AZ-305 Practice Test 37 — 15 Questions

Question 1

You are designing a network architecture for a three-tier application hosted in Azure. The front-end tier must be accessible from the internet, the business tier must only communicate with the front-end tier, and the data tier must only communicate with the business tier. You need to minimize exposure and use Azure-native services. Which combination of services should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Application Gateway with WAF for front-end, NSGs on subnets, and service endpoints. Azure Application Gateway with WAF provides Layer 7 HTTP/HTTPS load balancing and web application firewall protection for internet-facing front-end traffic. Network Security Groups (NSGs) on subnets enforce east-west traffic isolation, allowing the business tier to only receive traffic from the front-end subnet and the data tier to only receive traffic from the business subnet. Service endpoints secure access to PaaS data services (e.g., Azure SQL Database) from the data tier subnet without exposing public endpoints, meeting the requirement to minimize exposure using Azure-native services.

Answer

Azure Load Balancer for front-end, NSGs on subnets, and VNet peering

Answer

VPN Gateway for front-end, NSGs on subnets, and private endpoints

Answer

Azure Firewall for all inbound traffic, NSGs on subnets, and VNet peering

Question 2

Your organization runs a web application on Azure App Service (Standard tier) in the West US region. The application uses Azure Blob Storage for static content and Azure SQL Database (Standard tier) for dynamic data. The compliance requirements specify a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 4 hours. You need to design a disaster recovery solution that meets these requirements with minimal cost. Which option should you recommend?

Accepted Answer

Configure App Service backup to a geo-redundant storage account. Use geo-redundant storage (GRS) for Blob Storage. Enable geo-restore for Azure SQL Database.. Meets the RPO of 1 hour and RTO of 4 hours at minimal cost by using App Service backup to geo-redundant storage (which can be restored within the RTO), geo-redundant storage (GRS) for Blob Storage (providing automatic replication to a paired region), and geo-restore for Azure SQL Database (which restores from geo-replicated backups with an RPO of 1 hour and RTO typically under 4 hours). This approach avoids the cost and complexity of running active secondary instances.

Answer

Deploy App Service in two regions with Azure Traffic Manager. Use Azure Site Recovery to replicate the App Service and SQL Database. Enable geo-redundant storage for Blob Storage.

Answer

Deploy App Service in two regions with Azure Front Door. Use active geo-replication for Azure SQL Database. Enable read-access geo-redundant storage (RA-GRS) for Blob Storage.

Answer

Use Azure Traffic Manager to distribute traffic. Manually copy Blob Storage to a secondary region. Use Azure SQL Database export to bacpac and import in secondary region.

Question 3

Which TWO features of Microsoft Entra ID can be used to secure hybrid identities?

Accepted Answer

Seamless Single Sign-On. Seamless Single Sign-On (Seamless SSO) automatically signs users in when they are on corporate devices connected to the corporate network, eliminating password prompts. Password Hash Synchronization (PHS) synchronizes a hash of the user's on-premises AD password to Microsoft Entra ID, enabling cloud authentication without additional infrastructure. Both features directly secure hybrid identities by extending on-premises credentials to the cloud.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Azure Active Directory Domain Services

Question 4

You are designing a data storage solution for a global e-commerce platform that handles millions of transactions per day. The platform uses Azure Cosmos DB for its transactional data. The company wants to implement a real-time analytics pipeline to monitor sales trends and detect anomalies. The analytics must be performed on the transactional data with minimal latency (under 5 seconds). The solution must not impact the transactional workload's performance. The analytics queries involve aggregations over time windows and joins with reference data stored in Azure SQL Database. You need to recommend a solution. Which option should you choose?

Accepted Answer

Use Azure Cosmos DB change feed to stream data to Azure Stream Analytics, which performs the aggregations and joins with reference data from Azure SQL Database.. Azure Cosmos DB change feed enables real-time streaming of transactional data to Azure Stream Analytics, which can perform low-latency aggregations and joins with reference data from Azure SQL Database without impacting the transactional workload. This architecture meets the sub-5-second latency requirement and avoids any direct query load on Cosmos DB.

