AZ-305 Practice Test 13 — 15 Questions

Question 1

A company has several Azure Virtual Machines running Windows Server with critical applications. They need to back up these VMs to a secondary Azure region to protect against regional disasters. The backup must be application-consistent and support file-level restore. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault. Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault is the correct solution because it provides application-consistent backups of Windows Server VMs using the Volume Shadow Copy Service (VSS) to ensure data integrity, and it supports file-level restore by allowing you to mount the backup as a drive to recover individual files. The GRS option replicates backup data to a paired secondary region, meeting the disaster recovery requirement without additional manual steps.

Answer

Azure Site Recovery

Answer

Azure Snapshot of managed disks stored in a different region

Answer

Azure Managed Disk with incremental snapshots and manual cross-region copy

Question 2

A company runs a critical application on Azure VMs in the West US region. They want to protect against a regional disaster by replicating VMs to East US using Azure Site Recovery. They have both managed and unmanaged disks. They need to ensure that after failover, the recovery VMs are automatically placed in a specific availability set to support the application's multi-tier architecture. Additionally, they want to minimize downtime during planned failover. Which configuration should they use?

Accepted Answer

Configure a recovery plan that includes the VMs and specifies the target availability set and failover order. A recovery plan in Azure Site Recovery allows you to group VMs, specify the target availability set, and define the failover order. This ensures that after failover, the recovery VMs are automatically placed in the specified availability set, supporting the application's multi-tier architecture. Additionally, recovery plans enable you to automate and sequence failover steps, minimizing downtime during planned failover by orchestrating the process efficiently.

Answer

Set the target availability set in each VM's replication settings individually without a recovery plan

Answer

Use Azure Traffic Manager to route traffic to the secondary region after manual failover

Answer

Enable consistency groups across the VMs using a replication policy

Question 3

A company needs a fully managed NoSQL database for a JSON document-oriented application that requires low latency (single-digit milliseconds) for reads and writes at any scale. The application will run globally and needs multi-region writes with automatic failover. Which Azure data store should they use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it is a fully managed NoSQL database that natively supports JSON documents, offers single-digit millisecond latency for reads and writes at any scale, and provides multi-region writes with automatic failover through its multi-master replication capability. Its global distribution model allows you to configure multiple write regions, ensuring high availability and low latency worldwide.

Answer

Azure Table Storage

Answer

Azure SQL Database

Answer

Azure Cache for Redis

Question 4

A company uses Microsoft Entra ID B2B to collaborate with external vendors. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from compliant devices (e.g., managed by Intune). They also want to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

Accepted Answer

B. It combines Conditional Access policies with session controls to enforce MFA, device compliance (via Intune), and a 1-hour session timeout. Conditional Access policies evaluate sign-in risk and require MFA and compliant devices, while the session control 'Sign-in frequency' can be set to 1 hour to enforce reauthentication. This meets all three requirements without relying on deprecated or separate features.

Answer

A

Answer

C

Answer

D

Question 5

A company is designing a solution for storing sensitive financial records that must be retained for 7 years. The solution must meet the following requirements: - Data must be immutable during the retention period. - After the retention period, data must be automatically deleted. - The solution must minimize storage costs. Which two Azure services should the company use? (Choose two.)

Accepted Answer

Azure Blob Storage lifecycle management. Azure Blob Storage lifecycle management (B) is correct because it allows you to define rules to automatically delete blobs after a specified period, such as 7 years, minimizing storage costs by tiering or expiring data. Azure Blob Storage with immutable storage policy (D) is correct because it enforces WORM (Write Once, Read Many) immutability, preventing data modification or deletion during the retention period, which is essential for sensitive financial records.

Answer

Microsoft Purview Data Map

Answer

Azure NetApp Files with replication

Answer

Azure Files with snapshots

Question 6

Your company uses Azure Policy to enforce compliance. You need to ensure that all storage accounts use HTTPS only. The policy should automatically remediate non-compliant storage accounts by enabling HTTPS-only. What policy effect should you use?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it not only evaluates whether storage accounts have the 'HTTPS only' setting enabled but also automatically deploys a remediation task to enable it when non-compliance is detected. This ensures continuous compliance without manual intervention, which aligns with the requirement for automatic remediation.

Answer

Deny

Answer

AuditIfNotExists

Answer

Append

Question 7

Your organization has multiple Azure subscriptions managed through Azure Management Groups. You need to enforce a policy that requires all resources to have a 'CostCenter' tag. If a resource is created without the tag, the deployment should be denied. Additionally, you need to ensure that existing non-compliant resources are automatically remediated. Which combination of actions should you take?

Accepted Answer

Create a policy with Deny effect for new resources, and create a remediation task using a DeployIfNotExists policy for existing resources.. It combines two policy effects to address both requirements: the Deny effect blocks creation of new resources without the 'CostCenter' tag, while a separate DeployIfNotExists policy with a remediation task automatically adds the tag to existing non-compliant resources. This dual approach ensures enforcement for new deployments and automated remediation for existing resources, which is necessary because a single policy effect cannot both deny and remediate simultaneously.

Answer

Create a policy with DeployIfNotExists effect only, and rely on periodic evaluation.

Answer

Create a policy with Modify effect to add the tag, and assign it at the management group level.

Answer

Create a policy with Deny effect only, and run a script to tag existing resources.

Question 8

You are designing a backup strategy for Azure virtual machines. The solution must support application-consistent backups for SQL Server databases running on the VMs. You need to ensure that backups are taken every 4 hours and retained for 30 days. What should you configure in Azure Backup?

