AZ-305 Practice Test 12 — 15 Questions

Question 1

Which TWO of the following are true about Microsoft Entra ID Governance features?

Accepted Answer

Access reviews allow administrators to periodically review and attest to access rights.. Microsoft Entra ID Access Reviews enable administrators to periodically review and attest to the access rights of users, groups, or applications, ensuring that only authorized users retain access. This is a core governance feature that helps organizations meet compliance and security requirements by automating the certification process.

Answer

Conditional Access policies govern access based on location and device.

Answer

Privileged Identity Management (PIM) provides just-in-time access for all users.

Answer

Identity Protection automatically blocks all risky sign-ins.

Question 2

An organization is migrating on-premises Oracle databases to Azure. They require minimal code changes and support for Oracle PL/SQL stored procedures. Which Azure data service best meets these requirements?

Accepted Answer

Azure Database for PostgreSQL with Oracle compatibility. Azure Database for PostgreSQL with the Oracle compatibility extension (e.g., orafce) provides support for Oracle PL/SQL stored procedures and syntax, minimizing code changes during migration. This service is designed to handle Oracle workloads with minimal re-engineering, unlike other Azure database options that lack native Oracle compatibility.

Answer

Azure Database for MySQL

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Question 3

A multinational company plans to deploy a new application on Azure. The application must comply with GDPR and requires data residency in the EU. The solution should minimize latency for users in Europe and provide disaster recovery across regions. Which Azure architecture should the company implement?

Accepted Answer

Deploy the application in two EU regions with Azure Traffic Manager and Azure Cosmos DB multi-region writes.. It meets all requirements: deploying in two EU regions ensures data residency within the EU, Azure Traffic Manager provides low-latency routing for European users via DNS-based traffic distribution, and Azure Cosmos DB multi-region writes enable active-active disaster recovery with automatic failover and no data loss, minimizing latency for writes across regions.

Answer

Deploy the application in two EU regions with Azure Front Door and Azure SQL Database geo-replication.

Answer

Deploy the application in a single Azure region in Ireland with Azure Site Recovery for DR.

Answer

Deploy the application in a single EU region with Azure Site Recovery and Azure Redis Cache.

Question 4

Which TWO Azure services can be used to host a MongoDB-compatible database with global distribution? (Select two.)

Accepted Answer

Azure Cosmos DB API for MongoDB. Azure Cosmos DB API for MongoDB is correct because it provides a MongoDB-compatible API layer over Cosmos DB's globally distributed, multi-model database engine. This allows you to use standard MongoDB drivers and tools while benefiting from Cosmos DB's turnkey global distribution, multi-region writes, and 99.999% availability SLA.

Answer

Azure SQL Database

Answer

Azure Database for PostgreSQL

Answer

Azure Cache for Redis

Question 5

Drag and drop the steps to configure an Azure Application Gateway with end-to-end TLS encryption into the correct order.

Accepted Answer

Step 1: Obtain a TLS/SSL certificate. Step 2: Upload the certificate to the Application Gateway. Step 3: Configure the backend pool. Step 4: Create backend HTTP settings with HTTPS and upload the backend certificate (if required). Step 5: Create a routing rule.. First, have the certificate. Upload it, configure the backend, set up HTTP settings with TLS, then create the rule.

Answer

Step 1: Upload the certificate to the Application Gateway. Step 2: Obtain a TLS/SSL certificate. Step 3: Configure the backend pool. Step 4: Create backend HTTP settings with HTTPS and upload the backend certificate. Step 5: Create a routing rule.

Answer

Step 1: Obtain a TLS/SSL certificate. Step 2: Configure the backend pool. Step 3: Upload the certificate to the Application Gateway. Step 4: Create backend HTTP settings with HTTPS and upload the backend certificate. Step 5: Create a routing rule.

Answer

Step 1: Obtain a TLS/SSL certificate. Step 2: Upload the certificate to the Application Gateway. Step 3: Create backend HTTP settings with HTTPS and upload the backend certificate. Step 4: Configure the backend pool. Step 5: Create a routing rule.

