AZ-305 Practice Test 37 — 15 Questions

Question 1

Your company has a hybrid network with multiple on-premises sites connected to Azure via ExpressRoute. You need to design a DNS resolution strategy that allows Azure resources to resolve on-premises hostnames and on-premises clients to resolve Azure hostnames. The solution must minimize administrative overhead. What should you use?

Accepted Answer

Azure DNS Private Resolver. Option B is correct because Azure DNS Private Resolver can resolve between on-premises and Azure DNS zones without additional DNS servers. Option A is wrong because Azure DNS (public) does not resolve private hostnames. Option C is wrong because Azure Firewall DNS proxy requires manual forwarding rules. Option D is wrong because Azure Bastion is not a DNS resolution service.

Answer

Azure Bastion

Answer

Azure DNS public zones with conditional forwarding

Answer

Azure Firewall DNS proxy

Question 2

You need to design a storage solution for an application that stores large amounts of unstructured data that is accessed frequently for the first 30 days, then rarely after that. Compliance requirements mandate that data be retained for 7 years. Which of the following is the most cost-effective storage solution?

Accepted Answer

Use Azure Blob Storage with lifecycle management to transition blobs from Hot to Cool to Archive tiers.. Option B is correct because Azure Blob Storage with lifecycle management can automatically move blobs from Hot to Cool to Archive tiers as access patterns change, minimizing cost. Option A is wrong because Azure Files is for file shares, not optimal for large unstructured data. Option C is wrong because keeping all data in Hot tier is expensive. Option D is wrong because managed disks are for VM disks, not for general unstructured data storage.

Answer

Use Azure Files with snapshots and keep files in the Premium tier for 30 days, then move to Standard tier.

Answer

Use Azure Managed Disks with read-only snapshots and delete snapshots after 7 years.

Answer

Store all data in Blob Storage Hot tier and delete after 7 years.

Question 3

A company is designing a solution to store and analyze petabytes of IoT sensor data. The data is written once, rarely accessed, and must be retained for 10 years for compliance. The data must be queryable using SQL. Which combination of Azure services would be MOST cost-effective?

Accepted Answer

Azure Data Lake Storage Gen2 with Azure Synapse Serverless SQL. Option C is correct because Azure Data Lake Storage Gen2 (ADLS Gen2) provides low-cost storage for large volumes of data, and Azure Synapse Serverless SQL can query the data directly. Option A is wrong because Azure SQL Database is expensive for petabytes of cold data. Option B is wrong because Azure Cosmos DB is expensive for large cold storage. Option D is wrong because Azure Databricks is more expensive for simple SQL queries.

Answer

Azure Cosmos DB with analytical store

Answer

Azure SQL Database with Hyperscale tier

Answer

Azure Databricks with Delta Lake

Question 4

Refer to the exhibit. The ARM template provisions a VM. The deployment succeeds but the VM fails to start. What is the most likely cause?

Accepted Answer

The admin password is in plaintext and does not meet complexity requirements. Option C is correct because the template contains the admin password in plaintext, which violates Azure policy that requires a complex password or use of Key Vault. Option A is wrong because Premium_LRS is supported in most regions. Option B is wrong because StandardSSD_LRS is valid for data disks. Option D is wrong because the NIC reference uses the correct resourceId function.

Answer

The data disk size 1023 GB exceeds the maximum for StandardSSD_LRS

Answer

The network interface resource ID is incorrectly formatted

Answer

The VM size Standard_D2s_v3 is not available in the region

Question 5

A company is designing a backup strategy for a critical Azure SQL Database. The database is used in a production environment and the company requires the ability to restore to any point within the last 35 days with a maximum granularity of 5 minutes. Which backup configuration should the company choose?

Accepted Answer

Use Azure SQL Database automatic backups with a retention period of 35 days. Option A (Geo-redundant backup with long-term retention) does not specify point-in-time restore granularity. Option B (Configure point-in-time restore with a retention period of 35 days and a backup frequency of 5 minutes) is not possible because Azure SQL Database does not allow custom backup frequency; it uses automatic backups. Option C (Use Azure SQL Database automatic backups with a retention period of 35 days) meets the requirement because automatic backups provide point-in-time restore up to 35 days with 5-minute granularity. Option D (Use Azure Backup for SQL Server in Azure VM) is for SQL Server on VMs, not Azure SQL Database.

