AZ-305 Practice Exam 64 — 20 Questions

Question 1

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to design a monitoring solution to detect when users are assigned to high-privilege roles (e.g., Global Administrator) and ensure that any such assignment triggers an automated investigation. Additionally, you need to monitor sign-in failures for guest users and automatically block accounts after 5 failed attempts within 10 minutes. You have the following requirements: 1) Use a cloud-native solution that minimizes administrative overhead. 2) Integrate with Microsoft Sentinel for incident response. 3) Use built-in features where possible. What should you do?

Accepted Answer

Use Microsoft Entra Privileged Identity Management (PIM) alerts for role assignments and Microsoft Entra Identity Protection for sign-in risk policies; integrate both with Microsoft Sentinel.. Option C is correct because Microsoft Entra Privileged Identity Management (PIM) provides built-in alerts for high-privilege role assignments, and Microsoft Entra Identity Protection offers risk-based policies for sign-in failures, including user risk policies that can automatically block accounts after a specified number of failures. Both services natively integrate with Microsoft Sentinel via built-in data connectors, enabling automated incident creation with minimal administrative overhead, meeting all requirements.

Answer

Use Microsoft Entra audit logs streamed to Log Analytics, create Azure Logic Apps to detect role assignments and sign-in failures, and trigger Sentinel incidents.

Answer

Use Azure Policy to audit role assignments and create custom KQL functions in Log Analytics to detect sign-in failures, then forward to Sentinel.

Answer

Deploy Microsoft Identity Manager (MIM) on-premises to monitor role changes, and use Azure AD Connect Health for sign-in failures.

Question 2

Your organization has multiple Azure subscriptions managed through Azure Management Groups. You need to enforce a policy that requires all resources to have a 'CostCenter' tag. If a resource is created without the tag, the deployment should be denied. Additionally, you need to ensure that existing non-compliant resources are automatically remediated. Which combination of actions should you take?

Accepted Answer

Create a policy with Deny effect for new resources, and create a remediation task using a DeployIfNotExists policy for existing resources.. Option C is correct because it combines two policy effects to address both requirements: the Deny effect blocks creation of new resources without the 'CostCenter' tag, while a separate DeployIfNotExists policy with a remediation task automatically adds the tag to existing non-compliant resources. This dual approach ensures enforcement for new deployments and automated remediation for existing resources, which is necessary because a single policy effect cannot both deny and remediate simultaneously.

Answer

Create a policy with DeployIfNotExists effect only, and rely on periodic evaluation.

Answer

Create a policy with Modify effect to add the tag, and assign it at the management group level.

Answer

Create a policy with Deny effect only, and run a script to tag existing resources.

Question 3

Your organization has 500 users in Microsoft Entra ID. You need to ensure that users can only access Microsoft 365 apps from compliant devices (compliant with Intune policies). Users are already enrolled in Intune. The compliance policies are defined. You need to configure the access control mechanism. What should you do?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant.. Option C is correct because Conditional Access in Microsoft Entra ID is the mechanism that enforces access controls based on signals like device compliance. By creating a policy that requires the device to be marked as compliant, you ensure that only devices meeting Intune compliance policies can access Microsoft 365 apps. This directly addresses the requirement without blocking all access or relying on automatic revocation.

Answer

Create a Conditional Access policy that blocks all access and then create exclusions for compliant devices.

Answer

Configure Intune compliance policies to automatically revoke access for non-compliant devices.

Answer

Create a Conditional Access policy that requires MFA based on location.

Question 4

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution to detect when a user account is created in Microsoft Entra ID with Global Administrator privileges. When detected, an incident must be created in Sentinel and the account should be disabled temporarily until reviewed. You want to use built-in capabilities where possible. What should you do?

Accepted Answer

Use a Microsoft Sentinel analytics rule template for 'Suspicious Entra ID role assignment' and configure a playbook to disable the account via Microsoft Graph API.. Option C is correct because it uses a built-in Sentinel analytics rule template specifically designed to detect suspicious Entra ID role assignments, which meets the requirement for built-in capabilities. The playbook, triggered by the rule, can use the Microsoft Graph API to disable the account temporarily, providing automated remediation without custom code or external services.

