AZ-305 Practice Test 35 — 15 Questions

Question 1

You are designing a disaster recovery solution for an Azure IaaS workload. The application runs on Azure VMs in a single region and requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which of the following is the most cost-effective approach to meet these requirements?

Accepted Answer

Deploy Azure Site Recovery to replicate VMs to the secondary region with a replication policy that meets the RPO and RTO.. Option C is correct because Azure Site Recovery provides replication with RPO as low as 30 seconds to another region, easily meeting 15 minutes, and automated failover within minutes, meeting 4-hour RTO. Option A is wrong because geo-redundant storage applies to storage accounts, not VMs, and doesn't provide automated failover. Option B is wrong because backing up to a secondary region via Azure Backup has an RPO of 1-2 hours and RTO of hours to days. Option D is wrong because Azure Front Door is for web traffic load balancing, not VM failover.

Answer

Configure geo-redundant storage (GRS) for the VM disks and manually attach them to new VMs in the secondary region.

Answer

Use Azure Front Door with a back-end pool containing VMs in both regions, and configure health probes to route traffic on failure.

Answer

Use Azure Backup to back up VMs to a Recovery Services vault in the secondary region and perform restore during failover.

Question 2

Which THREE of the following are best practices for securing an Azure Kubernetes Service (AKS) cluster? (Choose three.)

Accepted Answer

Enable Azure Policy for Kubernetes to enforce security policies.. Correct answers are A, B, and D. Option C is wrong because AKS supports Azure RBAC for Kubernetes authorization. Option E is wrong because network policies are recommended to micro-segment traffic.

Answer

Allow all pod-to-pod communication within the cluster without network policies.

Answer

Disable Kubernetes RBAC and use only Azure RBAC for simplicity.

Question 3

Your company has Azure virtual machines running a critical application. You need to back up these VMs daily and retain backups for 7 years. The solution must be cost-effective and support application-consistent backups. What should you use?

Accepted Answer

Azure Backup. Option D is correct because Azure Backup supports daily backup, long-term retention (up to 99 years), and application-consistent backups via VSS. Option A is wrong because Azure Site Recovery is for disaster recovery, not backup. Option B is wrong because Azure VM snapshots are not managed backups. Option C is wrong because Azure Files is for file shares, not VM backup.

Answer

Azure Files backup

Answer

Azure Site Recovery

Answer

Azure VM snapshots stored in Azure Storage

Question 4

A healthcare organization is migrating a regulatory-compliant application to Azure. The application must be isolated from the internet and accessible only from on-premises networks via a private IP address. The solution must minimize latency and maximize throughput for large data transfers. Which Azure networking solution should the organization implement?

Accepted Answer

Azure ExpressRoute. Option A (Azure VPN Gateway) uses IPSec tunnels over the internet, which may not provide the lowest latency and throughput. Option B (Azure ExpressRoute) provides dedicated private connections with higher bandwidth, lower latency, and more reliability than VPN. Option C (Azure Private Link) provides private connectivity to PaaS services but does not connect on-premises to VNets. Option D (Azure Virtual WAN) is a hub-and-spoke architecture that can incorporate ExpressRoute, but the question asks for the best solution to connect on-premises to Azure privately. ExpressRoute is the optimal choice for low latency and high throughput.

Answer

Azure Private Link

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Question 5

You are designing a backup strategy for Azure virtual machines that must support application-consistent backups and be capable of restoring to a different Azure region. Which solution should you use?

Accepted Answer

Azure Backup. Option C is correct because Azure Backup supports application-consistent backups for VMs and cross-region restore. Option A is wrong because Azure Site Recovery provides disaster recovery, not backup. Option B is wrong because Azure Disk Backup supports disk-level backups but not application-consistent backups. Option D is wrong because Azure Files is a storage service, not a backup service.

Answer

Azure Site Recovery

Answer

Azure Files

Answer

Azure Disk Backup

Question 6

Refer to the exhibit. You have an Azure Storage account with the settings shown. A developer reports that they cannot access the storage account from their Azure VM that is connected to subnet-a. The VM's subnet ID matches the one in the rule. What is the most likely cause of the issue?

