AZ-305 Practice Test 38 — 15 Questions

Question 1

A company is migrating on-premises SQL Server databases to Azure. They need to minimize administrative overhead for patching and backups while ensuring high availability. The solution must support automatic failover within the same Azure region. Which Azure service should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure SQL Database Managed Instance. Azure SQL Database Managed Instance is correct because it provides near-100% compatibility with on-premises SQL Server, automated patching and backups, and built-in high availability with automatic failover within the same region via Always On availability groups. This minimizes administrative overhead while meeting the high availability requirement without manual configuration.

Answer

SQL Server on Azure Virtual Machines

Answer

Azure SQL Database Hyperscale

Answer

Azure SQL Database (single database)

Question 2

You are designing a backup strategy for Azure Files shares that contain critical data. The backup must support snapshot-based backups and allow restoration to a specific point in time. The solution must also protect against accidental deletion. What should you use?

Accepted Answer

Use Azure Backup for Azure Files with soft delete enabled.. Azure Backup for Azure Files provides snapshot-based backups that support point-in-time restoration, and when combined with soft delete, it protects against accidental deletion by retaining deleted data for a configurable retention period (default 14 days). This meets all stated requirements: snapshot backups, point-in-time restore, and deletion protection.

Answer

Use Azure File Sync with cloud tiering.

Answer

Use Azure Storage account geo-redundant storage (GRS) with versioning.

Answer

Use Azure Backup for Azure Files without soft delete.

Question 3

Refer to the exhibit. You run this Kusto query in Azure Monitor Logs. What does it return?

Accepted Answer

Computers that have not sent a heartbeat in the last 5 minutes.. The query uses the `Heartbeat` table and filters for heartbeats older than 5 minutes (`ago(5m)`). The `where` clause selects records where `TimeGenerated` is less than 5 minutes ago, meaning it finds heartbeats that were sent before that threshold. The `distinct Computer` then returns only computers whose most recent heartbeat is older than 5 minutes, i.e., computers that have not sent a heartbeat in the last 5 minutes. This is a common pattern for detecting unresponsive or offline machines.

Answer

The number of heartbeats per computer in the last hour.

Answer

Computers that sent a heartbeat in the last 5 minutes.

Answer

The average heartbeat frequency per computer.

Question 4

A company runs a web application on Azure VMs in a single region. They need to ensure that if the region fails, the VMs are replicated to another region and can be started automatically. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs from one region to another. It continuously replicates VM disks to the target region and, upon failover, automatically starts the replicated VMs, meeting the requirement for regional disaster recovery with automated startup.

Answer

Azure Backup

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Question 5

A company uses Azure Backup to protect their critical Azure VMs. An administrator accidentally deleted a file from one of the VMs. They need to restore that specific file quickly without restoring the entire VM. Which Azure Backup feature should they use?

Accepted Answer

Azure Backup file recovery. Azure Backup's file recovery feature allows you to mount a recovery point as a drive on the VM (or another machine) using iSCSI, enabling you to browse and copy individual files without restoring the entire VM. This is the correct choice because it meets the requirement for a quick, granular restore of a single deleted file.

Answer

Azure Backup full VM restore

Answer

Azure Site Recovery

Answer

Azure Storage snapshots

Question 6

A multinational company uses Microsoft Entra ID and several Azure subscriptions. Security administrators need to review privileged role assignments every month and require justification for continued access. Which design should be recommended?

Accepted Answer

Microsoft Entra Privileged Identity Management with access reviews. Microsoft Entra Privileged Identity Management (PIM) with access reviews is the correct design because it provides time-bound, just-in-time privileged role assignments and requires users to periodically justify their continued access through automated access reviews. This directly meets the monthly review and justification requirement for privileged roles, as PIM integrates with Entra ID to enforce approval workflows and expiration policies.

Answer

Azure Monitor metric alerts

Answer

Management group locks

Answer

Azure Policy guest configuration

Question 7

Drag and drop the steps to implement Azure AD Privileged Identity Management (PIM) for a role into the correct order.

Accepted Answer

Select role, Configure settings, Assign eligible members, Set notifications, Test activation. Select role, configure settings, assign eligible members, set notifications, then test activation.

Answer

Select role, Assign eligible members, Configure settings, Set notifications, Test activation

Answer

Configure settings, Select role, Assign eligible members, Set notifications, Test activation

Answer

Select role, Configure settings, Set notifications, Assign eligible members, Test activation

Question 8

A company runs several Azure virtual machines (VMs) that host SQL Server databases. The databases are stored on data disks attached to the VMs. The company needs to back up the databases and VMs separately. They require application-consistent backups for SQL Server to ensure transactional integrity. Additionally, they need to retain backups for up to 7 years to meet compliance requirements. The solution must minimize administrative overhead and support long-term retention of database backups. Which Azure service or feature should they use for the database backups?

Accepted Answer

Azure Backup for SQL Server in Azure VMs. Azure Backup for SQL Server in Azure VMs is the correct choice because it provides native, application-consistent backups specifically for SQL Server databases running on Azure VMs. It integrates directly with SQL Server VSS writer to ensure transactional integrity, supports long-term retention up to 10 years (exceeding the 7-year requirement), and minimizes administrative overhead by automating backup scheduling, retention management, and point-in-time restore. This service is purpose-built for SQL Server database backups, separate from VM-level backups.