Answer

Use Microsoft Entra Privileged Identity Management to require approval for role activation, and audit logs to detect permanent assignments.

Answer

Use Microsoft Defender for Cloud Apps to monitor for privileged role assignments and send an alert to Sentinel.

Answer

Create a custom KQL query in Log Analytics and schedule it as a Sentinel analytics rule, then use an Azure Function to disable the account.

Question 5

You are a cloud architect for a multinational corporation. The company has a single Azure tenant with a management group hierarchy: Root MG -> Corp MG -> (Finance, HR, IT, Marketing) child management groups. Each child management group contains multiple subscriptions. The IT governance team wants to enforce a policy that all Azure resources must have a 'CostCenter' tag. However, the Finance department has legacy resources that cannot be modified and must be exempt from this policy. You need to design a solution that meets the following requirements: (1) The policy should be applied to all subscriptions in the Corp MG except those in the Finance MG. (2) The policy should audit non-compliant resources but not deny them. (3) The solution must use Azure Policy and minimize administrative overhead. What should you do?

Accepted Answer

Assign the policy at the Corp management group scope and exclude the Finance management group.. Assigning the policy at the Corp management group scope and excluding the Finance management group meets all requirements: it applies the policy to all subscriptions under Corp (including Finance, HR, IT, Marketing) while the exclusion removes Finance from policy evaluation. Using the 'audit' effect ensures non-compliant resources are flagged but not denied, and this single assignment minimizes administrative overhead.

Answer

Assign the policy at the Root management group and exclude all child management groups except Corp.

Answer

Assign the policy at each child management group except Finance.

Answer

Assign the policy to each subscription individually, excluding those in Finance.

Question 6

Your company plans to deploy a new SaaS application that will be used by employees and external users. The application requires single sign-on (SSO) and must support conditional access policies that enforce MFA for external users. Additionally, the application must be able to read user profile attributes from Microsoft Entra ID. You need to design an identity solution that meets these requirements. What should you include in the design?

Accepted Answer

Register the application in Microsoft Entra ID (App Registration) and configure it to use OpenID Connect for authentication; apply conditional access policies to the app.. Option A is correct because registering the application in Microsoft Entra ID (App Registration) and configuring OpenID Connect (OIDC) enables SSO and allows the application to read user profile attributes via the Microsoft Graph API. Conditional access policies can be applied directly to the enterprise app in Entra ID to enforce MFA for external users, meeting all stated requirements.

Answer

Use Azure AD Application Proxy to publish the SaaS app and configure pre-authentication with Entra ID.

Answer

Use Microsoft Entra Domain Services to authenticate the application via LDAP.

Answer

Register the application in Microsoft Entra B2C and configure federation with your Entra ID tenant.

Question 7

Your company operates in a highly regulated industry and must retain all sign-in logs for 7 years. The logs must be immutable and cannot be modified or deleted by administrators. You need to design a monitoring solution that stores sign-in logs in a cost-effective manner while meeting compliance requirements. The solution should also allow for real-time analysis of sign-in activity. What should you include in the design?

Accepted Answer

Stream sign-in logs to Log Analytics for real-time analysis and simultaneously archive them to an Azure Storage account with immutable blob policy (WORM).. Option A is correct because it meets both compliance and real-time analysis requirements. Streaming sign-in logs to Log Analytics enables real-time monitoring and querying, while simultaneously archiving them to an Azure Storage account with an immutable blob policy (WORM) ensures the logs cannot be modified or deleted for the required 7-year retention period. This combination provides cost-effective long-term storage (Azure Blob is cheaper than Log Analytics for long-term retention) and satisfies regulatory immutability mandates.

Answer

Stream sign-in logs to Azure Event Hubs and then to cold storage in Azure Blob with lifecycle management.

Answer

Stream sign-in logs to Log Analytics workspace with 7-year retention and use Azure Policy to restrict deletion.

Answer

Use Azure Data Explorer to store logs for 7 years and configure a purge policy to prevent deletion.

Question 8

Your company uses Microsoft Entra ID and has recently deployed Microsoft Sentinel. You need to design a monitoring solution to detect brute-force attacks against user accounts. The solution should use built-in analytics rules where possible and must trigger an automated response to temporarily disable the affected account. What should you include in the design?

