AZ-305 Hard Questions — 25 Difficult Questions

Question 1

You are designing a governance strategy for an Azure environment that includes multiple subscriptions. The security team requires that all storage accounts must have HTTPS traffic only. Any non-compliant storage account must be automatically remediated. What is the most efficient solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Policy with a DeployIfNotExists effect to enable HTTPS-only traffic. Azure Policy with a DeployIfNotExists effect can automatically remediate non-compliant storage accounts by enabling the 'HTTPS traffic only' property. This approach ensures continuous compliance without manual intervention, meeting the security team's requirement for automatic remediation.

Answer

Create an Azure Blueprint that includes a policy initiative

Answer

Assign a custom RBAC role that denies creation of storage accounts without HTTPS

Answer

Configure Azure Monitor alerts to notify the security team

Question 2

A company is designing a backup strategy for Azure resources. They have the following resources: Azure VMs, Azure SQL Database, and Azure Files shares. They need to meet the following requirements: 1) Backup of VMs must be application-consistent. 2) SQL Database backups must be retained for 10 years. 3) Azure Files backups must support soft delete. Which THREE services or features should they use?

Accepted Answer

Azure Backup. Azure Backup is the correct service for VM backups because it supports application-consistent backups for Windows VMs via Volume Shadow Copy Service (VSS) and for Linux VMs via file-system-consistent snapshots with pre/post-scripts, ensuring that applications are in a consistent state at the time of backup. This directly meets requirement 1.

Answer

Azure Site Recovery

Answer

Azure Policy

Question 3

You have an Azure subscription that contains a virtual network named VNet1. You need to monitor all network security group (NSG) flow logs. Which three components must you enable? (Select THREE.)

Accepted Answer

Azure Network Watcher. Network security group flow logs must be explicitly enabled on the NSG to capture IP traffic data. Without enabling this feature, no flow log data is generated regardless of other components. The question asks which components must be enabled, and enabling NSG flow logs is the direct action that starts logging.

Answer

Log Analytics workspace

Answer

Traffic Analytics

Question 4

Which THREE components are required to implement a disaster recovery solution for Azure Virtual Desktop (AVD) using active-passive model?

Accepted Answer

Configure Azure Files geo-replication for the profile share.. Azure Files geo-redundant storage (GRS) replicates the profile share to a paired secondary region, ensuring profile data is available during a regional outage. This is essential for an active-passive disaster recovery model where the secondary region's AVD host pool must access the same profile data to provide a consistent user experience.

Answer

Deploy AVD host pool in the primary region only.

Answer

Configure Azure Backup for the AVD session hosts.

Question 5

Refer to the exhibit. You deploy this ARM template to create a storage account in the West US region. The business continuity requirement states that if the primary region becomes unavailable, the storage account must be readable within 1 hour. What is the most important limitation of this configuration?

Accepted Answer

The storage account does not support read access in the secondary region, so manual failover is required, which may exceed the 1-hour RTO. The ARM template configures GRS (Geo-Redundant Storage), which replicates data to a secondary region but does not provide read access to that data unless a manual failover is initiated. Without read-access geo-redundant storage (RA-GRS), the storage account cannot be read in the secondary region within 1 hour of a primary region outage, as manual failover requires user intervention and may take longer than the RTO. The business continuity requirement demands readability within 1 hour, which is not guaranteed with standard GRS.

Answer

The storage account uses GRS, which replicates data only to a secondary region within the same geography, not to a different region

Answer

The storage account only supports HTTPS traffic, which blocks replication

Answer

The storage account is configured with the Hot access tier, which prevents failover

Question 6

Which THREE of the following are considerations when designing a storage solution for a high-availability application on Azure?

Accepted Answer

Recovery Point Objective (RPO) and Recovery Time Objective (RTO). RPO and RTO are fundamental design considerations for any high-availability application. RPO defines the maximum acceptable data loss (measured in time), which directly influences the choice of backup frequency and replication type (e.g., synchronous vs. asynchronous). RTO defines the maximum acceptable downtime, which dictates the failover mechanism and infrastructure redundancy (e.g., active-passive vs. active-active). Both metrics must be explicitly defined before selecting a storage redundancy tier or disaster recovery strategy.

Answer

Data encryption at rest using Azure Storage Service Encryption

Answer

Data striping with RAID 0 for performance

Question 7

Which THREE Azure Monitor capabilities can be used to detect and diagnose performance issues in a multi-tier application?

Accepted Answer

Live Metrics Stream in Application Insights. Live Metrics Stream in Application Insights (Option C) provides real-time monitoring of application performance metrics, such as request rates, response times, and failure rates, with sub-second latency. This allows immediate detection of performance issues as they occur, making it ideal for diagnosing live problems in a multi-tier application.

Answer

Azure Monitor Workbooks

Answer

Azure Policy

Question 8

Which THREE should you consider when designing a monitoring solution for a critical application that requires high availability and low latency? (Choose three.)