Answer

Use Azure Backup for SQL Server in Azure VM

Answer

Configure point-in-time restore with a retention period of 35 days and a backup frequency of 5 minutes

Answer

Configure geo-redundant backup with long-term retention

Question 6

A company uses Azure Firewall to secure outbound traffic from a hub virtual network. The security team reports that some traffic is bypassing the firewall because of asymmetric routing. You need to design a solution to force all outbound traffic through the firewall. What should you implement?

Accepted Answer

User Defined Routes (UDRs) with a default route (0.0.0.0/0) pointing to Azure Firewall. Option D is correct because User Defined Routes with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP enforce traffic symmetry. Option A is wrong because Azure Firewall Manager does not enforce routing; it manages policies. Option B is wrong because VNet peering does not force traffic through a firewall. Option C is wrong because Azure Route Server learns routes dynamically but does not enforce forced tunneling.

Answer

VNet peering with gateway transit

Answer

Azure Route Server

Answer

Azure Firewall Manager to enforce routing policies

Question 7

Your organization is migrating a legacy application to Azure that requires Windows authentication and a fixed IP address. The application will run on an Azure VM. You need to design a networking solution that ensures the VM retains its IP address even after a reboot and that the application can be reached by on-premises users using its hostname. Which TWO actions should you take? (Choose two.)

Accepted Answer

Assign a static private IP address to the VM's NIC. Options A and D are correct. A static private IP ensures the IP does not change after reboot. Azure DNS private zone allows custom DNS resolution for the hostname. Option B (public IP) is not required for internal access. Option C (Azure Bastion) is for management access, not name resolution. Option E (Azure Firewall) is not needed for this scenario.

Answer

Assign a static public IP address to the VM

Answer

Configure Azure Firewall to forward DNS requests

Answer

Connect to the VM using Azure Bastion for name resolution

Question 8

Your company is designing a hybrid identity solution that will allow users to authenticate to Azure resources using their on-premises Active Directory credentials. The solution must support multi-factor authentication (MFA) and conditional access policies. Which TWO components should you include?

Accepted Answer

Microsoft Entra Connect. Options A and D are correct. Microsoft Entra Connect syncs identities to the cloud, and Microsoft Entra ID provides the authentication and policy enforcement. Option B is wrong because ADFS is not required if using password hash sync or pass-through authentication with MFA. Option C is wrong because Intune is for device management, not authentication. Option E is wrong because Azure AD Application Proxy is for publishing on-prem apps.

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Application Proxy

Answer

Microsoft Intune

Question 9

You are designing a disaster recovery solution for a critical application running in Azure. The application uses Azure SQL Database. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 30 minutes. Which Azure SQL Database configuration should you recommend?

Accepted Answer

Active geo-replication. Option A is correct because active geo-replication provides continuous replication with RPO of 5 seconds and supports failover within 30 minutes. Option B is wrong because auto-failover groups have similar RPO but slightly higher RTO. Option C is wrong because point-in-time restore cannot meet the RPO of 5 seconds. Option D is wrong because Azure Backup has higher RPO.

Answer

Point-in-time restore to a different region

Answer

Auto-failover groups

Answer

Azure Backup for SQL Server in Azure VM

Question 10

A company is deploying a new application on Azure Kubernetes Service (AKS). The application requires persistent storage that can be dynamically provisioned and accessed by multiple pods simultaneously. Which Azure storage solution should the company use?

Accepted Answer

Azure Files. Option A (Azure Disk) can only be mounted on a single pod as ReadWriteOnce. Option B (Azure Files) supports ReadWriteMany and can be accessed by multiple pods. Option C (Azure Blob Storage) is object storage not directly mountable as a volume. Option D (Azure NetApp Files) supports ReadWriteMany but is more expensive and complex. The simplest and most cost-effective solution is Azure Files.