Accepted Answer

Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user.. Option A is correct because Microsoft Sentinel includes a built-in analytics rule specifically for detecting brute-force attacks against Microsoft Entra ID accounts. By connecting a playbook to this rule, you can automate the response to temporarily disable the affected user account, meeting the requirement for an automated response without custom development.

Answer

Use Microsoft Entra Identity Protection to detect brute-force and configure a conditional access policy to block sign-ins.

Answer

Stream sign-in logs to Log Analytics and create a scheduled query that alerts on multiple failures, then manually disable accounts.

Answer

Create a custom KQL query in Microsoft Sentinel and configure an automation rule to disable the account.

Question 9

Your company has a hybrid identity environment with 10,000 on-premises users synchronized to Microsoft Entra ID using Microsoft Entra Connect. You plan to implement a modern access control strategy for all cloud applications. The requirements are: enforce multifactor authentication (MFA) for all users when accessing sensitive applications, allow users to self-remediate risky sign-ins via a mobile app, and minimize infrastructure complexity. You need to design the identity and governance solution. What should you do?

Accepted Answer

Configure Microsoft Entra ID Protection to detect risky sign-ins and create a conditional access policy that requires MFA for sensitive apps. Enable the risky user policy to require password change, and use Microsoft Authenticator for self-remediation.. Option B is correct because it uses Microsoft Entra ID Protection to detect risky sign-ins and a Conditional Access policy to require MFA for sensitive applications, meeting the MFA enforcement requirement. The risky user policy requiring a password change combined with Microsoft Authenticator for self-remediation allows users to resolve their own risk without admin intervention, satisfying the self-remediation requirement. This approach minimizes infrastructure complexity by relying entirely on cloud-native services rather than on-premises components.

Answer

Deploy Azure AD Domain Services and configure Kerberos authentication for cloud apps. Use Azure MFA Server on-premises for MFA enforcement.

Answer

Implement Microsoft Defender for Identity to monitor on-premises AD and require MFA via on-premises NPS extension.

Answer

Use Microsoft Entra Permissions Management to enforce MFA policies and manage user permissions.

Question 10

You are designing a data storage solution for a global e-commerce platform that handles millions of transactions per day. The platform uses Azure Cosmos DB for its transactional data. The company wants to implement a real-time analytics pipeline to monitor sales trends and detect anomalies. The analytics must be performed on the transactional data with minimal latency (under 5 seconds). The solution must not impact the transactional workload's performance. The analytics queries involve aggregations over time windows and joins with reference data stored in Azure SQL Database. You need to recommend a solution. Which option should you choose?

Accepted Answer

Use Azure Cosmos DB change feed to stream data to Azure Stream Analytics, which performs the aggregations and joins with reference data from Azure SQL Database.. Option A is correct because Azure Cosmos DB change feed enables real-time capture of changes, and Azure Stream Analytics can process streams with low latency and join with reference data from Azure SQL Database. Option B is wrong because Azure Data Factory is a batch ETL tool, not suitable for sub-5-second latency. Option C is wrong because Azure Synapse Link replicates data to Azure Synapse, which adds latency and is not real-time. Option D is wrong because Azure Databricks with Auto Loader is also batch-oriented and not designed for sub-5-second streaming.

Answer

Enable Azure Synapse Link for Cosmos DB and use Synapse serverless SQL to query the transactional data directly.

Answer

Use Azure Data Factory to copy data from Cosmos DB to Azure Synapse Analytics every minute, and run analytics queries in Synapse.

Answer

Use Azure Databricks with Auto Loader to incrementally load data from Cosmos DB into Delta Lake, and then query with Spark SQL.

Question 11

AdventureWorks is a global retailer with a cloud-native architecture. They have a microservices application deployed on Azure Kubernetes Service (AKS). Each microservice needs to store its own data. The data requirements vary: (1) Shopping cart service: key-value data with high write throughput and low latency, data can be lost if not critical; (2) Order service: transactional data with strong consistency and ACID compliance; (3) Product catalog service: semi-structured product data that supports complex queries and is globally distributed for low-latency reads. The solution must use Azure PaaS services and minimize operational overhead. You need to design the data storage for each microservice. What should you recommend?

