View Full Microsoft AZ-305 Exam Dumps and Practice Test Dumps

 

Question 121

A company needs to expose a web application globally with low latency and automatic routing to healthy backends. Which Azure service should the architect choose?

1. Azure VPN Gateway
2. Azure Front Door
3. Azure Load Balancer
4. Azure Bastion

Correct Answer: 2

Explanation

Azure Front Door provides global HTTP and HTTPS application delivery with intelligent routing between backend endpoints. It can direct users to healthy application instances and improve performance by using Microsoft’s global edge network. Front Door also supports features such as caching, TLS termination, and Web Application Firewall integration. Azure Load Balancer is primarily used for regional Layer 4 traffic distribution, while VPN Gateway provides connectivity and Bastion provides secure administrative access. Front Door is therefore the appropriate choice for globally distributed web applications requiring intelligent routing and improved user performance.

Question 122

Which Azure service can store frequently accessed data in memory to reduce database load?

1. Azure Cache for Redis
2. Azure Data Factory
3. Azure Event Grid
4. Azure Blob Storage

Correct Answer: 1

Explanation

Azure Cache for Redis provides a managed in-memory caching platform that can store frequently accessed application data. By retrieving information from memory instead of repeatedly querying a database, applications can achieve lower latency and reduce database workload. Redis can also support distributed session state and other high-performance application scenarios. Architects often place a cache between application services and a database when repeated reads create performance pressure. Blob Storage is intended for object storage, Data Factory handles data integration, and Event Grid distributes events rather than acting as a general-purpose application cache.

Question 123

Which Azure storage option provides the lowest-cost storage for data that is rarely accessed and can tolerate retrieval delays?

1. Hot tier
2. Cool tier
3. Archive tier
4. Premium tier

Correct Answer: 3

Explanation

The Archive tier is designed for long-term storage of blob data that is rarely accessed and can tolerate retrieval delays. It offers lower storage costs compared with Hot and Cool tiers, making it suitable for historical records, compliance information, and backup-related data that does not require immediate access. Archived data must be rehydrated before normal access, so it should not be selected for active application workloads. The Cool tier is better when data is infrequently accessed but still needs faster availability. Architects should select tiers according to access frequency and recovery requirements.

Question 124

Which approach best protects an application against a complete Azure region failure?

1. Availability Zones only
2. Multiple Azure regions
3. Larger virtual machines
4. Locally redundant storage

Correct Answer: 2

Explanation

Deploying an application across multiple Azure regions provides protection against a complete regional failure. A multi-region architecture can replicate application components and data and use traffic-routing services to redirect users to a healthy region. Availability Zones provide protection from failures within one region but do not protect against an entire region becoming unavailable. Locally redundant storage also provides protection within a limited physical location. Architects should design the secondary region according to business requirements, including RTO, RPO, failover strategy, data consistency, operational complexity, and cost.

Question 125

Which Azure feature can automatically remove old blob data according to defined rules?

1. Azure Storage lifecycle management
2. Azure Private Link
3. Azure Network Watcher
4. Azure API Management

Correct Answer: 1

Explanation

Azure Storage lifecycle management allows organizations to automatically manage blob data according to predefined rules. Policies can move blobs between Hot, Cool, and Archive tiers or delete data after a specified period. This helps reduce storage costs and maintain appropriate data retention practices without requiring applications to perform these operations manually. Lifecycle rules can be based on factors such as the age of blobs or their last modification. Architects should carefully define retention policies to avoid deleting information that is still required for business, compliance, or recovery purposes.

Question 126

A solution requires private access to Azure Storage without sending traffic through a public endpoint. What should the architect use?

1. Service Bus
2. Private Endpoint
3. Traffic Manager
4. Public IP

Correct Answer: 2

Explanation

An Azure Private Endpoint provides a private IP address within a virtual network for accessing supported Azure services. When configured for Azure Storage, applications can communicate with the storage account through private connectivity rather than relying on its public endpoint. Private DNS can also be configured to ensure the normal service hostname resolves to the private IP address. This approach reduces public exposure and supports network-isolated architectures. Traffic Manager handles DNS-based traffic routing, Service Bus provides messaging, and a public IP would not satisfy the requirement for private access.

Question 127

Which metric specifies the maximum acceptable time for restoring a failed service?

1. RPO
2. RTO
3. SLA
4. Throughput

Correct Answer: 2

Explanation

Recovery Time Objective, or RTO, defines how quickly a service must be restored after a disruption. A workload with a short RTO requires a recovery architecture capable of bringing applications back online quickly. This may involve standby environments, automated failover, replicated infrastructure, or other recovery mechanisms. RPO is different because it defines the maximum acceptable amount of data loss. Architects should determine RTO based on business impact and then choose an appropriate disaster recovery strategy. Lower RTO requirements generally increase architectural complexity and cost.

