AZ-305 Practice Test 13 — 15 Questions

Question 1

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to implement a solution that automatically detects identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via API. Which Microsoft Entra ID feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. It provides risk event reports and integrates with SIEM systems via the Microsoft Graph API, enabling automated risk data export for centralized monitoring.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Entitlement Management

Question 2

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

Accepted Answer

A. Azure ExpressRoute provides a private, high-bandwidth, and reliable connection from on-premises data centers to Azure, bypassing the public internet. To meet the low-cost backup requirement, Azure VPN Gateway (Site-to-Site VPN) offers a secure, encrypted connection over the internet as a failover path, which is significantly cheaper than a second ExpressRoute circuit. This combination ensures primary connectivity via ExpressRoute and cost-effective redundancy via VPN.

Answer

B

Answer

C

Answer

D

Question 3

Contoso Ltd. is a global retail company with headquarters in New York and operations in Europe and Asia. They are migrating their on-premises SQL Server databases to Azure. The databases include a customer database (500 GB), an orders database (2 TB), and a product catalog database (100 GB). The customer database requires high read throughput with sub-10 ms latency for global users. The orders database must support complex queries and reporting with point-in-time restore capability up to 35 days. The product catalog is updated infrequently but must be available for read-heavy workloads with strong consistency. Contoso wants to minimize costs while meeting performance and compliance requirements. They also need to support hybrid deployments for databases that must remain on-premises due to data sovereignty laws. You need to design a data storage solution. Which combination of Azure services and configurations should you recommend?

Accepted Answer

Azure Cosmos DB with multiple write regions for customer DB; Azure SQL Database Business Critical for orders; Azure SQL Database serverless for product catalog; Azure SQL Managed Instance with managed instance link for hybrid. It matches each database's workload to the optimal Azure service: Cosmos DB with multiple write regions provides global low-latency reads and writes for the customer DB; Azure SQL Database Business Critical offers the complex query support and point-in-time restore up to 35 days for the orders DB; Azure SQL Database serverless minimizes cost for the infrequently updated product catalog; and Azure SQL Managed Instance with managed instance link enables hybrid deployment for on-premises databases subject to data sovereignty laws.

Answer

Azure SQL Managed Instance for all databases with geo-replication for customer DB; use failover groups for global distribution; Azure Data Sync for hybrid

Answer

Azure SQL Database Hyperscale for all databases; use geo-replication for customer DB; Azure SQL Server on Azure VMs for hybrid

Answer

Azure SQL Database Business Critical for customer DB with geo-replication; Azure SQL Database Hyperscale for orders; Azure SQL Database serverless for product catalog; Azure SQL Managed Instance for hybrid

Question 4

Your company is implementing a new Azure subscription for a project that requires strict separation of duties. The security team requires that all resource creation must be approved by a central IT team. Additionally, any resource that does not comply with company tagging standards should be automatically reported. You need to design a solution that meets these requirements using Azure Policy and Azure Role-Based Access Control (RBAC). What should you do?

Accepted Answer

Create a custom RBAC role that allows only the IT team to add a specific 'Approved' tag. Use Azure Policy with 'Deny' effect to block resources without that tag. Use a separate 'Audit' policy for other tagging standards.. It uses a custom RBAC role to restrict the ability to add an 'Approved' tag to the IT team, combined with a Deny policy that blocks creation of any resource lacking that tag, ensuring all resource creation requires IT approval. The separate Audit policy automatically reports resources that fail to meet other company tagging standards, fulfilling both the approval and compliance reporting requirements without manual intervention.

Answer

Use Azure Policy with 'Audit' effect to report non-compliant resources. Use Azure RBAC to assign Owner role to IT team.

Answer

Use Azure Policy with 'Append' effect to automatically add required tags at creation. Use Azure Monitor alerts for non-compliance.

Answer

Create an Azure Policy with 'DeployIfNotExists' to deploy a tagging template. Use Azure RBAC to assign Contributor role to IT team.

Question 5

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to implement a solution that automatically detects identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via API. Which Microsoft Entra ID feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access, requiring approval from designated approvers and automatically expiring role assignments after a defined duration. PIM also generates detailed audit logs for all role activations and assignments, meeting the compliance and monitoring requirements.

Answer

Microsoft Entra ID Entitlement Management

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Conditional Access

Question 6

A company deploys a critical multi-tier application on Azure VMs. The application includes a database tier that must be recovered to the same point in time as the application tier after a disaster. They use Azure Site Recovery (ASR) for disaster recovery to a secondary region. They also need to run a custom script after failover to update connection strings. Which ASR feature should they use?

