AZ-305 Practice Test 29 — 15 Questions

Question 1

A company runs a critical application on Azure VMs in a single region. They need to improve availability to meet an SLA of 99.99% while minimizing costs. The application is stateless and can run on multiple VMs. Which solution should you recommend?

Accepted Answer

Deploy a virtual machine scale set across multiple availability zones in a single region.. Option C is correct because a virtual machine scale set (VMSS) with zones across three availability zones provides 99.99% SLA and allows scaling. Option A is wrong because two VMs in an availability set provide only 99.95% SLA. Option B is wrong because two VMs in different regions adds cost and complexity. Option D is wrong because a single VM in a single zone offers no high availability.

Answer

Deploy two VMs in the same availability set in a single region.

Answer

Deploy a single VM with Azure Site Recovery to another region.

Answer

Deploy two VMs in two different Azure regions with Azure Traffic Manager.

Question 2

You are designing a solution to securely store secrets, keys, and certificates for a cloud application. Which Azure service should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service for securely storing and managing secrets, keys, and certificates. Option A (Azure App Configuration) is wrong because it is optimized for application configuration, not secrets. Option B (Azure Managed HSM) is a hardware security module but is more specialized and not the standard recommendation for general secret storage. Option D (Azure Storage) is incorrect as it lacks native secret management capabilities.

Answer

Azure App Configuration

Answer

Azure Managed HSM

Answer

Azure Storage

Question 3

Which THREE of the following are valid methods to secure access to Azure Storage accounts? (Choose three.)

Accepted Answer

Generate Shared Access Signatures (SAS) with limited permissions and expiry. Options A, B, and D are valid security methods. Option A (Azure AD RBAC) allows fine-grained access control. Option B (Shared Access Signatures) provide delegated access. Option D (Firewall and virtual network service endpoints) restrict network access. Option C is incorrect because access keys provide full access and are not a security best practice. Option E is incorrect; Azure Front Door does not provide storage access control.

Answer

Enable Azure Front Door to authenticate requests

Answer

Use storage account access keys for authentication

Question 4

Your organization uses Microsoft Purview to govern data assets across Azure SQL Database, Azure Data Lake Storage, and on-premises SQL Server. You need to ensure that sensitive data such as credit card numbers are automatically detected and classified. What should you configure in Microsoft Purview?

Accepted Answer

Data classification rules. Option D is correct because Microsoft Purview's data classification system uses built-in and custom classification rules to automatically detect sensitive data like credit card numbers via pattern matching. Option A (Data lineage) tracks data movement, not classification. Option B (Data share) is for sharing data, not classification. Option C (Data catalog) organizes metadata but requires manual or automated classification to detect sensitive data.

Answer

Data share

Answer

Data catalog

Answer

Data lineage mapping

Question 5

You are an Azure administrator. You attempt to create a new virtual machine with size Standard_DS2_v2 in a subscription where the above Azure Policy is assigned. What will happen?

Accepted Answer

The VM creation will be denied.. Option D is correct. The policy denies VM creation if the size is NOT in the allowed list. Standard_DS2_v2 is not in the list, so the VM creation will be denied. Option A is wrong because the policy applies to all VMs. Option B is wrong because the effect is deny, not audit. Option C is wrong because the VM size is not allowed.

Answer

The VM will be created but a compliance alert will be generated.

Answer

The VM will be created but the size will be changed to Standard_D2s_v3.

Answer

The VM will be created successfully.

Question 6

A company is using Azure SQL Database for a critical application. They need to ensure that the database is automatically backed up and that backups are retained for 35 days. What should they configure?

Accepted Answer

Configure the point-in-time restore (PITR) retention to 35 days. Option A is correct because Azure SQL Database automatically performs full, differential, and transaction log backups with a default retention of 7 to 35 days depending on the service tier. Option B is incorrect because long-term retention is for longer periods. Option C is incorrect because geo-replication is for disaster recovery. Option D is incorrect because Azure Backup is for VMs and files, not SQL Database.

Answer

Enable long-term retention (LTR) for backups

Answer

Configure active geo-replication

Answer

Use Azure Backup to back up the SQL Database

Question 7

A company needs to provide secure access to Azure resources for remote employees. They want to enforce multi-factor authentication and conditional access policies. The solution should not require a VPN connection. Which Azure service should they implement?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) with conditional access and MFA provides secure access without VPN. Option B is wrong because Azure VPN Gateway requires VPN. Option C is wrong because Azure Bastion is for RDP/SSH to VMs. Option D is wrong because Microsoft Intune is for device management.

Answer

Microsoft Intune

Answer

Azure VPN Gateway

Answer

Azure Bastion

Question 8

Your organization has a large number of virtual machines running in Azure. You need to centrally manage backup policies, monitor backup jobs, and ensure compliance with retention requirements. Which Azure service should you use?

Accepted Answer

Azure Backup Center. Option B is correct. Azure Backup Center provides a single pane of glass for managing backups across Azure VMs, SQL in VMs, SAP HANA, and Azure Files. Option A is wrong because Azure Site Recovery is for disaster recovery, not backup. Option C is wrong because Azure Policy can enforce backup policies but does not provide monitoring and management. Option D is wrong because Azure Monitor can monitor backup jobs but does not manage policies.

Answer

Azure Policy

Answer

Azure Site Recovery

Answer

Azure Monitor

Question 9

Your company is designing a new application that will run on Azure VMs. The application must be highly available across two Azure regions. You need to ensure that the application can automatically fail over if a regional outage occurs. Which THREE components should you include in the architecture? (Choose three.)

