AZ-305 Practice Test 25 — 15 Questions

Question 1

Your company is migrating a critical on-premises database to Azure SQL Managed Instance. The database is 500 GB and requires minimal downtime during migration. You need to choose the best migration approach. What should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Database Migration Service with online migration.. Azure Database Migration Service (DMS) with online migration is the correct choice because it supports minimal downtime by continuously replicating changes from the source SQL Server to Azure SQL Managed Instance using a log-based change capture mechanism. This allows you to cut over to the target with only a brief pause, meeting the critical requirement for a 500 GB database.

Answer

Use the export/import bacpac method.

Answer

Use Azure Data Factory to copy data.

Answer

Use transactional replication.

Question 2

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to enable users to reset their own passwords without contacting the help desk. They also want to enforce multi-factor authentication (MFA) during the password reset process. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Microsoft Entra ID Self-Service Password Reset (SSPR). Microsoft Entra ID Self-Service Password Reset (SSPR) enables users to reset their own passwords without help desk intervention. When combined with Microsoft Entra ID Conditional Access, SSPR can enforce multi-factor authentication (MFA) during the password reset process, meeting both requirements.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Question 3

You are designing a monitoring solution for a cloud-native application that uses Azure Functions, Azure Storage, and Azure Cosmos DB. The solution must provide centralized log collection and analysis, enable proactive alerting on application errors, and support long-term log retention for compliance (7 years). What should you include in the design?

Accepted Answer

Configure diagnostic settings for each Azure resource to send logs and metrics to a Log Analytics workspace.. It leverages Log Analytics workspace as a centralized destination for diagnostic settings from Azure Functions, Storage, and Cosmos DB, enabling unified log collection, Kusto Query Language (KQL)-based analysis, proactive alerting, and long-term retention (up to 7 years) for compliance. This design satisfies all requirements: centralized logging, alerting on application errors, and archival-grade retention.

Answer

Use Azure Storage with cool tier for logs and enable Azure Storage Analytics logs.

Answer

Store logs in Azure Monitor Metrics with a retention of 93 days.

Answer

Use Application Insights to collect logs and set retention to 90 days, then export to Azure Blob Storage for archival.

Question 4

A company uses Microsoft Entra ID. They want to require users to use multi-factor authentication when accessing the Azure portal from any device. They do not want to require MFA for other applications. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access policy targeting Azure Portal. Conditional Access policies allow granular control over authentication requirements based on conditions such as application, user, location, or device state. By creating a policy that targets the 'Microsoft Azure Management' cloud app and requires multi-factor authentication, you can enforce MFA specifically for the Azure portal without affecting other applications. This provides the precise control requested, unlike broader or legacy methods.

Answer

Per-user MFA (legacy)

Answer

Security defaults

Answer

Identity Protection

Question 5

A company needs to store millions of small JSON files (average 10 KB each) for a serverless application. The data must be accessed via HTTPS and support high read throughput. Which Azure storage solution is most cost-effective?

Accepted Answer

Azure Blob Storage (general-purpose v2, hot tier). Azure Blob Storage (general-purpose v2, hot tier) is the most cost-effective solution because it provides native HTTPS access, high throughput for read-heavy workloads, and low-cost storage for small objects like JSON files. The hot tier optimizes for frequent access, and GPv2 accounts support the high request rates needed for millions of small files without premium pricing.

Answer

Azure Files (standard)

Answer

Azure Cosmos DB

Answer

Azure Table Storage

Question 6

Refer to the exhibit. An Azure Policy is assigned to a subscription. A user tries to create a blob container via the Azure portal and receives a deny error. What is the most likely reason?

Accepted Answer

The policy denies creation of blob containers. The Azure Policy assigned to the subscription includes a policy definition that explicitly denies the creation of blob containers. When the user attempts to create a blob container via the Azure portal, Azure Policy evaluates the request against the assigned policies and returns a deny error because the action violates the policy rule. This is the most direct and likely reason for the denial.

Answer

The blob container requires immutable storage

Answer

The user is trying to enable public access on the container

Answer

The storage account does not have encryption enabled

Question 7

A company uses Azure NetApp Files for high-performance file shares accessed by Linux VMs. They need to reduce latency for read-heavy workloads. Which configuration should you implement?

Accepted Answer

Enable read-only cache on the volume. Azure NetApp Files supports a read-only cache option on volumes, which stores frequently accessed data in a high-speed cache (SSD-based) local to the compute resources. This reduces read latency for read-heavy workloads by serving data from the cache instead of the underlying storage tier. The cache is transparent to the Linux VMs and requires no application changes.

Answer

Migrate to Azure Files with Azure File Sync

Answer

Disable the export policy to allow all clients

Answer

Mount the volume using SMB protocol

Question 8

Your organization uses Microsoft Entra ID with P2 licensing. You need to implement a strategy to automatically detect and remediate risky sign-ins without requiring user interaction for low-risk events. What should you configure?

Accepted Answer

Identity Protection sign-in risk policy set to allow access and log for low risk, and require MFA for medium and above. The Identity Protection sign-in risk policy allows you to automatically respond to sign-in risk levels. By configuring it to 'allow access' and 'log' for low risk, you meet the requirement of no user interaction for low-risk events, while requiring MFA for medium and above ensures remediation for higher-risk sign-ins without manual intervention.

