AZ-305 Practice Test 36 — 15 Questions

Question 1

A company is migrating on-premises applications to Azure. They require that all traffic between Azure resources and on-premises resources traverse a private connection. They also want to reduce the attack surface by eliminating exposure of management endpoints over the internet. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure ExpressRoute with Private Link for Azure services. Azure ExpressRoute provides a private, dedicated connection from on-premises to Azure, bypassing the public internet. By combining ExpressRoute with Private Link for Azure services, you ensure that traffic to Azure PaaS services (e.g., Azure SQL, Storage) traverses only the private connection and that the service endpoints are not exposed over the internet, reducing the attack surface. This directly meets the requirement for private connectivity and elimination of public management endpoints.

Answer

Azure Firewall

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 2

Which TWO Microsoft Entra ID editions include Conditional Access? (Choose two.)

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 includes Conditional Access, which allows organizations to enforce access policies based on signals like user, location, device, and application. This edition provides the core Conditional Access capabilities needed for most enterprise scenarios, such as requiring multi-factor authentication or blocking access from untrusted locations.

Answer

Azure AD Basic (legacy)

Answer

Microsoft 365 Business Basic

Answer

Microsoft Entra ID Free

Question 3

A company is planning to migrate a legacy application to Azure VMs. The application requires a static IP address for licensing purposes. The VM must be highly available within a single region. Which combination of Azure resources should they use?

Accepted Answer

Standard Load Balancer with a static frontend IP and availability set. A Standard Load Balancer with a static frontend IP provides a fixed IP address for licensing, and an availability set ensures high availability by distributing VMs across fault and update domains within a single region. This combination meets the requirement for a static IP and regional HA without needing scale-out or global routing.

Answer

Application Gateway with a static frontend IP and virtual machine scale set

Answer

Basic Load Balancer with a static frontend IP and availability zone

Answer

Azure Front Door with a static backend IP and VM in an availability zone

Question 4

You are reviewing a Bicep template that deploys two App Service Environments (ASE) and an Azure Traffic Manager profile. The exhibit shows the template snippet. What is the expected behavior when the primary ASE becomes unhealthy?

Accepted Answer

Traffic is automatically routed to the secondary ASE with priority 2.. Azure Traffic Manager uses priority routing, which directs all traffic to the primary endpoint (priority 1) as long as it is healthy. When the primary ASE becomes unhealthy, Traffic Manager automatically fails over to the next priority endpoint (priority 2), ensuring continuous availability without manual intervention.

Answer

Traffic is stopped until an administrator updates the DNS manually.

Answer

Traffic is load-balanced between both ASEs based on performance.

Answer

Traffic continues to be sent to the primary ASE because priority routing only uses the primary.

Question 5

Which TWO of the following are benefits of using Azure Cosmos DB for a globally distributed application?

Accepted Answer

Multiple well-defined consistency levels. Azure Cosmos DB offers multiple well-defined consistency levels (Strong, Bounded Staleness, Session, Consistent Prefix, Eventual) that allow developers to balance data consistency, availability, and latency according to application requirements. This flexibility is a key benefit for globally distributed applications because different operations may tolerate different levels of staleness while still meeting SLAs.

Answer

Full support for SQL Server features like stored procedures

Answer

Automatic failover to a secondary region without manual intervention

Answer

Support for only the SQL API

Question 6

A hub-and-spoke Azure network must centralize outbound inspection and still allow spokes to resolve private endpoint DNS names. Which two components are commonly required? (Choose 2.)

Accepted Answer

User-defined routes from spoke subnets to the firewall or NVA.. User-defined routes (UDRs) on spoke subnets force all outbound traffic (including internet-bound traffic) to the central firewall or network virtual appliance (NVA) in the hub, enabling centralized inspection. Without UDRs, spoke VMs would bypass the firewall and use default outbound internet access, breaking the inspection requirement.

Answer

A public IP address on every private endpoint.

Answer

Basic SKU load balancers in each spoke.

Question 7

Refer to the exhibit. You are reviewing an ARM template for deploying a storage account. The template is missing the storage account name parameter definition. What will happen when you attempt to deploy this template?

Accepted Answer

The deployment will fail with a validation error because the parameter is not defined.. In Azure Resource Manager (ARM) templates, all parameters must be explicitly defined in the `parameters` section of the template. If a parameter is referenced (e.g., in the `resources` section) but not defined, the deployment fails with a validation error before any resource provisioning begins. This is because ARM validates the template structure and parameter definitions during the pre-deployment validation phase, and an undefined parameter is considered a syntax error.

Answer

The deployment will prompt the user to provide the missing parameter.

Answer

The deployment will succeed using a default name based on the resource group.

Answer

The deployment will create a storage account with a random name.

Question 8

Refer to the exhibit. You are reviewing the replication health of an on-premises Hyper-V VM replicated to Azure using Azure Site Recovery. The JSON output shows the properties of the replicated item. The replication health is 'Normal', but the last recovery point is from 2 hours ago. You need to ensure the Recovery Point Objective (RPO) of 15 minutes is met. What is the most likely cause of the issue?

Accepted Answer

The replication frequency is set to 30 minutes or more.. The replication frequency for Hyper-V replication to Azure using Azure Site Recovery (ASR) can be set to 30 seconds, 5 minutes, or 15 minutes. If the last recovery point is 2 hours old despite 'Normal' health, the replication frequency is likely configured to 30 minutes or more, which directly prevents meeting a 15-minute RPO. ASR's replication frequency setting controls how often changes are sent to Azure, and a value exceeding 15 minutes would cause the observed gap.

