AZ-305 Practice Test 33 — 15 Questions

Question 1

A data platform must support analytical queries over petabytes of files in a data lake, while preserving hierarchical namespaces and fine-grained ACLs. Which storage service should you design around?

Accepted Answer

Azure Data Lake Storage Gen2.. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs, enabling fine-grained access control at the file and directory level while supporting petabyte-scale analytical workloads. It is built on Azure Blob Storage, providing high-throughput and parallel processing for big data analytics engines like Azure Synapse, Spark, and Hadoop.

Answer

Azure Files premium shares.

Answer

Azure Table Storage.

Answer

Azure Queue Storage.

Question 2

You need to design a storage solution for a global e-commerce application that requires low-latency access to product catalog data across multiple Azure regions. The data is read-heavy and updates are rare. Which service should you use for the primary data store?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it provides globally distributed, multi-region writes and reads with turnkey data replication and guaranteed single-digit-millisecond latency at the 99th percentile. Its multi-homing API and automatic failover capabilities make it ideal for a read-heavy, rarely updated global e-commerce catalog that requires low-latency access across multiple Azure regions.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Table Storage

Answer

Azure Redis Cache

Question 3

A company runs a file server on Azure VMs using Windows Server. The server stores business-critical documents. You need to design a backup strategy that meets a recovery point objective (RPO) of 1 hour and recovery time objective (RTO) of 4 hours. The solution must be cost-effective. Which backup solution should you use?

Accepted Answer

Azure Backup for Azure VMs. Azure Backup for Azure VMs provides application-consistent backups for Windows Server VMs, supporting RPOs as low as 1 hour with frequent backup policies and RTOs within 4 hours by restoring to a new VM or using instant restore. It is cost-effective because it uses incremental backups and only charges for storage consumed, without the replication overhead of Site Recovery.

Answer

Azure Site Recovery

Answer

Azure Backup for Azure Blobs

Answer

Azure File Sync

Question 4

Your organization plans to migrate a legacy on-premises application that uses a proprietary authentication mechanism to Azure. The application must run as a virtual machine and must not require any code changes. You need to design an identity solution that integrates with the application without modifying it. What should you use?

Accepted Answer

Microsoft Entra Application Proxy with Kerberos Constrained Delegation. Microsoft Entra Application Proxy with Kerberos Constrained Delegation (KCD) allows you to publish on-premises applications that use Kerberos authentication without modifying the application code. The Application Proxy pre-authenticates users via Entra ID, then uses KCD to obtain a Kerberos ticket on behalf of the user and pass it to the legacy application running on a VM. This meets the requirement of no code changes while integrating the proprietary authentication mechanism with Azure identity.

Answer

Azure VPN Gateway

Answer

Microsoft Entra Domain Services

Answer

Azure Bastion

Question 5

A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They want to enforce that users accessing sensitive cloud applications from outside the corporate network must use multi-factor authentication (MFA). Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to define policies that enforce MFA based on specific conditions, such as network location (outside corporate network) and cloud app sensitivity. By configuring a Conditional Access policy targeting 'All cloud apps' or specific sensitive apps with the condition 'Locations: All trusted/untrusted networks', you can require MFA for external access. This directly meets the requirement without needing additional licenses or features beyond Entra ID Premium P2.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Access Reviews

Question 6

A healthcare analytics platform stores semi-structured JSON documents and requires globally distributed low-latency reads with tunable consistency. Which Azure data platform should be recommended?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it natively supports semi-structured JSON documents, offers globally distributed multi-region writes and reads with low-latency (typically <10 ms at the 99th percentile), and provides tunable consistency levels (from strong to eventual) via its multi-master replication protocol. This directly matches the requirements for a healthcare analytics platform needing global distribution and flexible consistency.

Answer

Azure Files premium shares

Answer

Azure Data Factory

Answer

Azure SQL Managed Instance

Question 7

A company stores unstructured data such as documents and images in Azure Blob Storage. The data is accessed frequently for the first month, then only rarely for the next year, and after that must be retained for 10 years for compliance. The company wants to minimize storage costs by automatically moving data to the most cost-effective storage tiers. Which Azure Blob Storage feature should they implement?

Accepted Answer

Lifecycle management policies. Lifecycle management policies in Azure Blob Storage allow you to automatically transition blobs to cooler tiers (e.g., from Hot to Cool, then to Archive) based on age or last modification time. This directly matches the requirement to move data from frequent access (first month) to rare access (next year) and then to long-term retention (10 years) while minimizing costs.

Answer

Azure Data Lake Storage access tiers

Answer

Soft delete

Answer

Immutability policies

Question 8

Your company uses Azure SQL Database and needs to archive data older than 7 years for compliance. The archived data must be stored in the most cost-effective manner, must be immutable, and must be deleted exactly after 10 years. What should you use?

Accepted Answer

Azure Blob Storage with immutable storage and time-based retention policy. Azure Blob Storage with immutable storage and a time-based retention policy ensures that archived data cannot be modified or deleted until the specified retention period expires. This meets the compliance requirements for immutability and a 10-year deletion timeline, while blob storage tiers (e.g., cool or archive) can be used for cost-effective long-term storage.

