AZ-305 Practice Test 34 — 15 Questions

Question 1

You need to design a solution to store log data from multiple Azure services. The data must be retained for 7 years for compliance purposes and should be queryable for analysis. Which Azure service should you use as the primary storage for these logs?

Accepted Answer

Azure Log Analytics workspace. Option B is correct because Azure Log Analytics workspaces (part of Azure Monitor) can ingest logs from multiple services, retain data for up to 7 years (with extended retention), and support KQL queries. Option A (Azure Blob Storage) can store logs but is not optimized for interactive querying. Option C (Azure Data Lake Storage) is for big data analytics, not primarily for logs. Option D (Azure SQL Database) is not designed for high-volume log ingestion and may be costly.

Answer

Azure Data Lake Storage

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 2

Your company is designing a hybrid network architecture to connect an on-premises data center to Azure. The requirements include: high availability, low latency, and cost optimization. Which TWO options should you recommend?

Accepted Answer

ExpressRoute Gateway. Option A is correct because ExpressRoute offers low latency and high bandwidth. Option C is correct because two ExpressRoute circuits from different providers provide high availability. Option B is incorrect because VPN Gateway can be used for backup but does not provide low latency. Option D is incorrect because ExpressRoute Direct is not required for high availability. Option E is incorrect because a single ExpressRoute circuit does not provide high availability.

Answer

Single ExpressRoute circuit

Answer

Site-to-Site VPN

Answer

ExpressRoute Direct

Question 3

Your company is deploying a critical application on Azure VMs. The application requires a static private IP address that does not change even if the VM is stopped and deallocated. The VM must be placed in an availability zone for high availability. Which networking approach should you use?

Accepted Answer

Assign a static private IP address to the VM's NIC and use a standard public load balancer.. Option A is correct because a standard public load balancer can be used in front of VMs, and static private IPs can be assigned via NIC-level static IP allocation. Option B is incorrect because Azure Firewall is not for load balancing. Option C is incorrect because Traffic Manager is a DNS-based load balancer for global traffic. Option D is incorrect because Application Gateway is a layer 7 load balancer, but it does not provide static private IP for the VM itself.

Answer

Use Azure Firewall to provide static private IP and load balancing.

Answer

Use Azure Traffic Manager to assign static private IP.

Answer

Use Application Gateway with a static private IP.

Question 4

You are designing a high-availability solution for a stateless web application running on Azure VMs. The solution must provide automatic failover to another region in the event of a regional outage. Which Azure service should you use to distribute traffic across regions?

Accepted Answer

Azure Front Door. Option C is correct because Azure Front Door provides global load balancing with automatic failover across regions. Option A is wrong because Azure Traffic Manager is DNS-based and can also do cross-region failover, but Front Door provides more features like SSL offload and WAF. Option B is wrong because Azure Load Balancer is for regional load balancing. Option D is wrong because Application Gateway is regional.

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 5

You are designing a solution to securely store and manage secrets for multiple applications deployed in Azure. The solution must support automated rotation of secrets and provide audit logging. Which Azure service should you use?

Accepted Answer

Azure Key Vault with managed identity and rotation policy. Option C is correct because Azure Key Vault with managed identities and rotation policies provides automated secret rotation and audit logging. Option A is wrong because Azure App Service Key Vault references are for referencing secrets, not managing rotation. Option B is wrong because Azure Automation can rotate secrets but is more complex. Option D is wrong because Microsoft Entra ID is for identity, not secret storage.

Answer

Microsoft Entra ID application registration

Answer

Azure App Service Key Vault references

Answer

Azure Automation with PowerShell runbooks

Question 6

Refer to the exhibit. You are reviewing an ARM template that deploys a virtual network with two subnets. Subnet-b includes a delegation to Microsoft.Web/serverFarms. What is the purpose of this delegation?