Accepted Answer

Data volume and associated costs. Monitoring data volume directly impacts cost, especially in Azure Monitor where data ingestion and retention are billed per GB. For a critical application with high availability and low latency, you must balance the granularity of monitoring data against budget constraints to avoid unexpected costs that could compromise operational sustainability.

Answer

Dashboard visual appeal and color scheme

Answer

Custom metric creation for all application counters

Question 9

Which THREE components are required to implement a complete monitoring solution with Azure Monitor? (Choose three.)

Accepted Answer

Alert rules to notify on conditions. Alert rules (C) are a core component of a complete monitoring solution because they define conditions that trigger notifications or automated actions when monitored metrics or log data cross thresholds. Without alert rules, collected data remains passive and cannot proactively inform administrators of issues, making the solution incomplete.

Answer

Application Insights for every application

Answer

Azure Policy assignments

Question 10

Your company is designing a governance strategy for Azure. You need to ensure that all resource groups in a subscription are created with a specific naming convention and mandatory tags. Which THREE services or features should you use together? (Choose three.)

Accepted Answer

Azure Blueprints. Azure Blueprints is correct because it enables the orchestrated deployment of Azure Policy, RBAC, and resource templates as a single composable artifact. By defining a blueprint that includes a policy for naming conventions and mandatory tags, you can enforce these requirements consistently across all resource groups within a subscription or management group hierarchy.

Answer

Azure RBAC

Answer

Resource Locks

Question 11

Which TWO features are part of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. The correct answers are A (Entitlement Management) and E (Access Reviews). Both are core features of Microsoft Entra ID Governance. Entitlement Management enables creation and management of access packages for internal and external users, while Access Reviews automate periodic recertification of group memberships and application access. Option B (Self-service password reset) is a user management feature, not governance. Option C (Conditional Access) is a security policy feature for access control. Option D (Privileged Identity Management) is also a governance feature but is not selected here; it is part of Identity Governance, not Identity Protection.

Answer

Self-service password reset

Answer

Conditional Access

Answer

Privileged Identity Management

Question 12

Which THREE considerations are important when designing a storage solution for Azure Virtual Desktop (AVD) user profiles using FSLogix? (Choose three.)

Accepted Answer

Use Azure Files as the storage solution.. Azure Files is the recommended storage solution for FSLogix profile containers in AVD because it supports SMB protocol, which FSLogix requires for proper locking and concurrent access. It also integrates natively with Azure Active Directory for identity-based access control, eliminating the need for domain-joined storage. This ensures seamless user profile roaming across session hosts with minimal latency when deployed in the same region.

Answer

Use a public endpoint for profile storage.

Answer

Enable geo-redundant storage (GRS) for disaster recovery.

Question 13

Refer to the exhibit. You deploy this ARM template to create an Azure Monitor Workbook. The template deploys successfully. What will the workbook display?

Accepted Answer

CPU utilization averaged over 5-minute intervals.. The ARM template configures an Azure Monitor Workbook to query the `InsightsMetrics` table for the `cpu_usage_percentage` metric, which is collected by Azure Monitor Agent (AMA) at a default granularity of 1 minute. The workbook uses the `avg` aggregation and a time grain of `5m` (5 minutes) in the query, so it displays CPU utilization averaged over 5-minute intervals. The `summarize` operator with `bin(TimeGenerated, 5m)` explicitly groups data into 5-minute buckets, making option B correct.

Answer

CPU utilization averaged over 1-hour intervals.

Answer

Memory utilization over time.

Answer

Disk I/O utilization over time.

Question 14

Which THREE capabilities are provided by Microsoft Entra ID Identity Governance? (Select THREE.)

Accepted Answer

Entitlement management. Microsoft Entra ID Identity Governance is a suite of capabilities designed to help organizations manage and govern access to resources. Entitlement management (A) enables the creation of access packages to automate access requests, approvals, and assignments. Access reviews (B) allow periodic recertification of group memberships and application access to ensure only the right users have access. Privileged Identity Management (C) provides just-in-time privileged access and role activation workflows for Azure AD roles and Azure resources, directly supporting governance of elevated access.

Answer

Conditional Access

Answer

Identity Protection

Question 15

Refer to the exhibit. You are testing a disaster recovery plan for three Azure VMs. The recovery plan in the exhibit is failing during a test failover. VM3 fails to start after failover. What is the most likely cause?

Accepted Answer

VM3 is in a Shutdown group, which means it is not started during failover.. In Azure Site Recovery, a recovery plan can include groups with different startup actions: 'Start' groups initiate VMs during failover, while 'Shutdown' groups are used to sequence the orderly shutdown of VMs during planned failover or to group VMs that should not be started. If VM3 is placed in a 'Shutdown' group, it will not be started during a test failover, causing it to remain off and fail to start. This is the most likely cause given the exhibit shows VM3 in a group that does not trigger startup.

Answer

VM3 is not replicated properly.

Answer

The boot order is incorrect; VM3 should be before VM1.

Answer

The primary and recovery locations are swapped.

