AZ-305 Practice Test 17 — 15 Questions

Question 1

Your organization is implementing a zero-trust security model. You need to ensure that all access to corporate resources from mobile devices is conditional based on device compliance, user risk, and location. Which Microsoft Entra ID feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID are the correct choice because they allow you to enforce access controls based on conditions such as device compliance (via integration with Microsoft Intune), user risk (via integration with Identity Protection), and location (via IP ranges or named locations). This directly supports the zero-trust principle of 'never trust, always verify' by evaluating signals before granting access to corporate resources.

Answer

Identity Protection

Answer

Microsoft Intune

Answer

Microsoft Defender XDR

Question 2

A company runs an Azure SQL Database in a single region. They need to ensure that the database can be restored to any point in time within the last 90 minutes with a granularity of 1 minute. Which feature should they enable?

Accepted Answer

Point-in-time restore. Point-in-time restore (PITR) for Azure SQL Database automatically creates backups every 5-10 minutes and retains them for the default retention period of 7 days (configurable up to 35 days). This allows restoring the database to any second within the retention window, meeting the requirement of 1-minute granularity for the last 90 minutes. The feature is built-in and does not require any additional configuration beyond setting the desired retention period.

Answer

Active geo-replication

Answer

Auto-failover groups

Answer

Long-term backup retention

Question 3

Your company plans to deploy a new application to Azure. The application will be used by external partners. You need to design an identity solution that allows partners to authenticate using their own corporate credentials while ensuring that the application can enforce conditional access policies based on partner device compliance. What should you include in the design?

Accepted Answer

Configure Microsoft Entra B2B collaboration and enable conditional access policies for guest users.. Microsoft Entra B2B collaboration allows you to invite external partners as guest users who can authenticate with their own corporate credentials. You can then enforce conditional access policies, including device compliance checks, on these guest users by targeting the policy to the 'Guest' user type or specific external users.

Answer

Federate your Microsoft Entra tenant with each partner's on-premises Active Directory.

Answer

Create guest user accounts in your Microsoft Entra tenant and assign them application roles.

Answer

Configure Microsoft Entra B2C and federate with partner identity providers.

Question 4

A company uses Microsoft Entra ID. They want to enforce that all users must use multi-factor authentication (MFA) when accessing sensitive applications from outside the corporate network, but allow access without MFA when coming from the corporate office IP range. Which Microsoft Entra ID feature should they use to create this policy?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow administrators to define access controls based on conditions such as user location, device state, and application sensitivity. By creating a policy that requires MFA for all users accessing sensitive applications from outside the corporate network, and excluding the trusted corporate office IP range from the MFA requirement, the company can enforce the desired behavior. This is the correct feature because it directly supports location-based access controls and granular policy conditions.

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID roles

Question 5

Your organization uses Microsoft Purview for data governance. You need to classify sensitive data in Azure SQL Database and automatically apply sensitivity labels. What should you configure?

Accepted Answer

Microsoft Purview Data Map with scanning and labeling. Microsoft Purview Data Map with scanning and labeling is the correct solution because it integrates with Azure SQL Database to automatically scan for sensitive data types (e.g., credit card numbers, social security numbers) and apply sensitivity labels defined in Microsoft Purview Information Protection. This native integration uses the Purview scanning infrastructure to classify data at rest and propagate labels directly to the SQL database, meeting the requirement for automated classification and labeling.

Answer

Azure Information Protection scanner

Answer

Microsoft Sentinel with a workbook

Answer

Azure Policy with built-in SQL classification policy

Question 6

Your company has a hybrid infrastructure with on-premises servers and Azure virtual machines. You need to design a backup strategy that includes on-premises file servers and Azure VMs. The solution must support long-term retention for compliance (7 years) and provide immediate recovery for recent versions. What should you include in the design?

Accepted Answer

Deploy Azure Backup with the Microsoft Azure Recovery Services (MARS) agent for on-premises and the Azure Backup extension for VMs.. Azure Backup with the MARS agent provides long-term retention (up to 99 years) and supports on-premises file servers, while the Azure Backup extension for Azure VMs offers application-consistent snapshots and instant recovery for recent versions. This combination meets the 7-year compliance requirement and immediate recovery needs without additional infrastructure.

Answer

Use Azure Storage account snapshots for on-premises files and Azure VM snapshots for VMs.

Answer

Set up Azure File Sync to sync on-premises files to Azure Files, then back up the Azure file shares.

Answer

Use Azure Site Recovery for both on-premises servers and Azure VMs.

Question 7

A company runs a critical application on Azure SQL Database in the West US region. They need a disaster recovery solution with an RPO of 5 seconds and an RTO of 1 hour. They also need to be able to perform patching and maintenance on the primary without downtime. Which configuration should they implement?

Accepted Answer

Active geo-replication with auto-failover group. Active geo-replication with auto-failover group meets the RPO of 5 seconds (typically under 5 seconds for active geo-replication) and RTO of 1 hour (auto-failover groups can fail over in minutes). It also supports patching and maintenance on the primary without downtime by failing over to a secondary replica during planned maintenance, leveraging the continuous data synchronization between primary and secondary databases in different Azure regions.

Answer

Azure SQL Database backup to geo-redundant storage

Answer

Azure SQL Database with zone-redundant configuration

Answer

Azure SQL Database with failover group using manual failover

Question 8

A company uses Microsoft Entra ID (Microsoft Entra ID) and Microsoft Intune. They want to block all access to internal corporate applications from devices that are not enrolled in Intune and do not meet the company's compliance policies. The solution must apply to all cloud app access seamlessly. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct feature because it enables you to create policies that evaluate device compliance and enrollment status before granting access to cloud applications. By configuring a Conditional Access policy with a condition requiring devices to be marked as compliant and enrolled in Intune, you can block access from non-compliant or unenrolled devices seamlessly across all integrated cloud apps.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Access Reviews

Question 9

Your company is deploying a critical application on Azure VMs. The application requires a static private IP address that does not change even if the VM is stopped and deallocated. The VM must be placed in an availability zone for high availability. Which networking approach should you use?

