AZ-305 Practice Test 26 — 15 Questions

Question 1

Your company is deploying Microsoft Entra ID Governance and needs to ensure that guest users' access to internal applications expires after 90 days. Which feature should you configure?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID Governance allows you to create access packages that govern guest user access to internal applications. You can configure an access package with a specific expiration policy, such as setting the access to expire after 90 days, ensuring automatic removal of guest access without manual intervention.

Answer

Privileged Identity Management (PIM)

Answer

Access reviews

Answer

Conditional Access policies

Question 2

Your company uses Microsoft Entra ID for identity management. You need to ensure that only devices compliant with your company's security policies can access corporate resources. Which solution should you implement?

Accepted Answer

Conditional Access with device compliance policies from Microsoft Intune. Conditional Access in Microsoft Entra ID allows you to enforce access controls based on conditions, including device compliance. By integrating with Microsoft Intune, you can define device compliance policies (e.g., requiring encryption, a minimum OS version, or anti-malware status) and then configure a Conditional Access policy to block or grant access only to devices that are marked as compliant. This directly ensures that only compliant devices can access corporate resources.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Sentinel

Answer

Microsoft Defender XDR

Question 3

A financial services company runs a critical SQL Server database on Azure VMs. They require a failover solution that provides automatic detection of database health issues and automatically fails over to a secondary replica in another Azure region with no data loss and sub-minute RPO. What should they use?

Accepted Answer

SQL Server Always On Availability Groups with automatic failover. SQL Server Always On Availability Groups with automatic failover is the correct choice because it supports synchronous data replication between primary and secondary replicas, ensuring zero data loss (RPO=0) and sub-minute RPO. Automatic failover requires a quorum-based health detection mechanism (using Windows Server Failover Clustering) that monitors database health and triggers failover to a secondary replica in another Azure region without manual intervention, meeting the strict RPO and automatic failover requirements.

Answer

Azure SQL Database geo-replication

Answer

Azure SQL Managed Instance failover groups

Answer

Azure Backup for SQL Server

Question 4

A company needs to connect its on-premises data center to Azure for hybrid workloads. The connection must be private, dedicated, and provide guaranteed bandwidth. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a private, dedicated connection from on-premises to Azure, bypassing the public internet. It offers guaranteed bandwidth, higher reliability, and lower latency compared to VPN-based solutions, making it ideal for hybrid workloads requiring consistent performance.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 5

A company uses Microsoft Entra ID Premium P2. They need to automatically detect users with high-risk sign-ins (e.g., from anonymous IP addresses or leaked credentials) and require them to reset their password. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Identity Protection. Identity Protection is the correct feature because it is specifically designed to detect and remediate risky sign-ins, including those from anonymous IP addresses or leaked credentials. It uses machine learning to assign a risk level to each sign-in and user, and can automatically enforce password resets when high-risk events are detected, aligning with the requirement for automated detection and remediation.

Answer

Privileged Identity Management

Answer

Conditional Access

Answer

Access Reviews

Question 6

You execute the above PowerShell script to create a Windows VM in Azure. After the script completes, you try to RDP to the public IP address but the connection fails. What is the most likely reason?

Accepted Answer

The network interface is not attached to the VM.. The PowerShell script creates a VM but does not explicitly associate the network interface (NIC) with the VM. In Azure, a NIC must be attached to a VM for network connectivity; without this association, the VM has no network path, and RDP (TCP/3389) cannot reach the VM even if a public IP and NSG rules are correctly configured.

Answer

The public IP address is not assigned correctly.

Answer

The NSG rule blocks RDP traffic.

Answer

The VM size does not support RDP.

Question 7

Refer to the exhibit. You are deploying a Log Analytics workspace using an ARM template with the parameters shown. Your compliance team requires that all log data be retained for at least 2 years. Which parameter value should you modify?

Accepted Answer

retentionInDays. The `retentionInDays` parameter controls how long log data is retained in a Log Analytics workspace. To meet the compliance requirement of at least 2 years (730 days), you must set this value to 730 or higher. The default retention is 30 days for free tiers and up to 730 days for paid tiers, but the parameter must be explicitly modified to enforce the 2-year retention.

Answer

workspaceName

Answer

sku

Answer

dailyQuotaGb

Question 8

Your company has a Microsoft Entra ID tenant with 10,000 users. You plan to grant external partners access to a specific SharePoint Online site using Microsoft Entra B2B collaboration. You need to ensure that partners can authenticate using their own corporate credentials. What should you configure?

Accepted Answer

Microsoft Entra B2B collaboration with external identities. Microsoft Entra B2B collaboration allows external partners to authenticate using their own corporate credentials (such as Microsoft Entra ID, Microsoft account, or other identity providers) without requiring a separate password or local account. This is the correct solution because it directly supports the requirement for partners to use their own identity providers, enabling seamless access to the SharePoint Online site via guest user invitations.

Answer

Cross-tenant synchronization

Answer

Conditional Access policy for guest users

Answer

Microsoft Entra guest user accounts with password

Question 9

An Azure SQL Database supports a customer-facing application. The company requires automatic failover to a paired region with minimal administrative action. Which feature should be recommended?

Accepted Answer

Auto-failover group. Auto-failover groups in Azure SQL Database enable automatic, synchronous or asynchronous replication of databases to a paired region, with a built-in listener endpoint that handles transparent failover. This meets the requirement for minimal administrative action because failover can be triggered automatically based on the built-in grace period and health monitoring, without manual intervention.

Answer

Zone-redundant storage only

Answer

SQL elastic pool only

Answer

Azure Backup vault only

Question 10

Refer to the exhibit. You need to enable public access to the storage account for a specific IP address while keeping the default action as Deny. What should you do?

