AZ-305 Practice Test 29 — 15 Questions

Question 1

A company uses Microsoft Entra ID (Microsoft Entra ID). They have a SaaS application that supports SCIM (System for Cross-domain Identity Management). The company wants to automatically create, update, and deactivate user accounts in the SaaS application whenever changes occur in Microsoft Entra ID. They do not want to use custom scripts. Which Microsoft Entra ID feature should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra ID Provisioning (Automatic User Provisioning). Microsoft Entra ID Provisioning (Automatic User Provisioning) is the correct feature because it natively supports the SCIM (System for Cross-domain Identity Management) protocol to automate the creation, update, and deactivation of user accounts in SaaS applications. This eliminates the need for custom scripts by synchronizing identity changes from Microsoft Entra ID to the target application in near real-time.

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID B2B Collaboration

Question 2

A global e-commerce company stores product catalog data in a JSON document format. The application requires low-latency reads and writes from multiple geographic regions. The solution must support multi-region writes with automatic conflict resolution and provide a guaranteed 99th percentile latency. Which Azure Cosmos DB API and consistency level should they choose?

Accepted Answer

SQL API with Session consistency. The SQL API with Session consistency is correct because it supports multi-region writes with automatic conflict resolution using last-writer-wins (LWW) and provides a guaranteed 99th percentile latency. Session consistency is the most widely used level for globally distributed applications, offering read-your-writes guarantees while maintaining low latency across regions.

Answer

Table API with Eventual consistency

Answer

SQL API with Strong consistency

Answer

MongoDB API with Bounded staleness consistency

Question 3

Your company is designing a data lake solution using Azure Data Lake Storage Gen2. The solution must support hierarchical namespace for efficient directory operations, and must provide encryption at rest using customer-managed keys stored in Azure Key Vault. Which steps must you take to enable customer-managed key encryption for the storage account?

Accepted Answer

Create the storage account with hierarchical namespace enabled, then assign a system-assigned managed identity, and configure encryption with Azure Key Vault.. Azure Data Lake Storage Gen2 requires hierarchical namespace to be enabled at account creation time, and customer-managed key encryption with Azure Key Vault requires a system-assigned managed identity to be assigned to the storage account after creation. The system-assigned identity is used to authenticate to Key Vault for key access, and encryption with customer-managed keys can be configured post-creation via the Azure portal or PowerShell.

Answer

Create the storage account with a user-assigned managed identity, then enable hierarchical namespace, and configure encryption.

Answer

Create the storage account without hierarchical namespace, then enable it later, and configure encryption with Key Vault.

Answer

Create the storage account and specify customer-managed key encryption during creation using the Azure portal.

Question 4

A company runs a critical application on Azure VMs. They want to back up the VMs using Azure Backup. The retention requirements are: daily backups for 35 days, weekly backups for 52 weeks, and yearly backups for 10 years. Which backup policy should they create?

Accepted Answer

Create a custom backup policy with a daily backup schedule and retention rules for daily (35), weekly (52), and yearly (10 years). Azure Backup allows you to create a custom backup policy that defines a daily backup schedule and separate retention rules for daily, weekly, and yearly retention points. This directly meets the requirement of 35 days daily, 52 weeks weekly, and 10 years yearly retention, as Azure Backup supports granular retention policies with multiple tiers (daily, weekly, monthly, yearly) within a single policy.

Answer

Use the default backup policy provided by Azure Backup

Answer

Use Azure Site Recovery (ASR) to replicate the VMs and meet the retention

Answer

Use Azure Backup for VMs with instant recovery enabled

Question 5

A company deploys a web application on Azure VMs within a single region. They need to distribute incoming HTTP traffic across multiple VMs, offload SSL encryption, and maintain session persistence (sticky sessions) for user sessions. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that can route HTTP/HTTPS traffic, offload SSL/TLS encryption, and support session affinity (sticky sessions) using cookies. Unlike a Layer 4 load balancer, it can inspect application-layer data, making it ideal for web applications requiring SSL termination and persistent user sessions.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 6

You are designing a disaster recovery solution for a SQL Server database hosted on an Azure VM. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 1 hour. Which strategy should you recommend?

