AZ-305 Practice Exam 53 — 20 Questions

Question 1

A company has headquarters and multiple branch offices worldwide, each with its own on-premises network. They want to connect all these sites to Azure and to each other over a single, centrally managed solution. They need high bandwidth connectivity for site-to-site traffic, support for both VPN and ExpressRoute connections, and automatic routing management without the complexity of configuring multiple VPN tunnels or BGP manually. Which Azure service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the correct choice because it provides a single, centrally managed hub-and-spoke architecture that connects branch offices, headquarters, and Azure over a unified network. It supports both VPN and ExpressRoute connections, automatically manages routing (including BGP) without manual configuration of multiple tunnels, and offers high bandwidth for site-to-site traffic.

Answer

Azure VPN Gateway (site-to-site) with BGP

Answer

Azure ExpressRoute with Microsoft peering

Answer

Azure Virtual Network peering

Question 2

A small business is moving its on-premises file server to Azure. The company has 50 users and stores approximately 500 GB of data, which includes documents and spreadsheets. The users need to access the files from their Windows laptops both at the office and remotely. The company wants to minimize costs while ensuring that files are always available and secure. You need to recommend a storage solution. What should you recommend?

Accepted Answer

Deploy Azure Files with Azure File Sync and use a Windows File Server on-premises.. Azure Files with Azure File Sync provides a cloud-based file share that users can access via the SMB protocol from Windows laptops both on-premises and remotely, while Azure File Sync enables caching on an on-premises Windows File Server for low-latency access. This solution minimizes costs by using a standard file share tier and leverages Azure Backup for security and availability, meeting the 50-user, 500 GB requirement without over-provisioning.

Answer

Migrate the files to Azure Blob Storage and use Azure Storage Explorer for access.

Answer

Use Azure Stack Edge to sync the data to Azure Blob Storage.

Answer

Deploy Azure NetApp Files with a Standard capacity pool.

Question 3

A company uses Azure Firewall to secure outbound traffic from a hub virtual network. The security team reports that some traffic is bypassing the firewall because of asymmetric routing. You need to design a solution to force all outbound traffic through the firewall. What should you implement?

Accepted Answer

User Defined Routes (UDRs) with a default route (0.0.0.0/0) pointing to Azure Firewall. User Defined Routes (UDRs) with a default route (0.0.0.0/0) pointing to Azure Firewall as the next hop are the correct solution because they override the system default route and force all outbound traffic from subnets to be forwarded to the firewall, preventing asymmetric routing. Asymmetric routing occurs when traffic takes different paths to and from a destination; by ensuring the firewall is the next hop for all outbound traffic, UDRs guarantee symmetric flow through the firewall.

Answer

VNet peering with gateway transit

Answer

Azure Route Server

Answer

Azure Firewall Manager to enforce routing policies

Question 4

You are designing a business continuity solution for a globally distributed SaaS application that uses Azure Cosmos DB for its operational store. The application must survive a complete regional outage with zero data loss and automatic failover. What should you use?

Accepted Answer

Configure Cosmos DB with a single write region, strong consistency, and enable automatic failover to a secondary region.. It combines a single write region with strong consistency and automatic failover, which guarantees zero data loss during a regional outage. Strong consistency ensures that all reads reflect the latest write, and automatic failover allows Azure to promote a secondary read region to the primary write region without manual intervention, meeting the requirement for zero data loss and automatic failover.

Answer

Configure a single write region in Cosmos DB with eventual consistency and manual failover.

Answer

Enable multi-region writes in Cosmos DB with eventual consistency and automatic failover.

Answer

Use Azure SQL Database with active geo-replication and automatic failover.

Question 5

Which THREE of the following are best practices for designing an Azure SQL Database solution for performance and scalability?

Accepted Answer

Use appropriate indexes to optimize query performance. Appropriate indexes, such as clustered and nonclustered indexes, reduce the number of data pages scanned during query execution, directly improving query performance. In Azure SQL Database, index tuning is critical for minimizing I/O and CPU overhead, especially for large tables or complex joins.

