container data. Since the policy uses RBAC with an IP condition, the condition is ignored, and access is allowed from any IP.

Answer

Hierarchical namespace disables IP-based restrictions

Answer

Anonymous access is enabled on the container

Answer

The resource scope is incorrect; RBAC cannot be assigned at the container level

Question 15

You need to store billions of small JSON files (average 50 KB) that are accessed infrequently but must be available within seconds when requested. Which Azure storage solution is most cost-effective?

Accepted Answer

Azure Blob Storage Cool tier. Azure Blob Storage Cool tier is the most cost-effective solution for storing billions of small JSON files (average 50 KB) that are infrequently accessed but require low-latency retrieval within seconds. The Cool tier offers low storage costs for data accessed less than once per month, while still providing sub-second access latency for individual blobs via HTTPS REST API, matching the 'available within seconds' requirement without the higher costs of Hot or premium tiers.

Answer

Azure SQL Database with a table storing JSON

Answer

Azure Files with SMB shares

Answer

Azure Cosmos DB with a container for each file