AZ-305 Practice Test 31 — 15 Questions

Question 1

Your company has a hybrid identity environment with Microsoft Entra ID and an on-premises Active Directory. You need to enable single sign-on (SSO) for users accessing Microsoft 365 applications from domain-joined devices. Which authentication method should you configure?

Accepted Answer

Microsoft Entra Seamless SSO. Option A is correct. Seamless SSO automatically signs users in when they are on domain-joined devices connected to the corporate network. Option B is wrong because Pass-through Authentication validates passwords on-premises but does not provide SSO. Option C is wrong because password hash sync does not provide SSO by itself. Option D is wrong because federation with AD FS can provide SSO but is more complex than Seamless SSO for this scenario.

Answer

Microsoft Entra Pass-through Authentication

Answer

Microsoft Entra password hash synchronization

Answer

Active Directory Federation Services (AD FS)

Question 2

You are designing a storage solution for a new application that will store large binary files (up to 5 TB each) and require high throughput for sequential reads. The data is accessed infrequently but must be retained for 7 years for compliance. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage in the Cool tier. Option B is correct because Azure Blob Storage supports large blobs (up to ~4.75 TB) and the Cool tier is cost-effective for infrequently accessed data with long retention. Option A (Azure Files) has size limits. Option C (Azure Managed Disks) is for VM disks, not unstructured data. Option D (Azure NetApp Files) is for enterprise workloads, not cost-effective for archival.

Answer

Azure Managed Disks with Standard HDD

Answer

Azure Files shares in the Premium tier

Answer

Azure NetApp Files with Standard service level

Question 3

You executed the above Azure CLI commands. The remote VNet (yourVNet) has address space 10.1.0.0/16. What is the result?

Accepted Answer

A VNet with two subnets is created, and a VNet peering is established.. Option B is correct because the commands create a VNet with two subnets and then create a VNet peering to a remote VNet. Option A (only one subnet) is false because two subnets are created. Option C (peering fails) is false because the command succeeds. Option D (no peering) is false.

Answer

The peering command fails because the remote VNet does not exist.

Answer

A VNet with one subnet is created, and no peering is established.

Answer

Only the first subnet is created, and the peering is established.

Question 4

You are designing a storage solution for a media company that needs to store large video files (up to 50 GB each) and serve them to a global audience with low latency. The solution must be cost-effective and support resumable uploads. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage with Azure CDN and Azure Files for resumable uploads using AzCopy.. Option B is correct because Azure Blob Storage with CDN and Azure Files with AzCopy provides cost-effective storage for large files, CDN for low latency global delivery, and resumable uploads via AzCopy. Option A is wrong because Azure Files alone does not provide global CDN. Option C is wrong because Azure NetApp Files is enterprise-grade and expensive. Option D is wrong because Azure Disk Storage is for VM disks, not for serving files.

Answer

Azure Files with Azure File Sync and Azure CDN.

Answer

Azure Disk Storage with Azure Load Balancer.

Answer

Azure NetApp Files with Azure Front Door.

Question 5

You are designing a solution to provide high availability for a critical application running on Azure Virtual Machines. The virtual machines must be placed on physically separate hardware and have guaranteed availability during Azure maintenance events. Which option meets these requirements?

Accepted Answer

Deploy VMs in different Availability Zones. Availability Zones provide physically separate locations within an Azure region, protecting against datacenter failures. Option A (Availability Set) spreads VMs across fault domains but not across separate physical facilities. Option C (Scale Set) is for auto-scaling, not high availability. Option D (Proximity Placement Group) is for low latency, not HA.

Answer

Deploy VMs in an Availability Set

Answer

Deploy VMs in a Proximity Placement Group

Answer

Deploy VMs in a Virtual Machine Scale Set

Question 6

A company is migrating on-premises applications to Azure. They require that all traffic between Azure resources and on-premises resources traverse a private connection. They also want to reduce the attack surface by eliminating exposure of management endpoints over the internet. Which solution should they implement?

Accepted Answer

Azure ExpressRoute with Private Link for Azure services. Option D is correct because Azure ExpressRoute provides a private, dedicated connection, and when combined with Private Link, it allows accessing Azure services over a private endpoint. Option A is incorrect because VPN Gateway is encrypted but traverses the internet. Option B is incorrect because Azure Firewall does not provide a private connection. Option C is incorrect because Azure Front Door is for web traffic and not a private connection.

Answer

Azure Firewall

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 7

A company is planning to migrate on-premises SQL Server databases to Azure. They want to minimize administrative overhead and ensure high availability with automatic failover. Which TWO Azure SQL deployment options should they consider?

Accepted Answer

Azure SQL Database (single database). Options B and C are correct. Azure SQL Database Managed Instance provides high availability with automatic failover and reduces administrative overhead. Azure SQL Database (single database) also provides built-in high availability. Option A is incorrect because SQL Server on Azure VMs requires manual administration. Option D is incorrect because SQL Server Stretch Database is for archiving. Option E is incorrect because Azure Synapse Analytics is for data warehousing.

Answer

SQL Server on Azure VMs

Answer

SQL Server Stretch Database

Answer

Azure Synapse Analytics

Question 8

Which TWO Azure services can be used to provide a fully managed DNS solution that supports custom domains and DNSSEC?

Accepted Answer

Azure DNS. Azure DNS provides managed DNS with DNSSEC support (if enabled for certain zones). Azure Traffic Manager uses DNS to route traffic but does not manage DNS zones directly. Azure Front Door uses custom domains but does not provide DNS hosting or DNSSEC. Azure App Service provides custom domains but not DNS management. Azure Public IP does not provide DNS. Therefore, only Azure DNS supports DNSSEC and custom domains.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure App Service

Answer

Azure Public IP address

Question 9

You are designing a containerized microservices application on Azure Kubernetes Service (AKS). The application must scale automatically based on HTTP traffic. You need to minimize cost by scaling down to zero pods when there is no traffic. Which scaling solution should you use?