Answer

Avoid using stored procedures to reduce complexity

Answer

Disable automatic tuning to maintain consistent performance

Question 6

A company runs critical Azure VMs. They want to protect against accidental deletion or corruption of data by implementing a retention policy for Azure Backup. They need to keep daily backups for 30 days, weekly backups for 12 weeks, and monthly backups for 12 months. Which Azure Backup feature should they configure?

Accepted Answer

Backup policy with long-term retention. A backup policy with long-term retention (LTR) in Azure Backup allows you to define granular retention rules for daily, weekly, monthly, and yearly backup points. This directly meets the requirement to keep daily backups for 30 days, weekly for 12 weeks, and monthly for 12 months by configuring the retention duration for each frequency in the backup policy.

Answer

Immutable vault

Answer

Backup tiering

Answer

Soft delete

Question 7

Your company uses Microsoft Entra ID and has a custom application that requires users to have specific roles assigned. You need to ensure that role assignments are reviewed quarterly and automatically remove assignments that are not approved. Which feature should you use?

Accepted Answer

Microsoft Entra ID Governance access reviews. Microsoft Entra ID Governance access reviews enable you to create recurring reviews of role assignments, with automatic removal of assignments that reviewers do not approve. This directly meets the requirement for quarterly reviews and automatic removal of unapproved assignments, making it the correct choice.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 8

A database workload has an RPO of 15 minutes and an RTO of 4 hours. Cost is more important than near-zero data loss. Which design is usually more appropriate than synchronous multi-region replication?

Accepted Answer

Use scheduled backups or asynchronous replication aligned to the RPO/RTO.. The workload's RPO of 15 minutes and RTO of 4 hours, combined with a cost-sensitive requirement that deprioritizes near-zero data loss, makes synchronous multi-region replication overkill. Scheduled backups (e.g., every 15 minutes using Azure SQL Database automated backups with point-in-time restore) or asynchronous replication (e.g., Azure SQL Database active geo-replication with a recovery point objective of up to 5 seconds, but here we can tune it to meet 15 minutes) provide sufficient protection at a lower cost, avoiding the latency and expense of synchronous replication across regions.

Answer

Use synchronous replication across every Azure region.

Answer

Run the database on a single VM with no backups.

Answer

Use a public DNS CNAME only.

Question 9

A company runs a critical application on Azure VMs in a single region. They need to ensure the application can failover to another region with minimal data loss and a recovery time objective (RTO) of 1 hour. The application uses managed disks and SQL Server Always On availability groups. What is the MOST cost-effective solution that meets the requirements?

Accepted Answer

Use Azure Site Recovery to replicate VMs to a secondary region with a recovery plan. Azure Site Recovery (ASR) provides orchestrated replication and failover for Azure VMs, supporting both managed disks and SQL Server Always On availability groups. It meets the RTO of 1 hour by enabling a recovery plan that automates the failover sequence, and it minimizes data loss through continuous replication with a Recovery Point Objective (RPO) as low as 30 seconds. This is the most cost-effective solution because ASR replicates only changed blocks and does not require a continuously running secondary VM, unlike a full geo-redundant storage or cross-region Always On deployment.

Answer

Use Azure geo-redundant storage (GRS) for the managed disks and restore the VMs in the secondary region

Answer

Use Azure availability zones to protect against regional failures

Answer

Deploy SQL Server Always On availability groups across two regions

Question 10

A multinational company stores large amounts of unstructured data (documents, images) that must be read with low latency from multiple global regions. Data is written primarily in one region but read globally. Cost optimization is a key requirement. Which Azure storage replication option should they use?

Accepted Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS). B is correct because RA-GRS provides geo-redundant storage with read access to the secondary region, enabling low-latency reads from multiple global regions while maintaining cost efficiency. The data is written primarily in one region, but RA-GRS allows read requests to be served from the secondary region without additional compute costs, meeting the global read requirement.

Answer

Azure Blob Storage with geo-redundant storage (GRS)

Answer

Azure Files with premium shares

Answer

Azure NetApp Files

Question 11

Which TWO actions can be performed using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Manage access packages for internal and external users. Microsoft Entra ID Governance includes entitlement management, which allows administrators to create and manage access packages that bundle resources (like groups, apps, and SharePoint sites) and assign them to internal and external users. This enables automated lifecycle management of access, including expiration and renewal, making Option B correct.

