AZ-305 Questions 91-100: Security, Data, BCDR, and Well-Architected Review

0
0

AZ-305 questions 91-100

AZ-305 Questions 91-100: Security, Data, BCDR, and Well-Architected Review

Use this AZ-305 questions 91-100 practice set to finish a mixed Microsoft Azure Solutions Architect Expert review across security design, data resiliency, private connectivity, business continuity, and Well-Architected tradeoffs. These are original, exam-style scenarios based on public Microsoft objectives and documentation — no exam dumps, no proprietary item reconstruction.

Exam:
AZ-305 Designing Microsoft Azure Infrastructure Solutions
Range:
Questions 91-100
Primary objective:
Mixed architect design review
Difficulty:
Scenario-based architect decisions
Series note: This post continues the AZ-305 sequence after AZ-305 Questions 81-90: Landing Zones, Governance, and Cost Optimization. Questions 91-100 are a final mixed review: identity controls, application edge design, private PaaS access, data continuity, backup, disaster recovery, and architecture tradeoffs.
Exam tip: AZ-305 rarely asks for a feature in isolation. Read the constraint words first: global, private, least administrative effort, minimal data loss, region failure, and centralized governance. Those words usually decide the Azure service before the answer choices do.

AZ-305 questions 91-100

Question 91 Conditional Access

Protecting administrator access with risk-based controls

A company uses Microsoft Entra ID for Azure administrator sign-in. Security requires that privileged Azure management actions be allowed only after multifactor authentication, and sign-ins from high-risk users should be blocked automatically. The design should avoid building a custom sign-in proxy or writing code.

Choose one answer.

  1. Create a network security group rule that allows Azure portal traffic only from administrator workstations.
  2. Use Microsoft Entra Conditional Access policies with MFA requirements and user/sign-in risk conditions for privileged users.
  3. Store administrator passwords in Azure Key Vault and rotate them every 90 days.
  4. Create an Azure Policy assignment that denies virtual machine creation by non-administrators.
Correct answer: B

Explanation: Conditional Access is the Microsoft Entra policy engine for enforcing access decisions such as requiring multifactor authentication and responding to user or sign-in risk. For privileged administrator access, it is the right control plane because the requirement is about identity sign-in conditions, not resource deployment after sign-in.

Why the other options are wrong: A controls network traffic to resources, not Entra sign-in risk. C protects secrets but does not evaluate interactive administrator sign-ins. D can govern Azure resource deployments, but it does not require MFA or block risky sign-ins.

Objective/domain: Design identity, governance, and security solutions.

Reference: Microsoft Learn: Conditional Access overview

Question 92 Key Vault

Designing secret access for an application without stored credentials

An Azure App Service application must retrieve database connection secrets from Azure Key Vault. Developers do not want to store client secrets or certificates in the application configuration. Access should be granted only to this application identity and should follow least privilege.

Choose one answer.

  1. Enable a managed identity for the App Service app and grant that identity the minimum required Key Vault permissions by using Azure RBAC or a vault access policy.
  2. Copy the database password into an App Service application setting and restrict access to the Azure portal.
  3. Create a shared local administrator account on the App Service worker and use that account to access Key Vault.
  4. Disable Key Vault firewall rules so the application can access secrets anonymously.
Correct answer: A

Explanation: Managed identities let Azure resources authenticate to services that support Microsoft Entra authentication without storing application credentials. Granting the App Service managed identity only the required Key Vault secret permissions satisfies least privilege and removes the need to manage a client secret.

Why the other options are wrong: B stores the secret with the application configuration instead of retrieving it securely. C is not how App Service authenticates to Azure services and creates a credential management problem. D is both insecure and technically wrong: Key Vault access still requires authenticated authorization.

Objective/domain: Design security for applications and data.

Reference: Microsoft Learn: Managed identities in App Service

Question 93 Azure SQL

Designing cross-region failover for Azure SQL Database

A business-critical application uses Azure SQL Database. The architecture must support planned and unplanned failover to another Azure region with a listener endpoint that applications can use, and administrators want to manage failover for a group of related databases together.

Choose one answer.

  1. Configure auto-failover groups for the Azure SQL databases and use the failover group listener endpoints in the application connection strings.
  2. Use Azure Backup to restore the database to a storage account in the secondary region during an outage.
  3. Create a read-only replica by exporting a BACPAC file every night.
  4. Place the database server behind Azure Load Balancer and probe TCP port 1433.
Correct answer: A

Explanation: Auto-failover groups provide a business continuity design for Azure SQL Database and SQL Managed Instance across regions. They include listener endpoints and allow related databases to fail over together, which fits the requirement better than backup-only or manual export patterns.