Answer

Conditional Access policy with session control requiring MFA for all sign-ins

Answer

Identity Protection user risk policy set to block high risk

Answer

Identity Protection sign-in risk policy set to allow access with MFA for medium and above

Question 9

Your company, Contoso Ltd., is a global financial services firm with a primary data center in London and a disaster recovery site in Paris. They are migrating their on-premises SQL Server databases to Azure. The databases include: (1) a 2-TB customer database with high transaction throughput, requiring an RPO of 5 seconds and an RTO of 30 seconds; (2) a 500-GB reporting database that is read-only and can tolerate an RPO of 1 hour and an RTO of 2 hours; (3) a 100-GB archival database that is accessed once a month. The solution must minimize costs while meeting requirements. You need to recommend a storage and database strategy for each database. What should you recommend?

Accepted Answer

Use Azure SQL Database with active geo-replication for the customer database, geo-restore for the reporting database, and long-term retention for the archival database.. It aligns the recovery objectives and cost constraints for each database. The customer database requires an RPO of 5 seconds and RTO of 30 seconds, which active geo-replication can meet by continuously replicating transactions to a secondary region with an RPO of 5 seconds and RTO of 30 seconds (including failover time). The reporting database tolerates an RPO of 1 hour and RTO of 2 hours, making geo-restore (which restores from geo-redundant backups with up to 1-hour RPO) a cost-effective choice. The archival database is accessed monthly, so long-term retention (LTR) backups stored in Azure Blob Storage minimize cost while meeting the infrequent access pattern.

Answer

Use Azure SQL Managed Instance for all databases with auto-failover groups.

Answer

Use Azure Cosmos DB for the customer database, Azure SQL Database for reporting, and Azure Blob Storage for archival.

Answer

Use Azure SQL Database with active geo-replication for all databases.

Question 10

You are designing a storage solution for a media company that needs to store large video files (up to 50 GB each) and serve them to a global audience with low latency. The solution must be cost-effective and support resumable uploads. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large unstructured data like video files, and Azure CDN ensures low-latency global delivery. Blob Storage natively supports resumable uploads via block blob APIs, making additional services like Azure Files unnecessary. This solution is cost-effective due to Blob Storage's tiered pricing and CDN edge caching.

Answer

Azure Files with Azure File Sync and Azure CDN.

Answer

Azure Disk Storage with Azure Load Balancer.

Answer

Azure NetApp Files with Azure Front Door.

Question 11

A company uses Microsoft Entra ID. They want to block all access to corporate applications from devices that are not managed by their organization. They require that only devices enrolled in Microsoft Intune and compliant with company policies can access company resources. Which Microsoft Entra ID feature should they use?

Accepted Answer

Conditional Access policy requiring device compliance. Conditional Access policies in Microsoft Entra ID can enforce device compliance as a condition for granting access. By configuring a policy that requires devices to be marked as compliant in Microsoft Intune, only devices enrolled and meeting company policies can access corporate applications, effectively blocking unmanaged devices.

Answer

Identity Protection with user risk policy

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Join process

Question 12

Drag and drop the steps to set up Azure Key Vault for storing secrets and access them from an Azure function into the correct order.

Accepted Answer

Create vault, Add secret, Grant access, Configure references, Test. The correct sequence for setting up Azure Key Vault with an Azure function begins with creating the vault, then adding the secret. Next, grant the function app's managed identity access to the vault (using an access policy). After that, configure app settings or references in the function app to point to the secret. Finally, test the function to ensure it can retrieve the secret successfully. Common mistakes include misordering the grant access and configure references steps, or attempting to add secrets or configure references before the vault exists.

Answer

Create vault, Add secret, Configure references, Grant access, Test

Answer

Create vault, Configure references, Add secret, Grant access, Test

Answer

Add secret, Create vault, Grant access, Configure references, Test

Question 13

Drag and drop the steps to implement Azure Site Recovery for a Hyper-V VM into the correct order.

Accepted Answer

Create the vault, then ensure network connectivity, then install the provider and agent, then create and apply a replication policy, then enable replication.. First, create the vault. Then ensure network connectivity. Install the provider and agent. Create and apply a replication policy. Finally, enable replication.

Answer

Install the provider and agent, then create the vault, then ensure network connectivity, then create and apply a replication policy, then enable replication.

Answer

Create the vault, then ensure network connectivity, then create and apply a replication policy, then install the provider and agent, then enable replication.

Answer

Enable replication, then create the vault, then ensure network connectivity, then install the provider and agent, then create and apply a replication policy.

Question 14

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution that automatically responds to incidents involving high-severity alerts. The response should include creating an incident in Microsoft Teams and sending an email to the security team. What should you use?

Accepted Answer

Microsoft Sentinel automation rules and playbooks. Microsoft Sentinel automation rules and playbooks (built on Azure Logic Apps) are specifically designed to orchestrate automated responses to security incidents. When a high-severity alert triggers an incident, an automation rule can invoke a playbook that creates a Microsoft Teams message and sends an email via connectors like Office 365 Outlook, meeting the exact requirements.

Answer

Azure Policy with remediation tasks

Answer

Azure Monitor alert rules with action groups

Answer

Microsoft Defender for Cloud security alerts

Question 15

A company uses Microsoft Entra ID. They need to automatically block sign-ins from users whose accounts have been identified as high-risk for compromise. They also want users to be prompted to reset their password when the risk is detected. Which Microsoft Entra ID feature should they use?

Accepted Answer

Identity Protection with user risk policy. Identity Protection with a user risk policy is the correct feature because it allows automatic blocking of sign-ins when a user's account is flagged as high-risk by Microsoft's machine learning models. Additionally, the policy can be configured to require a secure password reset (self-service password reset) as a remediation action, directly meeting both requirements.

Answer

Conditional Access with location policy

Answer

Microsoft Entra ID MFA

Answer

Microsoft Entra ID Privileged Identity Management