Accepted Answer

The subnet does not have a service endpoint for Microsoft.Storage enabled. The network rule set has defaultAction set to Deny, and only virtual network rules are configured. For traffic from a VM in subnet-a to be allowed, the VM's subnet must be listed. However, the VM might not have a service endpoint enabled for Microsoft.Storage on that subnet. Option A is wrong because the subnet is listed. Option C is wrong because HTTPS is enabled. Option D is wrong because GRS does not prevent access.

Answer

The storage account requires HTTPS and the VM is using HTTP

Answer

The storage account does not have a firewall rule for the VM's public IP

Answer

The storage account uses GRS replication which is not supported with network rules

Question 7

You are designing a backup strategy for Azure virtual machines. The solution must support application-consistent backups for SQL Server databases running on the VMs. You need to ensure that backups are taken every 4 hours and retained for 30 days. What should you configure in Azure Backup?

Accepted Answer

Configure a VM backup policy with 4-hour frequency and 30-day retention using the default backup extension.. Option D is correct because Azure Backup supports application-consistent backups via the VM backup policy, which can be configured with a frequency of 4 hours and retention of 30 days. The backup extension for Windows (VMSnapshot) ensures application consistency. Option A (Azure Site Recovery) is for replication, not backup. Option B (Azure SQL Backup) is for Azure SQL databases, not VMs. Option C (Azure Backup for SAP HANA) is specific to SAP HANA.

Answer

Configure Azure SQL Backup for the SQL Server databases.

Answer

Configure Azure Site Recovery replication policy with 4-hour frequency.

Answer

Configure Azure Backup for SAP HANA on the VM.

Question 8

Refer to the exhibit. You are an Azure administrator. You assign this policy definition to a subscription. A developer attempts to deploy a virtual machine with SKU Standard_DS1_v2. What is the outcome?

Accepted Answer

The deployment is denied because Standard_DS1_v2 is not in the allowed list.. The policy denies any virtual machine deployment where the SKU is not in the allowed list. The allowed SKUs are Standard_DS2_v2, Standard_DS3_v2, Standard_DS4_v2. Standard_DS1_v2 is not in the list, so the deployment is denied. Option A is incorrect because the policy denies non-compliant SKUs. Option C is incorrect because the effect is deny, not audit. Option D is incorrect because the policy does not create a remediation task.

Answer

The deployment succeeds because Standard_DS1_v2 is not explicitly denied.

Answer

The deployment is denied and a remediation task is created.

Answer

The deployment succeeds but is logged as non-compliant.

Question 9

You are designing a landing zone in Azure for a regulated financial services company. They require that all storage accounts be restricted to specific virtual networks and have encryption using customer-managed keys (CMK). Additionally, they want to ensure that any storage account creation outside of the approved network boundaries is prevented. Which combination of Azure Policy and Network Security controls should you recommend?

Accepted Answer

Use Azure Policy to enforce service endpoints on storage accounts and deny creation if not present, along with a policy requiring CMK encryption.. Option B is correct because Azure Policy can enforce service endpoints and deny creation if a required tag (like 'network') is not set. Network security groups alone cannot enforce encryption or creation policies. Option A is wrong because NSGs are not used for storage account access control. Option C is wrong because Azure Firewall is for outbound traffic, not storage access. Option D is wrong because Private Endpoint is recommended for private connectivity, but service endpoints can also be used with policies; however, the question requires enforcement of network restrictions and CMK, which Azure Policy does.

Answer

Use Azure Policy to require storage account encryption with CMK, and use network security groups (NSGs) to restrict storage account access to specific subnets.

Answer

Deploy Azure Firewall in the hub virtual network and configure application rules to allow only approved storage accounts.

Answer

Use Azure Policy to require storage accounts to use private endpoints, and use Azure Private Link to restrict access from specific virtual networks.

