AZ-305 Practice Test 28 — 15 Questions

Question 1

You are reviewing a Conditional Access policy for a Microsoft Entra ID tenant. The exhibit shows the policy configuration. Users report that they are prompted for MFA every hour even when using approved Microsoft applications. The security team wants to reduce MFA prompts but maintain security. What should you modify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the signInFrequency value to 24 hours. The sign-in frequency control in Conditional Access determines how often a user must re-authenticate. Increasing the value from 1 hour to 24 hours directly reduces the frequency of MFA prompts while still requiring re-authentication daily, balancing security and user experience. This change applies to approved Microsoft applications as configured in the policy.

Answer

Enable 'persistentBrowser' session control

Answer

Change cloudAppSecurityType to 'blockDownloads'

Answer

Remove the 'approvedApplication' grant control

Question 2

You are designing a backup strategy for Azure VMs running critical business applications. The solution must support application-consistent backups and allow for restoration to a different region. Which Azure service and configuration should you use?

Accepted Answer

Azure Backup with application-consistent backup policy and geo-redundant storage. Azure Backup with an application-consistent backup policy uses the Volume Shadow Copy Service (VSS) on Windows or pre/post-scripts on Linux to ensure that all in-memory data and pending I/O operations are flushed before the snapshot is taken. By configuring the Backup vault with geo-redundant storage (GRS), the backup data is replicated to a paired region, enabling restoration to a different region in the event of a regional disaster.

Answer

Azure Disk Encryption with Azure Backup

Answer

Azure Snapshot with cross-region copy

Answer

Azure Site Recovery with replication to secondary region

Question 3

A company runs a web application on Azure VMs in a single region. The application must scale out automatically based on CPU utilization. The VMs are behind an Azure Load Balancer. Which Azure service should they use to automatically add or remove VMs based on demand?

Accepted Answer

Azure Virtual Machine Scale Sets. Azure Virtual Machine Scale Sets (VMSS) is the correct service because it provides automatic scaling of identical VM instances based on metrics like CPU utilization. When you configure an autoscale rule on a VMSS, it automatically adds or removes VM instances behind the Azure Load Balancer, ensuring the application scales out or in based on demand without manual intervention.

Answer

Azure App Service

Answer

Azure Functions

Answer

Azure Batch

Question 4

A company runs a SQL Server database on an Azure virtual machine. They need to increase the storage capacity and improve I/O performance for their transaction log. The current data disk is a standard HDD. They want to achieve higher IOPS and throughput without increasing the size of the VM (the VM size supports up to 8 data disks). The database workload is write-intensive on the transaction log. Which configuration should they implement?

Accepted Answer

Replace the standard HDD disk with a premium SSD disk for the log drive. Replacing the standard HDD with a premium SSD directly addresses the need for higher IOPS and throughput for a write-intensive transaction log. Premium SSDs provide consistent low-latency performance and significantly higher IOPS/throughput compared to standard HDDs, without requiring a VM size change. Since the VM supports up to 8 data disks, a single premium SSD can meet the performance requirements more effectively than adding more HDDs.

Answer

Add additional standard HDD disks and configure a storage pool with simple (striping) layout

Answer

Add a premium SSD disk and configure a storage space with mirroring for the log drive

Answer

Use Azure Disk Encryption to improve performance

Question 5

A company stores terabytes of archival data that must be retained for 10 years per regulatory requirements. The data is accessed infrequently (once or twice per year) and retrieval latency of up to 5 hours is acceptable. The company wants the lowest storage cost. They also need to ensure data is encrypted at rest and immutability to prevent deletion or modification during the retention period. Which Azure storage solution should they choose?

Accepted Answer

Azure Blob Storage with Archive tier and immutability policy (time-based retention). Azure Blob Storage's Archive tier offers the lowest storage cost for infrequently accessed data, and the immutability policy with time-based retention provides WORM (Write Once, Read Many) compliance to prevent deletion or modification for the required 10-year period. The 5-hour retrieval latency is acceptable for archival data accessed once or twice per year, and encryption at rest is automatically enabled for all Azure Blob Storage tiers.

