AZ-305 Practice Test 34 — 15 Questions

Question 1

Your company has multiple Azure subscriptions. You need to ensure that all security-related logs from Azure resources are centralized in a single Log Analytics workspace for analysis. Which Azure service should you use to collect and route these logs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy. Azure Policy is correct because it can enforce the deployment of a diagnostic setting on all Azure resources, automatically routing security-related logs (such as Activity Logs, resource logs, and audit logs) to a single Log Analytics workspace. This ensures centralized collection and analysis without manual configuration per resource, meeting the requirement for a governance-driven approach.

Answer

Azure Monitor

Answer

Microsoft Sentinel

Answer

Azure Event Hubs

Question 2

Refer to the exhibit. You are assigned an Azure policy that restricts resource group locations to eastus, westus, and centralus. A user attempts to create a resource group in 'eastus2' and receives a denial. The user argues that there are existing resources in 'eastus2' and that the policy should allow it. What is the best course of action to allow the resource group creation while maintaining compliance?

Accepted Answer

Instruct the user to create the resource group in an allowed location and then deploy resources to 'eastus2'. Azure Policy evaluates resource group location at creation time, not the location of individual resources within it. A resource group is a logical container that can hold resources in any region, regardless of the resource group's own location. By creating the resource group in an allowed location (eastus, westus, or centralus), the user satisfies the policy constraint while still being able to deploy resources to 'eastus2' within that resource group.

Answer

Add 'eastus2' to the list of allowed locations in the policy parameters

Answer

Create an Azure Policy exemption for the user's subscription

Answer

Disable the policy assignment for that subscription

Question 3

Your company has a hybrid identity environment with Microsoft Entra ID and an on-premises Active Directory. You need to enable single sign-on (SSO) for users accessing Microsoft 365 applications from domain-joined devices. Which authentication method should you configure?

Accepted Answer

Microsoft Entra Seamless SSO. Microsoft Entra Seamless SSO (C) is the correct choice because it automatically signs users in when they are on domain-joined devices connected to the corporate network, without requiring any additional prompts. It integrates with password hash synchronization or pass-through authentication to provide a true single sign-on experience for Microsoft 365 applications, leveraging Kerberos delegation to validate the user's identity against on-premises Active Directory.

Answer

Microsoft Entra Pass-through Authentication

Answer

Microsoft Entra password hash synchronization

Answer

Active Directory Federation Services (AD FS)

Question 4

Refer to the exhibit. You are deploying NSG flow logs. After deployment, you notice that no logs are being written to the storage account. What is the most likely cause?

Accepted Answer

Network Watcher is not enabled in the region.. NSG flow logs require Network Watcher to be enabled in the region where the NSG resides. If Network Watcher is not enabled, the flow logs cannot be written to the storage account because the logging pipeline depends on the Network Watcher agent to capture and forward flow data. Enabling Network Watcher in the region resolves this issue.

Answer

Retention policy is set to 0 days.

Answer

The storage account is in a different subscription.

Answer

The format version is incorrect.

Question 5

You need to store semi-structured data from IoT devices in Azure. The data has varying schemas and high write throughput. Which Azure service should you use?

Accepted Answer

Azure Cosmos DB.. Azure Cosmos DB is the correct choice because it is a globally distributed, multi-model database service designed for high write throughput and semi-structured data with varying schemas. It supports multiple APIs (e.g., SQL, MongoDB, Cassandra) and offers single-digit millisecond latency at any scale, making it ideal for IoT scenarios where device telemetry has inconsistent fields and requires rapid ingestion.

Answer

Azure Blob Storage.

Answer

Azure SQL Database.

Answer

Azure Table Storage.

Question 6

Refer to the exhibit. An administrator configured Azure Site Recovery replication for a VM using the policy shown. The VM workload is a critical database that requires application-consistent snapshots every 30 minutes to meet compliance. What is the issue with the current configuration?

Accepted Answer

The application-consistent snapshot frequency is 60 minutes, which is too high (should be 30 minutes).. The current policy sets the application-consistent snapshot frequency to 60 minutes, but the compliance requirement demands a snapshot every 30 minutes. Application-consistent snapshots are taken by the Azure Site Recovery mobility service using VSS (Volume Shadow Copy Service) on Windows, and the frequency is configured in the replication policy. Since the requirement is 30 minutes, the policy must be adjusted to match that interval.

Answer

The recovery point retention is set too low (1440 minutes).

Answer

The target region eastus2 is not a valid paired region for the source.

Answer

The storage account type is Standard_LRS; it should be Premium_LRS.

Question 7

Your company uses Azure SQL Database and needs to retain backups for 7 years for compliance. Which backup retention policy should you configure?

Accepted Answer

Configure long-term retention (LTR) backup policy.. Azure SQL Database's automated backup retention is limited to a maximum of 35 days, which is insufficient for a 7-year compliance requirement. Long-term retention (LTR) allows you to retain full database backups for up to 10 years by storing them in separate Azure Blob Storage containers. Therefore, configuring an LTR backup policy is the correct solution for meeting a 7-year retention mandate.

Answer

Increase automated backup retention to 7 years.

Answer

Configure point-in-time restore backup retention for 7 years.

Answer

Enable geo-redundant backups.

