AZ-305 Design data storage solutions Practice Test 9 — 15 Questions

Question 1

Which TWO of the following are requirements for using Azure SQL Database auto-failover groups? (Select two.)

Accepted Answer

The primary and secondary servers must be in different Azure regions.. Azure SQL Database auto-failover groups require the primary and secondary servers to be in different Azure regions for geo-replication and disaster recovery (B). All databases in the group must use the same service tier to ensure consistent performance (E). The secondary server must have a different logical server name from the primary; having the same name is incorrect (C). The servers can be in different regions, not the same (A). There is no requirement that databases must be in different elastic pools (D).

Answer

Both servers must be in the same Azure region.

Answer

The secondary server must have the same logical server name.

Answer

The databases must be in different elastic pools.

Question 2

Your company is designing a data lake solution using Azure Data Lake Storage Gen2. The solution must support hierarchical namespace for efficient directory operations, and must provide encryption at rest using customer-managed keys stored in Azure Key Vault. Which steps must you take to enable customer-managed key encryption for the storage account?

Accepted Answer

Create the storage account with hierarchical namespace enabled, then assign a system-assigned managed identity, and configure encryption with Azure Key Vault.. Azure Data Lake Storage Gen2 requires hierarchical namespace to be enabled at account creation time, and customer-managed key encryption with Azure Key Vault requires a system-assigned managed identity to be assigned to the storage account after creation. The system-assigned identity is used to authenticate to Key Vault for key access, and encryption with customer-managed keys can be configured post-creation via the Azure portal or PowerShell.

Answer

Create the storage account with a user-assigned managed identity, then enable hierarchical namespace, and configure encryption.

Answer

Create the storage account without hierarchical namespace, then enable it later, and configure encryption with Key Vault.

Answer

Create the storage account and specify customer-managed key encryption during creation using the Azure portal.

Question 3

You need to provide temporary shared access to a specific blob in Azure Storage for a contractor. The access must expire after 24 hours. Which feature should you use?

Accepted Answer

Shared access signature (SAS). A shared access signature (SAS) provides delegated, time-limited access to a specific Azure Storage resource, such as a blob, without exposing the storage account key. By configuring the SAS with an expiration time of 24 hours, you grant the contractor temporary access that automatically revokes after that period, meeting the requirement precisely.

Answer

Managed identity

Answer

Azure role-based access control (RBAC)

Answer

Storage account access key

Question 4

A company is designing a storage solution for a critical application that requires low latency (under 5 ms) and high throughput for large files (up to 10 GB). The solution must support NFS and SMB protocols. Which Azure storage solution should you recommend?

Accepted Answer

Azure NetApp Files. Azure NetApp Files is the correct choice because it provides a fully managed, high-performance file share service that supports both NFS and SMB protocols natively, with sub-millisecond latency and throughput suitable for large files up to 10 GB. It is built on NetApp's ONTAP technology and is designed for latency-sensitive enterprise workloads, meeting the under-5 ms requirement while handling large file sizes efficiently.

Answer

Azure Blob Storage (premium tier)

Answer

Azure Managed Disks (Ultra Disk)

Answer

Azure Files (premium tier)

Question 5

Your company stores sensitive customer data in Azure Blob Storage. You must ensure that data is encrypted at rest using customer-managed keys (CMK) and that key rotation is automated. You also need to prevent data from being accessed by any Microsoft administrator. Which solution should you implement?

Accepted Answer

Use Azure Key Vault Managed HSM with customer-managed keys and enable double encryption with infrastructure encryption.. Azure Key Vault Managed HSM provides FIPS 140-2 Level 3 validated hardware security modules (HSMs) for storing customer-managed keys (CMK), supports automated key rotation, and enables double encryption via infrastructure encryption. This ensures that data is encrypted at rest with a customer-controlled key, and the use of Managed HSM prevents Microsoft administrators from accessing the key material, as the HSM is isolated and Microsoft has no export or visibility permissions.

Answer

Use Azure Key Vault (Standard) to store customer-managed keys and enable automatic key rotation.

Answer

Use Azure Disk Encryption with customer-managed keys stored in Azure Key Vault.

Answer

Enable Azure Storage Service Encryption with platform-managed keys.

Question 6

A company needs to store millions of small JSON files (average 10 KB each) for a serverless application. The data must be accessed via HTTPS and support high read throughput. Which Azure storage solution is most cost-effective?

Accepted Answer

Azure Blob Storage (general-purpose v2, hot tier). Azure Blob Storage (general-purpose v2, hot tier) is the most cost-effective solution because it provides native HTTPS access, high throughput for read-heavy workloads, and low-cost storage for small objects like JSON files. The hot tier optimizes for frequent access, and GPv2 accounts support the high request rates needed for millions of small files without premium pricing.

Answer

Azure Files (standard)

Answer

Azure Cosmos DB

Answer

Azure Table Storage

Question 7

You are reviewing the above Azure Policy definition assigned to a storage account. What does this policy enforce?

Accepted Answer

All containers must use a specific customer-managed encryption scope named 'customEncryptionScope' to allow write operations.. The Azure Policy definition uses the 'denyAction' effect to block write operations unless the storage account's containers are configured with a specific customer-managed encryption scope named 'customEncryptionScope'. This enforces that all containers must use that exact encryption scope for write operations, ensuring data is encrypted with a customer-managed key at the container level.