Why the other options are wrong: B may be part of a recovery strategy, but it does not provide managed cross-region failover with listener endpoints. C creates stale copies and is not a high-availability design. D does not make Azure SQL Database regionally resilient and is not the supported failover mechanism.

Objective/domain: Design data storage and business continuity solutions.

Reference: Microsoft Learn: Auto-failover groups for Azure SQL Database

Question 94 Storage redundancy

Selecting object storage redundancy for zone and regional failure

A document archive uses Azure Blob Storage. The design must protect data if a datacenter zone fails in the primary region and must also keep a replicated copy in a paired secondary region. The business accepts asynchronous replication to the secondary region.

Choose one answer.

  1. Locally redundant storage (LRS)
  2. Zone-redundant storage (ZRS)
  3. Geo-redundant storage (GRS)
  4. Geo-zone-redundant storage (GZRS)
Correct answer: D

Explanation: GZRS combines synchronous zone redundancy in the primary region with asynchronous geo-replication to a secondary region. That matches both requirements: resilience to availability zone failure locally and a regional replica for disaster recovery scenarios.

Why the other options are wrong: A replicates within one datacenter and does not meet zone or regional requirements. B handles zone redundancy but not secondary-region replication. C replicates to another region but does not provide primary-region zone redundancy in the same way GZRS does.

Objective/domain: Design storage and resiliency solutions.

Reference: Microsoft Learn: Azure Storage redundancy

Question 95 Application delivery

Choosing a global edge service for multi-region web applications

A public web application runs in two Azure regions. Users are distributed globally. The application team needs global HTTP routing, TLS termination at the edge, web application firewall protection, and automatic routing to the best healthy regional endpoint. The solution should operate at the global edge rather than inside a single virtual network.

Choose one answer.

  1. Azure Front Door with Web Application Firewall
  2. Azure Application Gateway deployed in one regional virtual network only
  3. Azure Load Balancer with an internal frontend IP address
  4. Azure Bastion in each region
Correct answer: A

Explanation: Azure Front Door is a global layer 7 service for internet-facing HTTP/S applications. It can provide global routing, edge TLS termination, acceleration, health-probe-based endpoint selection, and WAF protection. That matches a multi-region public web application better than a single regional gateway.

Why the other options are wrong: B is a regional layer 7 load balancer and WAF service inside a virtual network; it is excellent for regional ingress but not the global edge requirement by itself. C is layer 4 and, with an internal frontend, is not appropriate for public global HTTP routing. D provides secure VM access and is unrelated to web application delivery.

Objective/domain: Design network and application delivery solutions.

Reference: Microsoft Learn: What is Azure Front Door?

Question 96 Private Link

Keeping PaaS access on private IP addresses

A workload in an Azure virtual network must access an Azure Storage account without using the storage account public endpoint. Traffic should stay on private IP addresses from the virtual network, and the storage account should be reachable through private DNS from the workload subnet.

Choose one answer.

  1. Create a private endpoint for the storage account, integrate the appropriate private DNS zone, and disable or restrict public network access as required.
  2. Create a public IP address for the storage account and add it to a route table.
  3. Use Azure Bastion to tunnel blob traffic from the application subnet.
  4. Enable read-access geo-redundant storage (RA-GRS) and keep all access through the public endpoint.
Correct answer: A

Explanation: Azure Private Endpoint uses Azure Private Link to expose a supported PaaS resource through a private IP address in a virtual network. Private DNS integration ensures the normal service name resolves to the private endpoint from the workload network. Public network access can then be disabled or restricted based on the security design.

Why the other options are wrong: B misunderstands PaaS networking and does not create private access. C is for secure RDP/SSH access to VMs, not application data-plane traffic to Storage. D improves read availability for replicated storage but leaves the access path public.

Objective/domain: Design secure network access to Azure services.

Reference: Microsoft Learn: Azure Private Endpoint overview

Question 97 Virtual machine scale

Designing compute for variable stateless web traffic

A stateless web tier runs on Azure virtual machines. Traffic changes significantly during the day, and the business wants the environment to automatically add and remove identical VM instances based on load while keeping configuration consistent. The application stores session state outside the VMs.

Choose one answer.

  1. Deploy a virtual machine scale set and configure autoscale rules based on platform metrics.
  2. Deploy one larger virtual machine and resize it manually during business hours.
  3. Use Azure Backup to restore VMs when traffic increases.
  4. Create separate subscriptions for peak and off-peak traffic.
Correct answer: A

Explanation: Virtual machine scale sets are designed to deploy and manage a group of load-balanced VM instances. Autoscale can increase or decrease instance count based on metrics such as CPU, schedule, or other signals. Because the web tier is stateless, scaling out identical instances is a strong architectural fit.

Why the other options are wrong: B is manual vertical scaling and does not satisfy automatic elasticity. C is a recovery service, not a scale-out mechanism. D changes management scope but does not solve autoscaling.