Question 8

Refer to the exhibit. You are deploying an ARM template with the above parameters. After deployment, you need to ensure that the storage account automatically moves blobs that are not accessed for 30 days to the archive tier. What should you do?

Accepted Answer

Add a lifecycle management policy rule to the storage account.. Azure Storage lifecycle management policies allow you to automatically move blobs to cooler tiers (like Archive) based on age or last access time. By adding a rule with a filter for blobs not accessed in 30 days and an action to tier to Archive, you meet the requirement without manual intervention or changing the default access tier.

Answer

Enable soft delete for blobs.

Answer

Change the 'accessTier' parameter value to 'Archive'.

Answer

Change the 'replication' parameter value to 'GRS'.

Question 9

A company plans to deploy a web application on Azure App Service that will be accessed by users worldwide. The application must have a single endpoint and use Azure Web Application Firewall (WAF) policies. Which Azure service should be placed in front of the App Service to meet these requirements?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides a single, global endpoint with built-in Web Application Firewall (WAF) policies at the edge. It operates at Layer 7 (HTTP/HTTPS) and uses anycast routing to route user traffic to the nearest App Service instance, ensuring low latency and high availability worldwide.

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 10

You are reviewing a custom RBAC role in Azure. The exhibit shows the role definition. A user with this role reports they cannot read diagnostic settings for a storage account in the Production resource group. What is the most likely cause?

Accepted Answer

The role does not include 'Microsoft.Storage/storageAccounts/read'. The user cannot read diagnostic settings because the custom role lacks the 'Microsoft.Storage/storageAccounts/read' permission. This permission is required to read the storage account resource itself, which is a prerequisite for accessing its diagnostic settings. Without it, the role cannot perform any read operations on the storage account, including reading diagnostic logs or metrics configuration.

Answer

Custom roles cannot be assigned to users

Answer

The role lacks the 'Microsoft.Storage/storageAccounts/listKeys/action' permission

Answer

The role is assigned at the wrong scope

Question 11

A company needs to provide secure remote administration access to Azure virtual machines for their IT team. The VMs are in a virtual network with no public IP addresses. The IT team uses browsers to connect. The solution should not require any custom software on the client machines. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure virtual machines directly in the Azure portal over TLS. Because the VMs have no public IP addresses, Bastion acts as a jump server that is deployed inside the virtual network, eliminating the need for any public exposure. Since the IT team uses browsers and cannot install custom software, Bastion's native browser-based HTML5 client meets the requirement perfectly.

Answer

Just-in-Time VM access

Answer

Azure VPN Gateway

Answer

Microsoft Entra ID Domain Services

Question 12

A company wants workload deployments to access Azure resources without storing client secrets in CI/CD variables. The pipeline runs from GitHub Actions. Which identity design should be used?

Accepted Answer

Workload identity federation with Microsoft Entra ID. Workload identity federation with Microsoft Entra ID allows GitHub Actions to exchange an OpenID Connect (OIDC) token for an Azure access token, eliminating the need to store client secrets in CI/CD variables. This design uses short-lived tokens and federated identity credentials, aligning with the principle of zero-trust and secretless authentication.

Answer

A shared user account with MFA disabled

Answer

A storage account access key

Answer

A long-lived app registration client secret

Question 13

A company has multiple Azure subscriptions and wants to enforce consistent network policies across all VNets. They need to ensure that all traffic going out to the internet is inspected by a central firewall. The solution must be scalable and support multiple regions. What should they implement?

Accepted Answer

Use Azure Virtual WAN with a secured hub and Azure Firewall Manager. Azure Virtual WAN with a secured hub and Azure Firewall Manager provides a centralized, scalable solution for enforcing consistent network policies across multiple subscriptions and regions. It enables a hub-and-spoke architecture where all internet-bound traffic from VNets is routed through a central Azure Firewall for inspection, with Azure Firewall Manager offering global policy management and automated routing.

Answer

Deploy Azure Firewall in each subscription and route traffic through it

Answer

Use Azure Policy to enforce route tables on each VNet

Answer

Create VNet peering and use a network virtual appliance in one subscription

Question 14

Your organization has multiple Azure subscriptions. You need to create a central view of policy compliance across all subscriptions. What should you use?

Accepted Answer

Azure Policy compliance dashboard. The Azure Policy compliance dashboard provides a centralized view of policy compliance across all subscriptions in a management group or tenant. It aggregates compliance data from all assigned policies and initiatives, allowing you to filter by subscription, policy definition, or compliance state. This is the native tool designed specifically for cross-subscription policy compliance monitoring.

Answer

Azure Monitor

Answer

Azure Resource Graph

Answer

Azure Blueprints

Question 15

A company needs to provide secure access to Azure resources for remote employees. They want to enforce multi-factor authentication and conditional access policies. The solution should not require a VPN connection. Which Azure service should they implement?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure Active Directory) provides identity and access management services that include multi-factor authentication (MFA) and conditional access policies. These capabilities allow you to enforce security requirements like MFA and device compliance before granting access to Azure resources, all without requiring a VPN connection. Entra ID acts as the identity provider and policy engine, making it the correct choice for this scenario.

Answer

Microsoft Intune

Answer

Azure VPN Gateway

Answer

Azure Bastion