AZ-305 Practice Test 23 — 15 Questions

Question 1

A company is designing private access to a PaaS database from workloads in a VNet. The database should not be reachable over its public endpoint. What should be recommended?

Accepted Answer

Private Endpoint with public network access disabled. Private Endpoint with public network access disabled is the correct recommendation because it assigns a private IP address from the VNet to the PaaS database, making it accessible only over the private network. This eliminates exposure to the public internet by disabling the public endpoint, aligning with the requirement that the database should not be reachable over its public endpoint.

Answer

A public IP address with NSG rules

Answer

A route table to the internet gateway

Answer

Azure CDN endpoint

Question 2

Your organization has a policy that all administrative access to Azure resources must be performed using just-in-time (JIT) access. Which Azure service allows you to enable JIT VM access?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides just-in-time (JIT) VM access, which locks down inbound traffic to Azure VMs by creating network security group (NSG) rules that deny all inbound traffic except for specific ports. When a user requests access, Defender for Cloud temporarily creates an allow rule for the requested ports and source IP, then automatically removes it after the configured time period. This directly enforces the policy that administrative access must be JIT.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure AD Privileged Identity Management

Question 3

Your organization has 500 users in Microsoft Entra ID. You need to ensure that users can only access Microsoft 365 apps from compliant devices (compliant with Intune policies). Users are already enrolled in Intune. The compliance policies are defined. You need to configure the access control mechanism. What should you do?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant.. Conditional Access in Microsoft Entra ID is the mechanism that enforces access controls based on signals like device compliance. By creating a policy that requires the device to be marked as compliant, you ensure that only devices meeting Intune compliance policies can access Microsoft 365 apps. This directly addresses the requirement without blocking all access or relying on automatic revocation.

Answer

Create a Conditional Access policy that blocks all access and then create exclusions for compliant devices.

Answer

Configure Intune compliance policies to automatically revoke access for non-compliant devices.

Answer

Create a Conditional Access policy that requires MFA based on location.

Question 4

Your organization is designing a monitoring solution for a critical application running on Azure VMs. You need to collect performance metrics and logs from the VMs and send them to a centralized Log Analytics workspace. You also need to visualize the data in near real-time. Which combination of services should you use?

Accepted Answer

Azure Monitor Agent and Azure Workbooks. Azure Monitor Agent is the current recommended agent for collecting performance metrics and logs from Azure VMs and sending them to a Log Analytics workspace. Azure Workbooks provide interactive, near real-time visualizations by querying the workspace data. This combination meets the requirements for centralized collection and visualization without unnecessary overhead.

Answer

Azure Diagnostics extension and VM Insights

Answer

Azure Monitor Agent and Azure Sentinel

Answer

Log Analytics Agent and Azure Dashboards

Question 5

You are designing a solution to securely store secrets, keys, and certificates for a cloud application. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it is specifically designed to securely store and manage secrets, encryption keys, and certificates. It provides centralized control with hardware security module (HSM) backed keys, access policies, and audit logging, meeting the core requirement for a cloud application's secure storage.

Answer

Azure App Configuration

Answer

Azure Managed HSM

Answer

Azure Storage

Question 6

A company is designing a hub-spoke network topology across multiple Azure regions. They plan to deploy a third-party network virtual appliance (NVA) in the hub for traffic inspection. They require that all traffic between spokes in different regions must be routed through the hub NVA, and they want to minimize the number of peered connections. Which solution should they implement?

Accepted Answer

VNet peering with user-defined routes (UDRs) in each spoke pointing to the NVA IP in the hub. VNet peering combined with user-defined routes (UDRs) allows traffic between spokes in different regions to be forced through the NVA in the hub for inspection. By configuring UDRs in each spoke with the next hop set to the NVA's private IP, you ensure inter-spoke traffic traverses the hub without requiring a full mesh of peering connections. This minimizes the number of peered connections (only hub-to-spoke peering is needed) while meeting the routing requirement.

Answer

Azure Virtual WAN with a secured hub using Azure Firewall

Answer

Azure VNet-to-VNet VPN gateways between all spokes

Answer

Azure ExpressRoute with private peering

Question 7

Refer to the exhibit. You are implementing an Azure Policy to control VM SKU deployment. You assign this policy to a subscription. A developer attempts to deploy a virtual machine with SKU Standard_DS2_v2. What is the outcome?

Accepted Answer

The deployment is denied.. The Azure Policy in the exhibit uses a 'deny' effect, which explicitly blocks any deployment that does not match the allowed VM SKUs. Since Standard_DS2_v2 is not in the allowed list, the policy engine evaluates the request during deployment and rejects it before any resource is created. This results in the deployment being denied entirely, not just audited or flagged.

Answer

The deployment is audited and logged.

Answer

The deployment is allowed.

Answer

The VM is deployed but flagged as non-compliant.

Question 8

Your company requires that all administrative actions in Azure subscriptions be logged and retained for seven years. Which service should you use to collect and store these logs?

Accepted Answer

Azure Activity Log. The Azure Activity Log (now part of Azure Monitor) records all control-plane operations (create, update, delete) on Azure resources and can be retained for up to seven years by configuring a diagnostic setting to stream the logs to a Log Analytics workspace or Azure Storage. This meets the requirement for logging and long-term retention of administrative actions.