Accepted Answer

Azure Cache for Redis for shopping cart, Azure SQL Database for orders, Azure Cosmos DB for product catalog.. Option B is correct. For the shopping cart, Azure Cache for Redis provides in-memory key-value storage with low latency. For the order service, Azure SQL Database provides ACID compliance. For the product catalog, Azure Cosmos DB provides global distribution and complex query support. Option A is wrong because Cosmos DB is not ACID-compliant for orders. Option C is wrong because Azure Table Storage is not ACID-compliant. Option D is wrong because Azure SQL Database is not ideal for high-write key-value.

Answer

Azure Cosmos DB for all three services.

Answer

Azure Table Storage for shopping cart, Azure SQL Database for orders, Azure Cosmos DB for product catalog.

Answer

Azure SQL Database for all three services.

Question 12

A healthcare company is designing a data storage solution for its electronic health records (EHR) system. The system must store patient data in Azure SQL Database with high availability. The solution must meet the following requirements: - Data must be stored in the East US region with automatic failover to a secondary region in West US in case of a regional outage. - The Recovery Point Objective (RPO) must be less than 5 seconds. - The Recovery Time Objective (RTO) must be less than 1 hour. - The solution must minimize costs while meeting the RPO and RTO. Which Azure SQL Database configuration should the company recommend?

Accepted Answer

Deploy Azure SQL Database with active geo-replication to a secondary server in West US. Configure automatic failover using a failover group.. Option A is correct because Azure SQL Database active geo-replication with a secondary in West US meets the RPO of 5 seconds (typically 5-10 seconds) and RTO of 1 hour (failover time is usually < 30 minutes). Option B is wrong because auto-failover groups use the same replication but require a secondary in the same region for premium tiers. Option C is wrong because zone-redundant configuration provides high availability within a region, not across regions. Option D is wrong because Azure SQL Database Managed Instance does not support active geo-replication with sub-5-second RPO.

Answer

Deploy Azure SQL Database Managed Instance with failover group to a secondary instance in West US.

Answer

Deploy Azure SQL Database Business Critical tier with auto-failover group and a secondary replica in a different availability zone within East US.

Answer

Deploy Azure SQL Database General Purpose tier with zone-redundant configuration.

Question 13

A gaming company is developing a multiplayer online game that requires a low-latency data store for player profiles, inventory, and session state. The data is accessed globally, and the solution must support millions of concurrent players. The company expects write-heavy workloads with occasional reads. The solution must provide single-digit millisecond latency for reads and writes. The company also needs to run analytics on the data to understand player behavior, but analytics queries can tolerate higher latency (minutes). Which Azure data storage solution should the company recommend for the transactional data?

Accepted Answer

Azure Cosmos DB with multiple write regions. Option B is correct because Azure Cosmos DB with multi-master writes provides global low-latency access and high throughput. Option A is wrong because Azure SQL Database with geo-replication may have higher latency for writes due to replication. Option C is wrong because Azure Redis Cache is a caching layer, not a durable data store. Option D is wrong because Azure Table Storage is not designed for single-digit millisecond latency and global distribution.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Redis Cache with persistence

Answer

Azure Table Storage with geo-redundancy

Question 14

Contoso Ltd. is a global retail company with headquarters in New York and operations in Europe and Asia. They are migrating their on-premises SQL Server databases to Azure. The databases include a customer database (500 GB), an orders database (2 TB), and a product catalog database (100 GB). The customer database requires high read throughput with sub-10 ms latency for global users. The orders database must support complex queries and reporting with point-in-time restore capability up to 35 days. The product catalog is updated infrequently but must be available for read-heavy workloads with strong consistency. Contoso wants to minimize costs while meeting performance and compliance requirements. They also need to support hybrid deployments for databases that must remain on-premises due to data sovereignty laws. You need to design a data storage solution. Which combination of Azure services and configurations should you recommend?

