AZ-305 Hard Questions — 25 Difficult Questions

Question 1

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center connected via ExpressRoute. They need to implement a hub-and-spoke topology where a hub VNet hosts shared network virtual appliances (NVAs) for traffic inspection. All traffic between spokes and between spokes and on-premises must be routed through the hub. The company wants to minimize the administrative overhead of configuring and maintaining routing. Which Azure solution should they implement?

Accepted Answer

Use Azure Virtual WAN with a secured virtual hub.. Azure Virtual WAN with a secured virtual hub is the correct choice because it provides a managed hub-and-spoke topology with built-in routing, eliminating the need for manual user-defined routes (UDRs) and route tables. The secured virtual hub includes Azure Firewall for traffic inspection, and all inter-spoke and on-premises traffic is automatically routed through the hub via the Virtual WAN routing engine, which uses the Border Gateway Protocol (BGP) to propagate routes dynamically. This minimizes administrative overhead by centralizing routing and security management.

Answer

Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.

Answer

Create a single large VNet and use network security groups (NSGs) to isolate traffic.

Answer

Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.

Question 2

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

Accepted Answer

Peer each spoke VNet with the hub VNet. B is correct because VNet peering is required to establish connectivity between the spoke VNets and the hub VNet, enabling traffic to flow through the central Azure Firewall. Without peering, the spoke VNets would be isolated and unable to route traffic to the hub. C is correct because a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP ensures that all outbound internet traffic from spoke subnets is forced through the firewall for inspection and control.

Answer

Enable public IP addresses on all workload VMs

Answer

Deploy a NAT gateway in every spoke subnet

Question 3

A company has multiple Azure subscriptions and wants to enforce that all administrators must use multi-factor authentication (MFA) when accessing the Azure portal. They also want to monitor and report on any policy changes that affect this enforcement. Which combination of Azure services should they use?

Accepted Answer

Microsoft Entra ID Conditional Access policy to require MFA for Azure management and Azure Monitor with Log Analytics for monitoring.. Option B is correct because Microsoft Entra ID Conditional Access policies can enforce MFA specifically for Azure management (including the Azure portal), and Azure Monitor with Log Analytics provides the monitoring and reporting of policy changes via the Azure Activity Log. This combination directly addresses both requirements: enforcing MFA for administrators and auditing changes to the Conditional Access policy itself.

Answer

Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.

Answer

Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.

Answer

Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.

Question 4

A company has multiple Azure virtual networks (VNets) spread across three Azure regions (West US, East US, and West Europe). They also have an on-premises network connected to East US via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. They require centralized management of routing and the ability to enforce security policies such as forcing all internet-bound traffic from any VNet to pass through a central firewall in East US. Which Azure solution should they implement?

Accepted Answer

Azure Virtual WAN with a secured hub in East US.. Azure Virtual WAN with a secured hub in East US provides a centralized hub-and-spoke architecture that connects all VNets and the on-premises network via ExpressRoute. The secured hub includes Azure Firewall, enabling forced tunneling of all internet-bound traffic from any VNet through the central firewall in East US, while Virtual WAN automatically manages routing between all spokes and the on-premises network.

Answer

VNet peering between all VNets and use route tables for forced tunneling.

Answer

ExpressRoute Global Reach with VNet peering to connect all VNets.

Answer

VPN gateways with BGP to connect all VNets.

Question 5

A company runs large-scale analytics workloads using Apache Hadoop and Spark. They need a cloud storage solution that is fully compatible with the Hadoop Distributed File System (HDFS) and provides unlimited storage with high throughput for parallel processing. They also want to take advantage of tiered storage to reduce costs for older data. Which Azure data service should they use?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with Azure Blob Storage, providing full HDFS compatibility. This allows Apache Hadoop and Spark workloads to use the `wasbs://` or `abfss://` driver for unlimited storage and high throughput parallel processing, while also supporting tiered storage (hot, cool, archive) to reduce costs for older data.