Answer

Enable Azure Synapse Link for Cosmos DB and use Synapse serverless SQL to query the transactional data directly.

Answer

Use Azure Data Factory to copy data from Cosmos DB to Azure Synapse Analytics every minute, and run analytics queries in Synapse.

Answer

Use Azure Databricks with Auto Loader to incrementally load data from Cosmos DB into Delta Lake, and then query with Spark SQL.

Question 5

Match each Azure migration tool to its use case.

Accepted Answer

Azure Migrate: Assess and migrate on-premises servers to Azure.. Azure Migrate is for server assessment/migration, Azure Site Recovery for disaster recovery, and Azure Database Migration Service for database migrations. Common confusions involve swapping these use cases.

Answer

Azure Migrate: Automate disaster recovery and failover.

Answer

Azure Site Recovery: Assess and migrate on-premises servers to Azure.

Answer

Azure Database Migration Service: Transfer large amounts of data via physical device.

Question 6

A company deploys a web application on Azure VMs in a single region. They need to distribute incoming HTTPS traffic across multiple VMs, offload SSL termination, and provide session persistence. Which Azure load balancing solution should they choose?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports SSL termination, session persistence (via cookie-based affinity), and HTTP/HTTPS traffic distribution. Unlike Azure Load Balancer (Layer 4), it can inspect application-layer headers and offload SSL decryption, meeting all three requirements.

Answer

Azure Load Balancer (Standard SKU)

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 7

A company uses Azure SQL Database (Premium tier) for their application. They need to offload reporting queries to a read-only copy of the database to reduce load on the primary. The read-only copy must be kept in sync synchronously within the same Azure region. They also need automated failover to the read-only copy if the primary fails. Which Azure SQL Database feature should they enable?

Accepted Answer

Read Scale-Out. Read Scale-Out is the correct feature because it offloads reporting queries to a read-only replica that stays synchronously committed within the same Azure region. It also provides automated failover to the read-only replica if the primary database fails, meeting both the synchronous sync and failover requirements for Premium-tier Azure SQL Database.

Answer

Active geo-replication

Answer

Auto-failover groups

Answer

Database copy

Question 8

You need to monitor Azure resources and send alerts when the CPU usage of a virtual machine exceeds 90% for 5 minutes. Which two Azure services should you use? (Select TWO.)

Accepted Answer

Azure Monitor Action Groups. Azure Monitor is the core service for collecting and analyzing metrics and logs from Azure resources. It can be configured with metric alerts that trigger when CPU usage exceeds 90% for 5 minutes. Action Groups define the notification and response actions (e.g., email, SMS, webhook) that are executed when the alert fires, making them essential for sending alerts.

Answer

Log Analytics

Answer

Application Insights

Answer

Event Grid

Question 9

Which THREE factors should you consider when selecting a partition key for an Azure Cosmos DB container? (Select three.)

Accepted Answer

Even distribution of request unit (RU) consumption. An even distribution of request unit (RU) consumption across physical partitions prevents hot partitions, which can throttle throughput and degrade performance. In Azure Cosmos DB, the partition key determines how data and throughput are distributed; if RU consumption is skewed, some partitions become overloaded while others remain underutilized, violating the design goal of uniform load.

Answer

Low cardinality to reduce overhead

Answer

Property with large binary data

Question 10

Your organization is migrating a legacy on-premises application to Azure. The application uses a monolithic architecture and requires high availability. The application tier runs on Windows Server and uses a SQL Server database. You need to design a migration strategy that minimizes changes to the application code while maximizing availability. The application can be stateless if session state is externalized. You have the following requirements: (1) The application must be resilient to Azure region failures. (2) The database must have an RPO of 5 minutes and RTO of 1 hour. (3) The migration must be completed within 6 months. (4) The solution should use platform-as-a-service (PaaS) services where possible to reduce operational overhead. Which approach should you recommend?