Accepted Answer

Azure Traffic Manager. Option A, Option C, and Option D are correct. Azure Traffic Manager distributes traffic across regions. Azure Load Balancer distributes traffic within a region. Availability Sets protect against failures within a datacenter. Option B is wrong because Availability Zones are within a region, not across regions. Option E is wrong because Azure Application Gateway is a regional load balancer but not necessary if using Traffic Manager and Load Balancer.

Answer

Azure Application Gateway

Answer

Availability Zones

Question 10

Your company is planning to migrate a large number of on-premises servers to Azure. The migration must be completed within 3 months. You need to assess the current on-premises environment and recommend the most appropriate Azure VM sizes and costs. What should you do?

Accepted Answer

Use Azure Migrate to discover and assess the on-premises environment, and generate sizing and cost recommendations.. Option A is correct because Azure Migrate provides assessment, sizing recommendations, and cost estimates. Option B (Azure Advisor) is for optimization of existing resources. Option C (Azure Cost Management) is for cost analysis. Option D (manual inventory) is time-consuming and error-prone.

Answer

Create a manual inventory of all servers and use Azure Pricing Calculator to estimate costs.

Answer

Use Azure Advisor to analyze on-premises server usage and recommend Azure VM sizes.

Answer

Use Azure Cost Management to estimate costs based on manual input of server specifications.

Question 11

Your company has an Azure subscription with multiple virtual networks connected via VNet peering. You need to design a solution to allow VMs in different peered VNets to resolve each other's private IP addresses using custom DNS suffixes. The solution must minimize administrative overhead. What should you implement?

Accepted Answer

Create an Azure Private DNS Zone linked to each VNet with auto-registration enabled.. Option D is correct because Azure Private DNS Zones with auto-registration automatically register and resolve VMs across peered VNets. Option A is wrong because Azure DNS does not support custom DNS suffixes for private IPs. Option B is wrong because custom DNS servers require manual configuration and maintenance. Option C is wrong because Azure Firewall is not a DNS resolver.

Answer

Deploy custom DNS servers on Azure VMs and configure VNets to use those servers.

Answer

Configure Azure DNS to use a custom domain name and update each VM's DNS suffix.

Answer

Use Azure Firewall as a DNS proxy with custom DNS settings.

Question 12

Your company has a global application deployed across multiple Azure regions. You need to design a disaster recovery solution that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The solution should use Azure-native services and minimize costs. Which option should you choose?

Accepted Answer

Azure Site Recovery with 15-minute replication. Azure Site Recovery with replication frequency of 15 minutes meets the RPO, and the orchestrated failover meets the RTO. Option A (Active geo-replication for Azure SQL Database) is not applicable to all workloads. Option B (Azure Backup) has a longer RTO. Option D (Traffic Manager with health probes) is for load balancing, not disaster recovery.

Answer

Azure Traffic Manager with priority routing

Answer

Active geo-replication for Azure SQL Database

Answer

Azure Backup with cross-region restore

Question 13

You execute the above PowerShell script to create a Windows VM in Azure. After the script completes, you try to RDP to the public IP address but the connection fails. What is the most likely reason?

Accepted Answer

The network interface is not attached to the VM.. Option C is correct. The script creates an NSG with an inbound rule allowing RDP (port 3389) but the VM is created with the -Windows parameter, which should enable RDP. However, the script does not add any data disks or configure boot diagnostics. The most likely issue is that the script does not associate the NIC with the VM configuration properly. The New-AzVM cmdlet uses the -VM parameter, but the NIC is not added to the VM config. The script should include Add-AzVMNetworkInterface. Option A is wrong because the NSG rule allows RDP. Option B is wrong because the public IP is static. Option D is wrong because the VM size supports RDP.

Answer

The public IP address is not assigned correctly.

Answer

The NSG rule blocks RDP traffic.

Answer

The VM size does not support RDP.

Question 14

A company is deploying a web application on Azure App Service. The application must authenticate users with their Microsoft Entra ID credentials. The development team wants to use the Microsoft Authentication Library (MSAL) for authentication. Which App Service authentication feature should they use to simplify integration?

Accepted Answer

Configure the App Service authentication / authorization feature to use Microsoft Entra ID. Option A is correct because the App Service authentication / authorization feature (Easy Auth) can be configured to use Microsoft Entra ID as the identity provider and integrate with MSAL. Option B is incorrect because App Insights is for monitoring. Option C is incorrect because Azure AD B2C is for external users. Option D is incorrect because Azure API Management is for managing APIs.

Answer

Use Application Insights to capture authentication logs

Answer

Use Azure API Management to handle authentication

Answer

Use Azure AD B2C for identity management

Question 15

A company is designing an Azure Kubernetes Service (AKS) cluster for a microservices application. They need to ensure that pods can securely access Azure resources such as Azure Key Vault and Azure SQL Database without using service principals or connection strings. Which AKS feature should they enable?

Accepted Answer

Microsoft Entra Workload ID. Azure AD pod-managed identity (now called Microsoft Entra Workload ID) allows pods to assume an identity to access Azure resources. Option A is wrong because Azure RBAC is for Kubernetes authorization. Option B is wrong because Azure Policy is for compliance. Option C is wrong because Azure CNI is for networking.

Answer

Azure RBAC for Kubernetes authorization

Answer

Azure Policy for AKS

Answer

Azure CNI network plugin