View Full Microsoft AZ-305 Exam Dumps and Practice Test Dumps

 

Question 341

A company wants to protect a web application from common attacks such as SQL injection and cross-site scripting. Which Azure service should be included in the architecture?

1. Azure Bastion
2. Azure Traffic Manager
3. Azure DDoS Protection
4. Web Application Firewall

Correct Answer: 4

Explanation

Web Application Firewall, or WAF, is designed to protect web applications from common application-layer attacks. It can help detect and block threats such as SQL injection and cross-site scripting by applying managed and custom security rules to HTTP traffic. WAF can be integrated with services such as Azure Application Gateway and Azure Front Door. Azure Bastion provides secure administrative access to virtual machines, Traffic Manager provides DNS-based traffic routing, and DDoS Protection focuses on distributed denial-of-service attacks. Architects should place WAF appropriately in front of internet-facing application endpoints.

Question 342

Which Azure feature allows administrators to prevent accidental deletion of important resources?

1. Azure Policy
2. Resource locks
3. Azure Advisor
4. Azure Monitor

Correct Answer: 2

Explanation

Azure Resource Locks help prevent accidental modification or deletion of important Azure resources. The two primary lock types are ReadOnly and CanNotDelete. A CanNotDelete lock allows authorized users to modify a resource while preventing deletion, whereas a ReadOnly lock restricts modification as well. Locks can be applied at different scopes, including subscriptions, resource groups, and resources. Azure Policy enforces governance rules, Advisor provides recommendations, and Monitor provides observability. Architects should use locks carefully because inherited locks can affect administrative operations and may need to be removed before certain resource actions.

Question 343

An organization needs a centralized governance hierarchy for multiple Azure subscriptions belonging to different business units. What should the architect use?

1. Azure Storage accounts
2. Azure Load Balancer
3. Management groups
4. Availability sets

Correct Answer: 3

Explanation

Azure management groups provide a hierarchical way to organize multiple Azure subscriptions. Policies, role assignments, and governance controls can be applied at the management group level and inherited by child subscriptions and resources. This makes management groups useful for organizations with many subscriptions that need consistent governance across business units, environments, or regulatory boundaries. Storage accounts provide data storage, Load Balancer distributes traffic, and availability sets improve VM availability within a datacenter. Architects should design a management hierarchy that reflects organizational responsibilities while avoiding unnecessarily complex structures.

Question 344

A company has an application running on Azure VMs and wants inbound internet traffic to be distributed across multiple VM instances while supporting HTTP-based routing. Which service is most appropriate?

1. Azure Application Gateway
2. Azure Files
3. Azure Event Hubs
4. Azure DNS

Correct Answer: 1

Explanation

Azure Application Gateway is a Layer 7 load-balancing service designed for HTTP and HTTPS traffic. It can distribute requests across backend resources and supports capabilities such as host-based routing, path-based routing, TLS termination, autoscaling, and Web Application Firewall integration. Azure Files provides managed file shares, Event Hubs handles high-throughput event ingestion, and Azure DNS provides domain name resolution. Application Gateway is particularly suitable when routing decisions must be based on application-layer information rather than only IP addresses and ports.

Question 345

Which Azure storage capability helps protect blobs from accidental deletion or overwriting by retaining previous versions?

1. Storage firewall
2. Blob versioning
3. Secure transfer
4. Private DNS

Correct Answer: 2

Explanation

Azure Blob Storage versioning automatically maintains previous versions of a blob when it is modified or overwritten. This capability can help recover data after accidental changes or deletions and provides an additional layer of data protection. Versioning should be considered alongside blob soft delete, lifecycle management, and access controls depending on the recovery requirements. Storage firewalls control network access, secure transfer enforces encrypted connections, and Private DNS provides internal name resolution. Architects should also consider storage costs because retaining multiple versions can increase the amount of stored data.

Question 346

A solution requires a private endpoint for an Azure PaaS service so that traffic remains on private IP addresses. Which Azure capability enables this architecture?

1. Azure Traffic Manager
2. Azure Private Link
3. Azure CDN
4. Azure Advisor

Correct Answer: 2

Explanation

Azure Private Link enables private connectivity to supported Azure services and other resources through private endpoints. A private endpoint assigns a private IP address from a virtual network, allowing clients to access the target service through private connectivity instead of relying on public internet access. Private DNS is often used with private endpoints to resolve service names to private IP addresses. Traffic Manager provides DNS-based routing, CDN distributes cached content, and Advisor provides recommendations. Architects should plan DNS resolution, network routing, security controls, and service support when implementing Private Link.

Question 347

A company wants to automatically shut down development virtual machines outside business hours to reduce costs. Which solution is most suitable?

1. Azure Automation
2. Azure Front Door
3. Azure Event Grid
4. Azure Private DNS

Correct Answer: 1

Explanation

Azure Automation can run scheduled automation tasks that perform operational actions such as starting and stopping virtual machines. This makes it useful for development and test environments where resources do not need to operate continuously. Scheduled shutdown automation can significantly reduce compute costs by stopping VMs outside working hours. Front Door provides global application delivery, Event Grid routes events, and Private DNS provides private name resolution. Architects should account for workloads that require continuous availability and should ensure automation schedules are documented and managed through appropriate permissions.