Answer

Azure Blob Storage

Answer

Azure Files

Answer

Azure Disk Storage

Question 6

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to implement a solution that automatically detects identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via API. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. It provides risk event reports and integrates with SIEM systems via the Microsoft Graph API, enabling automated risk data export for centralized monitoring.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Entitlement Management

Question 7

A company is deploying a multi-tier web application on Azure. The web tier must be accessible from the internet. The application tier and database tier must be isolated within the virtual network and not directly accessible from the internet. The solution must provide SSL termination, URL-based routing, and Web Application Firewall (WAF) capabilities. Which Azure service should they use to expose the web tier?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer-7 load balancer that provides SSL termination, URL-based routing, and a built-in Web Application Firewall (WAF). It can expose the web tier to the internet while keeping the application and database tiers isolated within the virtual network, as it routes traffic to backend pools using HTTP/HTTPS rules without exposing those backends directly.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 8

A company ingests millions of IoT events per second from sensors around the world. Each event is a JSON message with timestamp, device ID, and readings. They need to support real-time analytics dashboards and also store all raw data for long-term historical analysis. They want to minimize operational overhead. Which Azure data storage solution should they recommend?

Accepted Answer

Azure Event Hubs with Capture to Azure Data Lake Storage.. Azure Event Hubs is designed for high-throughput data ingestion, capable of handling millions of events per second. By enabling the Capture feature, data is automatically and durably persisted to Azure Data Lake Storage in Avro format, providing a serverless, low-latency pipeline for real-time dashboards while storing raw data for long-term analytics. This minimizes operational overhead by eliminating the need to manage separate ingestion and storage infrastructure.

Answer

Azure Data Lake Storage Gen2 for all data.

Answer

Azure Cosmos DB for both real-time and historical data.

Answer

Azure Time Series Insights (TSI) Standard.

Question 9

A company is building a petabyte-scale data lake for analytics. They need a storage solution that supports a hierarchical namespace, POSIX-like permissions (ACLs), and is optimized for big data analytics workloads using Apache Spark and Hive. The data must be accessible over the Azure Blob Storage API. Which Azure data service should they use?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and is natively optimized for big data analytics workloads like Apache Spark and Hive. It exposes data through the Azure Blob Storage API, meeting all stated requirements for petabyte-scale analytics.

Answer

Azure Blob Storage (with flat namespace)

Answer

Azure NetApp Files

Answer

Azure HPC Cache

Question 10

A company runs a mission-critical SQL Server database on an Azure virtual machine using SQL Server Standard Edition. They need a disaster recovery solution that replicates the database to a secondary Azure region with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 1 hour. The solution must support non-disruptive disaster recovery drills. The company cannot modify the SQL Server configuration or use Always On features due to licensing constraints. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) replicates the entire VM (including the SQL Server database) to a secondary Azure region, meeting the RPO of 15 minutes and RTO of 1 hour. It supports non-disruptive disaster recovery drills by allowing test failovers in an isolated network without affecting the production environment. ASR does not require any changes to SQL Server configuration or licensing, as it operates at the hypervisor level using continuous replication.

Answer

SQL Server log shipping to a VM in the secondary region

Answer

Azure Backup with cross-region restore

Answer

Azure SQL Database geo-replication

Question 11

A company runs a critical multi-tier application on Azure VMs. The application includes a database tier that requires recovery across multiple VMs at the same point in time. The company uses Azure Site Recovery (ASR) for disaster recovery to a secondary region. The recovery point objective (RPO) is 15 minutes and the recovery time objective (RTO) is 1 hour. The database VMs have a high data change rate, and the company wants to minimize replication costs. Which combination of ASR configurations should they implement?