Question 128

Which Azure service provides a managed firewall for centralized network security?

1. Azure Firewall
2. Azure Monitor
3. Azure DNS
4. Azure Advisor

Correct Answer: 1

Explanation

Azure Firewall is a managed, stateful network security service designed for centralized traffic filtering and protection. It can control network traffic between virtual networks, on-premises environments, and the internet using configured rules. Azure Firewall can be deployed in a hub network and used by multiple spoke networks in a hub-and-spoke architecture. It provides more centralized security capabilities than individual network security rules. Azure Monitor focuses on monitoring, Azure DNS handles name resolution, and Advisor provides recommendations. Azure Firewall is therefore appropriate for centralized network traffic control.

Question 129

Which database is best suited for a globally distributed application using a NoSQL data model?

1. Azure SQL Database
2. Azure Cosmos DB
3. SQL Server on Azure VM
4. Azure Database for MySQL

Correct Answer: 2

Explanation

Azure Cosmos DB is designed for globally distributed applications that require low-latency access and scalable NoSQL data storage. It supports automatic distribution of data across Azure regions and provides configurable consistency options. Architects can select an appropriate partitioning strategy to support large-scale throughput and geographic distribution. Relational services such as Azure SQL Database and SQL Server on Azure VMs are more appropriate when relational schemas, transactions, and SQL capabilities are central requirements. Cosmos DB is particularly suitable for applications that need global distribution combined with flexible data models and elastic scalability.

Question 130

A company wants to control access to Azure resources using the principle of least privilege. Which service should be used?

1. Azure RBAC
2. Azure DNS
3. Azure Cache for Redis
4. Azure CDN

Correct Answer: 1

Explanation

Azure role-based access control, or Azure RBAC, allows organizations to assign permissions to users, groups, managed identities, and service principals based on defined roles. Architects can use built-in or custom roles to provide only the permissions required for specific tasks. This supports the principle of least privilege and reduces the risk associated with excessive access. RBAC assignments can be scoped at management group, subscription, resource group, or resource levels. Services such as DNS and Redis do not provide the centralized Azure resource authorization model required for this purpose.

Question 131

Which architecture is most suitable for an application that must remain available during a single availability zone failure?

1. Deploy all instances in one zone
2. Deploy instances across multiple availability zones
3. Use only one virtual machine
4. Use only LRS storage

Correct Answer: 2

Explanation

Deploying application instances across multiple availability zones helps protect the workload from a failure affecting one zone. Each zone is a separate physical location within an Azure region, with independent power, cooling, and networking. If one zone becomes unavailable, application instances in other zones can continue serving users when the architecture is properly configured. A single-zone deployment creates a larger failure domain. Architects should also ensure that supporting components, data services, load balancing, and storage are designed for the required level of zone resilience rather than relying on application replication alone.

Question 132

Which Azure service is designed to securely store application secrets, certificates, and encryption keys?

1. Azure Key Vault
2. Azure Event Hubs
3. Azure Traffic Manager
4. Azure Data Factory

Correct Answer: 1

Explanation

Azure Key Vault provides centralized and secure management of secrets, cryptographic keys, and certificates. Applications can retrieve required secrets from Key Vault rather than embedding them in source code or configuration files. Access can be controlled through Microsoft Entra ID and Azure RBAC or supported access policies. Key Vault can also support encryption-related operations and certificate management. Architects should combine Key Vault with managed identities where possible to reduce credential exposure. Event Hubs and Data Factory address data processing and integration, while Traffic Manager provides DNS-based traffic routing.

Question 133

Which Azure service is most appropriate for publishing and securing APIs for multiple consumers?

1. Azure API Management
2. Azure Queue Storage
3. Azure Backup
4. Azure Files

Correct Answer: 1

Explanation

Azure API Management provides a managed platform for publishing, securing, monitoring, and governing APIs. It can act as an API gateway between clients and backend services while enforcing policies such as authentication, authorization, rate limiting, transformation, and request validation. It also provides capabilities for API documentation and subscription management. This makes it useful when an organization has multiple API consumers and needs centralized control over how APIs are exposed. Queue Storage provides asynchronous messaging, Backup provides recovery services, and Azure Files provides managed file shares.

Question 134

Which option provides the best disaster recovery protection for critical data stored in Azure Blob Storage?