Answer

Azure Blob Storage

Answer

Azure Disk

Answer

Azure NetApp Files

Question 11

Your organization plans to migrate a legacy on-premises application that uses a proprietary authentication mechanism to Azure. The application must run as a virtual machine and must not require any code changes. You need to design an identity solution that integrates with the application without modifying it. What should you use?

Accepted Answer

Microsoft Entra Application Proxy with Kerberos Constrained Delegation. Option C is correct because Application Proxy with Kerberos Constrained Delegation allows legacy apps using Kerberos authentication to be published without code changes. Option A is wrong because Azure VPN Gateway provides network connectivity, not identity integration. Option B is wrong because Microsoft Entra Domain Services provides domain services but does not directly proxy legacy authentication. Option D is wrong because Azure Bastion provides secure RDP/SSH access, not application-level authentication.

Answer

Azure VPN Gateway

Answer

Microsoft Entra Domain Services

Answer

Azure Bastion

Question 12

You are designing a governance and compliance solution for a large Azure environment with multiple subscriptions. The solution must enforce tagging policies, restrict resource types, and ensure compliance with regulatory standards. Which THREE Azure services or features should you use? (Choose three.)

Accepted Answer

Azure Management Groups. Options A, B, and D are correct. Azure Policy enforces tags and restricts resource types. Management Groups allow hierarchical policy assignment. Azure Blueprints (now part of Azure Policy with initiatives) package policies and role assignments. Option C (Resource Graph) is for querying, not enforcement. Option E (Cost Management) monitors costs but not compliance.

Answer

Azure Resource Graph

Answer

Azure Cost Management

Question 13

You need to design a storage solution for a new application that requires low-latency access to frequently accessed data and also needs to archive data that is older than 90 days to the most cost-effective storage tier. Which Azure storage account type and tier configuration should you recommend?

Accepted Answer

General-purpose v2 account with hot tier and a lifecycle management policy to move to cool tier after 90 days.. Option B is correct because a general-purpose v2 account supports both hot and cool tiers, and lifecycle management can move blobs to the cool tier after 90 days. Option A is wrong because BlockBlobStorage does not support lifecycle management to cool. Option C is wrong because general-purpose v1 does not support tiering. Option D is wrong because premium block blob is for high-performance but not cost-effective for archiving.

Answer

Premium block blob storage account.

Answer

General-purpose v1 account with cool tier.

Answer

BlockBlobStorage account with hot tier.

Question 14

Your company is migrating a critical application to Azure and needs to design a highly available and disaster recovery solution. The application runs on Azure VMs with SQL Server Always On Availability Groups. You need to ensure that the database remains available even during a regional outage. Which TWO options should you include in the design? (Choose two.)

Accepted Answer

Enable geo-redundant backup storage (RA-GRS) for the database.. The correct answers are B and D. Azure SQL Database Managed Instance with auto-failover groups provides automatic failover to a secondary region. Geo-redundant backup storage (RA-GRS) ensures backups are replicated to a paired region. Option A is wrong because Always On Availability Groups require manual configuration for cross-region failover. Option C is wrong because Azure Site Recovery replicates VMs but not SQL Server databases in a consistent manner for transactional workloads. Option E is wrong because load balancers do not provide database-level failover.

Answer

Configure Azure Site Recovery for the SQL Server VMs.

Answer

Deploy SQL Server Always On Availability Groups across availability zones.

Answer

Deploy a load balancer and distribute traffic to multiple replicas.

Question 15

Refer to the exhibit. You are analyzing a deployment of Azure Storage account with customer-managed key encryption. The deployment fails with an error indicating that the key vault is not accessible. Which of the following is the most likely cause?

Accepted Answer

The user-assigned managed identity does not have permissions to access the key. The exhibit shows a user-assigned managed identity in the encryption settings. The most likely cause is that the user-assigned managed identity does not have the necessary permissions (get, wrapKey, unwrapKey) on the key vault. Option A is incorrect because the key vault might not be in the same region, but that is not a common issue. Option B is incorrect because the key vault is accessible via URI. Option D is irrelevant because network restrictions are not mentioned. Option C is the most common cause.

Answer

The key vault name is misspelled in the keyUri

Answer

The key vault has a firewall enabled and does not allow access from the storage account

Answer

The key vault is in a different Azure region than the storage account