Accepted Answer

Use multi-VM consistency groups and set the replication frequency to 15 minutes.. Option A is correct because multi-VM consistency groups in Azure Site Recovery ensure that all VMs in the group are recovered to the same crash-consistent point in time, which meets the requirement for cross-VM recovery. Setting the replication frequency to 15 minutes aligns with the 15-minute RPO while minimizing replication costs by avoiding more frequent replication (e.g., 5 minutes) that would increase bandwidth and storage costs.

Answer

Enable application-consistent recovery for all VMs and use ExpressRoute.

Answer

Use standard recovery plans and default replication policy.

Answer

Configure a single recovery plan with manual failover and use Premium SSD managed disks.

Question 12

A company runs a critical application on Azure SQL Database in the West US region. They need a disaster recovery solution with an RPO of 5 seconds and an RTO of 1 hour. They also need to be able to perform patching and maintenance on the primary without downtime. Which configuration should they implement?

Accepted Answer

Active geo-replication with auto-failover group. Active geo-replication with auto-failover group meets the RPO of 5 seconds (typically under 5 seconds for active geo-replication) and RTO of 1 hour (auto-failover groups can fail over in minutes). It also supports patching and maintenance on the primary without downtime by failing over to a secondary replica during planned maintenance, leveraging the continuous data synchronization between primary and secondary databases in different Azure regions.

Answer

Azure SQL Database backup to geo-redundant storage

Answer

Azure SQL Database with zone-redundant configuration

Answer

Azure SQL Database with failover group using manual failover

Question 13

A globally distributed application requires multi-region writes to a NoSQL database and must tolerate regional write outages. Which Azure service capability should be selected?

Accepted Answer

Azure Cosmos DB multi-region writes. Azure Cosmos DB multi-region writes is the correct choice because it provides active-active replication across multiple Azure regions, enabling writes to be accepted in any configured region and automatically replicated. This design ensures that if one region experiences a write outage, the application can continue writing to other regions without interruption, meeting the requirement for multi-region writes and regional write outage tolerance.

Answer

Azure Table Storage RA-GRS

Answer

Azure SQL Database serverless only

Answer

Azure Files geo-redundant storage

Question 14

A SaaS application must allow external partner users to sign in with their own organization credentials while the company controls application access. What should be used?

Accepted Answer

Microsoft Entra External ID/B2B collaboration with Conditional Access. Microsoft Entra External ID (formerly Azure AD B2B) enables external partner users to sign in using their own organization's credentials (their existing Azure AD or Microsoft account) while the company retains control over application access. By combining B2B collaboration with Conditional Access policies, the company can enforce MFA, device compliance, or location-based controls on guest users without managing their identities or passwords.

Answer

Create local cloud-only accounts for every partner user

Answer

Share one account per partner company

Answer

Use Azure DNS private zones

Question 15

A company stores terabytes of archival data that must be retained for 10 years per regulatory requirements. The data is accessed infrequently (once or twice per year) and retrieval latency of up to 5 hours is acceptable. The company wants the lowest storage cost. They also need to ensure data is encrypted at rest and immutability to prevent deletion or modification during the retention period. Which Azure storage solution should they choose?

Accepted Answer

Azure Blob Storage with Archive tier and immutability policy (time-based retention). Option C is correct because Azure Blob Storage's Archive tier offers the lowest storage cost for infrequently accessed data, and the immutability policy with time-based retention provides WORM (Write Once, Read Many) compliance to prevent deletion or modification for the required 10-year period. The 5-hour retrieval latency is acceptable for archival data accessed once or twice per year, and encryption at rest is automatically enabled for all Azure Blob Storage tiers.

Answer

Azure Blob Storage with Hot tier and lifecycle management to Archive tier with WORM policy

Answer

Azure Blob Storage with Cool tier and lifecycle management to Archive tier with legal hold

Answer

Azure Files with premium tier and soft delete

Question 16

You are designing an identity governance solution for a multinational company. The company uses Microsoft Entra ID and has a requirement to automatically remove user access to critical SaaS applications when the user leaves the organization or changes roles. You need to ensure that the access removal is audited and can be reversed within 30 days if needed. What should you implement?