1. LRS
2. ZRS
3. GRS
4. Premium SSD

Correct Answer: 3

Explanation

Geo-redundant storage, or GRS, replicates Azure Storage data to a secondary region, providing protection against a major regional disaster. The secondary copy is maintained separately from the primary region, allowing the organization to recover storage data if the primary region becomes unavailable. ZRS protects against failures within a region by replicating across availability zones, while LRS provides redundancy within a more limited physical scope. Architects should select GRS when geographic disaster recovery is required and should also evaluate whether the workload needs read access to the secondary region.

Question 135

Which Azure service can monitor application performance and collect request telemetry?

1. Azure Policy
2. Application Insights
3. Azure Resource Manager
4. Azure Firewall

Correct Answer: 2

Explanation

Application Insights is an Azure Monitor feature that provides application performance monitoring and telemetry. It can collect information about requests, dependencies, exceptions, response times, availability, and other application behavior. This information helps teams identify performance problems and application failures. Application Insights can also support distributed tracing and diagnostic analysis for supported workloads. Azure Policy manages governance, Resource Manager handles resource deployment and management, and Azure Firewall provides network security. Architects should include application monitoring as part of the overall observability strategy for production workloads.

Question 136

A company has many Azure subscriptions and wants consistent governance across them. What should the architect use?

1. Management Groups
2. Availability Sets
3. Azure Cache for Redis
4. Load Balancer

Correct Answer: 1

Explanation

Azure Management Groups provide a hierarchical structure for organizing multiple Azure subscriptions. Governance controls such as Azure Policy and role assignments can be applied at a management group level and inherited by subscriptions underneath it. This makes management groups useful for organizations with multiple departments, environments, or business units that need consistent governance. They can reduce administrative effort by allowing common controls to be defined centrally. Architects should design the hierarchy carefully so that policies and permissions align with organizational requirements without creating unnecessary administrative complexity.

Question 137

Which Azure service provides asynchronous event routing from publishers to subscribers?

1. Azure Event Grid
2. Azure SQL Database
3. Azure VPN Gateway
4. Azure Managed Disks

Correct Answer: 1

Explanation

Azure Event Grid is a managed event-routing service designed to deliver notifications when events occur. Publishers can send events, and subscribed consumers can react to those events without requiring tightly coupled communication between systems. It is useful for scenarios such as reacting to blob creation, resource changes, or application events. Event Grid is generally suited to event notification rather than durable enterprise messaging. Service Bus is more appropriate when applications require features such as queues, durable messages, transactions, or advanced message-processing capabilities.

Question 138

Which purchasing option can reduce Azure costs for predictable long-term workloads?

1. Pay-as-you-go only
2. Azure reservations
3. Temporary resources
4. Public IP addresses

Correct Answer: 2

Explanation

Azure reservations can reduce costs when an organization commits to using eligible Azure resources for a defined term. They are particularly useful for predictable workloads where resource usage is expected to remain relatively consistent. Instead of paying the full standard consumption rate, the organization receives discounted pricing in exchange for the commitment. Architects should evaluate workload stability before choosing reservations because they are most beneficial when capacity requirements are predictable. For workloads with highly variable or uncertain usage, other cost-management approaches may be more appropriate.

Question 139

A web application requires protection against malicious HTTP requests such as SQL injection and cross-site scripting. Which service should be considered?

1. Azure DDoS Protection
2. Azure Web Application Firewall
3. Azure ExpressRoute
4. Azure Network Watcher

Correct Answer: 2

Explanation

Azure Web Application Firewall, or WAF, helps protect web applications from common application-layer attacks. It can inspect HTTP and HTTPS requests and apply security rules designed to identify malicious traffic such as SQL injection and cross-site scripting. WAF can be integrated with services such as Application Gateway and Azure Front Door depending on the architecture. DDoS Protection focuses on distributed denial-of-service attacks, while ExpressRoute provides private connectivity and Network Watcher provides network troubleshooting tools. WAF is therefore the appropriate security layer for common web application threats.

Question 140

Which Azure service helps architects evaluate recommendations for cost, reliability, security, and performance?

1. Azure Advisor
2. Azure DNS
3. Azure Queue Storage
4. Azure Files

Correct Answer: 1

Explanation

Azure Advisor analyzes Azure deployments and provides personalized recommendations across areas such as cost, security, reliability, performance, and operational efficiency. These recommendations can help architects identify underutilized resources, improve security configurations, address reliability concerns, and optimize workloads. Advisor works with resources already deployed in an Azure environment, making its recommendations based on actual resource configuration and usage information. Azure DNS manages name resolution, Queue Storage provides messaging, and Azure Files provides file shares. Advisor is therefore the appropriate service for reviewing optimization recommendations across an Azure environment.