Answer

The VM's application-consistent snapshot is failing.

Answer

The target region is not correctly configured in the recovery plan.

Answer

The Hyper-V host is not registered with the Recovery Services vault.

Question 9

You need to design a virtual network architecture for a three-tier application in Azure. The web tier must be accessible from the internet, the application tier must only be accessible from the web tier, and the database tier must only be accessible from the application tier. Which combination of Azure services should you use?

Accepted Answer

Use Azure Application Gateway with WAF, network security groups (NSGs) on subnets, and Azure Private Endpoints for the database.. It uses Azure Application Gateway with WAF to provide internet-facing, layer-7 web traffic management and protection, network security groups (NSGs) on subnets to enforce east-west traffic isolation (web-to-app, app-to-database), and Azure Private Endpoints for the database to ensure the database is accessible only via a private IP within the virtual network, eliminating exposure to the internet. This combination meets the three-tier isolation requirements precisely.

Answer

Use Azure Front Door, service endpoints, and Azure SQL Database with firewall rules.

Answer

Use Azure Load Balancer, Azure Firewall, and Azure SQL Database with public endpoint.

Answer

Use a single virtual network with three subnets, no NSGs, and Azure SQL Database with VNet injection.

Question 10

Which THREE of the following are best practices for designing a data storage solution using Azure Cosmos DB?

Accepted Answer

Use the appropriate consistency level based on application requirements. Azure Cosmos DB offers five well-defined consistency levels (strong, bounded staleness, session, consistent prefix, and eventual). Choosing the appropriate level based on application requirements is a best practice, as it balances data consistency guarantees against latency and throughput. For example, session consistency is ideal for multi-user applications where each user reads their own writes, while strong consistency ensures linearizability but reduces availability and increases latency.

Answer

Store large binary data (e.g., images) directly as documents

Answer

Use manual provisioned throughput for all containers to control costs

Question 11

Your organization uses Azure Monitor to monitor a fleet of 500 VMs running Windows Server. You need to collect security event logs (Event ID 4625 for failed logons) from all VMs and send them to a Log Analytics workspace. The solution must support centralized configuration and be scalable. You also want to filter out high-volume noise events to reduce costs. What should you do?

Accepted Answer

Deploy the Azure Monitor agent via Azure Policy and create a data collection rule to collect Event ID 4625.. The Azure Monitor agent (AMA) is the current recommended agent for collecting security events from VMs, and using Azure Policy to deploy it ensures centralized, scalable configuration across 500 VMs. A data collection rule (DCR) can be configured to collect only Event ID 4625, filtering out high-volume noise events at the source, which reduces costs by minimizing data ingestion into the Log Analytics workspace.

Answer

Enable VM Insights on all VMs and use the Performance view to detect failed logons.

Answer

Stream events to Azure Event Hubs and use a function to filter and send to Log Analytics.

Answer

Install the Log Analytics agent on each VM and configure Windows Event log collection in the workspace.

Question 12

Which TWO of the following Azure services can be used to enable automatic failover of a web application across Azure regions?

Accepted Answer

Azure Front Door. Azure Front Door is a global, scalable entry point that provides built-in automatic failover across regions using anycast-based routing and health probes. When a primary region becomes unhealthy, Front Door instantly routes traffic to the next available healthy backend, enabling seamless multi-region failover for web applications.

Answer

Azure DNS

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 13

Refer to the exhibit. You create this Conditional Access policy in Microsoft Entra ID. What is the result?

Accepted Answer

All users are prompted for MFA when accessing any application from a browser or mobile app.. The exhibit shows a Conditional Access policy that applies to 'All users' and targets 'All cloud apps' with the grant control set to 'Require multi-factor authentication'. This configuration forces every user, including administrators and external users, to complete MFA when accessing any cloud application from any platform (browser or mobile app). Option B correctly states this universal MFA requirement.

Answer

Only administrators are prompted for MFA.

Answer

External users are prompted for MFA.

Answer

Access is blocked for all users.

Question 14

Which THREE of the following are best practices for designing a business continuity solution using Azure Site Recovery? (Select THREE.)

Accepted Answer

Perform test failovers regularly to validate the recovery plan. Azure Site Recovery (ASR) recommends performing test failovers regularly to validate that the recovery plan works as expected without impacting production workloads. Test failovers use isolated networks to verify replication health, application consistency, and RTO/RPO targets, ensuring the actual failover process is reliable.

Answer

Configure automatic failover for all VMs without manual intervention

Answer

Use a single target region for all VMs to simplify management

Question 15

Which TWO of the following are valid design considerations for implementing Azure SQL Database geo-replication? (Choose two.)

Accepted Answer

Geo-replication supports up to four readable secondary replicas. Azure SQL Database geo-replication supports up to four readable secondary replicas, which can be used for read-only query offloading and disaster recovery. Option E is correct because these secondary replicas are fully readable, allowing you to distribute read-only workloads to reduce load on the primary database.

Answer

Geo-replication ensures zero data loss during failover

Answer

Geo-replication provides automatic failover without manual intervention

Answer

Geo-replication requires a listener for client connections