AZ-305 Design data storage solutions Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are benefits of using Azure Cosmos DB for a globally distributed application?

Accepted Answer

Multiple consistency models to choose from. Azure Cosmos DB offers multiple well-defined consistency models (strong, bounded staleness, session, consistent prefix, and eventual) that allow developers to balance consistency, availability, and latency according to application needs. This is a key benefit for globally distributed applications because it enables tuning data guarantees across regions without sacrificing performance.

Answer

Support for foreign key constraints across containers

Answer

Built-in support for transactional replication

Answer

Native support for SQL Server stored procedures

Question 2

Which TWO of the following are valid replication options for Azure Blob Storage?

Accepted Answer

RA-GRS (Read-Access Geo-Redundant Storage). RA-GRS (Read-Access Geo-Redundant Storage) is a valid Azure Blob Storage replication option because it replicates data synchronously three times within the primary region and asynchronously to a secondary region hundreds of miles away, while additionally providing read access to the secondary region endpoint. ZRS (Zone-Redundant Storage) is also valid for Blob Storage, as it synchronously replicates data across three availability zones within a single primary region, protecting against zone-level failures. GRS is a real redundancy tier but is not one of the two options marked correct here, and LRS is likewise a valid tier but not marked correct; both are excluded from the correct set for this question. ASR (Azure Site Recovery) is not a Blob Storage replication option at all — it is a disaster-recovery orchestration service for VMs and other workloads, not a storage redundancy SKU.

Answer

GRS (Geo-Redundant Storage)

Answer

LRS (Locally Redundant Storage)

Answer

ASR (Azure Site Recovery)

Question 3

You are reviewing the encryption settings of an Azure Storage account using the above JSON output. What is the current encryption status for files stored in Azure Files shares in this account?

Accepted Answer

Files are encrypted at rest using Azure Storage encryption. The JSON output shows `"defaultEncryption": false` for the Azure Files share. However, Azure Storage Service Encryption (SSE) is always enabled for Azure Files and cannot be disabled. This property does not control encryption; it may relate to other settings. Therefore, files stored in Azure Files shares are always encrypted at rest using Microsoft-managed keys by default.

Answer

Files are encrypted because defaultEncryption is false

Answer

Files are encrypted using customer-managed keys

Answer

Files are not encrypted at rest

Question 4

You are deploying an Azure SQL Database using the ARM template snippet above. Which of the following describes the resulting database configuration?

Accepted Answer

Standard tier with 100 DTUs. The ARM template snippet specifies `requestedServiceObjectiveName: 'S0'`, which corresponds to the Standard service tier with 10 DTUs and a maximum database size of 250 GB. None of the provided options accurately describe this configuration: Option A incorrectly states 100 DTUs, Option B is incorrect because zone-redundancy is not enabled, Option C incorrectly states a 10 GB maximum size, and Option D is incorrect because it specifies Premium tier with 100 DTUs.

Answer

Zone-redundant deployment

Answer

Maximum size of 10 GB

Answer

Premium tier with 100 DTUs

Question 5

Your company is designing a data storage solution for a global e-commerce platform. The solution must support high-frequency read and write operations with sub-millisecond latency, and must be able to handle schema-less JSON documents. Which Azure data service should you recommend?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it is a globally distributed, multi-model database service that offers guaranteed single-digit-millisecond latency for both reads and writes at the 99th percentile, making it ideal for high-frequency operations. It natively supports schema-less JSON documents through its SQL API, allowing flexible data models without requiring schema definitions or migrations.

Answer

Azure SQL Database

Answer

Azure Blob Storage

Answer

Azure Table Storage

Question 6

A multinational corporation needs to store sensitive customer data in Azure. The data must be encrypted at rest using a customer-managed key stored in Azure Key Vault, and the key must be rotated every 90 days. The solution must also support geo-redundancy for disaster recovery. Which combination of services should you recommend?

