AZ-305 Practice Exam 55 — 20 Questions

Question 1

A company is deploying a web application that must be accessible from the internet. The application is hosted on Azure virtual machines in a virtual network. The solution must provide SSL termination, web application firewall (WAF) protection, and URL path-based routing (e.g., /api/* to one backend pool, /app/* to another). The web tier must not be directly exposed to the internet. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL path-based routing. It can route traffic to different backend pools based on URL paths (e.g., /api/* and /app/*) while keeping the web tier isolated within the virtual network, as the gateway itself is exposed to the internet.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 2

A company is designing a hub-spoke network topology across multiple Azure regions. They plan to deploy a third-party network virtual appliance (NVA) in the hub for traffic inspection. They require that all traffic between spokes in different regions must be routed through the hub NVA, and they want to minimize the number of peered connections. Which solution should they implement?

Accepted Answer

VNet peering with user-defined routes (UDRs) in each spoke pointing to the NVA IP in the hub. Option A is correct because VNet peering combined with user-defined routes (UDRs) allows traffic between spokes in different regions to be forced through the NVA in the hub for inspection. By configuring UDRs in each spoke with the next hop set to the NVA's private IP, you ensure inter-spoke traffic traverses the hub without requiring a full mesh of peering connections. This minimizes the number of peered connections (only hub-to-spoke peering is needed) while meeting the routing requirement.

Answer

Azure Virtual WAN with a secured hub using Azure Firewall

Answer

Azure VNet-to-VNet VPN gateways between all spokes

Answer

Azure ExpressRoute with private peering

Question 3

A company needs to connect its on-premises data center to Azure for hybrid workloads. The connection must be private, dedicated, and provide guaranteed bandwidth. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a private, dedicated connection from on-premises to Azure, bypassing the public internet. It offers guaranteed bandwidth, higher reliability, and lower latency compared to VPN-based solutions, making it ideal for hybrid workloads requiring consistent performance.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 4

A company needs to provide secure remote administration access to Azure virtual machines for their IT team. The VMs are in a virtual network with no public IP addresses. The IT team uses browsers to connect. The solution should not require any custom software on the client machines. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure virtual machines directly in the Azure portal over TLS. Because the VMs have no public IP addresses, Bastion acts as a jump server that is deployed inside the virtual network, eliminating the need for any public exposure. Since the IT team uses browsers and cannot install custom software, Bastion's native browser-based HTML5 client meets the requirement perfectly.

Answer

Just-in-Time VM access

Answer

Azure VPN Gateway

Answer

Microsoft Entra ID Domain Services

Question 5

A company plans to deploy a stateless web application on Azure virtual machines. They want to ensure that the application remains available in the event of a hardware failure within a single Azure datacenter. The VMs must be placed in a way that ensures they are on different physical servers and racks, but are still within the same datacenter. Which deployment strategy should they use?

Accepted Answer

Deploy the VMs in an Availability Set.. An Availability Set ensures that VMs are distributed across multiple fault domains (different physical servers, racks, and network switches) and update domains within a single Azure datacenter. This protects against hardware failures in that datacenter by guaranteeing that not all VMs are affected by the same local failure, while keeping them in the same datacenter for low-latency communication.

Answer

Deploy the VMs in different Availability Zones.

Answer

Deploy the VMs in a single Virtual Machine Scale Set with a large instance count.

Answer

Deploy each VM in a separate resource group.

Question 6

A company plans to migrate a legacy web application to Azure. The application runs on multiple Windows virtual machines (VMs) in an availability set. The VMs must be exposed to the internet via a single endpoint that performs SSL termination and health checks. The load-balancing solution must preserve the original client IP address for logging purposes. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports SSL termination, health probes, and provides a single public endpoint. It preserves the original client IP address by inserting the X-Forwarded-For header in the HTTP request, which the backend VMs can read for logging. This meets all requirements: single internet-facing endpoint, SSL offload, health checks, and client IP preservation.

Answer

Azure Load Balancer (Standard)

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 7

A company runs a high-performance computing (HPC) workload on Azure that requires extremely low latency (under 10 microseconds) between multiple VMs for MPI communication. The VMs are part of a single job and must be placed together to minimize network latency. Which VM deployment option should they use?