Accepted Answer

Configure a VM backup policy with 4-hour frequency and 30-day retention using the default backup extension.. Azure Backup's default VM backup extension (VMSnapshot) can achieve application-consistent backups for SQL Server by using Windows Volume Shadow Copy Service (VSS) to quiesce the database writes. You configure a VM backup policy with a 4-hour frequency and 30-day retention to meet the stated requirements, as this policy applies to the entire VM and ensures SQL Server databases are backed up consistently.

Answer

Configure Azure SQL Backup for the SQL Server databases.

Answer

Configure Azure Site Recovery replication policy with 4-hour frequency.

Answer

Configure Azure Backup for SAP HANA on the VM.

Question 9

A media company needs to store large volumes of video files that are processed by an application. The files are accessed via REST APIs and are rarely accessed after the first few days. The company wants to minimize storage costs by automatically moving older files to a cheaper storage tier without any manual intervention. Which Azure storage solution should they use, and which feature should they configure?

Accepted Answer

Azure Blob Storage with lifecycle management policies. Azure Blob Storage with lifecycle management policies is the correct solution because it allows you to define rules that automatically move blobs to cooler tiers (e.g., from Hot to Cool to Archive) based on age or last modification time, minimizing storage costs without manual intervention. The REST API access requirement is natively supported by Blob Storage via HTTPS, and the large video file workload fits well within its object storage capabilities.

Answer

Azure Files with tiering

Answer

Azure NetApp Files with capacity pools

Answer

Azure Disk Storage with managed disks

Question 10

A company runs a critical application on Azure Virtual Machines in a single availability set. They want to protect against an entire Azure region failure. They need a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes. Which solution should they use?

Accepted Answer

Azure Site Recovery to another region.. Azure Site Recovery (ASR) provides orchestrated replication, failover, and failback of Azure VMs to a secondary region, enabling a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes as required. ASR replicates VM disks continuously to the target region, and in a regional failure, you can initiate a planned or unplanned failover to bring up the application within the specified RTO/RPO. This is the only option that offers both cross-region disaster recovery and the granular recovery objectives stated.

Answer

Azure Backup for VMs with geo-redundant backup storage.

Answer

Deploy VMs in an availability zone within the same region.

Answer

Use Azure managed disks with geo-replication (LRS to GRS).

Question 11

Refer to the exhibit. The JSON shows role assignments for user1. The role definition IDs are: b24988ac-6180-42a0-ab88-20f7382dd24c = Key Vault Secrets User, 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 = Reader. User1 reports being unable to list secrets in the key vault 'vault-prod' using Azure CLI. What is the most likely cause?

Accepted Answer

The Key Vault Secrets User role does not include the ability to list secrets. The Key Vault Secrets User role (b24988ac-6180-42a0-ab88-20f7382dd24c) grants permissions only to read secret values and metadata, but it does not include the 'list' action on secrets. To list secrets in a key vault, a role such as Key Vault Secrets Officer or a custom role with Microsoft.KeyVault/vaults/secrets/read action is required. Since User1 only has the Key Vault Secrets User role on the vault, they cannot execute the 'az keyvault secret list' command.

Answer

User1 does not have any role assignment on the key vault

Answer

User1 must have the Contributor role on the key vault

Answer

The Reader role at resource group scope overrides the vault role

Question 12

A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones in the East US region. The application receives HTTPS traffic. They need to distribute incoming traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Which Azure load balancing solution should they choose?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports SSL/TLS termination, cookie-based session persistence (affinity), and can distribute HTTPS traffic across VMs in multiple availability zones. These features directly match all three requirements: SSL offloading, session persistence, and cross-zone traffic distribution.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 13

A company runs a mission-critical application on Azure virtual machines (VMs) in the West US region. The application consists of multiple VMs that must be recovered in a specific order during a disaster: database VM first, then application VMs, then web VMs. They also require that after failover to East US, the VMs retain their private IP addresses to avoid DNS updates. The recovery point objective (RPO) is 5 minutes and recovery time objective (RTO) is 30 minutes. The company needs to perform quarterly disaster recovery tests without impacting production. Which combination of Azure Site Recovery features should they configure?

Accepted Answer

Use app-consistent replication, recovery plans with pre/post scripts for ordering, and static IP address assignment in failover settings. The requirement for an RPO of 5 minutes and RTO of 30 minutes necessitates application-consistent replication, which ensures database and application integrity. The need to recover VMs in a specific order is met by recovery plans with pre/post scripts, which allow custom actions (e.g., starting the database VM first, then application, then web). Static IP address assignment in failover settings ensures that VMs retain their private IP addresses after failover to East US, avoiding DNS updates.

Answer

Use crash-consistent replication, recovery plans with manual ordering, and target network with same IP address range

Answer

Use multi-VM consistency groups, recovery plans with automation runbooks, and Azure Traffic Manager to redirect traffic

Answer

Use application-consistent replication, recovery plans with pre/post scripts for ordering, and target network with different IP address range and DNS updates

Question 14

A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is a managed networking service that aggregates branch, VPN, and ExpressRoute connectivity into a single hub-and-spoke architecture. It automatically handles routing between branches and Azure, supports any-to-any connectivity, and integrates natively with ExpressRoute and VPN gateways, making it the correct choice for a scalable, managed solution that simplifies network architecture.

Answer

Azure Virtual Network

Answer

Azure ExpressRoute

Answer

Azure VPN Gateway

Question 15

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Accepted Answer

Use managed identities for Azure resources instead of service principals. Managed identities for Azure resources eliminate the need to store and manage credentials. Azure automatically rotates the identity's principal in Azure AD, and the resource can obtain an access token directly from the Azure Instance Metadata Service (IMDS) endpoint without any secrets. This aligns with the least-privilege principle by removing static, long-lived credentials and reducing the attack surface.

Answer

Assign Global Administrator role to all cloud architects

Answer

Store service principal passwords in Azure Key Vault and retrieve at runtime

Answer

Enable self-service password reset for all users