Accepted Answer

Azure SQL Database with Transparent Data Encryption (TDE) using customer-managed keys in Azure Key Vault, and active geo-replication. Azure SQL Database with Transparent Data Encryption (TDE) using customer-managed keys in Azure Key Vault, combined with active geo-replication, fully satisfies the requirements for encryption, key rotation, and geo-redundancy. TDE encrypts the database files at rest using a Database Encryption Key (DEK), which is protected by a customer-managed asymmetric key in Azure Key Vault; when the Key Vault key is rotated, Azure SQL automatically re-encrypts the DEK with the new key version without downtime. Active geo-replication asynchronously replicates committed transactions to a readable secondary in another region, with a typical RPO of under 5 seconds (not a guaranteed zero), and allows a manual or automatic failover for disaster recovery.

Answer

Azure Storage with customer-managed keys in Azure Key Vault and geo-redundant storage (GRS)

Answer

Azure Cosmos DB with customer-managed keys in Azure Key Vault and multi-region writes

Answer

Azure SQL Managed Instance with TDE and failover groups

Question 7

Refer to the exhibit. Your Azure policy team has created the following policy definition. After assigning this policy to a subscription, a developer tries to create a new storage account with network ACLs default action set to 'Allow'. What will happen?

Accepted Answer

The storage account creation will be denied because it violates the policy.. The policy definition uses the 'Deny' effect, which explicitly blocks any non-compliant resource creation. Since the developer attempts to set the network ACLs default action to 'Allow', this violates the policy's condition that requires the default action to be 'Deny'. Therefore, Azure Resource Manager will reject the deployment before the storage account is created.

Answer

The storage account will be created if the developer uses a different resource group.

Answer

The storage account will be created with a default action of 'Deny' automatically.

Answer

The storage account will be created successfully because the policy only audits.

Question 8

Your organization is migrating on-premises SQL Server databases to Azure. The databases are mission-critical and require the highest level of availability with automatic failover to a secondary region. Which Azure SQL deployment option should you recommend?

Accepted Answer

Azure SQL Managed Instance with failover groups. Azure SQL Managed Instance with failover groups provides automatic failover to a secondary region by replicating data to a secondary instance and automatically failing over in case of an outage. Active geo-replication (Option A) does not support automatic failover; it requires manual or custom scripting to initiate failover. SQL Managed Instance with failover groups meets the requirement for automatic cross-region failover.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Database for PostgreSQL

Answer

SQL Server on Azure Virtual Machines with Always On availability groups

Question 9

A company is designing a storage solution for a critical application that requires low latency (under 5 ms) and high throughput for large files (up to 10 GB). The solution must support NFS and SMB protocols. Which Azure storage solution should you recommend?

Accepted Answer

Azure NetApp Files. Azure NetApp Files is the correct choice because it provides a fully managed, high-performance file share service that supports both NFS and SMB protocols natively, with sub-millisecond latency and throughput suitable for large files up to 10 GB. It is built on NetApp's ONTAP technology and is designed for latency-sensitive enterprise workloads, meeting the under-5 ms requirement while handling large file sizes efficiently.

Answer

Azure Blob Storage (premium tier)

Answer

Azure Managed Disks (Ultra Disk)

Answer

Azure Files (premium tier)

Question 10

You are reviewing the above Azure Policy definition assigned to a storage account. What does this policy enforce?

Accepted Answer

All containers must use a specific customer-managed encryption scope named 'customEncryptionScope' to allow write operations.. The Azure Policy definition uses the 'denyAction' effect to block write operations unless the storage account's containers are configured with a specific customer-managed encryption scope named 'customEncryptionScope'. This enforces that all containers must use that exact encryption scope for write operations, ensuring data is encrypted with a customer-managed key at the container level.

Answer

Containers can be written to only if they use the default encryption scope.

Answer

Write operations are allowed only when encryption scope is not specified.

Answer

Reading from containers is denied unless a specific encryption scope is used.

Question 11

Which TWO options are valid ways to enforce data residency in Azure Storage to ensure data does not leave a specific Azure region?