Accepted Answer

Recovery plans with pre-actions and post-actions. Recovery plans in Azure Site Recovery allow you to define pre-actions and post-actions, which can run custom scripts (e.g., PowerShell) after failover to update connection strings. This ensures the application tier can connect to the recovered database tier, meeting the requirement for a custom script execution after failover. The other options do not provide the ability to run custom scripts as part of the failover sequence.

Answer

Replication policies with application-consistent snapshots

Answer

Multi-VM consistency groups

Answer

Azure Backup with cross-region restore

Question 7

You are designing a disaster recovery solution for a critical application hosted in Azure VMs. The primary region is East US. The application requires a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes. Which Azure service should you use to replicate the VMs?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions, meeting the RTO of 30 minutes and RPO of 15 minutes by using continuous replication with crash-consistent or app-consistent snapshots. It is the native Azure service designed specifically for disaster recovery of IaaS workloads with granular recovery objectives.

Answer

Azure Front Door

Answer

Azure Backup

Answer

Azure Traffic Manager

Question 8

A company deploys a stateless web application on Azure VMs in a single region. They need to distribute incoming HTTP traffic across multiple VMs and perform health checks. The solution should be highly available within the region. Which Azure load balancing solution should they use?

Accepted Answer

Azure Load Balancer (Standard) with HTTP health probe.. Azure Load Balancer (Standard) operates at Layer 4 (TCP/UDP) and can distribute HTTP traffic across VMs in a single region while performing health checks via HTTP health probes. It provides high availability within a region by distributing traffic across availability zones or availability sets, meeting the requirement for a stateless web application without needing Layer 7 features.

Answer

Azure Application Gateway v2.

Answer

Azure Traffic Manager.

Answer

Azure Front Door.

Question 9

Your company stores sensitive customer data in Azure Blob Storage. You must ensure that data is encrypted at rest using customer-managed keys (CMK) and that key rotation is automated. You also need to prevent data from being accessed by any Microsoft administrator. Which solution should you implement?

Accepted Answer

Use Azure Key Vault Managed HSM with customer-managed keys and enable double encryption with infrastructure encryption.. Azure Key Vault Managed HSM provides FIPS 140-2 Level 3 validated hardware security modules (HSMs) for storing customer-managed keys (CMK), supports automated key rotation, and enables double encryption via infrastructure encryption. This ensures that data is encrypted at rest with a customer-controlled key, and the use of Managed HSM prevents Microsoft administrators from accessing the key material, as the HSM is isolated and Microsoft has no export or visibility permissions.

Answer

Use Azure Key Vault (Standard) to store customer-managed keys and enable automatic key rotation.

Answer

Use Azure Disk Encryption with customer-managed keys stored in Azure Key Vault.

Answer

Enable Azure Storage Service Encryption with platform-managed keys.

Question 10

A large enterprise is designing a hybrid network architecture. The company has an on-premises data center connected to Azure via ExpressRoute. They want to extend their on-premises network to Azure by using a site-to-site VPN as a backup connection. The company has multiple VNets in Azure that need to communicate with each other and with the on-premises network. The solution must be highly available and provide redundancy for the ExpressRoute connection. You need to recommend a network connectivity design. What should you include?

Accepted Answer

Use Azure ExpressRoute as the primary connection, and configure a site-to-site VPN as a backup. Use VNet peering for VNet-to-VNet connectivity.. It combines ExpressRoute as the primary connection with a site-to-site VPN as a backup, ensuring redundancy for on-premises connectivity. VNet peering is used for VNet-to-VNet communication, which is the recommended method for low-latency, high-bandwidth connectivity between VNets in the same region. This design meets the high availability and redundancy requirements without introducing unnecessary complexity.

Answer

Use Azure ExpressRoute as the primary connection, and configure VNet-to-VNet VPN as a backup for ExpressRoute.

Answer

Use Azure VPN Gateway to connect the on-premises network to Azure, and use VNet peering for VNet-to-VNet connectivity.

Answer

Use Azure ExpressRoute as the primary connection, and use Azure Firewall to inspect traffic between VNets.

Question 11

Which THREE of the following are best practices for securing an Azure Kubernetes Service (AKS) cluster? (Choose three.)

Accepted Answer

Enable Azure Policy for Kubernetes to enforce security policies.. Option A is correct because Azure Policy for Kubernetes (via the Azure Policy add-on) enforces governance and security controls at scale, such as restricting privileged containers, hostPath mounts, and allowed registries, and it reports compliance for AKS clusters. Option B is correct because integrating Microsoft Entra ID (Microsoft Entra ID) with AKS enables centralized, identity-based authentication using Microsoft Entra ID credentials and supports Kubernetes RBAC authorization, eliminating static local admin accounts. Option C is correct because managed identities (or workload identity) let pods obtain Microsoft Entra ID tokens without storing credentials, enabling secure, secretless access to Azure resources like Key Vault and Storage. Option D is not a best practice: allowing unrestricted pod-to-pod traffic removes segmentation and increases lateral movement risk; network policies (Calico or Azure NPM) should restrict traffic. Option E is incorrect because disabling Kubernetes RBAC removes fine-grained, namespace-scoped authorization; Azure RBAC alone does not replace Kubernetes RBAC for in-cluster permissions, and both should be used together.