Accepted Answer

Azure Cosmos DB with multiple write regions for customer DB; Azure SQL Database Business Critical for orders; Azure SQL Database serverless for product catalog; Azure SQL Managed Instance with managed instance link for hybrid. Option C is correct because Azure Cosmos DB with multiple write regions provides global low-latency for customer data; Azure SQL Database with Business Critical tier for orders provides complex query support and point-in-time restore; Azure SQL Database serverless for product catalog reduces costs for infrequent updates; and Azure SQL Managed Instance supports hybrid deployments with link. Option A is wrong because Azure SQL Database Hyperscale is for large databases but does not provide global low-latency. Option B is wrong because Azure SQL Database for customer data would not meet sub-10 ms latency globally. Option D is wrong because Azure SQL Managed Instance for all databases increases costs unnecessarily.

Answer

Azure SQL Managed Instance for all databases with geo-replication for customer DB; use failover groups for global distribution; Azure Data Sync for hybrid

Answer

Azure SQL Database Hyperscale for all databases; use geo-replication for customer DB; Azure SQL Server on Azure VMs for hybrid

Answer

Azure SQL Database Business Critical for customer DB with geo-replication; Azure SQL Database Hyperscale for orders; Azure SQL Database serverless for product catalog; Azure SQL Managed Instance for hybrid

Question 15

Your company, Fabrikam Inc., operates a global Software-as-a-Service (SaaS) application that provides real-time analytics. The application runs on Azure Kubernetes Service (AKS) with a microservices architecture. The data tier uses Azure Cosmos DB (Core SQL API) with multi-region writes. The application also uses Azure Event Hubs for event ingestion. The business requires a Recovery Time Objective (RTO) of 10 seconds and a Recovery Point Objective (RPO) of 0 for the entire platform. The solution must support active-active configuration across multiple Azure regions. You have been asked to recommend the disaster recovery design. Which option should you recommend?

Accepted Answer

Deploy AKS in three regions with Azure Front Door. Use Azure Cosmos DB with multi-region writes. Use Azure Event Hubs with geo-disaster recovery and active-active pattern. Use Azure Cache for Redis Enterprise with active geo-replication.. Option B is correct because all components support multi-region writes and active-active configuration: Azure Front Door for global load balancing, Cosmos DB multi-region writes for zero data loss, Event Hubs geo-disaster recovery for automatic failover, and Redis Enterprise active geo-replication. Option A is wrong because Azure Traffic Manager is DNS-based and slower. Option C is wrong because Azure Service Bus does not support multi-region active-active natively. Option D is wrong because Azure SQL Database does not support multi-region writes.

Answer

Deploy AKS in three regions with Azure Traffic Manager. Use Azure Cosmos DB with multi-region writes. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Answer

Deploy AKS in two regions with Azure Front Door. Use Azure Cosmos DB with single write region and auto-failover. Use Azure Service Bus with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Answer

Deploy AKS in two regions with Azure Front Door. Use Azure SQL Database with auto-failover groups. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.

Question 16

Contoso Ltd. is a global e-commerce company running its online store on Azure. The application consists of:
- Frontend: Azure App Service (Windows) in West US.
- Backend: Azure Kubernetes Service (AKS) cluster in West US.
- Database: Azure SQL Database (General Purpose, S2) in West US.
- Cache: Azure Cache for Redis (Standard C1) in West US.
- Storage: Azure Blob Storage (LRS) for product images.

Business continuity requirements:
- RPO: 5 minutes for the database.
- RTO: 1 hour for the entire application.
- The solution must survive a complete West US region outage.
- Budget is limited; minimize additional costs.

What should you recommend as the primary DR strategy?

Accepted Answer

Deploy a secondary region (East US) with a passive AKS cluster (minimal node count), a standby App Service plan (same tier), and a secondary Azure SQL Database in an auto-failover group. Use Azure Traffic Manager for frontend and configure Azure Cache for Redis with geo-replication. For Blob Storage, enable geo-redundant storage (GRS).. Option C is correct because Azure SQL Database auto-failover group with a secondary in a paired region (e.g., East US) meets the 5-minute RPO (active geo-replication with synchronous mode) and 1-hour RTO. For AKS and App Service, you can deploy a minimal standby cluster and App Service plan in the secondary region, and use Azure Traffic Manager for global load balancing. Azure Cache for Redis can be deployed with geo-replication. Option A is wrong because Azure Site Recovery for the entire environment would be more expensive and may not meet the database RPO. Option B is wrong because Azure Backup has an RPO of at least 1 hour. Option D is wrong because Availability Zones do not protect against a regional outage.

