AZ-305 Practice Test 16 — 15 Questions

Question 1

A company is migrating a large on-premises SQL Server database to Azure SQL Managed Instance. They need to minimize downtime during migration. The database is 500 GB and the network link is 1 Gbps. Which migration approach should they recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Database Migration Service with online migration. Azure Database Migration Service (DMS) with online migration mode uses continuous change data capture (CDC) to synchronize ongoing changes from the on-premises SQL Server to Azure SQL Managed Instance, minimizing downtime to a brief cutover window. This approach is ideal for a 500 GB database over a 1 Gbps link, as it avoids the lengthy full data transfer required by offline methods.

Answer

Perform offline backup and restore

Answer

Use transactional replication

Answer

Export BACPAC and import

Question 2

A company runs SQL Server on an Azure virtual machine. They need to ensure high availability within a single Azure region. The solution must provide automatic failover with zero data loss (synchronous replication) and support read-only routing for reporting workloads. Which solution should they implement?

Accepted Answer

SQL Server Always On Availability Group. SQL Server Always On Availability Groups (AG) provide high availability and disaster recovery at the database level. They support synchronous replication with automatic failover, ensuring zero data loss (RPO=0) within a single Azure region. Additionally, AGs allow secondary replicas to be configured as readable, enabling read-only routing for reporting workloads, which directly meets all stated requirements.

Answer

SQL Server Failover Cluster Instance (FCI)

Answer

Azure Site Recovery

Answer

Azure Backup

Question 3

A company runs an Azure SQL Database with active geo-replication configured to a secondary region. The primary region experiences a complete outage. The company needs to promote the secondary database to become the new primary with minimal data loss. Which action should they take?

Accepted Answer

Forced failover. Forced failover is the correct action because it immediately promotes the secondary database to primary without waiting for synchronization, which is necessary during a complete primary region outage. This option minimizes data loss by accepting any unsynchronized data at the secondary, prioritizing availability over consistency. In contrast, planned failover requires synchronous data transfer and fails if the primary is unreachable.

Answer

Planned failover

Answer

Enable geo-replication

Answer

Failover

Question 4

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to allow external business partners to access an internal web application using their own organizational identities. The solution must support self-service sign-up and enforce multi-factor authentication for partner users. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID B2B collaboration. Microsoft Entra ID B2B collaboration is the correct feature because it allows external business partners to access internal applications using their own organizational identities (home directory credentials) without requiring them to have a separate account in your tenant. It supports self-service sign-up through entitlement management and can enforce multi-factor authentication (MFA) via Conditional Access policies that evaluate the partner user's session, even if the partner's home tenant does not enforce MFA.

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Connect

Question 5

A company has multiple on-premises sites and Azure VNets in different regions. They need to connect all networks with a single mesh topology, ensuring that any network can communicate with any other network directly. They also want to minimize administrative overhead. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the correct choice because it provides a managed, global mesh network that automatically connects on-premises sites and Azure VNets across regions using a hub-and-spoke architecture with built-in transitive routing. This eliminates the need to manually configure individual VPN gateways or ExpressRoute circuits for each pair of networks, directly supporting the requirement for any-to-any direct communication with minimal administrative overhead.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Peering Service

Question 6

A company needs to store and retrieve large binary files (e.g., images and videos) for a web application. The data must be accessible via HTTPS URLs and support both public read access for anonymous users and private access for administrators. The solution must be highly durable and cost-effective for storing terabytes of data. Which Azure storage solution should they recommend?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is the correct choice because it is designed for storing large amounts of unstructured data, such as images and videos, and supports both public anonymous read access (via a public container or blob-level access policy) and private access (via shared access signatures or Microsoft Entra ID authentication). It provides HTTPS URL access for direct retrieval, offers 99.9999999999% (11 nines) durability for hot and cool tiers, and is cost-effective for terabytes of data due to its tiered storage options (hot, cool, archive).

Answer

Azure Files

Answer

Azure Queue Storage

Answer

Azure Table Storage

Question 7

Refer to the exhibit. You are an Azure administrator for a company that enforces a policy that no virtual networks or network security groups can be created. However, a developer reports that they successfully created a virtual network. What is the most likely reason the policy did not block the creation?

Accepted Answer

The policy was assigned to a scope that does not include the subscription or resource group where the virtual network was created.. Azure Policy assignments are scoped to a specific management group, subscription, or resource group. If the policy was assigned to a scope that does not include the subscription or resource group where the developer created the virtual network, the policy would not apply, and the creation would succeed. The policy definition itself may be valid, but without proper assignment scope, it cannot enforce the deny effect.

Answer

The policy definition contains a syntax error.

Answer

The policy only applies to network security groups, not virtual networks.

Answer

The policy effect should be 'append' instead of 'deny'.

Question 8

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to generate periodic reports of user sign-ins and audit activities for compliance. They want to store the logs for 1 year. Which Azure service should they use?

Accepted Answer

Azure Monitor Log Analytics workspace with Microsoft Entra ID diagnostic settings. Microsoft Entra ID sign-in and audit logs are retained for only 30 days by default. To store them for 1 year, you must route the logs via diagnostic settings to an Azure Monitor Log Analytics workspace, which allows configurable retention up to 2 years (or more with a commitment tier). This is the only native Azure service that supports long-term retention of Entra ID logs for compliance reporting.