Question 10

Which TWO of the following are valid data storage solutions for an Azure-based microservices architecture that requires high throughput and low latency? (Choose two.)

Accepted Answer

Azure Cosmos DB. Correct answers are A and D. Option B is wrong because Azure SQL Database is relational and may not provide the scalability needed for high throughput. Option C is wrong because Azure Files is for file shares, not optimized for microservices. Option E is wrong because Table Storage is for NoSQL key-value store but lower throughput than Cosmos DB.

Answer

Azure Table Storage

Answer

Azure Files

Answer

Azure SQL Database

Question 11

You are designing a solution to monitor a hybrid environment consisting of Azure VMs and on-premises servers. The solution must provide centralized log analytics, security threat detection, and the ability to run custom queries across all logs. Which TWO Azure services should you include? (Choose two.)

Accepted Answer

Azure Log Analytics workspace. Options B and C are correct. Azure Log Analytics workspace is the central repository for logs and supports KQL queries. Microsoft Sentinel provides security threat detection and SIEM capabilities. Option A is wrong because Azure Monitor Agent is a data collection mechanism, not a central analytics service. Option D is wrong because Azure Update Manager is for patching, not monitoring. Option E is wrong because Azure Arc is for management, not log analytics.

Answer

Azure Monitor Agent

Answer

Azure Arc

Answer

Azure Update Manager

Question 12

A company plans to deploy a web application on Azure App Service that will be accessed by users worldwide. The application must have a single endpoint and use Azure Web Application Firewall (WAF) policies. Which Azure service should be placed in front of the App Service to meet these requirements?

Accepted Answer

Azure Front Door. Option A (Azure Front Door) provides global load balancing, SSL offload, and WAF integration, making it the best choice. Option B (Azure Application Gateway) is a regional service, not global. Option C (Azure Traffic Manager) provides DNS-based load balancing but no WAF. Option D (Azure Load Balancer) is layer 4 and does not support WAF.

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 13

Your organization has a hybrid identity infrastructure with Microsoft Entra ID Connect Sync. You plan to enable Microsoft Entra ID Seamless Single Sign-On (Seamless SSO) for domain-joined Windows devices. What is the minimum requirement for the on-premises Active Directory forest functional level?

Accepted Answer

Windows Server 2008. Option B is correct because Microsoft Entra ID Seamless SSO requires the on-premises AD forest functional level to be Windows Server 2008 or higher. Option A is incorrect because Windows Server 2003 is too old. Option C (Windows Server 2012) and Option D (Windows Server 2016) are higher than necessary but would also work, but the question asks for the minimum.

Answer

Windows Server 2016

Answer

Windows Server 2012

Answer

Windows Server 2003

Question 14

You are designing a solution to grant external partners access to specific Azure resources. The partners must authenticate using their own corporate credentials. You need to manage their access centrally. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra ID B2B collaboration. Option C is correct because Microsoft Entra ID B2B collaboration allows external users to access your Azure resources using their own identities. Option A (Microsoft Entra ID B2C) is for customer-facing applications. Option B (Microsoft Entra ID Domain Services) provides domain services for VMs. Option D (Microsoft Entra ID Connect) syncs on-premises directories.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Connect

Question 15

Refer to the exhibit. You deploy this ARM template to a resource group in the East US region. You specify the parameter storageAccountType as 'Standard_GRS'. Which of the following is true about the deployed storage account?

Accepted Answer

The storage account is geo-redundant and replicates data to a paired region.. The template deploys a StorageV2 account with Standard_GRS SKU. Standard_GRS is geo-redundant, meaning data is replicated to a paired region. Option A is correct. Option B is incorrect because Standard_GRS is not zone-redundant. Option C is incorrect because the name is generated by uniqueString, which is deterministic based on the resource group ID. Option D is incorrect because the location is derived from the resource group location, not the parameter.

Answer

The storage account name will be 'storage' followed by a random string.

Answer

The storage account will be deployed in the same region as specified by the parameter.

Answer

The storage account is zone-redundant and replicates data across availability zones.