AZ-305 Practice Test 18 — 15 Questions

Question 1

A company is designing a disaster recovery solution for Azure VMs running a critical application. They need a Recovery Time Objective (RTO) of less than 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The solution should be cost-effective and allow testing without affecting production. Which Azure service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct choice because it provides orchestrated replication and failover for Azure VMs, supporting RPOs as low as 15 minutes (with continuous replication) and RTOs under 1 hour. It also enables non-disruptive test failovers in isolated networks, meeting the requirement for testing without affecting production. ASR is cost-effective for critical workloads as it only charges for replication storage and compute during failover, unlike always-on redundancy solutions.

Answer

Azure Migrate

Answer

Azure Backup

Answer

Azure Front Door

Question 2

Your company is implementing a monitoring solution for Azure virtual machines. You need to collect performance counters and log events from the VMs and send them to a centralized Log Analytics workspace. Which agent should you install on the VMs?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent (AMA) is the current recommended agent for collecting performance counters and log events from Azure VMs and sending them to a Log Analytics workspace. It replaces the legacy Log Analytics agent (MMA) and offers centralized management via data collection rules (DCRs), improved security, and support for both Windows and Linux VMs. The AMA uses the Azure Monitor service pipeline and supports multi-homing to multiple workspaces natively.

Answer

Log Analytics agent (MMA)

Answer

Diagnostics Extension

Answer

Dependency Agent

Question 3

You are designing a hybrid storage solution where on-premises applications need low-latency access to file shares hosted in Azure. The solution must cache frequently accessed files locally and sync changes bidirectionally. Which Azure feature should you use?

Accepted Answer

Azure File Sync. Azure File Sync is the correct choice because it enables bidirectional syncing of Azure file shares with on-premises Windows Servers, caching frequently accessed files locally for low-latency access while automatically syncing changes back to Azure. This meets the hybrid requirement of local caching and bidirectional sync without requiring full migration or dedicated network circuits.

Answer

Azure Data Box

Answer

Azure NetApp Files with ExpressRoute

Answer

Azure Blob Storage with Azure Files migration

Question 4

You are designing an authentication solution for a mobile application that uses Azure AD B2C (now Microsoft Entra External ID). The application needs to support social logins (Google, Facebook) and also allow users to sign in with their corporate Microsoft Entra ID accounts. Which of the following identity providers should you configure?

Accepted Answer

Configure Google and Facebook as social identity providers, and add Microsoft Entra ID as a custom identity provider.. Microsoft Entra External ID (Azure AD B2C) supports social identity providers like Google and Facebook natively, and also allows you to add Microsoft Entra ID as a custom (OpenID Connect) identity provider. This enables corporate users to sign in with their existing Entra ID accounts while external users can use social logins, all within a single B2C tenant.

Answer

Use Microsoft Entra ID as the only identity provider and configure federation with Google and Facebook.

Answer

Use Microsoft Entra External ID with Google and Facebook only, and advise corporate users to create local accounts.

Answer

Configure only Google and Facebook as identity providers, and use Microsoft account for corporate users.

Question 5

A company needs to store sensitive customer data in Azure Blob Storage with encryption at rest using customer-managed keys (CMK) stored in a hardware security module (HSM). Which Azure service should they use to manage the keys?

Accepted Answer

Azure Key Vault Managed HSM. Azure Key Vault Managed HSM is a fully managed, highly available, single-tenant HSM that is FIPS 140-2 Level 3 validated. It allows you to store customer-managed encryption keys (CMKs) in a hardware security module (HSM) for Azure Storage encryption at rest, meeting the requirement for HSM-backed key storage. The Premium tier of Azure Key Vault also supports HSM-backed keys, but the question specifies 'stored in a hardware security module (HSM)', and Managed HSM provides dedicated HSM partitions with stronger isolation and compliance.

Answer

Azure Key Vault (Premium tier)

Answer

Azure Information Protection

Answer

Azure Key Vault (Standard tier)

Question 6

Your organization uses Microsoft Purview to govern data assets across Azure SQL Database, Azure Data Lake Storage, and on-premises SQL Server. You need to ensure that sensitive data such as credit card numbers are automatically detected and classified. What should you configure in Microsoft Purview?

Accepted Answer

Data classification rules. Microsoft Purview's data classification rules are specifically designed to automatically detect and classify sensitive data like credit card numbers across data sources. By configuring classification rules, you define patterns (e.g., regex for credit card numbers) that Purview scans against assets in Azure SQL Database, Azure Data Lake Storage, and on-premises SQL Server, applying sensitivity labels accordingly.

Answer

Data share

Answer

Data catalog

Answer

Data lineage mapping

Question 7

Refer to the exhibit. The JSON snippet shows the properties of a replication-protected item in Azure Site Recovery. What is the MOST LIKELY reason for the replication health being 'Critical'?

Accepted Answer

A planned failover was completed, stopping replication. When a planned failover is completed in Azure Site Recovery, replication is automatically stopped and the replication health status changes to 'Critical' because the protected item is no longer actively replicating to the recovery region. This is expected behavior after a planned failover, as the source and target are now synchronized and replication is disabled to prevent data overwrites. The 'Critical' health indicator in this context reflects the intentional cessation of replication, not a fault.

Answer

The replication storage account is misconfigured

Answer

There is a network connectivity issue between the on-premises site and Azure

Answer

A test failover was initiated but not cleaned up

Question 8

A mission-critical web application must tolerate a full Azure region outage. The business requires automatic failover and global HTTP acceleration. Which two components should be included in the design? (Choose 2.)