Accepted Answer

Azure Virtual Machine Scale Sets with a Proximity Placement Group. A Proximity Placement Group (PPG) within a Virtual Machine Scale Set ensures that all VMs are physically located as close as possible within an Azure datacenter, reducing network latency to under 10 microseconds for MPI communication. This is the only option that guarantees co-location of VMs for a single HPC job, as PPGs minimize inter-VM latency by placing VMs in the same rack or cluster.

Answer

Azure Availability Sets

Answer

Azure Virtual Machine Scale Sets across Availability Zones

Answer

Azure Kubernetes Service (AKS)

Question 8

A company runs a web application on Azure VMs in a single region. The application must scale out automatically based on CPU utilization. The VMs are behind an Azure Load Balancer. Which Azure service should they use to automatically add or remove VMs based on demand?

Accepted Answer

Azure Virtual Machine Scale Sets. Azure Virtual Machine Scale Sets (VMSS) is the correct service because it provides automatic scaling of identical VM instances based on metrics like CPU utilization. When you configure an autoscale rule on a VMSS, it automatically adds or removes VM instances behind the Azure Load Balancer, ensuring the application scales out or in based on demand without manual intervention.

Answer

Azure App Service

Answer

Azure Functions

Answer

Azure Batch

Question 9

A global e-commerce company runs a web application in multiple Azure regions. They need to distribute incoming HTTPS traffic across regional deployments to provide low latency and high availability. The solution must support SSL offloading, Web Application Firewall (WAF) policies, and content caching to reduce backend load. They also need to route users to the nearest healthy backend region. Which Azure service should they use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it is a global, scalable entry point that provides HTTPS traffic distribution across multiple Azure regions with low latency, SSL offloading, WAF policies, and content caching. It uses Anycast-based routing to direct users to the nearest healthy backend region, meeting all the requirements for high availability and performance.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Content Delivery Network (CDN)

Question 10

A company wants to deploy containerized microservices on Azure without managing virtual machines. The solution must support automatic scaling based on demand, built-in load balancing, rolling updates for zero-downtime deployments, and a fully managed platform. Which Azure compute service should they choose?

Accepted Answer

Azure Container Apps. Azure Container Apps is the correct choice because it provides a fully managed, serverless platform for running containerized microservices without managing virtual machines. It supports automatic scaling based on HTTP traffic or events, built-in load balancing via Envoy, and rolling updates with revision management to ensure zero-downtime deployments. This aligns perfectly with the requirement for a fully managed platform that abstracts away infrastructure.

Answer

Azure Container Instances

Answer

Azure Batch

Answer

Azure Functions

Question 11

A company is developing a containerized microservices application. They want to minimize operational overhead for managing orchestration. The application has a low-to-medium traffic pattern that can spike unpredictably. They need fast scaling and pay-per-second billing. Which Azure compute service should they use?

Accepted Answer

B. Azure Container Instances (ACI) is the correct choice because it provides serverless container orchestration with per-second billing and rapid scaling, ideal for low-to-medium traffic with unpredictable spikes. Unlike Azure Kubernetes Service (AKS), ACI eliminates the need to manage a control plane or node pools, minimizing operational overhead while supporting fast scaling for containerized microservices.

Answer

A

Answer

C

Answer

D

Question 12

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via an API. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it provides automated detection of identity-based risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. It generates risk event reports and exposes risk data through the Microsoft Graph API, enabling integration with SIEM systems for centralized monitoring and response.

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Connect Health

Answer

Microsoft Entra ID Audit Logs

Question 13

Which THREE Azure services can be used to monitor the performance of a web application? (Choose three.)

Accepted Answer

Application Insights. Application Insights is an Azure service specifically designed for monitoring the performance and usage of live web applications. It collects telemetry data such as request rates, response times, failure rates, and dependency tracking, enabling developers to detect and diagnose performance issues in real time.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 14

A financial services company is designing a data storage solution for its transaction processing system. The system uses Azure Cosmos DB with the Core (SQL) API. The company needs to implement a change data capture (CDC) pipeline to feed a downstream analytics system in near real-time (under 1 minute). The analytics system uses Azure Synapse Analytics. The data volume is approximately 10,000 transactions per second. The solution must minimize operational complexity and cost. Which approach should the company recommend?