Answer

Containers can be written to only if they use the default encryption scope.

Answer

Write operations are allowed only when encryption scope is not specified.

Answer

Reading from containers is denied unless a specific encryption scope is used.

Question 8

You are designing a disaster recovery solution for a SQL Server database hosted on an Azure VM. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 1 hour. Which strategy should you recommend?

Accepted Answer

Use Azure SQL Managed Instance with failover groups.. Azure SQL Managed Instance with failover groups provides automated, synchronous or asynchronous replication of the database to a secondary region, enabling a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour. The failover group handles automatic or manual failover at the instance level, ensuring minimal data loss and rapid recovery without complex manual log shipping or backup restoration.

Answer

Configure log shipping to a secondary VM in another region.

Answer

Use Azure Backup to back up the database every 5 minutes.

Answer

Replicate the VM using Azure Site Recovery with 5-minute replication.

Question 9

You need to design a storage solution for a global e-commerce application that requires low-latency access to product catalog data across multiple Azure regions. The data is read-heavy and updates are rare. Which service should you use for the primary data store?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it provides globally distributed, multi-region writes and reads with turnkey data replication and guaranteed single-digit-millisecond latency at the 99th percentile. Its multi-homing API and automatic failover capabilities make it ideal for a read-heavy, rarely updated global e-commerce catalog that requires low-latency access across multiple Azure regions.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Table Storage

Answer

Azure Redis Cache

Question 10

You deploy the above ARM template. The deployment succeeds. However, you cannot access the storage account from the Azure portal. What is the most likely reason?

Accepted Answer

The network ACLs deny all traffic by default, and no allow rules are configured.. The ARM template likely includes a network ACL configuration that, by default, denies all traffic. Without explicit allow rules for the Azure portal's IP ranges or the 'Allow trusted Microsoft services' exception, the portal cannot reach the storage account's management endpoints, resulting in an inability to access it from the portal despite a successful deployment.

Answer

The storage account is configured to require HTTPS traffic only.

Answer

The minimum TLS version is set to TLS 1.2, which is not supported by the portal.

Answer

The encryption key source is set to Microsoft.Storage, which prevents portal access.

Question 11

Your company uses Azure SQL Database and needs to retain backups for 7 years for compliance. Which backup retention policy should you configure?

Accepted Answer

Configure long-term retention (LTR) backup policy.. Azure SQL Database's automated backup retention is limited to a maximum of 35 days, which is insufficient for a 7-year compliance requirement. Long-term retention (LTR) allows you to retain full database backups for up to 10 years by storing them in separate Azure Blob Storage containers. Therefore, configuring an LTR backup policy is the correct solution for meeting a 7-year retention mandate.

Answer

Increase automated backup retention to 7 years.

Answer

Configure point-in-time restore backup retention for 7 years.

Answer

Enable geo-redundant backups.

Question 12

Which TWO options are valid ways to enforce data residency in Azure Storage to ensure data does not leave a specific Azure region?

Accepted Answer

Use Azure Policy to deny storage accounts with geo-redundant storage (GRS) or read-access geo-redundant storage (RA-GRS).. Azure Policy can enforce data residency by denying the creation of storage accounts that use geo-redundant storage (GRS) or read-access geo-redundant storage (RA-GRS), as these replication options replicate data to a paired secondary region. By applying a policy that blocks these SKUs, you ensure that all storage account data remains within a single Azure region, meeting data residency requirements.

Answer

Use Azure Data Lake Storage Gen2 with hierarchical namespace.

Answer

Enable Azure Front Door with caching.

Answer

Use read-access geo-redundant storage (RA-GRS).

Question 13

Which THREE considerations are important when designing a data archiving solution for Azure Storage to optimize costs?

Accepted Answer

Consider early deletion penalties for data moved to archive tier.. Azure Archive tier has a minimum storage duration of 180 days; deleting or moving data before that incurs an early deletion penalty equal to the cost of the remaining days. This is critical for cost optimization as it prevents unexpected charges from short-lived data.

Answer

Use the hot tier for all data to ensure high performance.

Answer

Use geo-redundant storage (GRS) for all archive data.

Question 14

Which TWO Azure services provide native support for change data capture (CDC) to stream database changes to other systems?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB provides native change feed support, which is a persistent, ordered log of changes (inserts, updates, deletes) that can be streamed to downstream systems via the Change Feed processor or Azure Functions. This makes it a correct answer for change data capture (CDC) scenarios.

Answer

Azure Table Storage

Answer

Azure Cache for Redis

Answer

Azure Synapse Link for Azure Cosmos DB

Question 15

Which THREE features are available in Azure Files premium tier that are not available in standard tier?

Accepted Answer

Higher IOPS (up to 100,000 per share). Azure Files premium tier is backed by SSDs, providing higher IOPS (up to 100,000 per share), lower latency (single-digit milliseconds), and SMB Multichannel support for enhanced throughput and resilience. These features are not available in the standard tier. NFS v4.1 is also supported only on premium, but the question asks for exactly three features, and the most commonly cited exclusive features are higher IOPS, lower latency, and SMB Multichannel. Azure File Sync is available in both tiers.

Answer

Support for NFS v4.1 protocol

Answer

Azure File Sync integration