Accepted Answer

Deploy the application to at least two Azure regions.. Deploying the application to at least two Azure regions provides geographic redundancy, ensuring that if one entire region fails, the application can still operate from the other region. This is a fundamental requirement for tolerating a full region outage. Option B is correct because Azure Front Door provides global HTTP acceleration and automatic failover by using health probes to monitor endpoint health and routing traffic to healthy origins, which meets the business requirements for both automatic failover and performance.

Answer

Use only availability zones in one region.

Answer

Use Azure Bastion for failover routing.

Question 9

Your organization has a hybrid identity environment with Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to access cloud applications using their on-premises credentials, and also enables single sign-on (SSO) for legacy on-premises applications that do not support modern authentication protocols. What should you recommend?

Accepted Answer

Implement Azure AD Connect with password hash synchronization and Azure AD Application Proxy.. Microsoft Entra Connect with password hash synchronization enables users to authenticate to cloud applications using their on-premises credentials, while Microsoft Entra application proxy provides secure remote access and SSO for legacy on-premises applications that do not support modern authentication protocols (such as Kerberos, SAML, or OAuth). The Application Proxy can pass Kerberos constrained delegation tickets to legacy apps, enabling SSO without requiring those apps to be domain-joined or modified.

Answer

Deploy Azure Active Directory Domain Services and domain-join the legacy application servers.

Answer

Use Azure Active Directory B2B collaboration for internal users.

Answer

Configure Azure AD Seamless SSO and use Azure AD Connect with pass-through authentication.

Question 10

Refer to the exhibit. A role assignment has a condition that controls blob deletion. A user assigned this role tries to delete a blob with tag 'Project' set to 'ProjectB'. What will happen?

Accepted Answer

The deletion is denied because the blob does not have the required tag. The role assignment condition likely requires the blob to have the tag 'Project' set to a specific value (e.g., 'ProjectA'). Since the blob in question has the tag 'Project' set to 'ProjectB', the condition is not satisfied, and the deletion is denied. Option C correctly identifies this mismatch.

Answer

The deletion is allowed because the condition only applies to write operations

Answer

The deletion is allowed because the condition does not affect blob deletion

Answer

The deletion is denied because the condition version is 2.0 and not supported

Question 11

Your company runs a critical web application on Azure Virtual Machines in a single region. You need to design a disaster recovery solution that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The solution must be cost-effective for a planned failover test. What should you do?

Accepted Answer

Configure Azure Site Recovery (ASR) with replication to a paired secondary region and perform regular test failovers.. Azure Site Recovery (ASR) replicates Azure VMs to a paired secondary region with near-synchronous replication, achieving an RPO of 15 minutes and an RTO of 1 hour. It supports cost-effective test failovers by performing non-disruptive drills in an isolated network, validating recovery without impacting production.

Answer

Create a read-only replica of the VMs in another region using Azure SQL Database geo-replication.

Answer

Deploy the VMs across two Azure Availability Zones within the same region.

Answer

Use Azure Backup with daily backups to a Recovery Services vault in a paired region.

Question 12

A company is designing a hybrid storage solution to connect on-premises file shares to Azure. They need to cache frequently accessed files locally for low-latency access while storing all files in Azure. The solution must support SMB protocol and integrate with existing Windows file servers. Which Azure service should they use?

Accepted Answer

Azure File Sync. Azure File Sync is the correct choice because it enables caching of frequently accessed files on-premises via a sync agent installed on Windows Server, while all files are stored in Azure Files. This provides low-latency access for local users and supports SMB protocol, seamlessly integrating with existing Windows file servers through a cloud tiering feature that keeps only hot files locally.

Answer

Azure Blob Storage with NFS 3.0 support

Answer

Azure Files

Answer

Azure NetApp Files

Question 13

A startup needs a cost-effective data storage solution for its application logs. The logs are accessed infrequently but must be available for audit purposes for up to 3 years. The solution should minimize storage costs while allowing data retrieval within 24 hours when needed. Which Azure storage tier should the company recommend?

Accepted Answer

Azure Blob Storage Archive tier. The Archive tier is the most cost-effective option for data that is infrequently accessed and requires retrieval times of up to 15 hours (standard) or 24 hours (high-priority). Since the logs must be available within 24 hours and stored for up to 3 years, Archive meets both the cost and retrieval requirements, as it offers the lowest storage cost among Azure Blob Storage tiers.

Answer

Azure Blob Storage Cool tier

Answer

Azure Blob Storage Hot tier

Answer

Azure Blob Storage Premium tier

Question 14

Your organization plans to deploy Microsoft Entra ID Governance. You need to ensure that access to critical applications is reviewed quarterly by the application owners. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra ID Access Reviews. Microsoft Entra ID Access Reviews (Option D) is the correct feature because it enables recurring, delegated review of user access to applications, groups, or roles. By configuring an access review with quarterly frequency and assigning application owners as reviewers, you directly meet the requirement for periodic attestation of access to critical applications. This is the specific Entra ID capability designed for governance-driven access recertification.

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Entitlement Management

Answer

Microsoft Entra ID Terms of Use

Question 15

Your organization is migrating a legacy application to Azure that requires Windows authentication and a fixed IP address. The application will run on an Azure VM. You need to design a networking solution that ensures the VM retains its IP address even after a reboot and that the application can be reached by on-premises users using its hostname. Which TWO actions should you take? (Choose two.)

Accepted Answer

Assign a static private IP address to the VM's NIC. A is correct because assigning a static private IP address to the VM's NIC ensures the IP address persists across reboots, which is required for Windows authentication and legacy application dependencies that rely on a fixed IP. This is done by setting the private IP allocation method to 'Static' in the NIC's IP configuration, preventing DHCP from assigning a new address after a restart.

Answer

Assign a static public IP address to the VM

Answer

Configure Azure Firewall to forward DNS requests

Answer

Connect to the VM using Azure Bastion for name resolution