AZ-305 Practice Test 1 — 10 Questions

Question 1

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center connected via ExpressRoute. They need to implement a hub-and-spoke topology where a hub VNet hosts shared network virtual appliances (NVAs) for traffic inspection. All traffic between spokes and between spokes and on-premises must be routed through the hub. The company wants to minimize the administrative overhead of configuring and maintaining routing. Which Azure solution should they implement?

Accepted Answer

Use Azure Virtual WAN with a secured virtual hub.. Azure Virtual WAN with a secured virtual hub is the correct choice because it provides a managed hub-and-spoke topology with built-in routing, eliminating the need for manual user-defined routes (UDRs) and route tables. The secured virtual hub includes Azure Firewall for traffic inspection, and all inter-spoke and on-premises traffic is automatically routed through the hub via the Virtual WAN routing engine, which uses the Border Gateway Protocol (BGP) to propagate routes dynamically. This minimizes administrative overhead by centralizing routing and security management.

Answer

Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.

Answer

Create a single large VNet and use network security groups (NSGs) to isolate traffic.

Answer

Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.

Question 2

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

Accepted Answer

Peer each spoke VNet with the hub VNet. B is correct because VNet peering is required to establish connectivity between the spoke VNets and the hub VNet, enabling traffic to flow through the central Azure Firewall. Without peering, the spoke VNets would be isolated and unable to route traffic to the hub. C is correct because a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP ensures that all outbound internet traffic from spoke subnets is forced through the firewall for inspection and control.

Answer

Enable public IP addresses on all workload VMs

Answer

Deploy a NAT gateway in every spoke subnet

Question 3

A company has virtual machines in Azure that need to be grouped across multiple fault domains and update domains to ensure high availability. They plan to deploy three VMs running the same application tier. Which Azure feature should they use to provide redundancy within a single region?

Accepted Answer

Availability Set. An Availability Set distributes VMs across multiple fault domains (shared hardware, power, and networking) and update domains (planned maintenance) within a single Azure datacenter. This ensures that at least one VM remains available during both hardware failures and Azure patching cycles. For three VMs running the same application tier, an Availability Set provides the required redundancy without the complexity of zone-level isolation.

Answer

Availability Zone

Answer

Virtual Machine Scale Set with manual scaling

Answer

Azure Site Recovery

Question 4

A company plans to migrate on-premises applications to Azure. They require users to authenticate using their existing on-premises Active Directory credentials without syncing password hashes to the cloud. Which Microsoft Entra ID authentication method should they use?

Accepted Answer

Microsoft Entra ID Pass-through Authentication. Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud. A lightweight agent on-premises forwards authentication requests to the local domain controller, meeting the requirement to avoid password hash synchronization.

Answer

Microsoft Entra ID Password Hash Sync

Answer

Microsoft Entra ID Federation Services (AD FS)

Answer

Microsoft Entra ID Connect with Seamless SSO

Question 5

A company has multiple Azure subscriptions and wants to enforce that all administrators must use multi-factor authentication (MFA) when accessing the Azure portal. They also want to monitor and report on any policy changes that affect this enforcement. Which combination of Azure services should they use?

Accepted Answer

Microsoft Entra ID Conditional Access policy to require MFA for Azure management and Azure Monitor with Log Analytics for monitoring.. Option B is correct because Microsoft Entra ID Conditional Access policies can enforce MFA specifically for Azure management (including the Azure portal), and Azure Monitor with Log Analytics provides the monitoring and reporting of policy changes via the Azure Activity Log. This combination directly addresses both requirements: enforcing MFA for administrators and auditing changes to the Conditional Access policy itself.

Answer

Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.

Answer

Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.

Answer

Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.

Question 6

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

Accepted Answer

A. Azure ExpressRoute provides a private, high-bandwidth, and reliable connection from on-premises data centers to Azure, bypassing the public internet. To meet the low-cost backup requirement, Azure VPN Gateway (Site-to-Site VPN) offers a secure, encrypted connection over the internet as a failover path, which is significantly cheaper than a second ExpressRoute circuit. This combination ensures primary connectivity via ExpressRoute and cost-effective redundancy via VPN.

Answer

B

Answer

C

Answer

D

Question 7

A company has multiple Azure virtual networks (VNets) spread across three Azure regions (West US, East US, and West Europe). They also have an on-premises network connected to East US via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. They require centralized management of routing and the ability to enforce security policies such as forcing all internet-bound traffic from any VNet to pass through a central firewall in East US. Which Azure solution should they implement?

Accepted Answer

Azure Virtual WAN with a secured hub in East US.. Azure Virtual WAN with a secured hub in East US provides a centralized hub-and-spoke architecture that connects all VNets and the on-premises network via ExpressRoute. The secured hub includes Azure Firewall, enabling forced tunneling of all internet-bound traffic from any VNet through the central firewall in East US, while Virtual WAN automatically manages routing between all spokes and the on-premises network.

Answer

VNet peering between all VNets and use route tables for forced tunneling.

Answer

ExpressRoute Global Reach with VNet peering to connect all VNets.

Answer

VPN gateways with BGP to connect all VNets.

Question 8

A company runs a critical application on an Azure virtual machine in the West US region. They want to enable disaster recovery to East US with the ability to perform non-disruptive DR drills. They need an RPO of a few minutes. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct service because it provides continuous replication of Azure VMs from a primary region (West US) to a secondary region (East US) with a Recovery Point Objective (RPO) of a few minutes. It also supports non-disruptive disaster recovery drills by allowing you to perform test failovers in an isolated network without impacting the production workload.

Answer

Azure Backup

Answer

Azure Traffic Manager

Answer

Azure Blueprints

Question 9

A company is building a new application that requires a fully managed relational database. The application has varying workloads across different databases. The company wants to pool resources to optimize cost and allow each database to scale as needed. They also need automated backups with point-in-time restore and geo-replication for disaster recovery. Which Azure data service should they use?

Accepted Answer

Azure SQL Database. Azure SQL Database is a fully managed relational database service that supports elastic pools, which allow you to pool resources across multiple databases to optimize cost and enable each database to scale independently based on demand. It also provides automated backups with point-in-time restore (PITR) and active geo-replication for disaster recovery, meeting all the stated requirements.

Answer

Azure SQL Managed Instance

Answer

Azure Database for MySQL

Answer

Azure Database for PostgreSQL

Question 10

A company has multiple virtual networks in different Azure regions. They need to connect all VNets together securely over the Microsoft backbone. They also need to connect to an on-premises data center via ExpressRoute. The solution should support transitive routing between all connected networks. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the correct choice because it provides a hub-and-spoke architecture that supports transitive routing between all connected networks (multiple VNets across regions and on-premises via ExpressRoute) over the Microsoft backbone. It natively integrates ExpressRoute and VPN gateways into a single managed service, enabling seamless connectivity and routing between any spoke VNet, branch, or on-premises site without requiring manual peering or gateway transit configuration.

Answer

Azure Virtual Network Peering

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute Gateway