Answer

Azure Archive Storage with lifecycle management to delete after 10 years

Answer

Azure SQL Database restore to a point in time with a retention period of 10 years

Answer

Azure SQL Database long-term retention (LTR) backups

Question 9

You are designing a high-availability solution for a stateless web application running on Azure VMs. The solution must provide automatic failover to another region in the event of a regional outage. Which Azure service should you use to distribute traffic across regions?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it is a global, scalable entry point that uses HTTP/HTTPS traffic to provide cross-region load balancing and automatic failover. It supports path-based routing, SSL offload, and health probes that can detect a regional outage and instantly reroute traffic to a healthy region, meeting the requirement for stateless web applications.

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 10

Your company has an Azure subscription with a single virtual network. You need to design a solution to back up Azure VMs to meet a 7-day retention policy. The backup data must be stored in a separate region for compliance. What should you use?

Accepted Answer

Azure Backup with cross-region restore (CRR) enabled. Azure Backup with cross-region restore (CRR) enabled is the correct solution because it allows you to store backup data in a secondary Azure paired region, meeting the compliance requirement for separate region storage. CRR works by replicating the backup data from the default geo-redundant storage (GRS) in the primary region to the paired region, and then enabling you to restore VMs in that secondary region. With a 7-day retention policy, CRR supports restoring from the recovery point within that window, ensuring compliance without additional infrastructure.

Answer

Azure Site Recovery with replication to a secondary region

Answer

Azure File Share snapshots stored in a different region

Answer

Azure Backup with default geo-redundant storage (GRS) in the same region

Question 11

A company deploys a multi-tier web application on Azure VMs across availability zones. The web tier must have SSL termination, session persistence, and health probe monitoring. Additionally, all traffic must be inspected by a central firewall for compliance. The solution must be highly available. Which combination of Azure services should they implement?

Accepted Answer

Azure Application Gateway (WAF) in front of web VMs, with Azure Firewall in a hub VNet for central inspection. Azure Application Gateway provides SSL termination, session persistence (via cookie-based affinity), and health probes at Layer 7, which are required for a web tier. Placing Azure Firewall in a hub VNet for central inspection ensures all traffic is inspected for compliance, and deploying the web VMs across availability zones meets the high-availability requirement.

Answer

Azure Load Balancer (Standard) in front of web VMs, with a third-party Network Virtual Appliance (NVA) for inspection

Answer

Azure Front Door in front of web VMs, with Azure Firewall for inspection

Answer

Azure Traffic Manager + Azure Application Gateway

Question 12

You are designing a monitoring solution for a hybrid environment with on-premises servers and Azure VMs. You need to collect performance data from all servers and visualize it in a single dashboard. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a unified platform for collecting, analyzing, and visualizing performance data from both on-premises servers and Azure VMs. By deploying the Azure Monitor agent on all servers, you can send metrics and logs to a single Log Analytics workspace and then use Azure Workbooks or Metrics Explorer to create a consolidated dashboard.

Answer

Azure Service Health

Answer

Azure Workbooks

Answer

Azure Arc

Question 13

Your company deploys a line-of-business application on Azure App Service. The application requires custom domain names and SSL/TLS certificates. You need to ensure that the application can be accessed via a custom domain with HTTPS. What should you configure in the App Service?

Accepted Answer

Add the custom domain and bind the SSL/TLS certificate.. To access an App Service via a custom domain with HTTPS, you must first add the custom domain to the App Service and then bind an SSL/TLS certificate (either App Service Managed Certificate, a Key Vault certificate, or a third-party certificate) to that domain. This binding enables the App Service to present the certificate during the TLS handshake, allowing secure HTTPS connections. Without both steps, the custom domain will not resolve securely.

Answer

Configure IP restrictions to allow only the custom domain.

Answer

Create a deployment slot for production traffic.

Answer

Scale out the App Service plan to increase instance count.

Question 14

Your organization needs to share large files (up to 100 GB) with external partners securely. The solution must allow partners to access files for a limited time and track who accessed which file. Which Azure solution should you use?

Accepted Answer

Azure Blob Storage with shared access signatures (SAS).. Azure Blob Storage with shared access signatures (SAS) is correct because it allows you to generate time-limited, permission-restricted URIs that grant external partners secure access to large files (up to 100 GB) without exposing the storage account key. SAS tokens can be configured with an expiration time and, when combined with Azure Storage analytics logging, enable tracking of who accessed which file by correlating the SAS identifier with log entries.

Answer

Azure Data Box.

Answer

Azure Files with SMB protocol.

Answer

Azure Blob Storage with public access.

Question 15

Refer to the exhibit. You assign this Azure Policy to a resource group. A user attempts to create a new Azure SQL Server without specifying an administrator login. What will happen?

Accepted Answer

The SQL Server creation is denied.. The Azure Policy assigned to the resource group includes a condition that checks if the 'administratorLogin' property is missing or null when creating a SQL Server. Since the user does not specify an administrator login, the condition evaluates to true, triggering the 'deny' effect. This prevents the creation of the SQL Server entirely, as Azure Policy enforces compliance before the resource is provisioned.

Answer

The SQL Server is created with a default administrator login.

Answer

The policy is ignored because the condition is not met.

Answer

The SQL Server is created but a compliance alert is generated.