Accepted Answer

Migrate the web tier to Azure App Service with staging slots and use Azure SQL Database with active geo-replication.. It uses Azure App Service (PaaS) to host the stateless web tier with staging slots for zero-downtime deployments and Azure SQL Database with active geo-replication to meet the RPO of 5 minutes and RTO of 1 hour. This approach minimizes code changes by externalizing session state (e.g., using Azure Cache for Redis) and leverages PaaS to reduce operational overhead while providing regional failover resilience.

Answer

Rehost the application on Azure VMs in an availability set and use SQL Server Always On Availability Groups.

Answer

Refactor the application into microservices and deploy to Azure Kubernetes Service.

Answer

Containerize the application using Docker and deploy to Azure Container Instances in paired regions.

Question 11

You need to design a solution to store log data from multiple Azure services. The data must be retained for 7 years for compliance purposes and should be queryable for analysis. Which Azure service should you use as the primary storage for these logs?

Accepted Answer

Azure Log Analytics workspace. Azure Log Analytics workspace is the correct choice because it is purpose-built for ingesting, storing, and querying log data from Azure services. It supports long-term retention up to 7 years (via the Basic Logs tier or data archiving with Azure Data Explorer) and provides Kusto Query Language (KQL) for interactive analysis, meeting both compliance and queryability requirements.

Answer

Azure Data Lake Storage

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 12

Refer to the exhibit. You deploy this Azure Monitor scheduled query rule to alert when CPU usage exceeds 90% for sustained periods. However, alerts are not firing even when the condition is met. What is the most likely cause?

Accepted Answer

The threshold of 5 with 'Count' aggregation requires more than 5 data points above 90% in the window, which may not be happening.. The alert rule uses a 'Count' aggregation with a threshold of 5, meaning the alert fires only when the number of data points exceeding 90% CPU within the evaluation window is greater than 5. If the sustained high CPU usage produces fewer than 5 such data points (e.g., due to a short burst or insufficient sampling), the condition is not met, and the alert will not fire. This is a common misconfiguration where the threshold value is set too high relative to the actual data point frequency.

Answer

The KQL query syntax is incorrect and returns no results.

Answer

The action group is not configured with a valid email address.

Answer

The evaluation frequency is too short compared to the window size.

Question 13

You are designing a governance strategy for a new Azure subscription. The security team requires that all resources must have a 'CostCenter' tag and an 'Environment' tag. Which Azure policy effect should you use to automatically apply the tags to new resources?

Accepted Answer

modify. The 'modify' effect is correct because it can automatically append or replace missing tags on new or existing non-compliant resources during resource creation or update. Unlike 'deployIfNotExists', which only runs remediation tasks after creation, 'modify' applies the tags inline as part of the resource creation request, ensuring compliance without requiring a separate remediation task.

Answer

audit

Answer

deny

Answer

deployIfNotExists

Question 14

A solution stores critical VM backups in Azure. The company wants protection against accidental or malicious deletion of backups. Which two controls should be included?

Accepted Answer

Soft delete for Azure Backup. Soft delete for Azure Backup (Option C) is correct because it retains backup data for an additional 14 days after deletion, allowing recovery from accidental or malicious deletion. This feature is enabled by default for Recovery Services vaults and protects backup data even if the backup itself is deleted, providing a critical safety net against data loss.

Answer

Disabling backup alerts

Answer

Storing all backups on the original VM disk

Question 15

A company uses Microsoft Entra ID (Microsoft Entra ID) and Microsoft Intune. They want to block access to all corporate cloud applications (e.g., Office 365, Azure portal) from devices that are not enrolled in Intune or do not meet the company's compliance policies. The solution must work seamlessly for all cloud apps without requiring per-app configuration. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access policy with 'Require device to be marked as compliant' grant control. A Conditional Access policy with the 'Require device to be marked as compliant' grant control enforces device compliance across all cloud apps (Office 365, Azure portal, etc.) without per-app configuration. This works by integrating with Intune compliance policies and checking device enrollment status at the time of authentication, blocking non-compliant or unenrolled devices at the Entra ID level.

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID B2C