Objective/domain: Design compute and scalability solutions.

Reference: Microsoft Learn: Virtual Machine Scale Sets overview

Question 98 Disaster recovery

Replicating Azure virtual machines to another region

A line-of-business application runs on several Azure virtual machines in one region. The organization needs an orchestrated disaster recovery plan that can replicate the VMs to another Azure region, test failover without disrupting production, and execute planned or unplanned failover when required.

Choose one answer.

  1. Azure Site Recovery
  2. Azure Resource Graph
  3. Azure Advisor cost recommendations
  4. Azure Policy guest configuration only
Correct answer: A

Explanation: Azure Site Recovery supports disaster recovery replication and orchestration for Azure VMs and other supported workloads. It can perform test failovers, planned failovers, and unplanned failovers, making it the right service for VM-level regional disaster recovery planning.

Why the other options are wrong: B queries resources but does not replicate or fail over VMs. C may identify optimization opportunities but is not a DR service. D can audit or configure guest state but does not provide regional replication or failover orchestration.

Objective/domain: Design business continuity and disaster recovery solutions.

Reference: Microsoft Learn: About Azure Site Recovery

Question 99 Backup design

Centralizing operational backup for Azure virtual machines

A company needs a native Azure backup solution for production virtual machines. Administrators must define backup schedules and retention policies centrally, monitor backup jobs, and restore VM data when accidental deletion or corruption occurs. The requirement is operational recovery, not real-time regional failover.

Choose one answer.

  1. Azure Backup with a Recovery Services vault and backup policies
  2. Azure Site Recovery only
  3. Azure Front Door health probes
  4. Azure Container Registry geo-replication
Correct answer: A

Explanation: Azure Backup provides centralized backup and restore capabilities for Azure VMs using vaults and policies. It is intended for operational recovery scenarios such as accidental deletion, corruption, or point-in-time restore requirements. That is different from orchestrated disaster recovery failover.

Why the other options are wrong: B is for disaster recovery replication and failover, not routine backup policy management by itself. C checks web endpoint health for routing decisions. D replicates container images, not VM backups.

Objective/domain: Design backup and recovery solutions.

Reference: Microsoft Learn: What is the Azure Backup service?

Question 100 Well-Architected

Balancing availability requirements and cost

An architect is reviewing a workload that currently runs all components across three availability zones, uses premium storage everywhere, and keeps hot replicas in two regions. Telemetry shows that only the checkout workflow has a strict recovery time objective, while reporting and internal admin features can tolerate longer recovery. Leadership asks for lower cost without reducing the reliability target for checkout.

Choose one answer.

  1. Apply the same maximum-resiliency design to every component because mixed reliability tiers are not supported in Azure.
  2. Remove all resiliency from the workload and rely on manual redeployment during an outage.
  3. Classify workload components by business criticality, preserve the required reliability design for checkout, and reduce redundancy or performance tiers for components with less demanding RTO/RPO requirements.
  4. Move all components to a single larger virtual machine to simplify the architecture.
Correct answer: C

Explanation: The Azure Well-Architected Framework emphasizes tradeoffs across reliability, cost optimization, performance, security, and operational excellence. Not every component needs the same resilience tier. A good architect maps technical design to business requirements, protects critical paths, and avoids paying for unnecessary redundancy on noncritical components.

Why the other options are wrong: A over-engineers low-criticality components and ignores cost optimization. B violates the reliability requirement for checkout. D creates a single point of failure and does not address component-level RTO/RPO needs.

Objective/domain: Design for reliability and cost optimization using Well-Architected principles.

Reference: Microsoft Learn: Azure Well-Architected Framework

Answer key summary

Question Answer Key idea
91BConditional Access enforces identity-based MFA and risk controls
92AManaged identities avoid stored credentials for Key Vault access
93AAzure SQL failover groups provide cross-region listener endpoints
94DGZRS combines primary-region zone redundancy with geo-replication
95AAzure Front Door provides global layer 7 routing and WAF at the edge
96APrivate Endpoint keeps supported PaaS access on private IP addresses
97AVirtual machine scale sets support automatic scale-out/in for stateless tiers
98AAzure Site Recovery orchestrates VM regional disaster recovery
99AAzure Backup handles operational VM backup and restore policies
100CWell-Architected design balances reliability targets with cost tradeoffs
Final review: For AZ-305 questions 91-100, keep the design intent visible. Conditional Access protects sign-ins, managed identity removes stored secrets, failover groups and GZRS solve different data continuity problems, Front Door is global HTTP edge, Private Endpoint is private PaaS access, and backup is not the same thing as disaster recovery. Tiny distinction, big exam points.

Sources

📚 More questions from: AZ-305: Azure Solutions Architect

Related QuestionMORE FROM AUTHOR