Accepted Answer

Microsoft Entra Access Reviews with automatic removal and a grace period. Microsoft Entra Access Reviews allow you to automatically remove user access to SaaS applications when a user leaves or changes roles, with a configurable grace period (up to 30 days) for reversal. This meets the audit and reversal requirements because Access Reviews provide a full audit trail of decisions and can automatically revoke access, while the grace period allows administrators to restore access within the specified timeframe.

Answer

Conditional Access policies to block access for inactive users

Answer

Azure Automation runbooks to delete user accounts upon termination

Answer

Microsoft Entra Privileged Identity Management (PIM) to require approval for access assignments

Question 17

Your organization has a hybrid identity infrastructure with Microsoft Entra ID and on-premises Active Directory. You plan to implement Microsoft Entra ID Protection to detect and respond to identity risks. You need to ensure that risky sign-ins from anonymous IP addresses are automatically blocked, while still allowing legitimate users to self-remediate. What should you configure?

Accepted Answer

Configure a Conditional Access policy to block sign-ins from anonymous IP addresses and enable user risk policy for self-remediation. Option C is correct because it combines a Conditional Access policy to block sign-ins from anonymous IP addresses with a user risk policy that allows legitimate users to self-remediate by performing a password change. This ensures that high-risk sign-ins are automatically blocked while users can still recover their accounts without administrative intervention.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to block access for high risk

Answer

Use the Identity Protection dashboard to manually review and block risky sign-ins

Answer

Configure a user risk policy to require password change for high risk users

Question 18

Your company has multiple Azure subscriptions managed by a management group. You need to enforce that all resources are deployed in the West US region only. Additionally, you must allow a specific resource group in the production subscription to be deployed in East US. What should you configure?

Accepted Answer

Assign a policy at the management group level that denies all locations except West US, and create a policy exemption for the specific resource group.. Azure Policy can be assigned at the management group level with a deny effect to restrict locations. To allow exceptions, you can create an exclusion by specifying the resource group as an exemption or by using a policy assignment at a lower scope with a different effect. The best practice is to use policy exemptions for specific RGs.

Answer

Assign a policy at the management group level that denies all locations except West US, and assign a separate policy at the subscription level that allows East US.

Answer

Assign a policy at each subscription level allowing only West US, and grant the resource group owner role to bypass.

Answer

Use Azure Blueprints to assign a policy at the management group and then edit the blueprint for the exception.

Question 19

Refer to the exhibit. You are analyzing a deployment of a Custom Script Extension on an Azure VM. The extension fails to run. What is the most likely cause?

Accepted Answer

The 'protectedSettings' property is misconfigured.. The Custom Script Extension on Azure VMs requires the `commandToExecute` parameter to be placed in the `protectedSettings` property when the script URL or command contains sensitive information (e.g., storage account keys). If `commandToExecute` is incorrectly placed in the `publicSettings` property instead, or if the `protectedSettings` JSON structure is malformed (e.g., missing the required `commandToExecute` key or using an incorrect casing), the extension will fail to run because it cannot parse the execution command. This is a common misconfiguration that causes the extension to report a failure status without executing the script.

Answer

The VM agent is not installed.

Answer

The VM has no outbound internet connectivity.

Answer

The extension type is incorrect.

Question 20

Which THREE conditions should be met to implement a successful Azure landing zone for a new enterprise subscription? (Choose three.)

Accepted Answer

A management group hierarchy that separates environments.. A management group hierarchy that separates environments (e.g., production, non-production, and management) is a core design principle of an Azure landing zone. It enables policy inheritance, role-based access control (RBAC) isolation, and cost tracking across different workloads, aligning with the Cloud Adoption Framework's governance best practices.

Answer

A dedicated Azure Active Directory tenant.

Answer

Microsoft Sentinel enabled for security monitoring.