Accepted Answer

It enables Azure App Service instances to be deployed into subnet-b. Delegation to Microsoft.Web/serverFarms indicates that the subnet is intended for use by Azure App Service (App Service Plan). Option A is incorrect because the delegation does not define address space. Option C is incorrect because firewall policies are not configured via delegation. Option D is incorrect because VNet peering is unrelated.

Answer

It allows subnet-b to use a different address space

Answer

It configures a firewall policy for subnet-b

Answer

It creates a peering connection to another virtual network

Question 7

You are designing a network architecture for a multi-tier application. The front-end tier is an Azure Application Gateway that routes traffic to a web app on Azure App Service. The back-end tier is an Azure SQL Database. You need to ensure that all traffic between the Application Gateway and the web app remains within the Azure backbone network, and that the web app can only be accessed through the Application Gateway. What should you configure?

Accepted Answer

Enable Service Endpoints for the web app and configure the Application Gateway with a private IP.. Option C is correct because enabling Service Endpoints for the web app's subnet restricts access to that subnet, and configuring the Application Gateway to use a private IP ensures traffic stays within Azure. App Service can be integrated with a VNet via regional VNet integration, but Service Endpoints are simpler for this scenario. Option A (Azure Firewall) is not needed. Option B (VPN Gateway) is for hybrid connectivity. Option D (Private Link) is more complex and used for PaaS services; Service Endpoints are sufficient.

Answer

Use Azure Private Link for the web app and disable public access.

Answer

Deploy Azure Firewall in front of the Application Gateway.

Answer

Use a site-to-site VPN between the App Service and Application Gateway.

Question 8

A multinational corporation is designing a backup and disaster recovery strategy for Azure IaaS VMs. The solution must support cross-region failover, meet a recovery point objective (RPO) of 15 minutes, and a recovery time objective (RTO) of 1 hour. Which THREE options should you include in the design?

Accepted Answer

Azure Backup with geo-redundant storage (GRS). Option A is correct because Azure Backup with geo-redundant storage (GRS) enables cross-region recovery. Option B is correct because Azure Site Recovery replicates VMs to a secondary region for failover. Option C is correct because Azure Backup with locally redundant storage (LRS) does not support cross-region failover. Option D is incorrect because managed disk snapshots are not cross-region. Option E is correct because Azure Backup with zone-redundant storage (ZRS) provides redundancy within a region but not cross-region.

Answer

Azure Backup with locally redundant storage (LRS)

Answer

Managed disk snapshots

Question 9

Your organization is building a serverless application that processes events from Azure Event Hubs and stores results in Azure Cosmos DB. The processing logic must be scalable and cost-effective, with no idle costs. Which compute service should you use?

Accepted Answer

Azure Functions. Option A is correct because Azure Functions can be triggered by Event Hubs and scales automatically, with pay-per-execution pricing. Option B is incorrect because Azure Logic Apps is more expensive and less suitable for high-throughput event processing. Option C is incorrect because Azure Container Instances have idle costs and are not serverless. Option D is incorrect because Azure Kubernetes Service has management overhead and idle costs.

Answer

Azure Container Instances

Answer

Azure Logic Apps

Answer

Azure Kubernetes Service

Question 10

Which TWO of the following are valid considerations when designing a SQL Server Always On availability group in Azure VMs? (Choose two.)

Accepted Answer

The availability group listener should use a static IP address in the same subnet as the primary replica.. Correct answers are B and D. Option A is wrong because availability group replicas should be in different subnets for proper routing. Option C is wrong because cloud witness is recommended for quorum, not file share witness. Option E is wrong because the listener requires a dedicated IP address.

Answer

The availability group listener can use DHCP to automatically assign an IP address.

Answer

A file share witness is required for the quorum configuration.

Answer

All replicas must be in the same subnet to use a single internal load balancer.

Question 11

A healthcare organization needs to store patient health records in Azure. The data must be encrypted at rest and in transit. The organization requires a customer-managed key (CMK) with automatic key rotation every 90 days. The solution must support Azure SQL Database and Azure Blob Storage. Which key management solution should you recommend?