Answer

Synchronize users from on-premises Active Directory

Answer

Configure network security group rules

Answer

Deploy virtual machines in Azure

Question 12

A media company is building a video streaming platform on Azure. The platform will store original high-definition videos and convert them to multiple resolutions for distribution. The company needs a cost-effective storage solution for the original videos, which are accessed infrequently but must be instantly available when needed. The converted videos will be served to end users globally and must be cached at edge locations for low latency. You need to design a storage and content delivery solution. What should you recommend?

Accepted Answer

Store original videos in Azure Blob Storage Cool tier and use Azure CDN for distribution.. Azure Blob Storage Cool tier provides low-cost storage for infrequently accessed data with instant retrieval, meeting the requirement for original videos that are rarely accessed but must be available immediately. Azure CDN caches the converted videos at edge locations globally, ensuring low-latency delivery to end users.

Answer

Store original videos in Azure Blob Storage Premium tier and use Azure CDN for distribution.

Answer

Store original videos in Azure Blob Storage Archive tier and use Azure CDN for distribution.

Answer

Store original videos in Azure Files and use Azure Front Door for caching.

Question 13

A company runs a critical application on Azure VMs in a single region. They need to implement disaster recovery using Azure Site Recovery (ASR) with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. The database VMs have a very high data change rate, and the company wants to minimize replication costs. They also need to ensure that in the recovery plan, database VMs start before application VMs, and a script updates DNS records after failover. Which combination of ASR configurations should they use?

Accepted Answer

Enable crash-consistent replication and use recovery plans with pre- and post-actions.. Crash-consistent replication is the most cost-effective ASR option for VMs with high data change rates, as it replicates only the data that has changed since the last snapshot without requiring application-level consistency. The RPO of 15 minutes and RTO of 2 hours can be met with crash-consistent replication, and recovery plans with pre- and post-actions allow you to specify that database VMs start before application VMs and run a script to update DNS records after failover.

Answer

Enable multi-VM consistency groups and use recovery plans with manual ordering.

Answer

Enable app-consistent replication and use deployment plans with pre- and post-actions.

Answer

Enable replication with high churn protection and use recovery plans with availability groups.

Question 14

A company has multiple Azure virtual networks (VNets) in different regions connected via VNet peering. They also have an on-premises data center connected to Azure via ExpressRoute. They need to provide internet-bound traffic from all Azure VNets through a single, centralized network virtual appliance (NVA) in the hub VNet for security inspection. They also need to ensure that traffic between VNets and on-premises is routed optimally without going through the internet. Which Azure solution should they implement?

Accepted Answer

Deploy an Azure Virtual WAN with a secured hub (Azure Firewall) and route traffic through it. Azure Virtual WAN with a secured hub (Azure Firewall) provides a centralized, managed routing architecture that meets all requirements. It automatically routes internet-bound traffic from all VNets through the Azure Firewall in the hub for security inspection, while also ensuring optimal routing between VNets and on-premises via ExpressRoute without traversing the internet. This solution eliminates the need for manual UDRs and complex NVA management, as Virtual WAN handles routing and security centrally.

Answer

Implement VNet peering with user-defined routes (UDRs) to force traffic through the NVA

Answer

Use Azure Firewall in each VNet to inspect traffic locally

Answer

Use Azure Route Server to propagate routes to all VNets

Question 15

A company wants to ensure that their Azure SQL Database can continue to serve read-write traffic if the primary region becomes unavailable. They require minimal data loss. What should they implement?

Accepted Answer

Configure an auto-failover group with a secondary in another region. An auto-failover group with a secondary in another region provides continuous read-write traffic capability during a regional outage with minimal data loss. The failover group uses asynchronous replication with a configurable grace period (default 1 hour) to balance performance and data loss, and upon failover, the secondary becomes the new primary with the same connection string, ensuring application transparency.

