AZ-305 Sample Questions & Answers

A development team is building a new serverless application using Azure Functions. The application needs to store connection strings, API keys, and other secrets securely. The team wants to follow the principle of least privilege and avoid storing secrets in application settings or source code. The Azure Functions must be able to retrieve these secrets at runtime automatically using their identity.

What is the most secure and recommended approach for managing these secrets?

An enterprise is planning to deploy a large number of applications in Azure, organized into multiple subscriptions for different business units. The CIO wants to ensure that all deployed resources comply with corporate standards from the moment they are created. The standards include a mandatory cost center tag, deployment only in specific Azure regions, and the automatic deployment of the Log Analytics agent on all VMs. The solution must be repeatable and version-controlled.

Which Azure service is best suited for defining and assigning this comprehensive package of governance artifacts?

You are designing the storage for a new cloud-native application that will process large volumes of unstructured data, including images and videos. The application requires a hierarchical namespace to manage files in a directory-like structure for big data analytics workloads (e.g., Spark, Databricks). It also needs to be cost-effective and support fine-grained, POSIX-like access control lists (ACLs).

Which Azure Storage solution should you recommend?

A company is designing a global web application with users in North America, Europe, and Asia. The application consists of a web front-end and a set of backend APIs. The company has the following requirements:

• Provide a single, global endpoint for users (e.g., www.contoso.com).
• Route users to the closest Azure region hosting the application to minimize latency.
• Implement a Web Application Firewall (WAF) to protect against common web vulnerabilities.
• Terminate SSL at the edge and manage certificates centrally.

Which Azure service should be used to meet all these requirements?

A company has an Azure SQL Database with a service level objective of General Purpose, Gen5, 8 vCores. The database supports a critical business application. The company's business continuity plan requires a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 30 seconds for regional outages. The plan also requires that the failover process be manageable through a single endpoint for both the primary and secondary databases.

Which feature should you configure to meet these requirements?

A company is deploying a multi-tier application to Azure. The architecture consists of web servers, application servers, and a database. The security team wants to segment the network and control traffic flow between the tiers. They have the following rules:

• Web servers should only be able to communicate with application servers on port 443.
• Application servers should only be able to communicate with the database server on port 1433.
• The database server should not be able to initiate connections to the web or application servers.

You want to implement these rules using the simplest possible mechanism. Which combination of Azure networking components should you use?

You are designing a solution to collect and analyze logs from hundreds of Azure resources, including VMs, App Services, and Storage Accounts. The solution must meet the following requirements:

• Provide a centralized repository for all logs.
• Enable complex log queries using a rich query language.
• Create alerts based on log data patterns.
• Retain logs for 90 days for active analysis and up to 2 years for compliance.

Which two Azure services should you design the solution around? Each correct answer presents part of the solution.

A company is migrating a legacy application to Azure. The application was designed to use Windows Integrated Authentication to authenticate users from an on-premises Active Directory. The company wants to publish this application to remote users over the internet without using a VPN. The remote users should be able to sign in using their Azure AD credentials and experience single sign-on (SSO). The solution must be able to translate the Azure AD-based authentication to the Kerberos-based authentication required by the application.

Which Azure service should be used to meet these requirements?

You are designing a backup strategy for an Azure VM that runs a business-critical database server. The business requires the ability to restore the VM to a specific point in time with minimal data loss. Backups must be application-consistent to ensure the database can be recovered without corruption. The backups should be stored in a separate region for disaster recovery purposes.

Which backup solution should you design?

An organization is building a new application that will be deployed using containers on Azure Kubernetes Service (AKS). The application will consist of numerous microservices. They need to choose a compute node (VM) size for their AKS cluster. The primary goal is to minimize costs while ensuring that if a single node fails, the impact on the overall cluster capacity is minimized. The workloads are not memory or CPU intensive.

Which strategy for selecting VM sizes for the AKS node pools should be recommended?