AZ-305 Practice Test 19 — 15 Questions

Question 1

Your Azure environment includes multiple subscriptions that are managed by different teams. You need to ensure that all resources are compliant with your company's security policies, and any non-compliant resources must be automatically remediated or reported. Which solution should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy with remediation tasks. Azure Policy with remediation tasks is the correct solution because it allows you to define and enforce security policies across multiple subscriptions, and automatically remediate non-compliant resources using managed identities and DeployIfNotExists or Modify policy effects. This ensures continuous compliance without manual intervention, meeting the requirement for both automatic remediation and reporting.

Answer

Azure Blueprints

Answer

Azure RBAC

Answer

Microsoft Defender for Cloud

Question 2

A company is designing a solution for a data analytics workload. The company receives streaming data from multiple sources, including IoT devices and social media feeds. The data must be ingested, processed in real-time, and stored for historical analysis. The company also wants to use Power BI to create real-time dashboards from the streaming data. You need to recommend a data pipeline architecture. What should you include?

Accepted Answer

Use Azure Event Hubs for ingestion, Azure Stream Analytics for real-time processing, and Power BI for dashboards.. Azure Event Hubs is designed for high-throughput ingestion of streaming data from multiple sources, including IoT devices and social media feeds. Azure Stream Analytics provides real-time processing with low latency, and it can output directly to Power BI for live dashboards, meeting all requirements for ingestion, real-time processing, and visualization.

Answer

Use Azure IoT Hub for ingestion, Azure Stream Analytics for processing, and Power BI for dashboards.

Answer

Use Azure Event Hubs for ingestion, Azure Data Lake Analytics for processing, and Power BI for dashboards.

Answer

Use Azure Event Hubs for ingestion, Azure Synapse Analytics for processing, and Power BI for dashboards.

Question 3

Your company uses Microsoft Entra ID to manage identities for 5,000 employees. You plan to implement Microsoft Entra ID Governance to automate the user provisioning lifecycle for a third-party SaaS application. The application supports SCIM 2.0. You need to ensure that user accounts are automatically created, updated, and disabled in the application based on changes in Entra ID. What should you do?

Accepted Answer

Configure automatic provisioning in Microsoft Entra ID using the SCIM endpoint. Microsoft Entra ID's automatic provisioning feature natively supports SCIM 2.0 endpoints, enabling automated creation, update, and deactivation of user accounts in third-party SaaS applications based on changes in Entra ID. This eliminates the need for custom code and provides a managed, scalable solution for the user provisioning lifecycle.

Answer

Use Microsoft Graph API to write a custom provisioning solution

Answer

Configure Microsoft Entra B2B collaboration for the application

Answer

Publish the application using Microsoft Entra Application Proxy

Question 4

A healthcare company is designing a data storage solution for its electronic health records (EHR) system. The system must store patient data in Azure SQL Database with high availability. The solution must meet the following requirements: - Data must be stored in the East US region with automatic failover to a secondary region in West US in case of a regional outage. - The Recovery Point Objective (RPO) must be less than 5 seconds. - The Recovery Time Objective (RTO) must be less than 1 hour. - The solution must minimize costs while meeting the RPO and RTO. Which Azure SQL Database configuration should the company recommend?

Accepted Answer

Deploy Azure SQL Database with active geo-replication to a secondary server in West US. Configure automatic failover using a failover group.. Active geo-replication with a failover group provides automatic, asynchronous replication to a secondary region (West US) with an RPO of less than 5 seconds and an RTO of less than 1 hour. This configuration meets the high-availability and disaster recovery requirements while minimizing costs compared to higher-tier options.

Answer

Deploy Azure SQL Database Managed Instance with failover group to a secondary instance in West US.

Answer

Deploy Azure SQL Database Business Critical tier with auto-failover group and a secondary replica in a different availability zone within East US.

Answer

Deploy Azure SQL Database General Purpose tier with zone-redundant configuration.

Question 5

A company is using Azure SQL Database for a critical application. They need to ensure that the database is automatically backed up and that backups are retained for 35 days. What should they configure?

Accepted Answer

Configure the point-in-time restore (PITR) retention to 35 days. Azure SQL Database has a default point-in-time restore (PITR) retention period of 7 days, which can be configured up to 35 days. By setting the PITR retention to 35 days, the company ensures that automated backups are retained for the required duration, allowing restoration to any point within that window. This meets the requirement without additional services or configurations.