Question 348

An enterprise uses a hub-and-spoke network architecture. What is a common purpose of the hub virtual network?

1. Hosting every application workload
2. Providing centralized shared network services
3. Replacing all subscriptions
4. Storing application backups

Correct Answer: 2

Explanation

In a hub-and-spoke architecture, the hub virtual network commonly hosts centralized services such as Azure Firewall, VPN Gateway, ExpressRoute Gateway, Bastion, DNS infrastructure, or other shared networking components. Spoke networks can then host individual workloads while using connectivity and security services provided through the hub. This architecture can improve network governance and reduce duplication of shared services. The hub does not necessarily host every application, replace subscriptions, or act as the primary backup location. Architects should carefully design routing, peering, security, and shared-service dependencies.

Question 349

Which Azure service can provide secure browser-based access to virtual machines without requiring a public IP address on the VMs?

1. Azure Bastion
2. Azure Data Factory
3. Azure Cache for Redis
4. Azure Service Bus

Correct Answer: 1

Explanation

Azure Bastion provides secure RDP and SSH connectivity to virtual machines through the Azure portal without requiring public IP addresses directly on those VMs. Bastion is deployed into a dedicated AzureBastionSubnet within a virtual network and helps reduce the need to expose management ports to the public internet. Data Factory provides data integration, Redis provides caching, and Service Bus provides messaging. Architects should still apply network security controls and identity-based access because Bastion improves the access path but does not replace broader security and governance measures.

Question 350

A company needs global HTTP routing, edge acceleration, and centralized web application protection for a distributed application. Which service should be evaluated?

1. Azure Load Balancer
2. Azure Files
3. Azure Front Door
4. Azure Table Storage

Correct Answer: 3

Explanation

Azure Front Door provides global application delivery capabilities for HTTP and HTTPS workloads. It can route traffic across global backends, use edge locations to improve user performance, provide health-based routing, and integrate with Web Application Firewall capabilities. This makes Front Door suitable for globally distributed web applications requiring centralized traffic management and edge delivery. Azure Load Balancer operates primarily at Layer 4, while Files and Table Storage provide data storage capabilities. Architects should evaluate routing requirements, caching, WAF policies, backend health, and regional deployment when designing a Front Door architecture.

Question 351

Which Azure service provides a managed relational database platform that supports serverless compute for suitable workloads?

1. Azure Cosmos DB
2. Azure SQL Database
3. Azure Queue Storage
4. Azure Cache for Redis

Correct Answer: 2

Explanation

Azure SQL Database is a fully managed relational database service that supports several purchasing and compute models, including serverless for appropriate workloads. In the serverless model, compute can automatically scale based on demand and may pause after a configured period of inactivity, helping optimize costs for intermittent workloads. Cosmos DB is a globally distributed NoSQL database, Queue Storage provides messaging, and Redis provides in-memory caching. Architects should evaluate workload patterns, database size, performance requirements, connectivity, scaling behavior, and cost before selecting SQL Database serverless.

Question 352

A security team wants Azure resources to use customer-controlled encryption keys stored in Azure Key Vault. Which capability should be selected?

1. Azure Advisor
2. Azure Traffic Manager
3. Customer-managed keys
4. Azure Load Balancer

Correct Answer: 3

Explanation

Customer-managed keys allow organizations to control encryption keys used by supported Azure services instead of relying exclusively on Microsoft-managed keys. Keys can be stored and managed through Azure Key Vault or supported managed HSM solutions. This approach can help organizations meet specific compliance, governance, or key-management requirements. Architects must plan key rotation, access permissions, availability, recovery, and operational ownership carefully. Advisor provides recommendations, Traffic Manager provides DNS-based routing, and Load Balancer distributes network traffic. Customer-managed keys should be adopted only when the additional management requirements are justified.

Question 353

Which Azure networking capability allows a service to use a private IP address from a virtual network while connecting to a supported PaaS resource?

1. Network Security Group
2. Azure DNS
3. Private endpoint
4. Azure Load Balancer

Correct Answer: 3

Explanation

A private endpoint provides a private IP address from an Azure virtual network for accessing a supported Azure service or resource through Azure Private Link. This allows traffic to remain on private connectivity rather than requiring access through a public endpoint. Private DNS zones are commonly used to resolve the service’s normal hostname to the private endpoint address. NSGs provide network filtering, Azure DNS provides DNS hosting and resolution, and Load Balancer distributes traffic. Architects should consider subnet placement, DNS architecture, routing, and access policies when implementing private endpoints.

Question 354

A company wants to use a centralized firewall to inspect and control traffic between Azure virtual networks and to on-premises networks. Which service is appropriate?

