AZ-305 Practice Test 30 — 15 Questions

Question 1

You are designing an identity solution for a multinational corporation that uses Microsoft Entra ID. The company has a complex organizational structure with multiple subsidiaries. You need to ensure that users from one subsidiary cannot access resources in another subsidiary unless explicitly granted. The solution must minimize administrative overhead. What should you use?

Accepted Answer

Administrative units. Option D is correct. Administrative units in Microsoft Entra ID allow you to delegate administration and restrict access to a subset of users and resources. Option A is wrong because Conditional Access policies control access based on conditions but do not provide administrative boundaries. Option B is wrong because custom roles can be created but administrative units are designed for scoping. Option C is wrong because B2B collaboration is for external users, not internal subsidiaries.

Answer

Conditional Access policies

Answer

Microsoft Entra B2B collaboration

Answer

Custom directory roles

Question 2

You are reviewing a network security group (NSG) rule for a subnet that hosts web servers. The subnet's address space is 10.0.1.0/24. What is the effect of this rule?

Accepted Answer

The rule allows inbound TCP traffic on ports 80 and 443 from the same subnet.. Option A is correct because the rule allows inbound TCP traffic on ports 80 and 443 from any source (SourceAddressPrefixes is missing, but by default it means any; however, the JSON shows SourceAddressPrefixes with 10.0.1.0/24, so it only allows from that subnet). Wait, the exhibit shows SourceAddressPrefixes: ["10.0.1.0/24"], so the rule allows inbound traffic from the same subnet. Option A is incorrect because it says 'from any source'. Actually, the rule allows from 10.0.1.0/24 only. So Option D is correct: The rule allows inbound traffic from the same subnet. Option B (deny) is false. Option C (allow from internet) is false. Option D is correct.

Answer

The rule allows inbound TCP traffic on ports 80 and 443 from any source.

Answer

The rule denies inbound TCP traffic on ports 80 and 443 from any source.

Answer

The rule allows inbound TCP traffic on ports 80 and 443 from the internet.

Question 3

A company plans to migrate on-premises SQL Server databases to Azure. They need to minimize changes to existing applications and want to use the latest features of SQL Server. Which Azure data service should they use?

Accepted Answer

Azure SQL Managed Instance. Option A is correct because Azure SQL Managed Instance provides near 100% compatibility with SQL Server, minimizing application changes, and supports the latest SQL Server features. Option B is wrong because Azure SQL Database requires application changes for database-level compatibility. Option C is wrong because SQL Server on Azure VMs requires management of OS and SQL Server. Option D is wrong because Azure Cosmos DB is NoSQL, not compatible with SQL Server.

Answer

SQL Server on Azure Virtual Machines

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Question 4

You are designing a network architecture for a three-tier application hosted in Azure. The front-end tier must be accessible from the internet, the business tier must only communicate with the front-end tier, and the data tier must only communicate with the business tier. You need to minimize exposure and use Azure-native services. Which combination of services should you use?

Accepted Answer

Azure Application Gateway with WAF for front-end, NSGs on subnets, and service endpoints. Azure Application Gateway with WAF provides internet-facing front-end with web firewall. Network Security Groups (NSGs) on subnets restrict traffic between tiers. Option A (Azure Load Balancer) lacks WAF. Option C (Azure Firewall) is overkill for simple tier isolation. Option D (VPN Gateway) is for on-premises connectivity, not internal isolation.

Answer

Azure Load Balancer for front-end, NSGs on subnets, and VNet peering

Answer

VPN Gateway for front-end, NSGs on subnets, and private endpoints

Answer

Azure Firewall for all inbound traffic, NSGs on subnets, and VNet peering

Question 5

You run the above KQL query in Azure Monitor Logs. What does the query return?

Accepted Answer

The number of successful VM write operations per caller per hour.. Option B is correct. The query filters AzureActivity for successful VM write operations, then summarizes the count by caller and hourly bins. Option A is wrong because it counts only successful, not failed. Option C is wrong because it groups by caller and hour. Option D is wrong because it does not include operation names.

Answer

The number of failed VM creation attempts per hour.