Answer

Allow all pod-to-pod communication within the cluster without network policies.

Answer

Disable Kubernetes RBAC and use only Azure RBAC for simplicity.

Question 12

A company uses Azure SQL Database for a critical OLTP workload. They need a disaster recovery solution that automatically fails over to a secondary region with an RPO of 5 seconds and an RTO of 1 hour. What should they implement?

Accepted Answer

Azure SQL Database auto-failover groups. Auto-failover groups in Azure SQL Database provide automatic failover across regions, leveraging active geo-replication under the hood. This combination achieves an RPO of up to 5 seconds (from active geo-replication) and an RTO of 1 hour (from the auto-failover group). Active geo-replication alone does not automate failover, which is required for the disaster recovery solution. Zone-redundant configuration protects only within a region, not cross-region. Managed Instance failover groups are for Azure SQL Managed Instance, not for Azure SQL Database, and have different RPO/RTO characteristics.

Answer

Azure SQL Database zone-redundant configuration

Answer

Azure SQL Database active geo-replication

Answer

Azure SQL Managed Instance failover groups

Question 13

A company uses Microsoft Entra ID B2B collaboration for external partners. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from devices that are compliant with Intune policies. Additionally, they need to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

Accepted Answer

Configure cross-tenant access settings to trust MFA and device compliance from external organizations, and then create a Conditional Access policy that requires MFA, compliant device, and a session sign-in frequency of 1 hour.. Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA and device compliance claims from external organizations, which is necessary when external users bring their own devices. Then, a Conditional Access policy targeting external users can enforce MFA, require compliant device, and set a session sign-in frequency of 1 hour using session controls. This combination ensures that the company's security requirements are met without relying on the external tenant's policies.

Answer

Create a Conditional Access policy for external users that requires MFA and compliant device, and set session controls for sign-in frequency. Trusting MFA from external tenants is automatic.

Answer

Use Microsoft Entra ID Identity Protection to detect risky sessions for external users and require MFA only when risk is high. This will also enforce device compliance automatically.

Answer

Configure Microsoft Entra ID Privileged Identity Management (PIM) for external users to activate MFA and require compliant device. PIM is for role activation, not for external user access policies.

Question 14

A company is building a petabyte-scale data lake for analytics. The workload includes Apache Spark and Hive jobs that read and write large files. The storage solution must support a hierarchical namespace for efficient directory operations, POSIX-like access control lists (ACLs) for fine-grained permissions, and must be accessible via the Azure Blob Storage API for compatibility with existing tools. Furthermore, the solution should be optimized for analytics workloads with high throughput. Which Azure data service should they choose?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and is accessible via the Azure Blob Storage API. This service is specifically optimized for analytics workloads like Apache Spark and Hive, providing high throughput for petabyte-scale data lakes. The hierarchical namespace enables efficient directory operations, while the Blob Storage API ensures compatibility with existing tools.

Answer

Azure Data Lake Storage Gen1

Answer

Azure Blob Storage

Answer

Azure Files

Question 15

A multinational corporation is designing a backup and disaster recovery strategy for Azure IaaS VMs. The solution must support cross-region failover, meet a recovery point objective (RPO) of 15 minutes, and a recovery time objective (RTO) of 1 hour. Which TWO options should you include in the design?

Accepted Answer

Azure Backup with geo-redundant storage (GRS). Azure Backup with geo-redundant storage (GRS) (A) is correct because GRS replicates backup data to a secondary Azure region hundreds of miles away, enabling cross-region restore and satisfying the cross-region failover requirement while supporting the 15-minute RPO through frequent backup schedules. Azure Site Recovery (E) is correct because it continuously replicates IaaS VM disks to a target region and can orchestrate failover with RTOs typically under an hour, directly meeting the 1-hour RTO and 15-minute RPO objectives. Azure Backup with LRS (B) is incorrect because locally redundant storage keeps three copies within a single datacenter in one region, providing no cross-region protection. Managed disk snapshots (C) are incorrect because they are stored regionally and are not a cross-region DR mechanism by themselves. Azure Backup with ZRS (D) is incorrect because zone-redundant storage only replicates across availability zones within one region, not across regions.

Answer

Azure Backup with locally redundant storage (LRS)

Answer

Managed disk snapshots

Answer

Azure Backup with zone-redundant storage (ZRS)