AZ-305 Practice Test 27 — 15 Questions

Question 1

Your company runs a critical workload on Azure Virtual Machines in a single region. You need to design a disaster recovery solution that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The solution should minimize cost. What should you recommend?

Accepted Answer

Implement Azure Site Recovery with replication to a secondary region.. Option D is correct because Azure Site Recovery provides replication with RPO as low as 15 minutes and RTO of minutes to hours, and it is cost-effective compared to always-on replication. Option A is wrong because Azure Backup has a minimum RPO of 1 hour for VMs. Option B is wrong because read-access geo-redundant storage (RA-GRS) is for storage accounts, not VM-level recovery. Option C is wrong because an active-passive configuration with Always On availability groups requires SQL Server and is overkill for non-database workloads.

Answer

Configure Azure Backup with geo-redundant storage.

Answer

Deploy an active-passive pair of VMs using SQL Server Always On availability groups.

Answer

Use Azure Storage with read-access geo-redundant storage (RA-GRS) and failover the VMs.

Question 2

You are designing a backup strategy for Azure VMs running critical business applications. The solution must support application-consistent backups and allow for restoration to a different region. Which Azure service and configuration should you use?

Accepted Answer

Azure Backup with application-consistent backup policy and geo-redundant storage. Option A is correct because Azure Backup with application-consistent backups and geo-restore meets the requirements. Option B is wrong because Azure Site Recovery is for disaster recovery, not backups. Option C is wrong because Azure Snapshot is not application-consistent. Option D is wrong because Azure Disk Encryption encrypts disks but does not provide backups.

Answer

Azure Disk Encryption with Azure Backup

Answer

Azure Snapshot with cross-region copy

Answer

Azure Site Recovery with replication to secondary region

Question 3

Your company plans to migrate an on-premises application to Azure. The application requires low-latency access to a shared file system that supports SMB protocol. Which Azure storage solution should you recommend?

Accepted Answer

Azure Files. Option B is correct because Azure Files supports SMB protocol and can be used as a shared file system with low-latency access when deployed in the same region. Option A is wrong because Blob Storage does not support SMB natively. Option C is wrong because Disk Storage is block-level and not shared. Option D is wrong because Queue Storage is for messaging.

Answer

Azure Blob Storage

Answer

Azure Disk Storage

Answer

Azure Queue Storage

Question 4

You are designing a disaster recovery solution for a critical application hosted in Azure VMs. The primary region is East US. The application requires a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes. Which Azure service should you use to replicate the VMs?

Accepted Answer

Azure Site Recovery. Option C is correct because Azure Site Recovery provides replication with RPO as low as 15 minutes and can meet the RTO with proper planning. Option A is wrong because Azure Backup has higher RPO. Option B is wrong because Azure Traffic Manager is for traffic routing, not replication. Option D is wrong because Azure Front Door is a global load balancer.

Answer

Azure Front Door

Answer

Azure Backup

Answer

Azure Traffic Manager

Question 5

You are designing a hybrid identity solution for a company with 5,000 on-premises users. The company wants to use Microsoft Entra ID for single sign-on and self-service password reset. They also need to synchronize user passwords to the cloud. Which feature should you enable to ensure password changes on-premises are immediately propagated to Microsoft Entra ID?

Accepted Answer

Password Hash Synchronization. Option A is correct because Password Hash Synchronization with Microsoft Entra Connect synchronizes password hashes and can be configured for immediate sync on change. Option B is wrong because Pass-through Authentication does not synchronize passwords. Option C is wrong because Federation uses AD FS and does not sync passwords. Option D is wrong because Microsoft Entra Cloud Sync is for syncing objects but password sync is a feature of Connect.

Answer

Federation with AD FS

Answer

Pass-through Authentication

Answer

Microsoft Entra Cloud Sync

Question 6

You are designing a network topology for a multi-tier application in Azure. The application has a web tier, an API tier, and a database tier. You need to ensure that the web tier can communicate with the API tier, and the API tier can communicate with the database tier, but the web tier cannot directly access the database tier. Which Azure networking solution should you implement?

Accepted Answer

Azure Application Security Groups (ASGs). Option B is correct because Azure Application Security Groups (ASGs) allow you to define network security policies based on application groups, and you can create rules that permit traffic only between specific tiers. Option A is wrong because NSGs alone would require complex rule management. Option C is wrong because Azure Firewall is a managed firewall but is overkill for this scenario. Option D is wrong because VNet peering is for connecting VNets, not controlling traffic within a VNet.

Answer

Azure Firewall

Answer

Network Security Groups (NSGs) with service tags

Answer

VNet peering

Question 7

Your company has an Azure subscription with multiple virtual networks (VNets) in different regions. You need to ensure that resources in all VNets can communicate with each other privately over the Microsoft backbone network. Which Azure solution should you implement?

Accepted Answer

VNet peering. Option D is correct because VNet peering connects VNets within the same region or across regions using the Microsoft backbone. Option A is wrong because Azure VPN Gateway connects on-premises to Azure, not VNet-to-VNet. Option B is wrong because Azure ExpressRoute connects on-premises to Azure. Option C is wrong because Azure DNS is for domain name resolution.

Answer

Azure ExpressRoute

Answer

Azure DNS

Answer

Azure VPN Gateway

Question 8

You are designing a storage strategy for a data analytics solution that processes large volumes of streaming data. The data must be stored in a cost-effective manner with low latency for hot data and infrequent access for cold data after 30 days. The solution must support both batch and interactive queries. Which combination of Azure storage services should you recommend?