Question 16

Your organization has multiple Azure subscriptions and uses Azure Blueprints to enforce governance. You need to design a blueprint that includes role assignments, policy assignments, and resource groups. Which THREE components can be included in an Azure Blueprint? (Choose three.)

Accepted Answer

Role assignments. Azure Blueprints allow you to define a repeatable set of Azure resources that adhere to your organization's standards, patterns, and requirements. Role assignments (B) are a core artifact that can be included to grant specific Azure RBAC roles at the blueprint scope, ensuring consistent access control. Policy assignments (C) are also a native blueprint artifact, enabling you to enforce compliance rules across the environment. ARM templates (E) can be included as an artifact to deploy infrastructure as code, making them a valid component of a blueprint definition.

Answer

Management group

Answer

Subscription

Question 17

A company runs an SAP HANA database on Azure large instances (HLI) in the West US region. The database is critical for business operations. They need a disaster recovery solution with a recovery point objective (RPO) of near zero (seconds) and a recovery time objective (RTO) of less than 30 minutes in the event of a region-wide outage. The solution must automatically replicate data to a secondary region (East US) and support automated failover. Which design should they implement?

Accepted Answer

Configure HANA System Replication (async) between the primary and secondary site, and use a Pacemaker cluster with Azure Load Balancer to enable automated failover. HANA System Replication (async) provides near-zero RPO by continuously replicating log changes to the secondary region, while a Pacemaker cluster with Azure Load Balancer enables automated failover within the required 30-minute RTO. This combination meets the strict RPO/RTO requirements for SAP HANA on Azure Large Instances, as Azure Site Recovery does not support HLI and synchronous replication would introduce unacceptable latency over the West US to East US distance.

Answer

Use Azure Site Recovery to replicate the HANA large instance VMs with a replication frequency of 30 seconds and enable auto-failover

Answer

Schedule HANA database backups every 5 minutes to Azure Blob Storage with geo-redundant storage (GRS), and restore in the secondary region on demand

Answer

Set up HANA System Replication with synchronous mode to the secondary region

Question 18

A global e-commerce company uses Azure Cosmos DB to store its product catalog. The catalog is read-heavy, with users worldwide expecting consistent reads with a 99th percentile latency under 10 ms. Writes to the catalog are performed by a central admin team in one region. The company needs to minimize write latency and cost while ensuring that users always see the same data within a single session. Which Cosmos DB configuration should the company choose?

Accepted Answer

Single-master write region with Session consistency and multiple read regions. Session consistency provides the required 'read your own writes' guarantee within a single session, which ensures users always see the same data during their session without the latency and cost penalties of Strong consistency. Single-master writes minimize write latency by directing all writes to one region (the central admin team's region), while multiple read regions allow global users to read from the nearest region with sub-10 ms latency. This configuration balances cost, performance, and consistency needs for a read-heavy catalog with centralized writes.

Answer

Single-master write region with Strong consistency and multiple read regions

Answer

Multi-master write with Eventual consistency and all regions enabled for writes

Answer

Multi-master write with Strong consistency and two regions

Question 19

A company runs a mission-critical SQL Server database on an Azure virtual machine using SQL Server Standard Edition. They need a disaster recovery solution that replicates the database to a secondary Azure region with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 1 hour. The solution must support non-disruptive disaster recovery drills. The company cannot modify the SQL Server configuration or use Always On features due to licensing constraints. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) replicates the entire VM (including the SQL Server database) to a secondary Azure region, meeting the RPO of 15 minutes and RTO of 1 hour. It supports non-disruptive disaster recovery drills by allowing test failovers in an isolated network without affecting the production environment. ASR does not require any changes to SQL Server configuration or licensing, as it operates at the hypervisor level using continuous replication.

Answer

SQL Server log shipping to a VM in the secondary region

Answer

Azure Backup with cross-region restore

Answer

Azure SQL Database geo-replication

Question 20

A global IoT platform ingests telemetry data from millions of devices. The application requires multi-region writes to support low-latency ingestion from any location. The schema uses JSON documents and fields often vary. The team needs automatic conflict resolution when the same document is updated concurrently from different regions. Additionally, read operations for device commands must use strong consistency, while user-facing dashboard queries can use eventual consistency. Which Azure Cosmos DB configuration should they choose?

Accepted Answer

Azure Cosmos DB with multi-master and per-request consistency override. The scenario requires multi-region writes (multi-master) and strong consistency for device command reads. In Azure Cosmos DB, strong consistency is not available for multi-region write accounts; the highest consistency level for multi-master is bounded staleness. Additionally, per-request consistency override only allows relaxing (weakening) the consistency for a specific request, not strengthening it to a level that the account does not support. Therefore, no configuration listed in the options can meet the strong consistency requirement with multi-master writes. A valid solution would require separate accounts or alternative designs, but this is not represented in the options.

Answer

Azure Cosmos DB with single-master and multiple read regions

Answer

Azure Cosmos DB with multi-master and default strong consistency

Answer

Azure Cosmos DB with multi-master and eventual consistency only