AZ-305 Practice Test 36 — 15 Questions

Question 1

A company plans to migrate an on-premises application with strict low-latency requirements to Azure. The application must communicate with an Azure SQL Database. Which of the following is the best design to minimize latency?

Accepted Answer

Deploy the application and Azure SQL Database in the same Azure region, and connect via Azure Private Link.. Option A is correct because deploying in the same region and using Azure Private Link for a private connection keeps traffic within the Microsoft backbone, minimizing latency. Option B is wrong because ExpressRoute adds extra latency. Option C is wrong because different regions increase latency. Option D is wrong because Point-to-Site VPN is not suitable for production applications and adds latency.

Answer

Deploy the application in one region and Azure SQL Database in a different region, using Azure Traffic Manager.

Answer

Deploy the application on-premises and use a Point-to-Site VPN to connect to Azure SQL Database.

Answer

Deploy the application on-premises and use ExpressRoute to connect to Azure SQL Database.

Question 2

Your company is migrating a legacy on-premises application to Azure. The application requires low-latency access to a shared file system that supports SMB protocol. The solution must be highly available within a single Azure region and must not require the application to be modified. Which Azure service should you recommend?

Accepted Answer

Azure Files (premium tier). Option C is correct because Azure Files with premium SSD (SMB) provides a fully managed SMB file share with low latency and high availability. Option A is wrong because Azure NetApp Files supports SMB but is more expensive and complex for this use case. Option B is wrong because Azure Blob Storage does not support SMB natively. Option D is wrong because Azure Managed Disks are block storage, not file shares.

Answer

Azure Managed Disks (SSD)

Answer

Azure NetApp Files

Answer

Azure Blob Storage

Question 3

A global e-commerce company is designing a highly available application on Azure. The application uses Azure SQL Database and requires that in the event of a regional outage, failover to a secondary region occurs automatically without manual intervention. The solution must minimize data loss. Which THREE components should be included? (Choose three.)

Accepted Answer

Azure App Service with deployment slots in secondary region. Options A, C, and E are correct. Azure SQL Database active geo-replication provides continuous replication. Azure Traffic Manager with priority routing ensures automatic traffic redirection. Azure App Service with deployment slots in secondary region allows fast application failover. Option B is wrong because Azure Front Door is for global load balancing, not SQL failover. Option D is wrong because Azure DNS does not provide failover routing.

Answer

Azure Front Door with health probes

Answer

Azure DNS with alias records

Question 4

A company is designing a hybrid identity solution that allows users to access both on-premises applications and Microsoft 365 using a single identity. The solution must support legacy authentication protocols for on-premises apps and modern authentication for cloud apps. Which Azure service should the company use?

Accepted Answer

Microsoft Entra Application Proxy. Option A (Microsoft Entra ID) provides modern authentication but does not natively support legacy on-premises protocols. Option B (Microsoft Entra Connect) syncs identities to the cloud. Option C (Microsoft Entra Application Proxy) provides access to on-premises apps without requiring legacy protocols on the client side. Option D (Active Directory Federation Services) can be used but is not a managed Azure service. The best answer is Microsoft Entra Application Proxy, which enables secure access to on-premises apps using modern authentication while the proxy handles the legacy protocol translation.

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra ID

Answer

Microsoft Entra Connect

Question 5

Your organization is deploying a critical application on Azure virtual machines. You need to ensure that the VMs are distributed across multiple fault domains and update domains within an availability set. You create an availability set with 3 fault domains and 5 update domains. How many VMs can you add to this availability set to maximize fault tolerance?

Accepted Answer

Unlimited. Option D is correct. There is no limit on the number of VMs you can add to an availability set, but to maximize fault tolerance, you should add as many VMs as needed; the fault domains and update domains will be used to distribute them. The question asks for the number of VMs you can add, which is unlimited (subject to subscription limits). Options A, B, and C are incorrect because they imply a limit.

Answer

5 VMs

Answer

15 VMs

Answer

3 VMs

Question 6

Refer to the exhibit. You are analyzing Azure VM performance using Azure Monitor Logs. You run the KQL query shown. What is the purpose of the 'take 10' operator?

Accepted Answer

Limits the results to the first 10 rows after sorting by time.. The 'take' operator returns a specified number of rows. Here, it limits the output to 10 rows after sorting by TimeGenerated ascending. Option A is correct. Option B is incorrect because 'take' does not sample; it returns the first N rows. Option C is incorrect because the query returns rows after aggregation. Option D is incorrect because 'take' is not specific to time windows.