Accepted Answer

Azure Key Vault Managed HSM (Premium tier). Option A is correct because Azure Key Vault Managed HSM supports CMK with automatic rotation and FIPS 140-2 Level 3 validation, meeting compliance. Option B is wrong because Key Vault Standard does not support automatic rotation. Option C is wrong because Azure Information Protection is for classification, not key management. Option D is wrong because Azure Storage encryption uses Microsoft-managed keys by default.

Answer

Azure Storage Service Encryption

Answer

Azure Information Protection

Answer

Azure Key Vault Standard

Question 12

A company is designing a multi-region disaster recovery solution for a mission-critical application hosted on Azure VMs. The application requires synchronous replication of storage and automatic failover with no data loss. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 0. Which Azure service should the company use?

Accepted Answer

Azure Site Recovery. Option A (Azure Site Recovery) supports RPO as low as a few seconds and RTO in minutes, but it uses asynchronous replication, so RPO of 0 cannot be guaranteed. Option B (Azure Backup) is for backup, not real-time replication. Option C (Azure Storage with geo-redundant storage) provides asynchronous replication, not synchronous. Option D (Azure Availability Zones) uses synchronous replication and can achieve RPO=0 and low RTO within the same region, but for multi-region, the company would need a stretched cluster across regions, which is complex. However, the question specifies 'multi-region' and 'no data loss' which implies synchronous replication across regions; Azure does not offer synchronous replication across regions for VMs. But among the options, Azure Site Recovery is the only one that can provide automated failover across regions, even though RPO is not zero. The best answer is Azure Site Recovery because it's designed for DR with low RPO/RTO, and although RPO=0 is not guaranteed, it's the closest fit. Corrected: Option A is the correct choice as it's the primary DR service for VMs.

Answer

Azure Availability Zones

Answer

Azure Backup

Answer

Azure Storage with geo-redundant storage (GRS)

Question 13

Refer to the exhibit. You are reviewing the properties of an Azure Storage account. The encryption section shows keySource as Microsoft.Keyvault and infrastructureEncryption enabled. What does infrastructureEncryption mean in this context?

Accepted Answer

It enables double encryption of data at rest. Infrastructure encryption provides an additional layer of encryption at the infrastructure level, encrypting data twice. Option A is incorrect because it does not refer to the key vault itself. Option C is incorrect because TLS is separate. Option D is incorrect because it is not about automatically rotating keys.

Answer

It enforces HTTPS for all data in transit

Answer

It automatically rotates the encryption key daily

Answer

It encrypts the encryption key stored in Key Vault

Question 14

Your company plans to migrate on-premises file servers to Azure. The solution must support SMB protocol and integrate with Microsoft Entra ID for authentication. You need to choose a service that provides fully managed file shares accessible from multiple Azure regions. Which Azure service should you use?

Accepted Answer

Azure Files. Option A is correct because Azure Files offers fully managed SMB file shares that can be accessed from multiple regions using Azure File Sync or through public endpoints. It also supports Microsoft Entra ID authentication. Option B (Azure NetApp Files) is for high-performance NFS/SMB but is more expensive. Option C (Azure Blob Storage) does not support SMB natively (only NFS for premium). Option D (Azure Disk Storage) is for VM disks, not file shares.

Answer

Azure Disk Storage

Answer

Azure NetApp Files

Answer

Azure Blob Storage

Question 15

Your organization is implementing a security strategy for Azure resources. You need to enforce consistent security policies across all subscriptions and ensure compliance with regulatory standards. Which TWO services should you use?

Accepted Answer

Microsoft Defender for Cloud. Option A is correct because Azure Policy enforces rules across resources. Option C is correct because Microsoft Defender for Cloud provides security posture management and compliance monitoring. Option B is incorrect because Azure Blueprints are deprecated. Option D is incorrect because Azure RBAC is for access control, not policy enforcement. Option E is incorrect because Microsoft Sentinel is for SIEM, not policy enforcement.

Answer

Azure RBAC

Answer

Microsoft Sentinel

Answer

Azure Blueprints