AZ-305 Practice Test 14 — 15 Questions

Question 1

A financial company must store customer transaction records in Azure Blob Storage. Regulatory requirements mandate that the records must not be modified or deleted for 7 years. Even administrators must be unable to alter or remove the blobs during this period. Which Azure Blob Storage feature should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Immutable storage with time-based retention policy. Immutable storage with a time-based retention policy (WORM – Write Once, Read Many) ensures that blobs cannot be modified or deleted for a specified duration, even by administrators. This directly satisfies the 7-year regulatory requirement by locking the data at the storage level, overriding any delete or write operations.

Answer

Legal hold

Answer

Soft delete

Answer

Versioning

Question 2

Your company uses Azure Resource Manager templates for infrastructure deployment. You need to ensure that all deployments are validated against organizational policies before resources are provisioned. Which Azure service should you use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it enforces organizational standards and assesses compliance at scale. It evaluates resources during deployment (via the ARM template deployment process) and can deny non-compliant resources before they are provisioned. Specifically, policies with a 'deny' effect block the deployment if the resource violates the policy, ensuring validation against organizational policies. This directly meets the requirement to validate deployments before resources are provisioned.

Answer

Azure RBAC

Answer

Management Groups

Answer

Azure Blueprints

Question 3

A company has multiple virtual networks in different Azure regions. They need to connect all VNets together securely over the Microsoft backbone. They also need to connect to an on-premises data center via ExpressRoute. The solution should support transitive routing between all connected networks. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the correct choice because it provides a hub-and-spoke architecture that supports transitive routing between all connected networks (multiple VNets across regions and on-premises via ExpressRoute) over the Microsoft backbone. It natively integrates ExpressRoute and VPN gateways into a single managed service, enabling seamless connectivity and routing between any spoke VNet, branch, or on-premises site without requiring manual peering or gateway transit configuration.

Answer

Azure Virtual Network Peering

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute Gateway

Question 4

A company is designing a backup strategy for a critical Azure SQL Database. The database is used in a production environment and the company requires the ability to restore to any point within the last 35 days with a maximum granularity of 5 minutes. Which backup configuration should the company choose?

Accepted Answer

Use Azure SQL Database automatic backups with a retention period of 35 days. Azure SQL Database's built-in automatic backups provide point-in-time restore (PITR) with a configurable retention period of up to 35 days and a default backup frequency that enables restore granularity of 5 minutes. This meets the requirement without additional configuration or cost, as automatic backups are enabled by default and include differential and transaction log backups every 5-10 minutes.

Answer

Use Azure Backup for SQL Server in Azure VM

Answer

Configure point-in-time restore with a retention period of 35 days and a backup frequency of 5 minutes

Answer

Configure geo-redundant backup with long-term retention

Question 5

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to design a monitoring solution to detect when users are assigned to high-privilege roles (e.g., Global Administrator) and ensure that any such assignment triggers an automated investigation. Additionally, you need to monitor sign-in failures for guest users and automatically block accounts after 5 failed attempts within 10 minutes. You have the following requirements: 1) Use a cloud-native solution that minimizes administrative overhead. 2) Integrate with Microsoft Sentinel for incident response. 3) Use built-in features where possible. What should you do?

Accepted Answer

Use Microsoft Entra Privileged Identity Management (PIM) alerts for role assignments and Microsoft Entra Identity Protection for sign-in risk policies; integrate both with Microsoft Sentinel.. Microsoft Entra Privileged Identity Management (PIM) provides built-in alerts for high-privilege role assignments, and Microsoft Entra Identity Protection offers risk-based policies for sign-in failures, including user risk policies that can automatically block accounts after a specified number of failures. Both services natively integrate with Microsoft Sentinel via built-in data connectors, enabling automated incident creation with minimal administrative overhead, meeting all requirements.

Answer

Use Microsoft Entra audit logs streamed to Log Analytics, create Azure Logic Apps to detect role assignments and sign-in failures, and trigger Sentinel incidents.

Answer

Use Azure Policy to audit role assignments and create custom KQL functions in Log Analytics to detect sign-in failures, then forward to Sentinel.

Answer

Deploy Microsoft Identity Manager (MIM) on-premises to monitor role changes, and use Azure AD Connect Health for sign-in failures.