Answer

The total number of successful operations across all Azure resources.

Answer

A list of all Azure activity log entries.

Question 6

A company is designing a backup strategy for Azure resources. They have the following resources: Azure VMs, Azure SQL Database, and Azure Files shares. They need to meet the following requirements: 1) Backup of VMs must be application-consistent. 2) SQL Database backups must be retained for 10 years. 3) Azure Files backups must support soft delete. Which THREE services or features should they use?

Accepted Answer

Azure Backup. Options B, C, and D are correct. Azure Backup can perform application-consistent backups for VMs (using VSS). Long-term retention (LTR) for SQL Database can retain backups for up to 10 years. Soft delete for Azure Files can be enabled to protect against accidental deletion. Option A is incorrect because Azure Site Recovery is for disaster recovery, not backup. Option E is incorrect because Azure Policy is for governance, not backup.

Answer

Azure Site Recovery

Answer

Azure Policy

Question 7

A financial services company must store sensitive customer data in Azure Blob Storage. The data must be encrypted at rest using a customer-managed key stored in a hardware security module (HSM). The key must be automatically rotated every 90 days. Which combination of Azure services and features should they use?

Accepted Answer

Azure Key Vault Managed HSM with automatic key rotation. Azure Key Vault Managed HSM provides FIPS 140-2 Level 3 validated HSM with automatic key rotation. Option A is wrong because Key Vault Standard does not support HSM. Option B is wrong because Key Vault Premium supports HSM but not automatic rotation without custom logic. Option C is wrong because Azure Storage encryption uses Microsoft-managed keys by default.

Answer

Azure Key Vault (Standard) with Azure Storage encryption

Answer

Azure Key Vault (Premium) with custom rotation logic

Answer

Azure Storage encryption with customer-managed keys stored in Azure Key Vault (Standard)

Question 8

You are designing a storage solution for a healthcare application that stores patient records. The solution must meet the following requirements: - Support for both structured and unstructured data. - Provide low-latency access to frequently accessed data. - Automatically move cold data to a lower-cost tier. - Encrypt data at rest using customer-managed keys. Which combination of Azure services should you recommend?

Accepted Answer

Azure Blob Storage for unstructured data and Azure Cosmos DB for structured data. Option A is correct. Azure Blob Storage supports unstructured data with hot, cool, and archive tiers; Azure Cosmos DB supports structured data with low-latency access; both support customer-managed keys. Option B is wrong because Azure Files is for file shares, not a database. Option C is wrong because Azure SQL Database is for relational data only. Option D is wrong because Azure Table Storage is a NoSQL key-value store but does not support automatic tiering.

Answer

Azure Table Storage for structured data and Azure Blob Storage for unstructured data

Answer

Azure Files for unstructured data and Azure SQL Database for structured data

Answer

Azure Blob Storage for unstructured data and Azure SQL Database for structured data

Question 9

Your company has a critical application running on Azure Virtual Machines that processes financial transactions. You need to ensure that the application remains available during an Azure region failure. The application is stateless and can scale horizontally. What is the most cost-effective design to meet the availability requirement?

Accepted Answer

Deploy VMs in an availability zone in the primary region and use Azure Site Recovery to replicate to a secondary region.. Option A is correct because deploying VMs across availability zones provides resilience within a region, but for region failure, you need a secondary region. Option B (active-passive with Azure Site Recovery) is cost-effective for stateless apps but incurs DR costs. Option C (active-active across regions) is more expensive. Option D (single region with scale sets) does not protect against region failure.

Answer

Deploy VMs in an active-active configuration across two Azure regions using Traffic Manager and Azure Front Door.

Answer

Deploy VMs in an availability set in the primary region and use Azure Site Recovery to failover to a secondary region.

Answer

Deploy VMs in a single region using Virtual Machine Scale Sets with automatic scaling.

Question 10

You are an Azure administrator. The above Azure Policy definition is assigned to a subscription. A developer tries to deploy a Virtual Machine with SKU Standard_DS2_v2. What will happen?