Accepted Answer

Azure Data Lake Storage Gen2 with lifecycle management. Option B is correct because Azure Data Lake Storage Gen2 provides scalable storage for analytics with hierarchical namespace, and lifecycle management policies can move data to cool or archive tiers. Option A is wrong because Blob Storage with hot/cool tiers works but Data Lake Gen2 is optimized for analytics. Option C is wrong because Azure SQL Database is relational and expensive for large-scale analytics. Option D is wrong because Cosmos DB is for NoSQL workloads.

Answer

Azure SQL Database with geo-replication

Answer

Azure Blob Storage with hot and cool access tiers

Answer

Azure Cosmos DB with multiple consistency levels

Question 9

Your company is deploying a web application on Azure App Service. The application must be able to read secrets from Azure Key Vault without storing credentials in application code. Which feature should you enable?

Accepted Answer

Managed Identity. Option C is correct because Managed Identity allows the App Service to authenticate to Key Vault without storing credentials. Option A is wrong because App Service authentication is for user authentication. Option B is wrong because Azure AD Application Registration requires client secrets. Option D is wrong because Key Vault access policies are authorization, not authentication.

Answer

Key Vault access policies

Answer

Azure AD Application Registration with client secret

Answer

App Service Authentication / Authorization

Question 10

Your organization has a policy that all administrative access to Azure resources must be performed using just-in-time (JIT) access. Which Azure service allows you to enable JIT VM access?

Accepted Answer

Microsoft Defender for Cloud. Option B is correct because Microsoft Defender for Cloud provides JIT VM access as a security feature. Option A is wrong because Azure Policy is for compliance. Option C is wrong because Microsoft Sentinel is a SIEM. Option D is wrong because Azure AD Privileged Identity Management (PIM) is for user role management, not VM access.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure AD Privileged Identity Management

Question 11

You are designing a solution to monitor and analyze security events across your Azure environment. Which TWO Azure services should you include in your design to provide centralized logging and threat detection? (Choose two.)

Accepted Answer

Azure Log Analytics. Options B and C are correct. Azure Log Analytics (now part of Azure Monitor) provides centralized logging and analysis. Microsoft Sentinel provides SIEM and threat detection. Option A is wrong because Azure Policy is for compliance. Option D is wrong because Azure Firewall is a network security service. Option E is wrong because Azure Network Watcher is for network monitoring.

Answer

Azure Firewall

Answer

Azure Policy

Answer

Azure Network Watcher

Question 12

A company is designing a solution for storing sensitive documents in Azure Blob Storage. They require that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they want to prevent any accidental deletion of the key vault and its keys. Which combination of actions should they take?

Accepted Answer

Enable soft-delete and purge protection on the key vault. Option A is correct because enabling soft-delete and purge protection on the key vault prevents accidental deletion. Option B is incorrect because RBAC alone does not prevent deletion. Option C is incorrect because firewall rules do not prevent deletion. Option D is incorrect because logging does not prevent deletion.

Answer

Assign the Key Vault Contributor role to only the security team

Answer

Configure firewall rules to restrict network access

Answer

Enable diagnostic settings and send logs to a Log Analytics workspace

Question 13

A company needs to implement a hybrid identity solution that allows users to access both on-premises applications and Microsoft 365 using a single identity. The company has on-premises Active Directory Domain Services (AD DS). They want to synchronize identities to the cloud while also enabling password writeback for self-service password reset. Which Azure service should they use?

Accepted Answer

Microsoft Entra Connect. Option A is correct because Microsoft Entra Connect can synchronize identities and support password writeback. Option B is incorrect because Microsoft Entra Connect Health is for monitoring. Option C is incorrect because Microsoft Entra Domain Services provides managed domain services. Option D is incorrect because Microsoft Entra ID is the cloud identity service but does not sync directly.

Answer

Microsoft Entra ID

Answer

Microsoft Entra Connect Health

Answer

Microsoft Entra Domain Services

Question 14

A multinational corporation needs to design a global DNS solution for Azure resources. They require automatic failover across Azure regions and low-latency responses based on the client's geographic location. The solution must also support custom domains without exposing the underlying Azure public IP addresses. Which combination of Azure services should they use?

Accepted Answer

Azure Traffic Manager with geographic routing and Azure Front Door. Azure Traffic Manager with geographic routing and Azure Front Door with custom domain and private endpoint integration provides the required functionality. Option A is wrong because Azure DNS does not provide traffic routing. Option C is wrong because Application Gateway does not provide global routing. Option D is wrong because Traffic Manager alone does not support custom domains without exposing IPs.

Answer

Azure Application Gateway with Azure Front Door

Answer

Azure DNS with Azure Traffic Manager

Answer

Azure Traffic Manager with priority routing and Azure Application Gateway

Question 15

A company is migrating a legacy application to Azure VMs. The application requires a static IP address that does not change if the VM is stopped and started. Which type of IP address should they assign to the VM?

Accepted Answer

Static public IP address. A static public IP address or a static private IP address ensures the IP does not change. Option A is wrong because dynamic public IPs change on stop/start. Option C is wrong because private IPs can be dynamic or static; dynamic changes. Option D is wrong because ephemeral IPs are for temporary usage.

Answer

Dynamic private IP address

Answer

Dynamic public IP address

Answer

Ephemeral IP address