AZ-305 Practice Test 27 — 15 Questions

Question 1

A company wants to analyze IoT sensor data from millions of devices in near real-time and store the raw data for batch processing. Which combination of Azure services should they use?

Accepted Answer

Azure Event Hubs and Azure Blob Storage. Azure Event Hubs is a highly scalable data streaming platform and event ingestion service capable of ingesting millions of events per second from IoT devices in near real-time. Azure Blob Storage provides cost-effective, durable object storage for the raw data, which can then be used for batch processing with services like Azure Data Lake Analytics or Azure Synapse. This combination directly meets the requirements for near real-time ingestion and raw data storage for batch processing.

Answer

Azure Event Hubs and Azure Synapse Analytics

Answer

Azure IoT Hub and Azure Cosmos DB

Answer

Azure Data Lake Storage and Azure Stream Analytics

Question 2

Your company has a large number of IoT devices sending telemetry to Azure IoT Hub. The data must be processed in near real-time to detect anomalies and trigger alerts. Additionally, the processed data must be stored in a time-series database for historical analysis. Which combination of Azure services should you recommend?

Accepted Answer

Azure Stream Analytics and Azure Data Explorer. Azure Stream Analytics provides real-time stream processing to detect anomalies and trigger alerts from IoT Hub telemetry. Azure Data Explorer (ADX) is a fully managed, high-performance time-series database optimized for storing and analyzing large volumes of time-stamped data, making it the ideal choice for historical analysis. Together, they meet both the near real-time processing and time-series storage requirements.

Answer

Azure Functions and Azure SQL Database

Answer

Azure HDInsight and Azure Cosmos DB

Answer

Azure Data Factory and Azure Blob Storage

Question 3

A company runs a critical web application on Azure VMs in two availability zones. They need to ensure the application remains available during a regional outage with an RPO of 5 minutes and an RTO of 15 minutes. What should they implement?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct choice because it provides automated replication of Azure VMs from one region to another, enabling failover during a regional outage. With continuous replication, ASR can achieve an RPO of as low as 30 seconds (well within the 5-minute requirement) and, when combined with a well-tested recovery plan, can meet the 15-minute RTO by orchestrating the startup of replicated VMs in the secondary region.

Answer

Azure Backup

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 4

A company uses Microsoft Entra ID for identity management. They want to ensure that users accessing sensitive data from unmanaged devices are prompted for multifactor authentication (MFA) and must accept a terms-of-use. Which policy should be configured?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow granular control over access based on conditions such as device state (managed vs. unmanaged). By configuring a policy that targets unmanaged devices, you can enforce MFA and require acceptance of a terms-of-use before granting access to sensitive data. This directly meets the requirement without needing separate policies for MFA and terms-of-use.

Answer

Terms-of-use policy

Answer

Identity Protection policy

Answer

Privileged Identity Management (PIM) policy

Question 5

A multinational company uses Microsoft Entra ID with a custom domain. They need to implement a governance strategy for Microsoft 365 groups, ensuring that group expiration policies are enforced and that group owners receive renewal notifications. What should you configure?

Accepted Answer

Microsoft Entra ID – Group settings (Expiration policy). Microsoft Entra ID's Group settings include an expiration policy specifically designed to enforce lifecycle management for Microsoft 365 groups. This policy allows administrators to set a group expiration period (e.g., 180, 365 days) and automatically sends renewal notification emails to group owners before expiration, enabling them to renew the group if needed. This directly meets the requirement for enforcing group expiration and renewal notifications.

Answer

Microsoft Purview compliance portal – Data Lifecycle Management

Answer

Microsoft Intune – Device compliance policies

Answer

Microsoft Sentinel – Analytics rules

Question 6

You are reviewing a recovery plan for Azure Site Recovery. The exhibit shows a snippet of the recovery plan configuration. What is the purpose of the script action defined in the exhibit?

Accepted Answer

To run a custom script on the recovered VMs after they boot up during test and unplanned failover.. The script action in an Azure Site Recovery recovery plan is configured to run after the VMs have booted up, allowing custom tasks such as installing software, modifying configurations, or verifying connectivity. This is supported during both test failover and unplanned failover, as the script executes post-boot on the recovered VMs.

Answer

To run a script before the VMs shut down during failover.

Answer

To update the Azure DNS records after failover.

Answer

To run a script only during planned failover from the primary to the recovery region.

Question 7

A media company uploads large video files to Azure Blob Storage. Users frequently access recent videos, while older videos are rarely accessed after 30 days. The company wants to minimize storage costs while ensuring that recently accessed videos are immediately available. Which storage tier strategy should you recommend?

Accepted Answer

Use Hot tier for the first 30 days, then automatically move to Cool tier. It balances cost and performance by using the Hot tier for the first 30 days (when videos are frequently accessed) and then automatically transitioning to the Cool tier via Azure Blob Storage lifecycle management. This ensures immediate availability for recent uploads while minimizing storage costs for older, rarely accessed content. The Cool tier offers lower storage costs than Hot but still provides low-latency access, meeting the requirement that recently accessed videos are immediately available.

Answer

Use Premium tier for all files

Answer

Use Cool tier for all files with lifecycle management to Archive

Answer

Use Archive tier for all files and rehydrate on access

Question 8

Your organization uses Microsoft Entra ID and requires that all external users invited via B2B collaboration must authenticate using multi-factor authentication (MFA). You need to enforce this for all guest users. What should you configure?

Accepted Answer

Microsoft Entra Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA for guest users by targeting the 'Guest or external users' identity type and requiring MFA as a grant control. This provides granular control over authentication requirements for B2B collaboration users, unlike the other options which either lack enforcement capability or apply to different scenarios.