1. Azure Firewall
2. Azure Table Storage
3. Azure CDN
4. Azure Event Hubs

Correct Answer: 1

Explanation

Azure Firewall is a managed, stateful network security service that can centrally inspect and control network traffic. It can be deployed in hub-and-spoke architectures to provide centralized security for traffic moving between spokes, toward the internet, or toward on-premises environments. Depending on the selected tier and configuration, it supports capabilities such as application rules, network rules, threat intelligence, and advanced inspection features. Table Storage provides NoSQL storage, CDN distributes content, and Event Hubs handles event ingestion. Architects should integrate Firewall with routing and appropriate security policies.

Question 355

A web application needs to connect privately to an App Service application while preventing direct public access to the application endpoint. Which capability should be considered?

1. Azure CDN
2. App Service private endpoint
3. Azure Traffic Manager
4. Azure Queue Storage

Correct Answer: 2

Explanation

An App Service private endpoint allows clients in a virtual network to access an App Service application through a private IP address using Azure Private Link. This architecture can help reduce public exposure of the application and support private connectivity requirements. DNS configuration is important because the application’s hostname must resolve appropriately to the private endpoint for clients using private access. CDN provides edge content delivery, Traffic Manager provides DNS-based routing, and Queue Storage provides asynchronous messaging. Architects should also review outbound connectivity, access restrictions, DNS zones, and application dependencies.

Question 356

Which Azure service is best suited for collecting high-volume event streams from devices or applications for later processing?

1. Azure Files
2. Azure Service Bus
3. Azure Event Hubs
4. Azure Key Vault

Correct Answer: 3

Explanation

Azure Event Hubs is designed for high-throughput event ingestion and streaming scenarios. It can collect large volumes of telemetry, application events, logs, and device data and make those streams available for downstream processing. Event Hubs is commonly integrated with Stream Analytics, Azure Functions, Databricks, and other analytics solutions. Azure Files provides shared file storage, Service Bus is designed for enterprise messaging and reliable asynchronous communication, and Key Vault manages secrets and keys. Architects should consider partitions, throughput, retention, consumer groups, scaling, and downstream processing requirements.

Question 357

An organization wants to ensure that Azure resources are consistently named and tagged across multiple subscriptions. Which governance approach is most appropriate?

1. Azure Policy
2. Azure Bastion
3. Azure Cache for Redis
4. Azure Front Door

Correct Answer: 1

Explanation

Azure Policy can enforce organizational standards for resource configuration, including required tags and naming-related governance requirements. Policies can audit resources that do not comply or deny deployments that violate defined rules. Policy initiatives can combine multiple related policies into a single governance package. Bastion provides secure VM access, Redis provides caching, and Front Door provides global application delivery. Architects should apply governance at suitable scopes, such as management groups or subscriptions, and establish clear standards for ownership, environment, cost center, application, and other important resource metadata.

Question 358

Which Azure capability is designed to provide automatic traffic distribution across multiple healthy application endpoints based on DNS responses?

1. Azure Application Gateway
2. Azure Traffic Manager
3. Azure Firewall
4. Azure Bastion

Correct Answer: 2

Explanation

Azure Traffic Manager is a DNS-based traffic distribution service. It evaluates endpoint health and routing rules and returns DNS responses that direct clients toward appropriate endpoints. It supports routing methods including priority, weighted, performance, geographic, and other configurations. Unlike Application Gateway, Traffic Manager does not function as an HTTP reverse proxy and does not inspect application requests directly. Azure Firewall provides network security, while Bastion provides secure VM management access. Architects should understand DNS caching and client behavior when designing Traffic Manager-based failover or global routing solutions.

Question 359

A company needs a centralized location to store application configuration values while allowing applications to retrieve configuration without hard-coding settings. Which Azure service should be considered?

1. Azure App Configuration
2. Azure Load Balancer
3. Azure Data Box
4. Azure VPN Gateway

Correct Answer: 1

Explanation

Azure App Configuration provides a centralized service for storing and managing application configuration settings. Applications can retrieve configuration values at runtime instead of embedding environment-specific settings directly into application code. It supports capabilities useful for modern application architectures, including feature flags and centralized configuration management. Load Balancer distributes network traffic, Data Box supports large-scale offline data transfer, and VPN Gateway provides secure network connectivity. Architects should separate sensitive secrets from ordinary configuration and generally use Azure Key Vault for secrets and cryptographic material.

Question 360

An organization is designing a disaster recovery solution and requires the secondary environment to be able to accept production traffic immediately after a regional failure. Which strategy should be considered?

1. Backup-only recovery
2. Active-passive with no standby capacity
3. Archive-based recovery
4. Active-active deployment

Correct Answer: 4

Explanation

An active-active architecture maintains production-capable environments in multiple locations and can route traffic to more than one environment. This approach can provide very low recovery time because a secondary environment is already operational and capable of serving users. It can also improve resilience and distribute workloads during normal operation. However, active-active designs are more complex and can increase cost and data synchronization requirements. Backup-only and archive-based approaches generally require more recovery work, while an inactive passive environment may require additional startup capacity before serving production traffic.