AZ-305 Practice Test 43 — 15 Questions

Question 1

A company is deploying a containerized microservices application on Azure Kubernetes Service (AKS). The application requires persistent storage that can be attached to pods and supports dynamic provisioning. Which Azure storage solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Disks. Azure Disks is the correct choice because it provides block-level storage volumes that can be dynamically provisioned via the AKS built-in StorageClass, supporting ReadWriteOnce access mode required for a single pod in a containerized microservices application. Azure Disks integrate directly with Kubernetes PersistentVolumeClaims (PVCs) for dynamic provisioning, offering low-latency, high-performance storage suitable for stateful workloads.

Answer

Azure Blob Storage

Answer

Azure Files

Answer

Azure NetApp Files

Question 2

You are designing a governance solution for a Microsoft Azure environment that contains multiple subscriptions. You need to ensure that all resources are compliant with corporate security policies. The solution must automatically remediate non-compliant resources. What should you include in the design?

Accepted Answer

Azure Policy with DeployIfNotExists effect. Azure Policy with the DeployIfNotExists effect is the correct choice because it automatically remediates non-compliant resources by triggering a deployment (e.g., via a template) when a resource is created or updated and does not meet the policy condition. This ensures continuous compliance with corporate security policies without manual intervention, as the effect can also be assigned a remediation task to fix existing resources.

Answer

Azure RBAC custom roles

Answer

Azure Resource Graph queries

Answer

Azure Blueprints

Question 3

A company uses Azure SQL Database for a line-of-business application. They need to implement a disaster recovery solution across Azure regions with RPO of 5 seconds and RTO of 30 seconds. Which feature should they use?

Accepted Answer

Active geo-replication. Active geo-replication for Azure SQL Database provides a continuous replication mechanism with an RPO of 5 seconds and an RTO of 30 seconds when using a readable secondary replica in a paired region. It replicates transactions asynchronously but with very low latency, meeting the strict RPO/RTO requirements for cross-region disaster recovery.

Answer

Geo-restore

Answer

Azure SQL Database zone-redundant configuration

Answer

Auto-failover groups

Question 4

A company is deploying a new application on Azure Kubernetes Service (AKS). The application requires persistent storage that can be dynamically provisioned and accessed by multiple pods simultaneously. Which Azure storage solution should the company use?

Accepted Answer

Azure Files. Azure Files provides SMB and NFS file shares that can be mounted concurrently by multiple pods in Azure Kubernetes Service (AKS), meeting the requirement for persistent storage that is dynamically provisioned and accessible by multiple pods simultaneously. Azure Files supports the ReadWriteMany (RWX) access mode, which is essential for multi-pod access, and can be dynamically provisioned using a StorageClass with the `provisioner: file.csi.azure.com`.

Answer

Azure Blob Storage

Answer

Azure Disk

Answer

Azure NetApp Files

Question 5

Your company has an Azure subscription with multiple virtual networks connected via VNet peering. You need to design a solution to allow VMs in different peered VNets to resolve each other's private IP addresses using custom DNS suffixes. The solution must minimize administrative overhead. What should you implement?

Accepted Answer

Create an Azure Private DNS Zone linked to each VNet with auto-registration enabled.. Azure Private DNS Zone with auto-registration enables VMs in peered VNets to resolve each other's private IP addresses using custom DNS suffixes without deploying or managing custom DNS servers. When auto-registration is enabled, Azure automatically creates and updates A records for VMs in the linked VNet, and VNet peering propagates DNS resolution across peered VNets. This minimizes administrative overhead because no manual DNS server configuration or VM-level DNS suffix updates are needed.

Answer

Deploy custom DNS servers on Azure VMs and configure VNets to use those servers.

Answer

Configure Azure DNS to use a custom domain name and update each VM's DNS suffix.

Answer

Use Azure Firewall as a DNS proxy with custom DNS settings.

Question 6

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to automate the process of granting users access to a specific application only during business hours and revoking it automatically. The access should be based on a request-approval workflow. Which Microsoft Entra ID feature should they use?

Accepted Answer

Entitlement Management. Entitlement Management (D) is correct because it provides automated access lifecycle management through access packages, which can include time-bound assignments (e.g., business hours) and require approval workflows. This allows you to define policies that grant access to the application only during specified hours and automatically revoke it when the policy expires or conditions change, without manual intervention.

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Answer

Access Reviews

Question 7

You need to design a storage solution for a large-scale media streaming application. The application serves video files to users worldwide. The solution must minimize latency for end-users and optimize content delivery costs. Which Azure service combination should you use?

Accepted Answer

Azure Blob Storage with Azure Content Delivery Network (CDN). Azure Blob Storage is optimized for storing large, unstructured data like video files, and when paired with Azure Content Delivery Network (CDN), it caches content at edge nodes worldwide. This combination minimizes latency for global users by serving videos from the nearest point of presence (PoP) and reduces egress costs by offloading traffic from the origin storage to the CDN's distributed network.

Answer

Azure Cosmos DB with multi-region writes

Answer

Azure NetApp Files with Azure Front Door

Answer

Azure Files with Azure File Sync

Question 8

You need to monitor the performance and health of your Azure virtual machines, including custom metrics and logs. You also need to set up alerts based on specific thresholds. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it provides a comprehensive solution for collecting, analyzing, and acting on telemetry from Azure virtual machines, including custom metrics and logs. It integrates with the Azure Monitor Agent to gather performance counters and event logs, and supports metric alerts and log alerts based on specific thresholds, directly meeting all stated requirements.