Accepted Answer

Assign a static private IP address to the VM's NIC and use a standard public load balancer.. A static private IP address assigned to the VM's NIC persists even when the VM is stopped and deallocated, ensuring the application always uses the same private IP. Placing the VM in an availability zone provides high availability by protecting against zonal failures, and a standard public load balancer can distribute traffic across VMs in different zones while preserving the static private IP for each VM.

Answer

Use Azure Firewall to provide static private IP and load balancing.

Answer

Use Azure Traffic Manager to assign static private IP.

Answer

Use Application Gateway with a static private IP.

Question 10

A company uses Azure Kubernetes Service (AKS) to run a containerized microservices application. They need a disaster recovery solution that can automatically fail over to a secondary region if the primary region fails. The solution must minimize data loss for stateful workloads. What should they implement?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct choice because it provides orchestrated replication and failover for Azure VMs and physical workloads, including stateful containers running on AKS. ASR can replicate persistent volumes and application data to a secondary region, enabling automated failover with minimal data loss by using crash-consistent or app-consistent recovery points.

Answer

Azure Backup for AKS

Answer

Azure Front Door

Answer

Azure Traffic Manager

Question 11

Your company uses Microsoft Entra ID for identity management. You need to ensure that users can access corporate resources without passwords while maintaining a high level of security. Which feature should you implement?

Accepted Answer

Passwordless authentication. Passwordless authentication (Option C) is correct because it allows users to access corporate resources without entering a password, using methods like Windows Hello for Business, FIDO2 security keys, or the Microsoft Authenticator app. This eliminates password-related risks (e.g., phishing, credential theft) while maintaining strong security through cryptographic key pairs or biometric verification, aligning with the requirement for both password-free access and high security.

Answer

Azure AD B2C

Answer

Conditional Access policies

Answer

Multifactor authentication (MFA)

Question 12

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to allow users to sign in to multiple SaaS applications using their Microsoft Entra ID credentials without being prompted again for each application. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Single Sign-On (SSO). Single Sign-On (SSO) enables users to authenticate once with Microsoft Entra ID and then access multiple SaaS applications without being prompted again. This works by using standards like SAML 2.0 or OpenID Connect to issue a session token or cookie that is reused across applications, eliminating repeated credential prompts.

Answer

Multi-Factor Authentication (MFA)

Answer

Conditional Access

Answer

Identity Protection

Question 13

A large enterprise wants to enforce zero-trust conditional access policies that use real-time user risk, sign-in risk, and device compliance. Which combination of Microsoft Entra ID features should they use?

Accepted Answer

Microsoft Entra ID Identity Protection and Conditional Access. Microsoft Entra ID Identity Protection provides real-time risk detection for users and sign-ins, while Conditional Access policies can enforce access controls based on those risk signals and device compliance. Together, they enable zero-trust conditional access by blocking or requiring MFA when user or sign-in risk is high, and ensuring only compliant devices can access resources.

Answer

Microsoft Entra ID Privileged Identity Management and Access Reviews

Answer

Microsoft Entra ID B2B and External Identities

Answer

Microsoft Entra ID Domain Services and Managed Identities

Question 14

Refer to the exhibit. You are reviewing the properties of an Azure Storage account. The encryption section shows keySource as Microsoft.Keyvault and infrastructureEncryption enabled. What does infrastructureEncryption mean in this context?

Accepted Answer

It enables double encryption of data at rest. Infrastructure encryption in Azure Storage provides double encryption of data at rest. When enabled, data is encrypted twice: once at the service level using a Microsoft-managed key or a customer-managed key from Azure Key Vault (as indicated by keySource: Microsoft.Keyvault), and a second layer at the infrastructure level using a separate platform-managed key. This ensures that even if one encryption layer is compromised, the second layer protects the data, meeting compliance requirements for highly sensitive workloads.

Answer

It enforces HTTPS for all data in transit

Answer

It automatically rotates the encryption key daily

Answer

It encrypts the encryption key stored in Key Vault

Question 15

You are designing a network topology for a global e-commerce company that operates multiple web applications. The company has three main offices (New York, London, Tokyo) connected via ExpressRoute to Azure. Users access the applications through a public endpoint. The company requires that traffic be routed to the nearest healthy application instance based on geographic location, and that the solution provide automatic failover if an entire region goes down. Additionally, the company wants to protect against DDoS attacks at the network layer. You need to recommend a solution that meets these requirements while minimizing cost. What should you include in the design?

Accepted Answer

Deploy Azure Front Door with geographic routing and enable DDoS protection.. Azure Front Door with geographic routing directs users to the nearest healthy application instance based on geographic location, and it provides automatic failover if an entire region goes down by routing traffic to the next closest healthy region. Front Door also includes built-in DDoS protection at the network layer (Azure DDoS Basic) at no additional cost, which meets the DDoS requirement while minimizing cost. This combination satisfies all requirements without the need for separate, more expensive services.

Answer

Deploy Azure Firewall in each region and use Public IP prefix for egress.

Answer

Deploy Azure Application Gateway v2 with WAF in each region and Azure DDoS Standard protection.

Answer

Deploy Azure Traffic Manager with geographic routing and Azure DDoS Standard protection.