Answer

Use Azure Backup with cross-region restore

Answer

Deploy the database across two Availability Zones

Answer

Read-scale replicas in the same region

Question 16

A company uses Microsoft Entra ID (Microsoft Entra ID) for identity management. They want to enforce that only devices compliant with security policies (e.g., BitLocker enabled, antivirus running) can access corporate cloud applications (Microsoft 365 and custom SaaS apps). They also need a dashboard to monitor device compliance status. Which Microsoft Entra ID feature(s) should they configure?

Accepted Answer

Conditional Access policies with device compliance conditions, and Microsoft Intune for compliance management. Conditional Access policies in Microsoft Entra ID can enforce device compliance as a condition for granting access to cloud applications, while Microsoft Intune provides the device compliance policies (e.g., BitLocker, antivirus) and the dashboard to monitor compliance status. Together, they ensure only compliant devices can access corporate resources and provide visibility into device health.

Answer

Microsoft Entra ID Identity Protection with user risk policies

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Device Registration only

Question 17

You are designing a disaster recovery solution for an Azure IaaS workload. The application runs on Azure VMs in a single region and requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which of the following is the most cost-effective approach to meet these requirements?

Accepted Answer

Deploy Azure Site Recovery to replicate VMs to the secondary region with a replication policy that meets the RPO and RTO.. Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs to a secondary region with configurable RPO (as low as 30 seconds) and supports automated failover, meeting the 15-minute RPO and 4-hour RTO requirements. It is the most cost-effective because it replicates only changed blocks and does not require running standby VMs, unlike multi-region active deployments.

Answer

Configure geo-redundant storage (GRS) for the VM disks and manually attach them to new VMs in the secondary region.

Answer

Use Azure Front Door with a back-end pool containing VMs in both regions, and configure health probes to route traffic on failure.

Answer

Use Azure Backup to back up VMs to a Recovery Services vault in the secondary region and perform restore during failover.

Question 18

A company deploys a web application on multiple Azure virtual machines (VMs) in a single region. The application receives HTTP and HTTPS traffic. They need to distribute the traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Additionally, they need to route requests based on URL paths (e.g., /api/* to one pool, /images/* to another). Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a layer-7 load balancer that supports SSL/TLS termination, URL path-based routing, and session persistence (sticky sessions) via cookies. These features directly match the requirements for distributing HTTP/HTTPS traffic, offloading SSL, routing requests based on URL paths, and maintaining user session affinity to the same backend VM.

Answer

Azure Load Balancer

Answer

Azure Front Door

Answer

Azure Traffic Manager

Question 19

A company plans to deploy a multi-tier application on Azure. The web tier requires SSL termination and health probes. The application tier must be isolated from the internet. The database tier requires high availability. They want to minimize administrative overhead and use Azure native services. Which architecture should they recommend?

Accepted Answer

Azure Application Gateway for web tier, Azure Load Balancer (internal) for application tier, and Azure SQL Database with active geo-replication. Azure Application Gateway provides SSL termination and health probes for the web tier, an internal Azure Load Balancer isolates the application tier from the internet, and Azure SQL Database with active geo-replication offers high availability with automatic failover, minimizing administrative overhead by using PaaS services.

Answer

Azure Front Door for web tier, Azure Load Balancer for database tier, and SQL Server on Azure VMs with Always On

Answer

Azure Traffic Manager for web tier, Azure Application Gateway for database tier, and Azure SQL Database with failover groups

Answer

Azure Application Gateway for web tier, Azure Load Balancer (internal) for application tier, and Azure SQL Database with geo-restore

Question 20

Your organization uses Microsoft Purview to govern data across Azure and on-premises sources. You need to ensure that sensitive data, such as credit card numbers, is automatically detected and classified in Azure Blob Storage. Which Purview feature should you configure?

Accepted Answer

Data classification scanning with built-in sensitive information types. Microsoft Purview's data classification scanning can be configured to automatically detect sensitive data like credit card numbers using built-in sensitive information types (e.g., Credit Card Number). When a scan is run against Azure Blob Storage, Purview identifies and classifies the data based on these predefined patterns, enabling governance and compliance.

Answer

Microsoft Sentinel

Answer

Data catalog search

Answer

Data lineage tracking