Answer

Microsoft Entra ID sign-in logs and audit logs with retention set to 1 year in the Azure portal

Answer

Azure Storage account with lifecycle management

Answer

Azure Event Hubs for streaming

Question 9

A company wants to store application configuration settings and secrets (e.g., database connection strings, API keys) securely with automatic rotation. Access must be controlled and audited. Which Azure service should they use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct choice because it is designed specifically for securely storing and managing secrets, keys, and certificates. It supports automatic rotation of secrets via integration with Azure managed identities and event grid notifications, and provides fine-grained access control through Azure RBAC and access policies, with full auditing via Azure Monitor and diagnostic logs.

Answer

Azure App Configuration

Answer

Azure Storage Queues

Answer

Azure Service Bus

Question 10

A company uses Microsoft Entra ID for identity management. They need to automate the process of granting access to resources for employees and external partners, and require periodic access reviews to ensure compliance. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management is the correct feature because it enables automation of access request workflows for employees and external partners, including time-limited access packages and periodic access reviews to enforce compliance. This directly matches the requirement for granting access and ensuring ongoing governance through reviews.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Question 11

Your company is migrating a legacy on-premises application to Azure. The application requires persistent storage for configuration files that must be accessible from multiple virtual machines in a virtual network. The storage must be accessible only from within the virtual network and should not be exposed to the internet. Which Azure storage solution should you use?

Accepted Answer

Azure Files with a private endpoint. Azure Files with a private endpoint is the correct choice because it provides fully managed file shares accessible via SMB or NFS protocols, supports persistent storage for configuration files, and ensures the storage is accessible only from within the virtual network by assigning a private IP address from the VNet, eliminating internet exposure. This meets the requirement for multi-VM access with network isolation.

Answer

Azure Disk Storage with shared disks

Answer

Azure NetApp Files with network security groups

Answer

Azure Blob Storage with a service endpoint

Question 12

A company uses Microsoft Entra ID. They want to integrate their security operations with a third-party SIEM tool. They need to export all Microsoft Entra ID sign-in logs and audit logs to the SIEM for analysis. The solution should be automated and near real-time. Which Azure service should they configure?

Accepted Answer

Azure Event Hubs. Azure Event Hubs is the correct service because it provides a high-throughput, low-latency data ingestion platform that can receive streaming diagnostic data from Microsoft Entra ID. By configuring diagnostic settings in Entra ID to stream sign-in and audit logs to an Event Hubs namespace, you enable near real-time export to a third-party SIEM tool via the Event Hubs-compatible endpoint, typically using the AMQP or HTTPS protocol.

Answer

Azure Logic Apps

Answer

Azure Monitor

Answer

Azure Storage

Question 13

A company runs a high-performance computing (HPC) workload on Azure that requires extremely low latency (under 10 microseconds) between multiple VMs for MPI communication. The VMs are part of a single job and must be placed together to minimize network latency. Which VM deployment option should they use?

Accepted Answer

Azure Virtual Machine Scale Sets with a Proximity Placement Group. A Proximity Placement Group (PPG) within a Virtual Machine Scale Set ensures that all VMs are physically located as close as possible within an Azure datacenter, reducing network latency to under 10 microseconds for MPI communication. This is the only option that guarantees co-location of VMs for a single HPC job, as PPGs minimize inter-VM latency by placing VMs in the same rack or cluster.

Answer

Azure Availability Sets

Answer

Azure Virtual Machine Scale Sets across Availability Zones

Answer

Azure Kubernetes Service (AKS)

Question 14

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect and respond to high-risk sign-in events, such as sign-ins from malware-linked IP addresses or leaked credentials. When such risks are detected, they want to require multi-factor authentication (MFA) or block the sign-in. They also need a dashboard to review risk events and generate reports. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect and respond to high-risk sign-in events, such as sign-ins from malware-linked IP addresses or leaked credentials. It provides risk-based conditional access policies that can require MFA or block sign-ins, and it includes a dashboard for reviewing risk events and generating reports. This aligns directly with the scenario's requirements for detection, automated response, and reporting.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Governance

Question 15

Your company runs a mission-critical application on Azure Virtual Machines that requires a Recovery Time Objective (RTO) of 5 minutes and a Recovery Point Objective (RPO) of 1 minute. The application uses a single VM with a managed disk. You need to design a disaster recovery solution that meets these requirements with minimal cost. What should you recommend?

Accepted Answer

Use Azure Site Recovery to replicate the VM to a secondary region with a recovery plan.. Azure Site Recovery (ASR) provides continuous replication with RPO as low as 30 seconds and RTO of minutes when using a recovery plan, meeting the 5-minute RTO and 1-minute RPO requirements. ASR replicates the VM to a secondary region and allows orchestrated failover with minimal cost compared to running a standby VM. This is the only option that satisfies both the RTO and RPO targets for a mission-critical application.

Answer

Configure Azure Backup for the VM with a 1-minute backup frequency.

Answer

Store the managed disk in geo-redundant storage and use Azure Resource Manager templates to redeploy.

Answer

Deploy a second VM in a secondary region and use continuous replication with Azure Migrate.