Accepted Answer

Use Azure SQL Managed Instance with failover groups.. Azure SQL Managed Instance with failover groups provides automated, synchronous or asynchronous replication of the database to a secondary region, enabling a Recovery Point Objective (RPO) of 5 minutes and a Recovery Time Objective (RTO) of 1 hour. The failover group handles automatic or manual failover at the instance level, ensuring minimal data loss and rapid recovery without complex manual log shipping or backup restoration.

Answer

Configure log shipping to a secondary VM in another region.

Answer

Use Azure Backup to back up the database every 5 minutes.

Answer

Replicate the VM using Azure Site Recovery with 5-minute replication.

Question 7

A company is designing a highly available architecture for a web application on Azure VMs. The solution must protect against both planned and unplanned downtime and provide automatic failover. Which TWO Azure services should the company use together? (Choose two.)

Accepted Answer

Azure Availability Zones. Azure Availability Zones (A) protect against datacenter-level failures by distributing VMs across physically separate zones within a region, each with independent power, cooling, and networking. Azure Load Balancer (D) provides automatic failover by distributing incoming traffic across healthy VMs in a backend pool, using health probes to detect and route away from failed instances. Together, they ensure the application remains available during both planned maintenance and unplanned outages, with the Load Balancer handling traffic redirection and Availability Zones providing infrastructure redundancy.

Answer

Azure Site Recovery

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Question 8

A company deploys a containerized microservices application on Azure Kubernetes Service (AKS). They need to expose the application to the internet with TLS termination and provide a single endpoint for multiple services. The solution must also include a Web Application Firewall (WAF). Which Azure service should they use as the ingress controller?

Accepted Answer

Azure Application Gateway with WAF. Azure Application Gateway with WAF is the correct choice because it is a regional, layer-7 load balancer that can act as an ingress controller for AKS. It provides TLS termination at the gateway and integrates a Web Application Firewall (WAF) to protect against common web exploits. This allows a single public endpoint to route traffic to multiple microservices within the AKS cluster based on URL paths or host headers.

Answer

Azure Front Door with WAF

Answer

Azure Load Balancer with TLS termination

Answer

Azure Traffic Manager with health probes

Question 9

A company wants to configure policies that detect risky sign-ins (e.g., from anonymous IPs or unfamiliar locations) and automatically require multi-factor authentication (MFA) when such risk is detected. Which Microsoft Entra ID feature should they use to create these policies?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct feature because it allows administrators to create policies that evaluate sign-in risk signals (such as anonymous IP addresses or unfamiliar locations) and enforce access controls like requiring multi-factor authentication (MFA). Conditional Access policies can integrate with Identity Protection risk detections, but the policy itself is defined and managed within the Conditional Access blade, making it the direct tool for this requirement.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Audit Logs

Question 10

A company requires all users to use multi-factor authentication (MFA) when accessing cloud applications. However, they want to exempt users from MFA when they connect from the company's headquarters, which has a trusted IP range. They want to enforce this policy centrally. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct feature because it allows administrators to create policies that enforce MFA based on conditions such as user location, device state, and application sensitivity. By configuring a Conditional Access policy with a 'trusted location' condition (defined via named locations with specific IP ranges), the company can require MFA for all cloud app access except when users connect from the headquarters' trusted IP range. This provides centralized, granular control over authentication requirements without needing to modify individual user settings.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Self-Service Password Reset

Question 11

Your organization has a critical application deployed on Azure VMs in the West US region. The application uses a Standard_D8s_v3 VM with two data disks (512 GB each) and a separate log disk (256 GB). The application writes data continuously to the data disks and logs. The business continuity requirements are: RPO of 15 minutes, RTO of 2 hours, and the ability to recover to a specific point in time within the last 7 days. You need to design a disaster recovery solution that replicates the VMs and disks to the East US region. The solution must also support failback to West US after a disaster. What should you do?