Accepted Answer

Use Azure Cosmos DB change feed with Azure Functions to process changes and load them into Azure Synapse Analytics using the COPY command.. Option A is correct because Azure Cosmos DB change feed can stream changes directly to Azure Functions or Stream Analytics, which can then write to Synapse via PolyBase or COPY command in near real-time. Option B is wrong because Azure Data Factory is batch-oriented and may not meet the <1 minute latency requirement. Option C is wrong because Azure Databricks with Change Feed adds complexity and cost. Option D is wrong because Azure Synapse Link is designed for analytical queries on Cosmos DB data but does not provide a CDC stream to Synapse; it replicates data into Synapse for querying, but the latency may vary.

Answer

Enable Azure Synapse Link for Cosmos DB and query the transactional data directly from Synapse serverless SQL.

Answer

Use Azure Data Factory to schedule incremental copy from Cosmos DB to Synapse every minute.

Answer

Use Azure Databricks with Spark Structured Streaming to read from Cosmos DB change feed and write to Synapse.

Question 15

A large enterprise is designing a data lake solution for its analytics platform. The data lake will store petabytes of structured and unstructured data from various sources, including IoT devices, logs, and transactional databases. The solution must support: - Multi-protocol access (ABFS, REST, and NFS 3.0) - Hierarchical namespace for folder-level permissions - Optimized for analytical workloads (Parquet format) - Cost-effective storage for cold data that is accessed less than once a year. Which Azure storage solution should the enterprise recommend for the data lake?

Accepted Answer

Azure Data Lake Storage Gen2 with Archive tier for cold data. Option C is correct because Azure Data Lake Storage Gen2 supports hierarchical namespace, multi-protocol access (ABFS, REST, NFS 3.0), and can use Archive tier for cold data. Option A is wrong because Azure Blob Storage does not support NFS 3.0 natively. Option B is wrong because Azure Files does not support ABFS or hierarchical namespace. Option D is wrong because Azure NetApp Files does not support ABFS and is expensive for petabyte-scale.

Answer

Azure NetApp Files Ultra tier

Answer

Azure Files Premium tier

Answer

Azure Blob Storage with hierarchical namespace enabled

Question 16

Your organization has a critical application deployed on Azure VMs in the West US region. The application uses a Standard_D8s_v3 VM with two data disks (512 GB each) and a separate log disk (256 GB). The application writes data continuously to the data disks and logs. The business continuity requirements are: RPO of 15 minutes, RTO of 2 hours, and the ability to recover to a specific point in time within the last 7 days. You need to design a disaster recovery solution that replicates the VMs and disks to the East US region. The solution must also support failback to West US after a disaster. What should you do?

Accepted Answer

Use Azure Site Recovery to replicate the VMs to East US with a recovery plan that includes the VM and disks, and configure failback using reprotection. Option C is correct because Azure Site Recovery can replicate Azure VMs to a secondary region with continuous replication meeting RPO of 15 minutes. It supports failback by reprotecting and failing back. Option A is wrong because Azure Backup has RPO of 1 hour for Azure VMs and does not support failback. Option B is wrong because geo-redundant storage (GRS) for managed disks does not provide VM replication or failback. Option D is wrong because Azure Migrate is for migration, not disaster recovery.

Answer

Use Azure Migrate to migrate the VMs to East US and then set up replication back to West US

Answer

Configure Azure Backup for the VMs with a backup policy that has a 15-minute frequency and replicate backups to the East US region using geo-redundant storage

Answer

Use Azure Storage geo-redundant storage (GRS) for the managed disks and manually attach the disks to a new VM in East US during a disaster

Question 17

Your organization runs a web application on Azure App Service (Standard tier) in the West US region. The application uses Azure Blob Storage for static content and Azure SQL Database (Standard tier) for dynamic data. The compliance requirements specify a Recovery Point Objective (RPO) of 1 hour and a Recovery Time Objective (RTO) of 4 hours. You need to design a disaster recovery solution that meets these requirements with minimal cost. Which option should you recommend?