Accepted Answer

Use Azure Policy to deny storage accounts with geo-redundant storage (GRS) or read-access geo-redundant storage (RA-GRS).. Option A is correct because Azure Policy can enforce data residency by denying the creation or update of storage accounts configured with geo-redundant SKUs such as GRS or RA-GRS, which replicate data to a paired secondary region outside the chosen primary region; restricting SKUs to LRS or ZRS keeps data within the specified region. Option E is correct because configuring the Azure Storage firewall with a default deny rule and scoping access through virtual network service endpoints (or private endpoints) restricts network reachability so that data can only be accessed from within the intended Azure region's virtual network, supporting residency enforcement. Option B is not correct because Azure Data Lake Storage Gen2 with hierarchical namespace is a data organization and analytics feature, not a residency control. Option C is not correct because Azure Front Door with caching is a global content delivery service that can cache and serve data from edge locations worldwide, which works against data residency. Option D is not correct because RA-GRS is itself a geo-replication option that copies data to a secondary region, directly violating the requirement that data not leave a specific Azure region.

Answer

Use Azure Data Lake Storage Gen2 with hierarchical namespace.

Answer

Enable Azure Front Door with caching.

Answer

Use read-access geo-redundant storage (RA-GRS).

Question 12

Which THREE features are available in Azure Files premium tier that are not available in standard tier?

Accepted Answer

Higher IOPS (up to 100,000 per share). Option A is correct because Azure Files premium tier (provisioned file shares backed by SSD storage) delivers significantly higher performance, scaling up to 100,000 IOPS per share, whereas standard tier shares are capped at much lower IOPS limits (e.g., 20,000 for standard SSD). Option B is correct because SMB Multichannel, which aggregates multiple network connections for higher throughput and resiliency, is supported only on premium file shares. Option C is correct because premium tier provides consistently low, single-digit millisecond latency due to its SSD-backed storage, while standard tier (HDD-backed) exhibits higher and more variable latency. Option D is not correct because NFS v4.1 is supported in both standard and premium tiers (as well as premium SSD and standard SSD/HDD file shares), so it is not exclusive to premium. Option E is not correct because Azure File Sync integration works with standard file shares as well as premium, so it is not a premium-only feature.

Answer

Support for NFS v4.1 protocol

Answer

Azure File Sync integration

Question 13

Which TWO options can be used to automatically replicate Azure SQL Database to a secondary region for disaster recovery with no data loss in the event of a regional outage?

Accepted Answer

Use auto-failover groups with data synchronization.. Option A is correct because auto-failover groups with data synchronization use asynchronous replication with a defined RPO (typically under 5 seconds) and support automatic or manual failover to a secondary region, providing disaster recovery for Azure SQL Database. Option E is correct because failover groups with an automatic failover policy enable automatic failover to the secondary region without manual intervention, meeting the requirement for automatic replication and recovery. Option B is incorrect because active geo-replication requires manual failover initiation and does not provide the automatic failover capability required here. Option C is incorrect because log shipping is not a native Azure SQL Database feature and does not provide automatic regional failover. Option D is incorrect because Azure Site Recovery replicates VMs, not Azure SQL Database, and is not applicable to this PaaS scenario.

Answer

Enable active geo-replication for the database.

Answer

Set up log shipping to a secondary server.

Answer

Deploy Azure Site Recovery to replicate the SQL Server VM.

Question 14

A company needs to store sensitive customer data in Azure Blob Storage. They require encryption at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, they want to prevent data from being accessed if the key is revoked. Which feature should they enable?

Accepted Answer

Storage Service Encryption (SSE). Storage Service Encryption (SSE) encrypts data at rest in Azure Blob Storage. When combined with customer-managed keys (CMK) in Azure Key Vault, revoking the key renders the data inaccessible because the encryption key is no longer available. Thus, SSE with CMK is the feature that prevents data access upon key revocation. Customer Lockbox controls Microsoft engineer access, not data access due to key revocation.

Answer

Azure Defender for Storage

Answer

Customer Lockbox for Azure Storage

Answer

Azure Files with AD DS authentication

Question 15

A global e-commerce company uses Azure Cosmos DB for its product catalog. The write-heavy workload experiences high latency during peak hours. Which design change would most reduce write latency?

Accepted Answer

Enable multiple write regions. Enabling multiple write regions allows writes to be accepted by the nearest regional replica, reducing cross-region network latency for write-heavy workloads. This is the most direct architectural change to lower write latency globally, as it avoids the round-trip to a single write region.

Answer

Change the default consistency level to eventual

Answer

Partition the container by a different key

Answer

Increase the request units (RUs) per container