Answer

Azure Blob Storage with Hot tier and lifecycle management to Archive tier with WORM policy

Answer

Azure Blob Storage with Cool tier and lifecycle management to Archive tier with legal hold

Answer

Azure Files with premium tier and soft delete

Question 6

A company has an on-premises data center and wants to connect it to Azure to extend their network. They require a dedicated, private, high-bandwidth connection that is not routed over the public internet. They also want a lower-cost backup connection for redundancy in case the primary connection fails. Which combination of connectivity options should they implement?

Accepted Answer

ExpressRoute as the primary connection and a Site-to-Site VPN as the backup connection.. ExpressRoute provides a dedicated, private, high-bandwidth connection that bypasses the public internet, meeting the primary requirement. A Site-to-Site VPN over the internet serves as a cost-effective backup path for redundancy, as it uses encrypted tunnels over the public internet without the recurring costs of a second ExpressRoute circuit.

Answer

Two ExpressRoute circuits from different service providers, both active.

Answer

Site-to-Site VPN as the primary connection and Point-to-Site VPN as the backup.

Answer

Azure VPN Gateway with active-passive mode and a second VPN Gateway for failover.

Question 7

A company runs a large-scale write-intensive application that requires a horizontally scalable relational database. They need to distribute data across multiple nodes to handle high write throughput while supporting SQL queries, including joins and transactions. The solution must be fully managed and provide elastic scaling. Which Azure database service should they choose?

Accepted Answer

Azure Database for PostgreSQL Hyperscale (Citus). Azure Database for PostgreSQL Hyperscale (Citus) is the correct choice because it provides horizontal scaling (sharding) across multiple worker nodes using the Citus extension, which distributes data and parallelizes SQL queries. It supports full SQL, including joins and transactions, while offering elastic scaling for write-intensive workloads. This makes it ideal for large-scale relational databases that need high write throughput and horizontal scalability.

Answer

Azure SQL Database Hyperscale

Answer

Azure Cosmos DB

Answer

Azure SQL Managed Instance

Question 8

A multinational company uses Microsoft Entra ID for identity. They need to grant external partners access to specific SharePoint Online sites. The access must be time-limited and require approval from a resource owner. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management.. Microsoft Entra ID Entitlement Management (A) is the correct feature because it enables organizations to manage external partner access to resources like SharePoint Online sites through access packages. These access packages can enforce time-limited access and require approval from designated resource owners, directly meeting the scenario's requirements.

Answer

Microsoft Entra ID B2C.

Answer

Microsoft Entra ID Conditional Access.

Answer

Microsoft Entra ID Identity Protection.

Question 9

A company runs a data analytics application that stores large volumes of structured data in a relational format. The data is write-intensive and the application needs to scale horizontally for high throughput. The solution must support SQL queries, including joins and ACID transactions. Which Azure database service should they choose?

Accepted Answer

Azure Database for PostgreSQL - Hyperscale (Citus). Azure Database for PostgreSQL - Hyperscale (Citus) is correct because it provides horizontal scaling (sharding) across multiple nodes while preserving full SQL support, including JOINs and ACID transactions. Citus distributes data across worker nodes using a coordinator node, enabling write-intensive workloads to achieve high throughput through parallelized writes. This makes it ideal for large-volume, relational, write-heavy analytics applications that require relational integrity.

Answer

Azure SQL Database Hyperscale

Answer

Azure Cosmos DB (SQL API)

Answer

Azure Synapse Analytics

Question 10

A business-critical App Service application must survive a full regional outage. The recovery design should fail over automatically based on endpoint health and avoid DNS-cache delay where possible. Which service should front the regional deployments?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides global HTTP/HTTPS load balancing with automatic failover across regions based on real-time endpoint health probes. It uses Anycast routing to direct traffic to the nearest healthy region, which avoids DNS-cache delay inherent in DNS-based solutions like Traffic Manager. This ensures sub-second failover and meets the requirement for a business-critical app that must survive a full regional outage.