Accepted Answer

Configure App Service backup to a geo-redundant storage account. Use geo-redundant storage (GRS) for Blob Storage. Enable geo-restore for Azure SQL Database.. Option B is correct because geo-redundant storage for Blob Storage is cost-effective and meets RPO; geo-restore for SQL Database meets RPO and RTO; App Service backup and restore in a secondary region meets RTO. Option A is wrong because Azure Site Recovery is for VMs, not App Service. Option C is wrong because active geo-replication for SQL Database is more expensive than needed. Option D is wrong because Azure Traffic Manager alone does not provide data replication.

Answer

Deploy App Service in two regions with Azure Traffic Manager. Use Azure Site Recovery to replicate the App Service and SQL Database. Enable geo-redundant storage for Blob Storage.

Answer

Deploy App Service in two regions with Azure Front Door. Use active geo-replication for Azure SQL Database. Enable read-access geo-redundant storage (RA-GRS) for Blob Storage.

Answer

Use Azure Traffic Manager to distribute traffic. Manually copy Blob Storage to a secondary region. Use Azure SQL Database export to bacpac and import in secondary region.

Question 18

Your company runs a Windows-based application on Azure Virtual Machines in the Brazil South region. The application uses Azure Files for shared storage and Azure SQL Database (Hyperscale tier) for the database. The business requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 30 minutes for the entire application. The solution must be cost-effective and leverage Azure-native services. You have been asked to design the disaster recovery strategy. Which option should you recommend?

Accepted Answer

Use Azure Site Recovery to replicate the VMs to a secondary region. Configure geo-redundant storage (GRS) for Azure Files. For Azure SQL Database Hyperscale, enable geo-restore and test restore procedures.. Option A is correct because Azure Site Recovery for VMs provides 15-minute RPO and fast RTO; geo-redundant storage for Azure Files meets RPO; Azure SQL Database Hyperscale geo-restore can achieve RTO within 30 minutes. Option B is wrong because Azure Backup for VMs has slower RTO. Option C is wrong because Azure File Sync is for hybrid scenarios, not DR. Option D is wrong because active geo-replication for SQL Database is more expensive than geo-restore.

Answer

Deploy a second set of VMs in a secondary region. Use Azure File Sync to keep Azure Files in sync. Use Azure SQL Database failover groups with a readable secondary.

Answer

Back up the VMs using Azure Backup with a 15-minute frequency. Use Azure File Sync to replicate Azure Files to a secondary region. Use Azure SQL Database backup with point-in-time restore.

Answer

Use Azure Site Recovery for VMs. Use Azure File Sync for Azure Files. Use active geo-replication for Azure SQL Database.

Question 19

A company uses Microsoft Entra ID to manage identities for employees and partners. They need to allow partners to self-service reset their passwords using a mobile app notification. Which feature should you enable?

Accepted Answer

Microsoft Entra ID Self-Service Password Reset (SSPR). Microsoft Entra ID Self-Service Password Reset (SSPR) is the correct feature because it allows users, including partners configured as external users in the tenant, to reset their own passwords without administrator intervention. SSPR supports multiple authentication methods, including mobile app notification via the Microsoft Authenticator app, which satisfies the requirement for a mobile app notification-based reset. This feature is specifically designed for password reset scenarios and can be scoped to include guest users when properly configured.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Intune

Answer

Microsoft Entra ID Privileged Identity Management

Question 20

Which TWO are valid methods to authenticate users in a Microsoft Entra ID hybrid identity solution? (Select TWO.)

Accepted Answer

Password hash synchronization. Password hash synchronization (B) is a valid authentication method for Microsoft Entra ID hybrid identity because it synchronizes password hashes from on-premises Active Directory to Azure AD, allowing users to authenticate using the same password without needing additional infrastructure. Pass-through authentication (D) is also valid as it validates passwords directly against on-premises Active Directory via agents, without storing password hashes in the cloud. Both methods are supported in hybrid identity scenarios and can be combined with Seamless SSO for a seamless experience.

Answer

Cloud-only authentication

Answer

Federation with Active Directory Federation Services (ADFS)

Answer

Seamless Single Sign-On