Answer

Use Azure Backup for the database with 5-minute log backup frequency. For the app, use Azure App Service backup with frequency to a secondary region. For AKS, back up persistent volumes using Azure Backup. Restore everything in a secondary region during disaster.

Answer

Deploy the entire application across two Azure Availability Zones within West US. Use zone-redundant storage for blobs, zone-redundant App Service plan, and zone-redundant AKS. For SQL Database, use a zone-redundant configuration. For Redis, use Enterprise tier with zone redundancy.

Answer

Use Azure Site Recovery to replicate all VMs (including AKS nodes) to a secondary region. For the database, use Azure SQL Database active geo-replication. For Azure Cache for Redis, replicate data via geo-replication. Use Azure Traffic Manager for frontend traffic routing.

Question 17

Fabrikam Inc. runs a file-sharing service used by 500 employees globally. The service is deployed on Azure VMs in the North Europe region. The VMs store data on Azure Files shares (Standard performance tier) mounted via SMB. The company's business continuity policy requires:
- RPO: 1 hour for any data loss.
- RTO: 4 hours to restore service after a regional disaster.
- All data must be backed up and recoverable in a different region.
- Budget is a concern; prefer cost-effective solutions.

Currently, there is no backup in place. You need to design a solution. What should you do?

Accepted Answer

Configure Azure Backup for the Azure Files shares with a backup policy of 1-hour frequency. Also back up the VMs using Azure Backup with a 1-hour policy. Store backups in a Recovery Services vault with geo-redundant storage (GRS). Enable cross-region restore.. Option B is correct because Azure Backup for Azure Files can schedule backups every hour (meeting 1-hour RPO) and store them in a Recovery Services vault with geo-redundant storage (GRS) to recover in another region. For the VMs, Azure Backup can also protect them with a 1-hour frequency. Cross-region restore enables recovery in a secondary region. Option A is wrong because Azure Site Recovery is more expensive and may not be needed for this RTO. Option C is wrong because Azure Files snapshots are manual and do not provide cross-region recovery. Option D is wrong because Azure File Sync is for sync, not backup.

Answer

Set up Azure Site Recovery (ASR) for the VMs and Azure Files. Replicate to a secondary region (West Europe). Use ASR recovery plans to orchestrate failover.

Answer

Use Azure Files share snapshots taken every hour and store them in a separate storage account in the same region. For VM backup, use Azure Backup with daily frequency. In a disaster, deploy new VMs and restore from snapshots.

Answer

Implement Azure File Sync between the Azure Files share and an on-premises file server. For disaster recovery, failover to the on-premises server.

Question 18

Adatum Corporation runs a customer-facing API on Azure API Management (Developer tier) in the East US region. The backend is an Azure Function app (Premium plan) also in East US. The data is stored in Azure Cosmos DB (Core SQL API) with a single write region in East US. The company requires:
- RPO: 0 (zero data loss).
- RTO: 1 minute for the API to be available after a region failure.
- The solution must be fully automated.
- Cost is not a primary concern.

What DR strategy should you recommend?

Accepted Answer

Deploy an active-active architecture in East US and West US. Deploy API Management in both regions and use Azure Front Door with health probes for automatic failover. Deploy Azure Functions in both regions (Premium plan supports multi-region). Configure Cosmos DB with multi-region writes (single write region with automatic failover) and strong consistency. All traffic is active-active, with automatic failover.. Option D is correct because an active-active multi-region architecture with Cosmos DB multi-region writes (strong consistency in single write region with automatic failover) ensures zero data loss and automatic failover. API Management can be deployed in multiple regions with Azure Front Door for global load balancing and automatic failover. Azure Functions Premium plan supports multi-region deployment. Option A is wrong because Azure Site Recovery has higher RTO. Option B is wrong because passive standby has higher RTO due to manual steps. Option C is wrong because Availability Zones do not protect against regional outage.