Question 6

A company has a hub-spoke network topology in Azure. They have multiple spoke VNets connected to a hub VNet via peering. They need to ensure that all east-west traffic between spoke VNets goes through a network virtual appliance (NVA) in the hub for inspection. Additionally, all outbound internet traffic from spoke VMs must use a single public IP address. What should they configure?

Accepted Answer

Configure VNet peering with 'Allow forwarded traffic' enabled, add user-defined routes in each spoke pointing to the NVA IP for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet with a default route in spokes.. It combines two critical configurations: user-defined routes (UDRs) in each spoke VNet force inter-spoke traffic through the NVA in the hub by specifying the NVA's IP as the next hop, and 'Allow forwarded traffic' on the VNet peering enables the hub NVA to forward packets between spokes. For outbound internet traffic, Azure Firewall in the hub provides a single public IP, and a default route (0.0.0.0/0) in the spoke UDRs directs all internet-bound traffic to the Azure Firewall's private IP, ensuring centralized inspection and egress.

Answer

Configure spoke VNets with a default route to the NVA IP, and deploy a NAT gateway in the hub for outbound traffic.

Answer

Configure a route table in each spoke with a route to the hub NVA for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet traffic.

Answer

Enable 'Allow gateway transit' on the hub VNet and 'Use remote gateways' on the spoke VNets for the NVA.

Question 7

A company wants to migrate its on-premises file server to Azure with minimal application changes. The application accesses files over the SMB protocol and requires identity-based access using the existing on-premises Active Directory Domain Services (AD DS). They need the solution to be fully managed with low latency. Which Azure storage solution should they choose?

Accepted Answer

Azure Files. Azure Files is the correct choice because it provides fully managed SMB file shares that can be accessed over the SMB protocol with identity-based authentication using on-premises AD DS via Azure Files AD DS integration. This allows the application to connect with minimal changes, as it continues to use SMB and existing domain credentials, while Azure Files offers low-latency access when deployed in the same region as the application.

Answer

Azure NetApp Files

Answer

Azure Blob Storage with NFS 3.0

Answer

Azure Disk Storage

Question 8

You are designing a solution to provide high availability for a critical application running on Azure Virtual Machines. The virtual machines must be placed on physically separate hardware and have guaranteed availability during Azure maintenance events. Which option meets these requirements?

Accepted Answer

Deploy VMs in different Availability Zones. Availability Zones provide physically separate locations within an Azure region, protecting against datacenter failures and maintenance events. Option A (Availability Set) spreads VMs across fault and update domains within a single datacenter, not across separate physical facilities. Option B (Proximity Placement Group) is for low latency, not high availability. Option D (Virtual Machine Scale Set) is for auto-scaling and can be combined with Availability Zones, but alone it does not guarantee placement on separate hardware.

Answer

Deploy VMs in an Availability Set

Answer

Deploy VMs in a Proximity Placement Group

Answer

Deploy VMs in a Virtual Machine Scale Set

Question 9

A company stores website static assets in Azure Blob Storage. The assets are updated weekly and must be available for immediate access for 30 days. After 30 days, older versions can be moved to the Cool tier to save costs but must still be accessible within seconds. They want an automated solution. What should they configure?

Accepted Answer

Use Azure Blob Storage lifecycle management rules. Azure Blob Storage lifecycle management rules allow you to automate tier transitions based on age or last modification time. By configuring a rule to move blobs to the Cool tier 30 days after creation, you meet the requirement for immediate access (Cool tier offers sub-second latency) while optimizing costs without manual intervention.

Answer

Set the access tier to Cool on the container

Answer

Manually change the access tier every 30 days

Answer

Use Azure Policy to enforce tier changes

Question 10

A company runs a global e-commerce platform on Azure VMs in a single region. They need to replicate the VMs to a secondary region for disaster recovery. Recovery must be possible within 30 minutes of a failure. The VMs run custom software that must be started in a specific order (database tier before web tier). Which Azure service should they use to meet both the replication and orchestration requirements?

Accepted Answer

Azure Site Recovery with recovery plans. Azure Site Recovery (ASR) with recovery plans is the correct choice because it provides both VM replication to a secondary region and the ability to orchestrate the startup order of VMs. Recovery plans allow you to group VMs into tiers (e.g., database and web) and define dependencies, ensuring the database tier starts before the web tier. ASR meets the 30-minute recovery time objective (RTO) by enabling failover to the secondary region within that timeframe.