Answer

Limits the time range to the last 10 hours.

Answer

Filters the results to only include the top 10 CPUs.

Answer

Samples the data to reduce query cost.

Question 7

You are designing a compute solution for a batch processing workload that runs once per day for about 30 minutes. The workload is CPU-intensive and can be parallelized. The team wants to minimize cost while ensuring the job completes within 2 hours. Which of the following is the most cost-effective solution?

Accepted Answer

Use Azure Batch with a pool of low-priority VMs, and scale up to many nodes to complete the job quickly.. Option D is correct because Azure Batch with low-priority VMs provides significant cost savings for interruptible workloads and can be scaled to complete quickly. Option A is wrong because App Service is not designed for batch processing and would be more expensive. Option B is wrong because a VM running all the time incurs cost even when idle. Option C is wrong because Functions have a timeout limit (default 5 min, max 10 min) unsuitable for 30-min job.

Answer

Deploy an Azure App Service plan with multiple instances, and trigger the job with a timer.

Answer

Use Azure Functions with a timer trigger and a Premium plan to allow longer execution.

Answer

Create an Azure VM that runs the job on schedule and turn it off after completion.

Question 8

A multinational corporation is designing a hub-spoke network topology in Azure to connect multiple on-premises sites and Azure regions. The hub contains Azure Firewall and Azure Bastion. Spokes are in different regions and need to communicate with each other through the hub. The solution must minimize latency and cost. What should you configure?

Accepted Answer

Use VNet peering to hub and UDRs to force traffic through Azure Firewall. Option D is correct because VNet peering with traffic forced through the hub firewall using user-defined routes (UDRs) allows spoke-to-spoke traffic to be inspected, minimizing additional cost. Option A is wrong because ExpressRoute Global Reach bypasses the hub firewall. Option B is wrong because Azure Virtual WAN is more expensive and complex. Option C is wrong because spoke-to-spoke direct peering bypasses the hub firewall.

Answer

Connect spokes via ExpressRoute Global Reach

Answer

Deploy Azure Virtual WAN with secured hub

Answer

Create VNet peering between spokes directly

Question 9

You are designing a network architecture for a three-tier application in Azure. The web tier must be accessible from the internet. The application tier must only accept traffic from the web tier. The database tier must only accept traffic from the application tier. Which TWO Azure services should you use to enforce these network rules? (Choose two.)

Accepted Answer

Network Security Groups (NSGs). Options A and D are correct. Azure Application Gateway provides web traffic routing and WAF. Network Security Groups (NSGs) allow inbound/outbound rules to restrict traffic between tiers. Option B is wrong because Azure Firewall is a stateful firewall but not needed for simple tier isolation. Option C is wrong because Azure Bastion is for RDP/SSH access. Option E is wrong because Azure Front Door is for global load balancing.

Answer

Azure Bastion

Answer

Azure Front Door

Answer

Azure Firewall

Question 10

A financial services company is designing a data platform on Azure that must comply with strict regulatory requirements. The platform will store sensitive customer data in Azure SQL Database. The company needs to prevent data exfiltration and ensure that only authorized Microsoft Entra ID users can access the data. The solution must also encrypt data at rest and in transit. Which combination of Azure services should the company implement?

Accepted Answer

Azure SQL Database with Managed Identity, Azure Private Link, and Transparent Data Encryption (TDE). Option A (Azure SQL Database firewall + Transparent Data Encryption + Always Encrypted) meets encryption requirements but does not prevent data exfiltration. Option B (Azure SQL Database with Managed Identity + Azure Private Link + Transparent Data Encryption) provides private connectivity, identity-based access, and encryption. Option C (Azure SQL Database with Azure AD authentication + Azure Key Vault + Azure Storage Service Encryption) is partially correct but Azure Storage Service Encryption is not relevant. Option D (Azure SQL Database with IP firewall rules + TLS 1.2 + Azure Information Protection) does not prevent exfiltration. The best answer is B because Private Link ensures traffic stays within the Microsoft backbone, Managed Identity restricts access, and TDE encrypts at rest.

Answer

Azure SQL Database firewall rules, Transparent Data Encryption (TDE), and Always Encrypted

Answer

Azure SQL Database with IP firewall rules, TLS 1.2, and Azure Information Protection

Answer

Azure SQL Database with Microsoft Entra ID authentication, Azure Key Vault, and Azure Storage Service Encryption

Question 11

A company is designing a data warehouse solution in Azure. The solution must support petabyte-scale data, high-performance queries, and integration with Power BI. The data includes both structured and semi-structured data. Which THREE services should you recommend?