Question 6

Refer to the exhibit. You deploy this Azure Network Watcher connection monitor to test TCP connectivity on port 443 between two VMs. The test consistently shows 'Unreachable' status. Both VMs are running and have correct NSG rules allowing inbound port 443 from the source VM's IP. What is the most likely cause?

Accepted Answer

The source VM does not have the Network Watcher Agent installed.. Azure Network Watcher connection monitor relies on the Network Watcher Agent extension installed on both source and destination VMs to collect and report connectivity data. Without the agent on the source VM, the test cannot initiate the TCP probes, resulting in a persistent 'Unreachable' status regardless of NSG rules or VM health.

Answer

The destination VM's NSG is blocking the traffic despite the rule.

Answer

The destination VM's private IP address is incorrect.

Answer

A firewall on the destination VM is blocking TCP port 443.

Question 7

Which TWO Azure networking services provide DDoS protection at the application layer (Layer 7)?

Accepted Answer

Azure Front Door Premium with WAF. Azure Front Door Premium includes a web application firewall (WAF) that operates at Layer 7, inspecting HTTP/HTTPS traffic for application-layer attacks such as SQL injection and cross-site scripting. This integration provides both global load balancing and application-layer DDoS protection, making it a correct answer for Layer 7 DDoS defense.

Answer

Azure Firewall

Answer

Azure DDoS Protection Standard

Answer

Azure Bastion

Question 8

A healthcare organization is deploying a new application on Azure that will handle Protected Health Information (PHI). The application must be compliant with HIPAA. The security team requires encryption at rest and in transit, and the ability to audit access to the data. The solution should minimize administrative overhead. Which storage solution should you recommend?

Accepted Answer

Azure SQL Database with Transparent Data Encryption and Always Encrypted. Azure SQL Database provides encryption at rest via Transparent Data Encryption (TDE), which is enabled by default, and encryption in transit via TLS. It also supports Always Encrypted to protect sensitive data client-side, ensuring PHI is never exposed to database administrators. Built-in auditing tracks access, and as a PaaS service, it minimizes administrative overhead compared to SQL Managed Instance or IaaS.

Answer

Azure Cosmos DB with encryption at rest

Answer

Azure SQL Managed Instance with customer-managed keys

Answer

SQL Server on Azure Virtual Machine with BitLocker

Question 9

Refer to the exhibit. You are an Azure administrator reviewing a custom Azure Policy definition. What does this policy do?

Accepted Answer

Denies the creation of virtual machines with the SKUs Standard_D2s_v3 or Standard_D4s_v3.. The policy definition uses the 'deny' effect, which blocks any request that matches the specified condition. The condition checks if the virtual machine SKU is either 'Standard_D2s_v3' or 'Standard_D4s_v3' using the 'in' operator on the 'Microsoft.Compute/virtualMachines/sku.name' alias. Therefore, any attempt to create a VM with these SKUs will be denied, making Option A correct.

Answer

Denies the creation of resource groups that contain virtual machines with the specified SKUs.

Answer

Allows only virtual machines with the SKUs Standard_D2s_v3 or Standard_D4s_v3 to be created in a specific region.

Answer

Audits virtual machines to check if they have the SKUs Standard_D2s_v3 or Standard_D4s_v3.

Question 10

A company ingests millions of IoT events per second from sensors around the world. Each event is a JSON message with timestamp, device ID, and readings. They need to support real-time analytics dashboards and also store all raw data for long-term historical analysis. They want to minimize operational overhead. Which Azure data storage solution should they recommend?

Accepted Answer

Azure Event Hubs with Capture to Azure Data Lake Storage.. Azure Event Hubs is designed for high-throughput data ingestion, capable of handling millions of events per second. By enabling the Capture feature, data is automatically and durably persisted to Azure Data Lake Storage in Avro format, providing a serverless, low-latency pipeline for real-time dashboards while storing raw data for long-term analytics. This minimizes operational overhead by eliminating the need to manage separate ingestion and storage infrastructure.

Answer

Azure Data Lake Storage Gen2 for all data.

Answer

Azure Cosmos DB for both real-time and historical data.