Answer

Microsoft Entra B2B collaboration settings

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Microsoft Entra ID MFA registration policy

Question 9

Your organization uses Microsoft Azure and has a subscription with multiple resource groups. You need to ensure that only users in the Finance department can access storage accounts in the 'Finance' resource group. The solution must use role-based access control (RBAC). What should you assign?

Accepted Answer

Assign the Storage Blob Data Reader role to the Finance users at the Finance resource group scope. Assigning the Storage Blob Data Reader role at the Finance resource group scope grants Finance users read access to blob data within all storage accounts in that resource group, using RBAC. This meets the requirement of restricting access to only the Finance department while leveraging Azure RBAC's built-in data plane role for storage.

Answer

Assign the Contributor role to the Finance users at the management group scope

Answer

Assign the Reader role to the Finance users at the subscription scope

Answer

Assign the Storage Account Contributor role to the Finance users at each storage account scope

Question 10

A company is deploying an internal web application on Azure VMs. The application requires SSL offloading, session stickiness, and URL-based routing (e.g., /api/* to one backend, /app/* to another). The solution must operate within a single Azure region and must not be exposed to the public internet. Which Azure load balancing solution should they use?

Accepted Answer

C. Azure Application Gateway v2 is the correct choice because it provides SSL offloading (SSL termination at the gateway), session stickiness (cookie-based affinity), and URL-based routing (path-based routing rules) within a single Azure region. It can be deployed with a private IP address only, ensuring it is not exposed to the public internet, meeting all requirements.

Answer

A

Answer

B

Answer

D

Question 11

You are designing a business continuity solution for a mission-critical Azure Kubernetes Service (AKS) cluster. The cluster hosts a stateful application that uses Azure Disks for persistent volumes. You need to ensure that the application can be recovered in a secondary region within 1 hour of a regional failure. What should you use to replicate the persistent volumes?

Accepted Answer

Azure Site Recovery with replication of the AKS node VMs and attached disks. Azure Site Recovery (ASR) can replicate Azure VMs and their attached managed disks to a secondary region. For an AKS cluster, replicating the node VMs and their attached Azure Disks ensures that the persistent volumes (backed by Azure Disks) are available in the secondary region. Combined with AKS cluster deployment in the secondary region, this meets the 1-hour recovery time objective (RTO) for a stateful application.

Answer

Azure Disk Backup with geo-redundant storage

Answer

Azure Backup with disk snapshot policies

Answer

Azure File Sync to replicate the disk content

Question 12

You are designing a governance strategy for Azure resources. Your organization has multiple departments, each with its own set of Azure subscriptions. You need to enforce consistent policies across all subscriptions, such as allowed resource locations and required tags, while allowing departments to manage their own resources within those constraints. Which Azure service should you use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it enforces organizational standards and compliance rules across all Azure resources, such as allowed locations and required tags, at scale. It applies policies to management groups, subscriptions, or resource groups, ensuring consistent governance while allowing departments to manage their own resources within those constraints. Unlike Azure Blueprints, which deploys a full environment template, Azure Policy focuses solely on rule enforcement and remediation.

Answer

Azure Blueprints

Answer

Azure Management Groups

Answer

Azure Role-Based Access Control (RBAC)

Question 13

Refer to the exhibit. You are a security administrator reviewing a custom Azure Policy assignment. The policy definition with ID 'abc123' is an initiative containing two policies: one that audits storage accounts with blob public access enabled and one that deploys a diagnostic setting for network security groups. The scope includes a production resource group. However, the compliance state shows 'Non-compliant' for several resources. What is the most likely reason for the non-compliance?

Accepted Answer

The diagnostic setting deployment policy requires a remediation task to bring non-compliant resources into compliance.. The policy that deploys a diagnostic setting for network security groups is a 'DeployIfNotExists' (DINE) policy. DINE policies do not automatically remediate existing non-compliant resources; they require a remediation task to be created and run, which will deploy the diagnostic settings to bring the resources into compliance. The audit-only policy for storage accounts does not require remediation, but the DINE policy's non-compliance indicates that the diagnostic settings are missing and need to be deployed via a remediation task.

Answer

The scope is incorrectly targeting the resource group, missing the subscription.

Answer

The audit policy is preventing the creation of storage accounts with public access.

Answer

The enforcement mode is set to 'Default' which disables policy evaluation.

Question 14

A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They want to automatically block sign-ins from malicious IP addresses and require users to perform multi-factor authentication (MFA) when signing in from untrusted locations. Which Microsoft Entra ID feature should they use?

Accepted Answer

Identity Protection. Identity Protection (option B) is the correct feature because it uses machine learning and heuristics to detect risky sign-ins, such as those from malicious IP addresses or untrusted locations. It can automatically block sign-ins from known malicious IPs and, when combined with Conditional Access, require MFA for sign-ins from untrusted locations. This directly addresses the requirement to block malicious IPs and enforce MFA based on location risk.

Answer

Conditional Access policies

Answer

Privileged Identity Management

Answer

Access Reviews

Question 15

An on-premises datacenter must connect privately to Azure with predictable bandwidth and avoid traversal of the public internet. Which connectivity option should be recommended?

Accepted Answer

ExpressRoute. ExpressRoute provides a dedicated private connection from on-premises to Azure, bypassing the public internet entirely. It offers predictable bandwidth, low latency, and high reliability through a Layer 3 MPLS or direct fiber link from a connectivity provider. This meets the requirement for a private, consistent network path without internet traversal.

Answer

Azure Bastion

Answer

Point-to-site VPN

Answer

Site-to-site VPN only