Accepted Answer

The deployment is denied and an error message is returned.. Option C is correct because the policy denies any VM with SKU name starting with 'Standard_DS*' (like match). Option A (allowed) is false. Option B (audited) is false. Option D (modified) is false.

Answer

The deployment succeeds with a warning logged.

Answer

The VM is created but the SKU is changed to a different series.

Answer

The deployment succeeds because the policy only audits.

Question 11

Your company has a hybrid identity environment using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to authenticate to Azure services using their on-premises credentials and enforce conditional access policies for sensitive applications. The solution must support multi-factor authentication (MFA) using the Microsoft Authenticator app. Which components should you include?

Accepted Answer

Microsoft Entra Connect Sync, Microsoft Entra ID, and Conditional Access policies with MFA.. Option C is correct because Microsoft Entra Connect Sync synchronizes identities, Entra ID provides authentication, and conditional access policies enforce MFA. Option A is wrong because Pass-through Authentication does not support MFA via Authenticator app. Option B is wrong because AD FS is an additional component that adds complexity. Option D is wrong because Microsoft Entra Connect Health is for monitoring, not authentication.

Answer

Microsoft Entra Connect Health, Microsoft Entra ID with cloud sync, and Azure AD Identity Protection.

Answer

Active Directory Federation Services (AD FS), Web Application Proxy, and Azure AD Conditional Access.

Answer

Azure AD Pass-through Authentication, Azure AD Application Proxy, and Azure AD Identity Protection.

Question 12

Your company is migrating on-premises virtual machines to Azure. You need to assess the current environment and get a cost estimate for Azure. Which tool should you use?

Accepted Answer

Azure Migrate. Azure Migrate provides assessment and migration capabilities for on-premises workloads to Azure. Option A (Azure Advisor) gives optimization recommendations after deployment. Option B (Azure Cost Management) is for cost analysis after migration. Option D (Azure Monitor) is for monitoring, not assessment.

Answer

Azure Cost Management

Answer

Azure Monitor

Answer

Azure Advisor

Question 13

A company is designing a multi-region disaster recovery solution for Azure VMs. They need to ensure that if the primary region fails, VMs can be failed over to a secondary region with minimal data loss. The application writes data to Azure SQL Database and Azure Files. Which Azure service should they use to meet the recovery point objective (RPO) of 5 seconds for the SQL Database?

Accepted Answer

Active geo-replication for SQL Database. Option C is correct because Azure SQL Database active geo-replication provides a configurable RPO of 5 seconds. Option A is incorrect because failover groups provide a higher RPO of 1 hour. Option B is incorrect because geo-restore has an RPO of hours. Option D is incorrect because Azure Site Recovery replicates VMs, not the database, and does not meet the SQL RPO.

Answer

Azure Site Recovery for SQL Server

Answer

Failover groups with auto-failover

Answer

Geo-restore of SQL Database backups

Question 14

A company is designing a network architecture for a three-tier application hosted on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must not have direct internet access. They also need to encrypt traffic between tiers. Which TWO solutions should they implement?

Accepted Answer

Deploy a network virtual appliance (NVA) as a reverse proxy for the web tier. Options A and D are correct. A network virtual appliance (NVA) can act as a reverse proxy for the web tier and restrict access. Azure Private Link can be used to access PaaS services (like SQL Database) privately. Option B is incorrect because Application Gateway can provide WAF but does not encrypt traffic between VMs. Option C is incorrect because VNet peering does not encrypt traffic. Option E is incorrect because Azure Front Door is a global load balancer.

Answer

Use Azure Application Gateway with WAF

Answer

Use Azure Front Door

Answer

Use VNet peering to connect the tiers

Question 15

A company is deploying a web application that must scale out automatically based on CPU usage. The application runs on Azure App Service. Which Azure feature should they configure?

Accepted Answer

Autoscale rules. Autoscale rules in App Service can scale out based on CPU percentage. Option A is wrong because Azure Load Balancer distributes traffic but does not scale. Option B is wrong because Traffic Manager is for global routing. Option C is wrong because Azure Front Door is for global load balancing with acceleration.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Traffic Manager