Answer

Deploy the API Management, Functions, and Cosmos DB across two Availability Zones in East US. Use zone-redundant services. For Cosmos DB, use multi-region writes within the same region (not possible).

Answer

Deploy a passive standby in West US with a second API Management instance, a second Functions app, and a second Cosmos DB write region (multi-region writes). Use Azure Front Door with health probes to automatically route traffic. Manually failover Cosmos DB during disaster.

Answer

Deploy a passive standby in West US using Azure Site Recovery to replicate the Azure Functions and API Management. For Cosmos DB, enable a secondary read region and manual failover. Use Azure Traffic Manager to switch traffic during a disaster.

Question 19

Your company, Contoso Ltd., runs a critical line-of-business application on Azure Virtual Machines in the West Europe region. The application uses Azure SQL Database (Business Critical tier) for data storage. The compliance team requires a Recovery Point Objective (RPO) of 5 seconds and a Recovery Time Objective (RTO) of 10 seconds for the database tier. For the compute tier, the RPO is 1 minute and RTO is 5 minutes. The application must remain available during planned maintenance and regional outages. You have been asked to design the business continuity solution. You need to recommend the most cost-effective solution that meets all requirements. What should you recommend?

Accepted Answer

Set up auto-failover group for Azure SQL Database with a secondary in North Europe; deploy AKS in both regions with Azure Front Door for global load balancing.. Option C is correct because Auto-failover groups with active geo-replication provide synchronous replication (RPO=0) and automatic failover (RTO~10 seconds) for Azure SQL Database Business Critical tier. AKS with Azure Front Door provides fast failover for compute tier. Option A is wrong because Azure SQL Database backup restore takes too long. Option B is wrong because Traffic Manager lacks health probe granularity and AKS failover is slower. Option D is wrong because SQL Server Always On requires additional licensing and management overhead.

Answer

Configure active geo-replication for Azure SQL Database; deploy AKS in two regions with Azure Traffic Manager; use manual failover scripts.

Answer

Use Azure SQL Database backup with point-in-time restore for the database; deploy AKS in West Europe and use Azure Traffic Manager for failover to a secondary cluster in North Europe.

Answer

Deploy SQL Server Always On availability groups on Azure VMs in two regions; use Azure Site Recovery for the VMs; use Azure Front Door for load balancing.

Question 20

Contoso Ltd. runs a mission-critical application on Azure Virtual Machines in the East US region. The application uses Azure SQL Database (Business Critical tier) and stores files in Azure Blob Storage (hot tier). The business requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes for the application. For SQL Database, they need the ability to fail over to a secondary region with no data loss. For Blob Storage, they need to maintain read access to data even if the primary region fails. The solution must be cost-optimized and not exceed the RTO/RPO. Which combination of services should you recommend?

Accepted Answer

Configure Azure SQL Database active geo-replication with a secondary in a paired region, and use read-access geo-redundant storage (RA-GRS) for Blob Storage.. Option B is correct because Azure SQL Database with active geo-replication provides synchronous replication to a secondary region, achieving RPO of 0 (no data loss), and failover can be initiated within minutes, meeting RTO of 15 minutes. Azure Blob Storage with read-access geo-redundant storage (RA-GRS) allows read access to data in the secondary region even if the primary fails, and asynchronous replication meets RPO of 5 minutes. Option A is wrong because Azure Site Recovery for SQL Database is not necessary and adds cost/complexity; SQL Database has built-in geo-replication. Option C is wrong because Azure SQL Database failover groups use asynchronous replication, which could lose data (RPO > 5 minutes) unless configured with premium tier, but still not zero data loss. Option D is wrong because Azure SQL Database with geo-restore has RTO of hours, not 15 minutes.

Answer

Configure Azure SQL Database failover groups with automatic failover, and use geo-redundant storage (GRS) for Blob Storage.

Answer

Deploy Azure Site Recovery for VMs, configure Azure SQL Database failover groups, and use geo-zone-redundant storage (GZRS) for Blob Storage.

Answer

Configure Azure SQL Database geo-restore for the database, and use zone-redundant storage (ZRS) for Blob Storage.