Answer

Enable long-term retention (LTR) for backups

Answer

Configure active geo-replication

Answer

Use Azure Backup to back up the SQL Database

Question 6

You are designing an identity solution for a multinational company that uses Microsoft Entra ID. The company has a requirement that all users must authenticate using biometrics or FIDO2 security keys. Which Entra ID feature should you configure?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID allow you to enforce authentication strength requirements, such as requiring biometrics or FIDO2 security keys, by targeting specific user groups or applications. This is achieved by configuring a Conditional Access policy with the 'Require multifactor authentication' control and integrating with authentication methods like Windows Hello for Business or FIDO2 security keys, ensuring that only passwordless authentication methods meeting the company's biometric or FIDO2 requirement are permitted.

Answer

Passwordless authentication

Answer

Identity Protection

Answer

Entra Verified ID

Question 7

You are designing a monitoring solution for a critical application hosted on Azure Virtual Machines. The application is latency-sensitive and you need to be alerted when CPU usage exceeds 90% for more than 5 minutes. Which Azure Monitor feature should you use?

Accepted Answer

Metric alert. Metric alerts in Azure Monitor evaluate resource metrics (like CPU percentage) at regular intervals and trigger actions when a threshold is breached for a specified duration. Since the question involves a latency-sensitive application and a numeric threshold (CPU > 90% for 5 minutes), a metric alert is the correct choice because it provides near-real-time, low-latency evaluation directly from the VM's performance counters.

Answer

Service health alert

Answer

Log alert

Answer

Activity log alert

Question 8

A company is designing a hybrid network solution connecting an on-premises data center to Azure. They require high availability with active-active routing and need to support up to 10 Gbps throughput. Which Azure service should they include in the design?

Accepted Answer

ExpressRoute Direct. ExpressRoute Direct provides dedicated, private connections from on-premises to Azure, supporting bandwidths up to 100 Gbps (10 Gbps easily). It enables active-active routing by using two circuits with BGP, meeting high availability and throughput requirements. ExpressRoute FastPath is a performance feature that reduces latency but is not a standalone service and does not itself provide active-active routing or guaranteed throughput; it requires an ExpressRoute circuit and does not replace the need for Direct when dedicated throughput is required.

Answer

Site-to-Site VPN Gateway

Answer

Azure Virtual WAN

Answer

ExpressRoute FastPath

Question 9

Your organization uses Microsoft Entra ID. You need to enforce multifactor authentication (MFA) for all guest users accessing a specific SharePoint Online site. What is the most efficient way to achieve this?

Accepted Answer

Create a Conditional Access policy targeting guest users and the SharePoint Online app.. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA specifically for guest users when they access the SharePoint Online app. This is the most efficient approach as it targets the exact user group (guests) and the specific application (SharePoint Online) without requiring per-user configuration or additional licensing overhead.

Answer

Use SharePoint site permissions to require MFA.

Answer

Enable MFA per-user for each guest account.

Answer

Configure Microsoft Entra Entitlement Management to require MFA.

Question 10

You deploy the above ARM template. The deployment succeeds. However, you cannot access the storage account from the Azure portal. What is the most likely reason?

Accepted Answer

The network ACLs deny all traffic by default, and no allow rules are configured.. The ARM template likely includes a network ACL configuration that, by default, denies all traffic. Without explicit allow rules for the Azure portal's IP ranges or the 'Allow trusted Microsoft services' exception, the portal cannot reach the storage account's management endpoints, resulting in an inability to access it from the portal despite a successful deployment.

Answer

The storage account is configured to require HTTPS traffic only.

Answer

The minimum TLS version is set to TLS 1.2, which is not supported by the portal.

Answer

The encryption key source is set to Microsoft.Storage, which prevents portal access.

Question 11

A multinational company runs a mission-critical application on Azure VMs in the West US region. The application uses Azure SQL Database (Business Critical tier) and Azure Cache for Redis. The company needs to ensure the application can fail over to a secondary region within 5 minutes during a regional outage. The design must minimize data loss. Which solution should you recommend?