Accepted Answer

Kubernetes Event-driven Autoscaler (KEDA). Option B is correct. The Kubernetes Event-driven Autoscaler (KEDA) can scale based on HTTP requests and supports scaling to zero pods when there is no traffic. Option A is wrong because the horizontal pod autoscaler (HPA) cannot scale to zero. Option C is wrong because the cluster autoscaler scales nodes, not pods. Option D is wrong because the vertical pod autoscaler adjusts resource requests, not number of pods.

Answer

Horizontal Pod Autoscaler (HPA)

Answer

Cluster Autoscaler

Answer

Vertical Pod Autoscaler (VPA)

Question 10

Your organization is migrating a legacy on-premises application to Azure. The application uses a proprietary authentication protocol that is not supported by Microsoft Entra ID. You need to integrate the application with Microsoft Entra ID without modifying the application code. What should you do?

Accepted Answer

Configure Microsoft Entra ID Application Proxy to provide secure remote access and pass through authentication.. Option A is correct because Microsoft Entra ID Application Proxy can be configured to pass authentication to the on-premises application, allowing legacy protocols. Option B (Azure AD Domain Services) is for Kerberos/NTLM. Option C (Azure AD B2C) is for customer-facing apps. Option D (Azure AD Connect) syncs identities but doesn't help with protocol translation.

Answer

Use Azure Active Directory B2C with custom policies to translate the authentication protocol.

Answer

Deploy Azure Active Directory Domain Services and domain-join the application servers.

Answer

Implement Azure Active Directory Connect with pass-through authentication.

Question 11

You are designing a highly available architecture for a stateful application running on Azure Virtual Machines. The application requires a shared storage solution that supports concurrent read/write access from multiple VMs, and must be resilient to zone failures. Which TWO Azure solutions meet these requirements? (Choose TWO.)

Accepted Answer

Azure NetApp Files with cross-zone replication. Option A (Azure Files premium shares) supports SMB multichannel and concurrent access, and can be zone-redundant. Option C (Azure NetApp Files) supports NFS/SMB and cross-zone replication. Option B (Azure Blob Storage) does not support concurrent access as a file share. Option D (Azure Managed Disks) cannot be shared without special clustering. Option E (Azure Disk Storage with shared disks) is limited to 2-3 nodes and not zone-redundant.

Answer

Azure Disk Storage with shared disks enabled

Answer

Azure Managed Disks with Standard SSD

Answer

Azure Blob Storage with hot access tier and geo-redundant storage (GRS)

Question 12

A company wants to implement a backup strategy for their Azure virtual machines. They need to retain backups for 7 years for compliance and ensure backups are encrypted at rest. Which solution should you recommend?

Accepted Answer

Azure Backup with a vault configured for 7-year retention and encryption at rest.. Option C is correct because Azure Backup supports long-term retention (up to 99 years) and encryption at rest using Azure Storage Service Encryption. Option A is wrong because Azure Site Recovery is for disaster recovery, not long-term backup. Option B is wrong because Azure Disk Snapshot does not support 7-year retention natively. Option D is wrong because Azure Files Backup is for file shares, not VMs.

Answer

Azure Disk Snapshot with a lifecycle management policy.

Answer

Azure Files Backup to a Recovery Services vault.

Answer

Azure Site Recovery with custom retention policies.

Question 13

Your organization has a hybrid identity solution using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to use their on-premises credentials to authenticate to cloud applications, but you want to avoid synchronizing password hashes to the cloud. Which authentication method should you choose?

Accepted Answer

Pass-through Authentication. Pass-through Authentication allows users to sign in using their on-premises password without synchronizing password hashes to Microsoft Entra ID. Option A (Password Hash Synchronization) requires hash sync. Option B (Federation with AD FS) requires federation infrastructure. Option D (Seamless Single Sign-On) is a feature that works with other methods.

Answer

Seamless Single Sign-On

Answer

Active Directory Federation Services (AD FS)

Answer

Password Hash Synchronization

Question 14

A company has multiple Azure subscriptions and wants to enforce consistent network policies across all VNets. They need to ensure that all traffic going out to the internet is inspected by a central firewall. The solution must be scalable and support multiple regions. What should they implement?

Accepted Answer

Use Azure Virtual WAN with a secured hub and Azure Firewall Manager. Option B is correct because Azure Virtual WAN with a secured hub using Azure Firewall Manager provides centralized internet inspection for multiple regions. Option A is incorrect because Azure Firewall in a single VNet does not scale across subscriptions without Virtual WAN. Option C is incorrect because Azure Policy enforces rules but does not inspect traffic. Option D is incorrect because VNet peering does not centralize traffic inspection.

Answer

Deploy Azure Firewall in each subscription and route traffic through it

Answer

Use Azure Policy to enforce route tables on each VNet

Answer

Create VNet peering and use a network virtual appliance in one subscription

Question 15

A company is designing a hybrid network solution connecting an on-premises data center to Azure. They require high availability with active-active routing and need to support up to 10 Gbps throughput. Which Azure service should they include in the design?

Accepted Answer

ExpressRoute FastPath. ExpressRoute FastPath provides active-active connectivity with high throughput up to 10 Gbps. Option A is wrong because VPN Gateway typically supports lower throughput and is active-passive. Option B is wrong because Azure Virtual WAN is a management layer, not a connectivity service itself. Option D is wrong because ExpressRoute Direct provides dedicated ports but not inherently active-active routing.

Answer

Site-to-Site VPN Gateway

Answer

Azure Virtual WAN

Answer

ExpressRoute Direct