AZ-305 Azure Storage and Data Architecture 3

Question 1

You need to ensure that data stored in an Azure Storage account is encrypted with your own keys and you can revoke access at any time. Which option should you configure?

Accepted Answer

Customer-managed keys (CMK) in Azure Key Vault

Answer

Microsoft-managed keys (default)

Answer

Customer-provided keys per request

Answer

Double encryption with infrastructure encryption

Question 2

You need to grant a third-party application temporary read access to specific blobs in a private storage container without exposing the account key. Which mechanism should you use?

Accepted Answer

Shared Access Signature (SAS) token with limited permissions and expiry

Answer

Azure Storage account key

Answer

Azure AD managed identity

Answer

Storage account public access level

Question 3

An application writes large files to Azure Blob Storage and needs to ensure files are only visible to readers after the entire upload is complete. Which upload method ensures this?

Accepted Answer

Block Blob upload with Commit Block List as the final step

Answer

Put Blob for small files; multipart upload for large files

Answer

Append Blob upload

Answer

Page Blob upload

Question 4

You need a database solution for storing session state for millions of concurrent users with sub-millisecond read latency and automatic expiry of old sessions. Which service is best?

Accepted Answer

Azure Cache for Redis with key expiration

Answer

Azure SQL Database

Answer

Azure Cosmos DB with TTL enabled

Answer

Azure Table Storage

Question 5

Your analytics pipeline requires transactional consistency for writes but also needs to run OLAP queries over the same data without impacting OLTP performance. Which Azure Cosmos DB feature enables this?

Accepted Answer

Cosmos DB Analytical Store (HTAP with Azure Synapse Link)

Answer

Cosmos DB multi-region writes

Answer

Cosmos DB automatic indexing

Answer

Cosmos DB change feed

Question 6

A storage account must only accept connections from a specific set of Azure VNet subnets and deny all other traffic including from the internet. Which two features should you configure?

Accepted Answer

Service Endpoints on subnets + Storage account network firewall deny rule with VNet subnet exceptions

Answer

Private Endpoints only

Answer

Storage account firewall with allowed public IPs only

Answer

Azure Firewall DNAT + Storage account private endpoint