Answer

Azure Monitor Metrics

Answer

Azure Resource Health

Answer

Microsoft Entra ID audit logs

Question 9

Which THREE components are required to implement a disaster recovery solution for Azure SQL Database using failover groups? (Choose three.)

Accepted Answer

A failover group that includes both servers. A failover group is the core orchestration component that manages the replication and automatic or manual failover of multiple databases between a primary and secondary Azure SQL Database server. It requires both a primary server in one region and a secondary server in another region to be included in the group, enabling a coordinated disaster recovery plan with a defined failover policy.

Answer

Zone-redundant configuration on the primary database

Answer

Active geo-replication configured on the primary database

Question 10

A manufacturing company is designing an IoT solution to monitor equipment in real-time. Thousands of sensors send telemetry data every second. The data must be ingested, processed, and stored for analysis. The solution must handle high throughput and provide low-latency analytics. Additionally, the company wants to use Azure Machine Learning to predict equipment failures based on historical data. You need to design a data pipeline that meets these requirements. What should you include in the design?

Accepted Answer

Use Azure IoT Hub to ingest data, Azure Stream Analytics for real-time processing, and Azure Blob Storage for long-term storage.. Azure IoT Hub is designed for secure, high-throughput ingestion from millions of IoT devices, Azure Stream Analytics provides low-latency, real-time processing using SQL-like queries, and Azure Blob Storage offers cost-effective, durable long-term storage for historical data. This combination directly meets the requirements for real-time monitoring and supports downstream Azure Machine Learning workloads by storing historical telemetry in a format easily accessible for model training.

Answer

Use Azure IoT Hub to ingest data, Azure Cosmos DB for storage, and Azure Functions for processing.

Answer

Use Azure IoT Hub to ingest data, Azure Data Lake Storage for storage, and Azure Stream Analytics for processing.

Answer

Use Azure Event Hubs to ingest data, Azure Databricks for processing, and Azure Blob Storage for storage.

Question 11

Your organization is deploying a critical application on Azure virtual machines. You need to ensure that the VMs are distributed across multiple fault domains and update domains within an availability set. You create an availability set with 3 fault domains and 5 update domains. How many VMs can you add to this availability set to maximize fault tolerance?

Accepted Answer

Unlimited. B is correct because Azure availability sets do not limit the number of VMs you can place into them; you can add an unlimited number of VMs. The fault domains (3) and update domains (5) define the maximum distribution groups, but Azure will place VMs across these domains as evenly as possible. Adding more VMs beyond the number of fault or update domains does not reduce fault tolerance—it simply means multiple VMs will share the same fault or update domain, but the set still provides the best possible distribution given the defined domain counts.

Answer

5 VMs

Answer

15 VMs

Answer

3 VMs

Question 12

Which TWO of the following are valid options to achieve high availability for Azure SQL Database? (Choose two.)

Accepted Answer

Deploy a zone-redundant Azure SQL Database. Azure SQL Database offers zone-redundant configuration that automatically replicates databases across multiple Azure Availability Zones within the same region, providing an SLA of 99.995% uptime. This built-in high availability feature uses quorum-based commit and automatic failover without any manual intervention, ensuring data durability and business continuity during zone-level failures.

Answer

Deploy a single database with locally redundant storage (LRS)

Answer

Configure manual failover to a secondary replica in the same region

Answer

Configure SQL Server Always On availability groups

Question 13

You are designing a storage solution for a global e-commerce platform that must serve users from multiple regions with low latency. The data includes product catalog (read-heavy, rarely updated) and user session state (write-heavy, short-lived). Which combination of Azure services meets the requirements?

Accepted Answer

Azure Cosmos DB for session state and Azure Front Door with Azure CDN for catalog.. Azure Cosmos DB is ideal for session state because it offers multi-region writes with single-digit-millisecond latency and automatic failover, meeting the write-heavy, short-lived requirements. Azure Front Door with Azure CDN provides global load balancing and caching for the read-heavy, rarely updated product catalog, ensuring low-latency content delivery from the nearest point of presence.

Answer

Azure Cache for Redis for session state and Azure Front Door for catalog.

Answer

Azure Table Storage for session state and Azure Front Door for catalog.

Answer

Azure SQL Database with geo-replication for both.

Question 14

A company deploys a containerized application on Azure Kubernetes Service (AKS). They need to expose the application to the internet and provide TLS termination. The solution must also include a Web Application Firewall (WAF) to protect against common attacks. Which Azure service should they use as the ingress controller?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a layer-7 load balancer that can act as an ingress controller for AKS, providing TLS termination and a built-in Web Application Firewall (WAF) to protect against common attacks like SQL injection and cross-site scripting. It integrates directly with AKS via the Application Gateway Ingress Controller (AGIC) add-on, allowing it to route external HTTP/HTTPS traffic to containerized applications while offloading SSL/TLS processing and enforcing WAF policies at the edge.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 15

Your company uses Microsoft Entra ID for identity management. You need to design a monitoring solution for sign-in logs to detect suspicious activity. Which TWO Azure services should you include in the design?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (Option B) is correct because it provides Cloud Access Security Broker (CASB) capabilities that analyze sign-in logs for anomalous behavior, such as impossible travel, suspicious IP addresses, and credential theft. It integrates with Microsoft Entra ID to detect and respond to risky sign-in events in real time, making it a core component for monitoring suspicious activity.

Answer

Azure Monitor

Answer

Microsoft Purview

Answer

Log Analytics workspace