Answer

Azure Load Balancer

Answer

Azure Application Security Groups

Answer

Azure Traffic Manager only

Question 11

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to enforce that all users accessing the company's internal application from mobile devices must be compliant with device management policies (e.g., require a PIN and encryption). The application does not support modern authentication. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Application Proxy. Microsoft Entra ID Application Proxy is the correct choice because it enables secure remote access to on-premises web applications that do not support modern authentication. By publishing the internal application through Application Proxy, you can enforce device compliance policies (e.g., requiring a PIN and encryption) via Conditional Access policies applied to the Application Proxy service, even though the application itself uses legacy authentication.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Question 12

Contoso is a global e-commerce company that runs its platform on Azure Kubernetes Service (AKS) with Istio service mesh. The application uses Azure Cosmos DB (API for MongoDB) with multi-region writes enabled. The platform also uses Azure Cache for Redis Enterprise for session caching. The business requires a Recovery Time Objective (RTO) of 30 seconds and a Recovery Point Objective (RPO) of 0 for all tiers. You need to design a disaster recovery solution that meets these requirements with high availability. What should you recommend?

Accepted Answer

Deploy AKS in two regions with Azure Front Door. Use Azure Cosmos DB with multi-region writes. Use Azure Cache for Redis Enterprise with active geo-replication.. It meets the RTO of 30 seconds and RPO of 0 by using Azure Front Door for global load balancing with health probes, Azure Cosmos DB with multi-region writes for zero data loss (RPO=0) and instant failover, and Azure Cache for Redis Enterprise with active geo-replication to provide a writable cache in both regions with sub-30-second failover. This combination ensures that all tiers can fail over independently and instantly without data loss.

Answer

Deploy AKS in two regions with Azure Traffic Manager. Use Azure Cosmos DB with multi-region writes. Use Azure Cache for Redis Enterprise with active geo-replication.

Answer

Deploy AKS in two regions with Azure Front Door. Use Azure Cosmos DB with a single write region and auto-failover. Use Azure Cache for Redis Standard with geo-replication.

Answer

Use Azure SQL Database with auto-failover groups for the database tier. Deploy AKS in two regions with Azure Front Door. Use Azure Cache for Redis Enterprise with active geo-replication.

Question 13

A company runs an application on Azure VMs that must be backed up according to regulatory compliance: daily backups retained for 30 days, weekly backups retained for 12 months, and yearly backups retained for 7 years. The backups must be stored in a secondary region for disaster recovery. They want to use Azure Backup for VMs. Which backup policy and storage configuration should they implement?

Accepted Answer

Configure a backup policy in Azure Backup for VMs with daily, weekly, and yearly retention rules, and enable cross-region restore by using a Recovery Services Vault with geo-redundant storage.. Azure Backup for VMs allows you to create a custom backup policy with daily, weekly, and yearly retention points, meeting the regulatory requirements. By enabling cross-region restore (CRR) on a Recovery Services Vault configured with geo-redundant storage (GRS), backups are automatically replicated to a paired secondary region, providing disaster recovery without additional infrastructure.

Answer

Enable backup with Azure Backup using the default policy and select Geo-Redundant Storage (GRS) for the Recovery Services Vault.

Answer

Use Azure Site Recovery to replicate VMs to the secondary region and configure retention policies in the replication settings.

Answer

Perform file-level backups using Azure Backup and store them in a separate storage account with read-access geo-redundant storage (RA-GRS).

Question 14

A company has deployed several Azure VMs that do not have public IP addresses. Administrators need to securely connect to these VMs using RDP and SSH from the internet over a browser without deploying a jump box or managing VPN connections. The solution must use Microsoft Entra ID authentication for single sign-on. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS, without requiring public IP addresses, jump boxes, or VPN connections. It supports Microsoft Entra ID authentication for single sign-on, meeting the requirement for browser-based access with no additional management overhead.

Answer

Azure Jump Box VM

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 15

Refer to the exhibit. You run this PowerShell script in an Azure subscription. The script executes successfully. What is the outcome?

Accepted Answer

All resources without tags get the tag 'Environment' with value 'Unknown'.. The `Update-AzTag` cmdlet with the `-Operation Merge` parameter merges the specified tags into existing resource tags without removing any existing tags. When a resource already has tags, only the specified tag is added or updated; when a resource has no tags, the specified tag is applied. This matches option B: all resources without tags get the tag 'Environment' with value 'Unknown'.

Answer

All existing tags are replaced with 'Environment'='Unknown'.

Answer

All resources in the subscription get the tag 'Environment' with value 'Unknown'.

Answer

The script fails because Update-AzTag does not support merge.