Accepted Answer

Use Azure Site Recovery to replicate the VMs to East US with a recovery plan that includes the VM and disks, and configure failback using reprotection. Azure Site Recovery (ASR) is the correct service for orchestrating replication, failover, and failback of Azure VMs between regions. It supports the required RPO of 15 minutes (using near-synchronous replication with change tracking) and RTO of 2 hours, and allows point-in-time recovery via recovery points. The reprotection and failback workflow enables you to replicate back to West US after a disaster, meeting the full business continuity requirements.

Answer

Use Azure Migrate to migrate the VMs to East US and then set up replication back to West US

Answer

Configure Azure Backup for the VMs with a backup policy that has a 15-minute frequency and replicate backups to the East US region using geo-redundant storage

Answer

Use Azure Storage geo-redundant storage (GRS) for the managed disks and manually attach the disks to a new VM in East US during a disaster

Question 12

A healthcare organization is migrating a regulatory-compliant application to Azure. The application must be isolated from the internet and accessible only from on-premises networks via a private IP address. The solution must minimize latency and maximize throughput for large data transfers. Which Azure networking solution should the organization implement?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated private connection from on-premises networks to Azure, bypassing the public internet. This ensures the application is isolated from the internet, uses private IP addresses, and offers the lowest latency and highest throughput for large data transfers due to dedicated bandwidth and no internet congestion.

Answer

Azure Private Link

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Question 13

A global e-commerce company needs a database solution that can handle high-velocity writes from user transactions across multiple regions. They require multi-region writes with automatic conflict resolution and single-digit millisecond latency for reads and writes. Which Azure data store should they use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it offers multi-region writes with automatic conflict resolution using last-writer-wins (LWW) or custom conflict resolution policies, and it guarantees single-digit millisecond latency for both reads and writes at the 99th percentile. Its globally distributed, multi-model design is purpose-built for high-velocity transactional workloads that require active-active replication across regions.

Answer

Azure Table Storage

Answer

Azure SQL Database

Answer

Azure Redis Cache

Question 14

Your organization is migrating a legacy on-premises application to Azure. The application uses a proprietary authentication protocol that is not supported by Microsoft Entra ID. You need to integrate the application with Microsoft Entra ID without modifying the application code. What should you do?

Accepted Answer

Configure Microsoft Entra ID Application Proxy to provide secure remote access and pass through authentication.. Microsoft Entra ID Application Proxy can be configured to publish on-premises applications that use legacy authentication protocols. It acts as a reverse proxy, terminating the external connection and forwarding requests to the internal application. Because it can be set to pass through authentication without requiring any changes to the application code, it allows the proprietary authentication protocol to continue working while still integrating with Microsoft Entra ID for access control and conditional access policies.

Answer

Use Azure Active Directory B2C with custom policies to translate the authentication protocol.

Answer

Deploy Azure Active Directory Domain Services and domain-join the application servers.

Answer

Implement Azure Active Directory Connect with pass-through authentication.

Question 15

You are designing a monitoring solution for a critical application running on Azure Kubernetes Service (AKS). The application generates custom metrics that need to be queried in real-time for dashboards. You also need to retain logs for one year for compliance. Which combination of services should you use?

Accepted Answer

Azure Monitor Metrics and Azure Monitor Logs. Azure Monitor Metrics is the correct choice for real-time querying of custom metrics because it stores numeric time-series data with sub-minute granularity and supports near real-time alerting and dashboarding via Azure Dashboards or Grafana. Azure Monitor Logs (Log Analytics) is required for retaining logs for one year, as it offers configurable retention up to 730 days (2 years) and supports KQL queries for compliance and audit needs. Together, they provide a unified monitoring solution for AKS that meets both real-time metric querying and long-term log retention requirements.

Answer

Prometheus and Azure Monitor Logs

Answer

Azure Data Explorer and Azure Blob Storage

Answer

Application Insights and Azure Storage