Accepted Answer

Power BI. Option A is correct because Azure Synapse Analytics provides petabyte-scale data warehousing with high-performance queries. Option B is incorrect because Azure HDInsight is for big data processing, not data warehousing. Option C is correct because Azure Data Lake Storage can store structured and semi-structured data at petabyte scale. Option D is incorrect because Azure Analysis Services is for semantic models, not data warehousing. Option E is correct because Power BI integrates with Synapse Analytics for reporting.

Answer

Azure Analysis Services

Answer

Azure HDInsight

Question 12

You are designing a logging and monitoring solution for a multi-region application. The application is deployed in three Azure regions. Security requirements mandate that all authentication and authorization logs be retained for 7 years. Logs must be queryable centrally from a single location. What is the most cost-effective way to meet these requirements?

Accepted Answer

Deploy a Log Analytics workspace per region, set retention to 7 years, and use cross-workspace queries from a central Log Analytics workspace or Azure Sentinel.. Option D is correct because Azure Monitor Log Analytics workspaces can be used in each region, and then you can query across them using cross-workspace queries in the Azure Portal or using Azure Sentinel. Option A is wrong because Log Analytics workspace can store logs for 7 years with retention settings, but using a single workspace for all regions introduces latency and potential data loss if region fails. Option B is wrong because Event Hubs is for real-time streaming, not long-term retention. Option C is wrong because Storage Analytics is for storage accounts only.

Answer

Use Azure Storage Analytics logs and store them in a geo-redundant storage account in each region.

Answer

Use Azure Event Hubs to collect logs from all regions and stream them to a Log Analytics workspace in a central region.

Answer

Deploy a single Log Analytics workspace in one region and configure all VMs to send logs to it.

Question 13

Refer to the exhibit. The JSON shows role assignments for user1. The role definition IDs are: b24988ac-6180-42a0-ab88-20f7382dd24c = Key Vault Secrets User, 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 = Reader. User1 reports being unable to list secrets in the key vault 'vault-prod' using Azure CLI. What is the most likely cause?

Accepted Answer

The Key Vault Secrets User role does not include the ability to list secrets. Option B is correct because the Key Vault Secrets User role at the vault scope does not include the 'list' permission on secrets; it only allows reading secret values. Option A is wrong because user1 has a role assignment at the vault scope. Option C is wrong because the Reader role at resource group scope does not grant permissions on secrets. Option D is wrong because the permissions are explicit.

Answer

User1 does not have any role assignment on the key vault

Answer

User1 must have the Contributor role on the key vault

Answer

The Reader role at resource group scope overrides the vault role

Question 14

Refer to the exhibit. A custom role is created. A user assigned this role reports being unable to view the VM's boot diagnostics in the Azure portal. What is the most likely reason?

Accepted Answer

The role lacks permissions to the diagnostics storage account. Option D is correct because the role does not include 'Microsoft.Storage/storageAccounts/listKeys/action' or 'Microsoft.Storage/storageAccounts/read' required to access boot diagnostics data in the diagnostics storage account. Option A is wrong because the role includes 'read' permission on VMs. Option B is wrong because start/restart are allowed. Option C is wrong because the issue is not related to VM size.

Answer

The user does not have permission to start or restart the VM

Answer

The VM is stopped and deallocated

Answer

The role does not include Microsoft.Compute/virtualMachines/read

Question 15

A company is designing a serverless architecture for a real-time data processing pipeline. The pipeline ingests data from IoT devices, processes the data using Azure Functions, and stores the results in Azure Cosmos DB. The solution must scale automatically and minimize cold starts. Which Azure service should the company use to trigger the Azure Functions?

Accepted Answer

Azure Event Grid. Option A (Azure Event Grid) is a push-based event broker that can trigger Functions with low latency, minimizing cold starts. Option B (Azure Event Hubs) is for high-throughput data ingestion; Functions can be triggered from Event Hubs but cold starts can be higher. Option C (Azure Service Bus) is for messaging, not real-time IoT ingestion. Option D (Azure Queue Storage) is for simple queuing, not ideal for real-time. The best answer is Event Grid because it directly triggers Functions with events from IoT devices (via IoT Hub).

Answer

Azure Queue Storage

Answer

Azure Event Hubs

Answer

Azure Service Bus