Answer

Azure Time Series Insights (TSI) Standard.

Question 11

Which TWO of the following are requirements for using Azure SQL Database auto-failover groups? (Select two.)

Accepted Answer

The primary and secondary servers must be in different Azure regions.. Option B is correct because auto-failover groups are designed for geo-replication and disaster recovery, requiring the primary and secondary logical servers to reside in different Azure regions to provide regional failover capability. Option E is correct because the databases in the failover group must be on the same service tier (and same compute tier/edition) so that the secondary can properly host the replicated databases and maintain consistent performance characteristics. Option A is incorrect because placing both servers in the same region defeats the purpose of geo-failover and is not a requirement. Option C is incorrect because the secondary server must have a different logical server name; it is the failover group listener that provides a stable connection endpoint, not identical server names. Option D is incorrect because elastic pool membership is not a requirement for auto-failover groups; databases can be in elastic pools or single databases, and they do not need to be in different pools.

Answer

Both servers must be in the same Azure region.

Answer

The secondary server must have the same logical server name.

Answer

The databases must be in different elastic pools.

Question 12

You are designing a solution to grant external partners access to specific Azure resources. The partners must authenticate using their own corporate credentials. You need to manage their access centrally. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra ID B2B collaboration. Microsoft Entra ID B2B collaboration is the correct choice because it allows external partners to authenticate using their own corporate credentials (via their home tenant or identity provider) while enabling centralized management of their access to Azure resources. B2B collaboration supports features like cross-tenant synchronization, conditional access policies, and entitlement management, making it ideal for granting granular, centrally managed access to external users without requiring them to create new accounts.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Connect

Question 13

Your organization has a hybrid identity infrastructure with Microsoft Entra ID Connect Sync. You plan to enable Microsoft Entra ID Seamless Single Sign-On (Seamless SSO) for domain-joined Windows devices. What is the minimum requirement for the on-premises Active Directory forest functional level?

Accepted Answer

Windows Server 2008. Microsoft Entra ID Seamless SSO works by having the client computer attempt Kerberos authentication against a local Active Directory domain controller using a special service principal name (AZUREADSSOACC). This process requires the on-premises Active Directory forest functional level to be at least Windows Server 2008, because the Kerberos service ticket used for Seamless SSO relies on the AES encryption type, which is only supported in domains with a Windows Server 2008 or higher functional level. Lower functional levels (2003 or earlier) do not support AES encryption, causing the authentication to fail.

Answer

Windows Server 2016

Answer

Windows Server 2012

Answer

Windows Server 2003

Question 14

Your company is designing a hybrid identity solution that will allow users to authenticate to Azure resources using their on-premises Active Directory credentials. The solution must support multi-factor authentication (MFA) and conditional access policies. Which TWO components should you include?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to authenticate with their corporate credentials. Microsoft Entra ID is the cloud-based identity and access management service that processes authentication requests, enforces multi-factor authentication (MFA), and evaluates conditional access policies. Together, they form the core of a hybrid identity solution that supports MFA and conditional access.

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Application Proxy

Answer

Microsoft Intune

Question 15

A gaming company is developing a multiplayer online game that requires a low-latency data store for player profiles, inventory, and session state. The data is accessed globally, and the solution must support millions of concurrent players. The company expects write-heavy workloads with occasional reads. The solution must provide single-digit millisecond latency for reads and writes. The company also needs to run analytics on the data to understand player behavior, but analytics queries can tolerate higher latency (minutes). Which Azure data storage solution should the company recommend for the transactional data?

Accepted Answer

Azure Cosmos DB with multiple write regions. Azure Cosmos DB with multiple write regions is the correct choice because it provides global distribution with multi-master writes, delivering single-digit millisecond latency for both reads and writes at any scale. It supports millions of concurrent players via automatic and elastic scaling, and its change feed enables analytics with higher latency tolerance by streaming data to Azure Synapse or HDInsight without impacting transactional performance.

Answer

Azure SQL Database with active geo-replication

Answer

Azure Redis Cache with persistence

Answer

Azure Table Storage with geo-redundancy