Accepted Answer

Add an IP rule with the specific IP address to the ipRules array.. The Azure Storage account firewall allows you to create IP rules that grant access to specific public IP addresses or ranges while keeping the default action as Deny. By adding an IP rule with the specific IP address to the `ipRules` array, you explicitly allow that IP through the firewall, and all other traffic is denied by the default rule. This is the standard method to enable selective public access without changing the default deny behavior.

Answer

Set the bypass to None to allow all traffic.

Answer

Set the networkAcls to an empty list to remove restrictions.

Answer

Change the defaultAction to Allow and remove the Deny rule.

Question 11

Your organization is building a serverless application that processes events from Azure Event Hubs and stores results in Azure Cosmos DB. The processing logic must be scalable and cost-effective, with no idle costs. Which compute service should you use?

Accepted Answer

Azure Functions. Azure Functions is the correct choice because it provides a serverless, event-driven compute service that can be triggered directly by Azure Event Hubs. It scales automatically based on the number of events, and you only pay for execution time, resulting in zero idle costs. This makes it ideal for processing streaming events in a cost-effective, scalable manner without managing infrastructure.

Answer

Azure Container Instances

Answer

Azure Logic Apps

Answer

Azure Kubernetes Service

Question 12

Refer to the exhibit. You have an Azure Storage account with the settings shown. A developer reports that they cannot access the storage account from their Azure VM that is connected to subnet-a. The VM's subnet ID matches the one in the rule. What is the most likely cause of the issue?

Accepted Answer

The subnet does not have a service endpoint for Microsoft.Storage enabled. The most likely cause is that the subnet does not have a service endpoint for Microsoft.Storage enabled. When a storage account firewall rule allows access from a specific subnet, that subnet must have a service endpoint configured for Microsoft.Storage; otherwise, traffic from the VM is treated as originating from the VM's public IP and is blocked by the firewall. The exhibit shows a firewall rule for the subnet, but without the service endpoint, the rule is ineffective.

Answer

The storage account requires HTTPS and the VM is using HTTP

Answer

The storage account does not have a firewall rule for the VM's public IP

Answer

The storage account uses GRS replication which is not supported with network rules

Question 13

A financial services company is migrating its on-premises SAP HANA database to Azure. The database requires high IOPS and low latency with a capacity of 4 TB. They need to choose a storage solution that supports SAP HANA certified configurations. Which Azure storage solution should they use?

Accepted Answer

Azure Ultra Disk Storage. Azure Ultra Disk Storage is the correct choice because it is the only Azure managed disk that is SAP HANA certified for high IOPS and sub-millisecond latency, which is critical for SAP HANA workloads. It supports up to 300,000 IOPS and 2,000 MB/s throughput per disk, and can be provisioned with up to 64 TB capacity, easily covering the 4 TB requirement. Premium SSD v2 is not SAP HANA certified for production databases, and Azure NetApp Files, while offering high performance, is not a managed disk and requires specific NFS configurations that may not meet SAP HANA's strict certification requirements for block storage.

Answer

Azure Premium SSD v2

Answer

Azure Standard HDD

Answer

Azure NetApp Files

Question 14

Your company, Contoso Ltd., operates a global e-commerce platform hosted on Azure. The architecture consists of: (1) A web front-end running on Azure App Service in multiple regions (East US, West Europe, Southeast Asia). (2) A microservices backend running on Azure Kubernetes Service (AKS) in East US. (3) A SQL Database in East US with geo-replication to West Europe and Southeast Asia for read scaling. (4) Azure Redis Cache for session state. (5) Azure Front Door for global load balancing. The platform experiences periodic traffic spikes, and during a recent spike, users reported slow page loads and intermittent errors. The operations team observed that the SQL Database in East US reached 100% DTU consumption, causing timeouts. The geo-replicated databases in other regions were underutilized. The application logic is read-heavy but also writes to a separate write-only table. You need to design a solution to improve scalability and reduce database load. The solution must: minimize latency for users, ensure write consistency, and handle traffic spikes without over-provisioning. What should you do?

Accepted Answer

Configure read-only routing in the application connection string to use the geo-replicated databases for read queries, and keep writes directed to the primary.. It leverages the existing geo-replicated SQL Databases for read scaling without additional cost. By configuring read-only routing in the application connection string, read queries are automatically directed to the readable secondary replicas in West Europe and Southeast Asia, offloading the primary East US database. This reduces DTU consumption on the primary while maintaining write consistency, as all writes still go to the primary. Azure SQL Database's active geo-replication supports this pattern, and Azure Front Door can route users to the nearest region for low latency.

Answer

Upgrade the SQL Database in East US to a higher DTU tier and enable auto-scaling.

Answer

Implement a second-level cache using Azure Cache for Redis with a local cache pattern in the web front-end.

Answer

Shard the database by customer region and deploy shards in each region.

Question 15

Refer to the exhibit. A user reports they cannot access a secret in the vault 'vault-prod'. The user has a Contributor role at the subscription scope and a Key Vault Secrets User role at the specific vault scope. What is the most likely reason for the failure?

Accepted Answer

The vault uses access policies instead of RBAC for authorization.. The user has the Key Vault Secrets User role at the vault scope, which grants read permissions to secrets via Azure RBAC. However, if the vault is configured to use access policies instead of RBAC for authorization, the RBAC role assignment is ignored. In that case, the user must be granted explicit permissions through the vault's access policy to read secrets. The Contributor role at subscription scope does not include data plane permissions for Key Vault secrets.

Answer

The user does not have write permissions on the vault.

Answer

The Key Vault Secrets User role does not allow reading secrets.

Answer

The scope of the Key Vault Secrets User role is incorrect.