Answer

Application Insights

Answer

Azure Service Health

Answer

Log Analytics

Question 9

A healthcare organization stores patient records in Azure SQL Database. They need to ensure that all read queries against the database are directed to a read-only replica to offload the primary. Which feature should you configure?

Accepted Answer

Read scale-out. Read scale-out in Azure SQL Database allows you to direct read-only queries to a read-only replica, offloading the primary database. By setting the `ApplicationIntent=ReadOnly` connection string parameter, queries are automatically routed to the secondary replica, which is ideal for read-heavy workloads like patient record queries.

Answer

Elastic database queries

Answer

Failover groups

Answer

Active geo-replication

Question 10

A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones. The application needs to automatically distribute incoming HTTPS traffic, offload SSL/TLS termination, and provide session persistence. Additionally, the solution must include a Web Application Firewall (WAF) to protect against common web vulnerabilities. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that can route HTTPS traffic, offload SSL/TLS termination, and provide session persistence (cookie-based affinity). It also natively integrates a Web Application Firewall (WAF) to protect against common web vulnerabilities like SQL injection and cross-site scripting.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 11

A large enterprise is designing a data analytics platform in Azure that will ingest terabytes of data daily from multiple sources, including IoT devices, social media feeds, and internal databases. The data must be stored in a raw format for future processing, and then transformed and aggregated for reporting. The company requires low-latency querying for real-time dashboards and the ability to run complex batch analytics using Spark. The solution must also provide a unified data governance layer for cataloging and lineage tracking. Which combination of Azure services should the company choose to meet all these requirements with minimal operational overhead?

Accepted Answer

Azure Data Lake Storage, Azure Synapse Analytics, and Microsoft Purview. Azure Data Lake Storage provides scalable, cost-effective raw storage for terabytes of daily data, Azure Synapse Analytics offers both low-latency querying for real-time dashboards and Spark-based batch analytics, and Microsoft Purview delivers a unified data governance layer with cataloging and lineage tracking. This combination minimizes operational overhead by integrating storage, compute, and governance into a single, managed platform.

Answer

Azure Cosmos DB, Azure Stream Analytics, and Azure Analysis Services

Answer

Azure Blob Storage, Azure HDInsight, and Azure Data Factory

Answer

Azure SQL Database, Azure Databricks, and Azure Data Catalog

Question 12

Your company plans to deploy a new SaaS application that will be used by employees and external users. The application requires single sign-on (SSO) and must support conditional access policies that enforce MFA for external users. Additionally, the application must be able to read user profile attributes from Microsoft Entra ID. You need to design an identity solution that meets these requirements. What should you include in the design?

Accepted Answer

Register the application in Microsoft Entra ID (App Registration) and configure it to use OpenID Connect for authentication; apply conditional access policies to the app.. Registering the application in Microsoft Entra ID (App Registration) and configuring OpenID Connect (OIDC) enables SSO and allows the application to read user profile attributes via the Microsoft Graph API. Conditional access policies can be applied directly to the enterprise app in Entra ID to enforce MFA for external users, meeting all stated requirements.

Answer

Use Azure AD Application Proxy to publish the SaaS app and configure pre-authentication with Entra ID.

Answer

Use Microsoft Entra Domain Services to authenticate the application via LDAP.

Answer

Register the application in Microsoft Entra B2C and configure federation with your Entra ID tenant.

Question 13

A company is designing a data storage solution for a globally distributed application that requires low-latency read access to frequently accessed data and high throughput for write operations. The data is non-relational and can be stored as key-value pairs. Which Azure service should they use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it is a globally distributed, multi-model database service that provides guaranteed low-latency reads (under 10 ms at the 99th percentile) and high throughput for write operations, with automatic indexing and turnkey global distribution. It natively supports key-value data models, making it ideal for non-relational, frequently accessed data requiring consistent performance across regions.

Answer

Azure Table Storage

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 14

You are designing a solution to store sensitive documents in Azure Blob Storage. The data must be encrypted at rest and access must be audited. You need to ensure that the encryption keys are managed by your organization and that access to the keys is logged. Which combination of Azure services should you use?

Accepted Answer

Azure Storage encryption with customer-managed keys in Azure Key Vault and Azure Monitor. Azure Storage encryption with customer-managed keys in Azure Key Vault meets the requirement for organization-managed encryption keys, while Azure Monitor (specifically the Azure Activity Log or diagnostic settings) captures access logs for both the storage account and Key Vault operations, enabling full auditability of key usage and data access.

Answer

Azure Disk Encryption with Azure Key Vault

Answer

Azure Storage encryption with Microsoft-managed keys and Azure Monitor

Answer

Azure Information Protection and Azure Sentinel

Question 15

A financial services company needs to store sensitive transaction records in Azure for 7 years to meet regulatory compliance. The data must be immutable and cannot be deleted or modified during the retention period. Which Azure storage feature should you enable?

Accepted Answer

Immutable blob with time-based retention policy. Immutable blob storage with a time-based retention policy enforces WORM (Write Once, Read Many) compliance, ensuring that data cannot be deleted or modified for a specified retention period. This meets the 7-year regulatory requirement for sensitive transaction records, as the policy locks the data at the blob level and prevents any overwrite or deletion, even by administrators with elevated permissions.

Answer

Blob versioning with lifecycle management

Answer

Soft delete for blob storage

Answer

Legal hold on the storage container