Accepted Answer

Deploy VMs in an Azure Site Recovery recovery plan to East US, use Azure SQL Database active geo-replication with auto-failover group, and use Azure Cache for Redis with geo-replication enabled.. It ensures all components can fail over to East US within 5 minutes with minimal data loss. Azure Site Recovery (ASR) provides orchestrated VM replication with RTO typically under 5 minutes. Azure SQL Database active geo-replication with auto-failover groups offers RPO of 5 seconds and RTO of ~1 minute, meeting the 5-minute target and minimizing data loss. Azure Cache for Redis geo-replication (Premium tier) replicates cache data asynchronously, providing a warm standby cache in East US to reduce data loss. Option A fails because availability zones do not protect against a regional outage and geo-restore has longer RTO. Option B uses availability sets (no regional protection) and manual failover for SQL (exceeds 5 minutes). Option C uses Standard tier Redis which lacks geo-replication, leading to data loss.

Answer

Deploy VMs across Azure availability zones in West US, use Azure SQL Database geo-restore to East US, and deploy a second Azure Cache for Redis instance in East US.

Answer

Deploy VMs in an availability set in West US, use Azure Site Recovery to replicate to East US, and configure Azure SQL Database failover group with manual failover.

Answer

Deploy VMs in an Azure Site Recovery recovery plan to East US, use Azure SQL Database active geo-replication with auto-failover group, and deploy Azure Cache for Redis Standard tier in East US.

Question 12

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to integrate their on-premises Active Directory with Microsoft Entra ID to enable single sign-on (SSO) for cloud applications. Users should be able to use the same password for on-premises resources and cloud applications. The company has a large on-premises user base and wants to avoid additional infrastructure for federation. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra ID Connect (Password Hash Synchronization). Password Hash Synchronization (PHS) is the correct choice because it synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID, enabling users to use the same password for both on-premises and cloud resources without requiring any additional federation infrastructure. This meets the requirement for SSO to cloud applications while avoiding the complexity and cost of deploying Active Directory Federation Services (AD FS) or other federation servers.

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Domain Services

Question 13

Refer to the exhibit. You are creating a role assignment in Azure. The role definition ID is for the Contributor role. What is the effect of this assignment?

Accepted Answer

The principal can manage all resources in resource group RG1.. The Contributor role in Azure provides full management access to all resources within the assigned scope, but it cannot grant access to other users (role assignments). Since the scope is resource group RG1, the principal can manage all resources in that resource group, including creating, deleting, and modifying them, but cannot manage access to the resource group itself.

Answer

The principal can read all resources in resource group RG1.

Answer

The principal can manage all resources in the subscription.

Answer

The principal can manage access to resource group RG1.

Question 14

A company runs a stateless web application on multiple Azure VMs behind a load balancer. They want to ensure that if a VM fails, traffic is automatically redirected to healthy VMs. Which Azure service provides this functionality with health probes?

Accepted Answer

Azure Load Balancer. Azure Load Balancer (Option D) is the correct choice because it is designed to distribute traffic across multiple VMs in the same region and uses health probes (TCP or HTTP) to monitor the health of each backend VM. If a probe fails, the load balancer automatically stops sending new traffic to that VM and redirects it to the remaining healthy instances, ensuring high availability for the stateless web application.

Answer

Azure Traffic Manager

Answer

Azure Front Door

Answer

Azure Application Gateway

Question 15

A company runs a mission-critical application on Azure VMs in West US. They need a disaster recovery plan with an RPO of 5 minutes and an RTO of 30 minutes. The application consists of multiple VMs that must be recovered in a specific order: the database VM first, then the front-end VMs. They also need to ensure that after failover, the IP addresses of the VMs are retained to avoid DNS propagation delays. The company wants to test the recovery process periodically without affecting production. Which Azure Site Recovery features should they use?

Accepted Answer

Use recovery plans with virtual machine group ordering and failover network settings to assign static IPs.. Azure Site Recovery recovery plans allow you to define the order of VM recovery using groups, and you can assign static IP addresses via failover network settings to retain IPs after failover. This meets the RPO of 5 minutes (via continuous replication) and RTO of 30 minutes (via orchestrated failover), while test failover can be performed without impacting production.

Answer

Use failover settings with retention IP and test failover.

Answer

Use recovery plans with custom scripts for ordering and Azure Traffic Manager for IP retention.

Answer

Use Azure Site Recovery with Application Consistent Snapshots and ignore IP retention.