AZ-305 Timed Practice Test 4 — 10 Questions

Question 1

A database workload has an RPO of 15 minutes and an RTO of 4 hours. Cost is more important than near-zero data loss. Which design is usually more appropriate than synchronous multi-region replication?

Accepted Answer

Use scheduled backups or asynchronous replication aligned to the RPO/RTO.. Option A is correct because the workload's RPO of 15 minutes and RTO of 4 hours, combined with a cost-sensitive requirement that deprioritizes near-zero data loss, makes synchronous multi-region replication overkill. Scheduled backups (e.g., every 15 minutes using Azure SQL Database automated backups with point-in-time restore) or asynchronous replication (e.g., Azure SQL Database active geo-replication with a recovery point objective of up to 5 seconds, but here we can tune it to meet 15 minutes) provide sufficient protection at a lower cost, avoiding the latency and expense of synchronous replication across regions.

Answer

Use synchronous replication across every Azure region.

Answer

Run the database on a single VM with no backups.

Answer

Use a public DNS CNAME only.

Question 2

A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is a managed networking service that aggregates branch, VPN, and ExpressRoute connectivity into a single hub-and-spoke architecture. It automatically handles routing between branches and Azure, supports any-to-any connectivity, and integrates natively with ExpressRoute and VPN gateways, making it the correct choice for a scalable, managed solution that simplifies network architecture.

Answer

Azure Virtual Network

Answer

Azure ExpressRoute

Answer

Azure VPN Gateway

Question 3

A company deploys a containerized microservices application on Azure Kubernetes Service (AKS). They need to expose the application to the internet with TLS termination and provide a single endpoint for multiple services. The solution must also include a Web Application Firewall (WAF). Which Azure service should they use as the ingress controller?

Accepted Answer

Azure Application Gateway with WAF. Azure Application Gateway with WAF is the correct choice because it is a regional, layer-7 load balancer that can act as an ingress controller for AKS. It provides TLS termination at the gateway and integrates a Web Application Firewall (WAF) to protect against common web exploits. This allows a single public endpoint to route traffic to multiple microservices within the AKS cluster based on URL paths or host headers.

Answer

Azure Front Door with WAF

Answer

Azure Load Balancer with TLS termination

Answer

Azure Traffic Manager with health probes

Question 4

A company deploys a web application on multiple Azure VMs in a single region. They need to distribute incoming HTTP and HTTPS traffic across the VMs, offload SSL/TLS termination, and maintain session persistence (sticky sessions) so that all requests from a user session go to the same backend VM. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a Layer 7 load balancer that can distribute HTTP/HTTPS traffic, offload SSL/TLS termination, and support session persistence via cookie-based affinity (sticky sessions). These capabilities directly match the requirements, making it the correct choice.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 5

A company backs up their Azure VMs using Azure Backup. They need to meet compliance that requires backups to be stored in a separate geographic region. Additionally, they want to be able to restore the entire VM to that secondary region in case of a regional disaster. What should they configure?

Accepted Answer

Use a Recovery Services vault with Geo-Redundant Storage (GRS) and enable cross-region restore. Option B is correct because Azure Backup with a Recovery Services vault using Geo-Redundant Storage (GRS) replicates backup data to a paired secondary region, meeting the compliance requirement for geographic separation. Enabling cross-region restore allows the entire VM to be restored in that secondary region during a regional disaster, as the backup data is already available there.

Answer

Use a Recovery Services vault with Locally Redundant Storage (LRS) and enable cross-region restore

Answer

Use Azure Site Recovery to replicate the entire VM to the secondary region

Answer

Manually copy backup snapshots to a storage account in the secondary region

Question 6

A company has deployed several Azure VMs that do not have public IP addresses. Administrators need to securely connect to these VMs using RDP and SSH from the internet over a browser without deploying a jump box or managing VPN connections. The solution must use Microsoft Entra ID authentication for single sign-on. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS, without requiring public IP addresses, jump boxes, or VPN connections. It supports Microsoft Entra ID authentication for single sign-on, meeting the requirement for browser-based access with no additional management overhead.

Answer

Azure Jump Box VM

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 7

A company must prevent non-compliant devices from accessing Exchange Online and SharePoint Online. Which design should you recommend?

Accepted Answer

Conditional Access policy requiring a compliant device.. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) can enforce device compliance by integrating with Microsoft Intune. When a policy requires a compliant device, it checks the device's compliance status before granting access to Exchange Online and SharePoint Online, blocking non-compliant devices at the authentication layer. This is the correct design because it directly controls access to these cloud services based on device health.

Answer

Azure Firewall application rule.

Answer

Storage account network rule.

Answer

Resource lock on the Microsoft 365 tenant.

Question 8

A company is migrating on-premises Windows applications that require LDAP, NTLM, or Kerberos authentication to Azure VMs. They want to provide domain services for these applications without deploying and managing domain controllers. Which Azure service should they use?

Accepted Answer

Microsoft Entra ID Domain Services. Microsoft Entra ID Domain Services (formerly Azure AD DS) provides managed domain services such as LDAP, NTLM, and Kerberos authentication without requiring you to deploy, patch, or manage domain controllers. It integrates with your existing Microsoft Entra tenant and supports group policy, domain join, and legacy authentication protocols needed by the on-premises Windows applications being migrated to Azure VMs.

Answer

Microsoft Entra ID

Answer

Active Directory on Azure VMs

Answer

Microsoft Entra ID B2C

Question 9

A company is deploying a multi-tier web application on Azure. The web tier must be accessible from the internet. The application tier and database tier must be isolated within the virtual network and not directly accessible from the internet. The solution must provide SSL termination, URL-based routing, and Web Application Firewall (WAF) capabilities. Which Azure service should they use to expose the web tier?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer-7 load balancer that provides SSL termination, URL-based routing, and a built-in Web Application Firewall (WAF). It can expose the web tier to the internet while keeping the application and database tiers isolated within the virtual network, as it routes traffic to backend pools using HTTP/HTTPS rules without exposing those backends directly.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 10

A company has an on-premises application running on physical servers with various operating systems. They want to use Azure as a disaster recovery site with an RPO of less than 1 hour and an RTO of less than 4 hours. They need to replicate the servers to Azure and support failover and failback. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback for physical servers and VMs to Azure, meeting the RPO of <1 hour and RTO of <4 hours. It supports heterogeneous operating systems on physical servers and provides continuous replication with recovery points as low as 30 seconds, enabling both planned and unplanned failover with full failback capability.

Answer

Azure Backup (MARS agent)

Answer

Azure Migrate

Answer

Azure File Sync