Answer

Azure Backup with cross-region restore

Answer

Azure Migrate with replication

Answer

Azure Automation runbooks

Question 11

A company ingests IoT sensor data into Azure Blob Storage. Data is written frequently and is accessed rarely after the first 24 hours. The company must retain the data for exactly 90 days for compliance. They want to minimize storage costs by automatically moving data to the cheapest possible storage tier as soon as possible. Which Azure Blob Storage lifecycle management policy should they implement?

Accepted Answer

Move to Cool tier after 1 day, delete after 90 days. The data is rarely accessed after 24 hours, so moving it to Cool tier after 1 day minimizes cost while still allowing low-latency access. The 90-day deletion aligns with the compliance retention requirement. Cool tier is the cheapest online tier, and moving data there as soon as possible (after 1 day) reduces costs without incurring the early deletion penalty or retrieval latency of Archive tier.

Answer

Move to Archive tier after 1 day, delete after 90 days

Answer

Move to Cool tier after 30 days, delete after 90 days

Answer

Move to Archive tier after 30 days, delete after 90 days

Question 12

A company is deploying a web application on Azure App Service. They need to guarantee that all traffic from the internet goes through a Web Application Firewall (WAF) before reaching the app. The solution must be cost-effective for a single application. Which Azure service should they place in front of the App Service?

Accepted Answer

Azure Application Gateway with WAF.. Azure Application Gateway with WAF is the correct choice because it provides a regional, layer-7 load balancer with built-in Web Application Firewall capabilities, designed to protect web applications from common exploits and vulnerabilities. For a single application, it is more cost-effective than Azure Front Door, which is a global service with higher minimum costs and additional features not required here. Application Gateway can be deployed directly in front of App Service to inspect and filter all internet traffic before it reaches the app.

Answer

Azure Front Door with WAF policy.

Answer

Azure Firewall with application rules.

Answer

Azure Traffic Manager.

Question 13

A company needs to store and analyze petabytes of semi-structured data from IoT devices. The data is append-only and written in time order. They need to support fast queries on time ranges and also aggregate data in real-time. Which Azure data service should they use?

Accepted Answer

Azure Data Explorer. Azure Data Explorer (ADX) is purpose-built for high-performance analysis of large volumes of time-series and semi-structured data. It supports append-only ingestion, optimized time-range queries via its columnar storage and indexing, and real-time aggregation using Kusto Query Language (KQL) with built-in materialized views and update policies.

Answer

Azure Cosmos DB

Answer

Azure SQL Database

Answer

Azure Table Storage

Question 14

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to grant external partners access to an internal application for a limited time (30 days). The access request must be approved by a manager from the partner's organization, and after 30 days the access must automatically expire. They also want to send email reminders 7 days before expiration. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management enables organizations to manage access for external partners through access packages, which can include time-limited assignments, approval workflows (including manager approval from the partner's organization), and automatic expiration with email notifications. This directly meets the requirement for a 30-day access period with manager approval and 7-day reminder emails.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID B2B with Conditional Access

Question 15

A company runs a mission-critical multi-tier application on Azure VMs in West US. The application consists of database VMs, application VMs, and web VMs. During a disaster, the VMs must be recovered in a specific order: database tier first, then application tier, then web tier. The recovery point objective (RPO) is 5 minutes and recovery time objective (RTO) is 15 minutes. The company wants to periodically test the recovery process without impacting production. After failover to East US, the VMs must retain their private IP addresses to avoid DNS propagation delays. Which combination of Azure Site Recovery features should they configure?

Accepted Answer

A recovery plan, test failover, and static IP address assignment. A recovery plan enforces the required startup order (database → application → web), test failover allows non-disruptive validation of the recovery process, and static IP address assignment ensures VMs retain their private IP addresses after failover to East US, avoiding DNS propagation delays. This combination meets the RPO of 5 minutes and RTO of 15 minutes while satisfying the requirement for periodic testing without impacting production.

Answer

A recovery plan, planned failover, and network mapping

Answer

A recovery plan, test failover, and network mapping

Answer

A recovery plan, planned failover, and static IP address assignment