Answer

Azure Backup for Azure VMs with application-consistent snapshots

Answer

Azure Site Recovery

Answer

Azure Files

Question 9

Match each Azure storage redundancy option to its description.

Accepted Answer

LRS: Replicates data three times within a single data center in the primary region.. Azure Storage offers several redundancy options: LRS (local), ZRS (zone), GRS (geo), and RA-GRS (geo with read access). Common confusions include mixing LRS and ZRS, or assuming all geo-replicated options provide read access.

Answer

LRS: Replicates data across multiple availability zones.

Answer

GRS: Provides read access to the secondary region without failover.

Question 10

A company uses Microsoft Entra ID (Microsoft Entra ID) for identity management. They want to automatically detect sign-in risks such as sign-ins from unfamiliar locations, anonymous IP addresses, or leaked credentials. Based on the risk level, they want to apply different controls: for low-risk sign-ins, show a message but allow access; for medium-risk sign-ins, require multi-factor authentication (MFA); for high-risk sign-ins, block the sign-in. They also need to receive a weekly summary report of risk events. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Conditional Access policies with sign-in risk conditions. Microsoft Entra ID Conditional Access policies can integrate sign-in risk conditions from Identity Protection to enforce granular controls based on risk levels. This allows you to configure actions such as showing a message for low risk, requiring MFA for medium risk, and blocking access for high risk, while Identity Protection provides the weekly summary report of risk events.

Answer

Microsoft Entra ID Identity Protection policies

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 11

A company is building a big data analytics platform that will process structured, semi-structured, and unstructured data using Azure Synapse Analytics and other tools. They need a storage layer that supports hierarchical namespaces and fine-grained access control at the directory level. Which Azure storage solution should they use?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines Azure Blob Storage with a hierarchical namespace, enabling directory-level access control lists (ACLs) and POSIX-compliant permissions. This is essential for the big data analytics platform described, as it must support structured, semi-structured, and unstructured data with fine-grained access control at the directory level, which Azure Synapse Analytics can directly query via ABFS (Azure Blob File System) driver.

Answer

Azure Blob Storage

Answer

Azure Files

Answer

Azure Cosmos DB

Question 12

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to implement a lifecycle workflow that automatically disables user accounts when employees leave the organization, and then deletes them after 30 days. What should you use?

Accepted Answer

Microsoft Entra ID Governance. Microsoft Entra ID Governance includes lifecycle workflows that automate the process of disabling and deleting user accounts based on triggers such as employee departure. This feature allows you to configure a workflow that disables the account immediately and then schedules deletion after a specified period, such as 30 days, without requiring custom scripting or manual intervention.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Intune

Answer

Microsoft Entra Connect Health

Question 13

Drag and drop the steps to implement Azure Traffic Manager for geographic routing into the correct order.

Accepted Answer

Create profile, then add endpoints, then configure mapping, then update DNS, then test.. The correct sequence for implementing Azure Traffic Manager for geographic routing is: first create the Traffic Manager profile, then add the endpoints (e.g., Azure regions), then configure the geographic routing mapping to assign regions to endpoints, then update DNS records to point to the Traffic Manager domain name, and finally test the routing. Skipping or reordering these steps can lead to misconfiguration or routing failures.

Answer

Add endpoints, then create profile, then configure mapping, then update DNS, then test.

Answer

Create profile, then configure mapping, then add endpoints, then update DNS, then test.

Answer

Create profile, then add endpoints, then update DNS, then configure mapping, then test.

Question 14

A company has Azure virtual networks (VNets) in three different Azure regions and an on-premises data center connected via ExpressRoute. They need to connect all VNets to each other and to on-premises over the Microsoft global backbone. They also require centralized management of routing and the ability to enforce security policies such as forced tunneling for internet-bound traffic. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the correct choice because it provides a hub-and-spoke architecture that connects VNets across regions and on-premises via the Microsoft global backbone, with built-in centralized routing management and the ability to enforce security policies like forced tunneling through integrated Azure Firewall or third-party NVAs. It meets all requirements: multi-region VNet connectivity, ExpressRoute integration, and centralized policy control.

Answer

Azure Virtual Network Manager

Answer

Azure Firewall

Answer

Azure Route Server

Question 15

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center connected via ExpressRoute. They need to implement a hub-and-spoke topology where a hub VNet hosts shared network virtual appliances (NVAs) for traffic inspection. All traffic between spokes and between spokes and on-premises must be routed through the hub. The company wants to minimize the administrative overhead of configuring and maintaining routing. Which Azure solution should they implement?

Accepted Answer

Use Azure Virtual WAN with a secured virtual hub.. Azure Virtual WAN with a secured virtual hub is the correct choice because it provides a managed hub-and-spoke topology with built-in routing, eliminating the need for manual user-defined routes (UDRs) and route tables. The secured virtual hub includes Azure Firewall for traffic inspection, and all inter-spoke and on-premises traffic is automatically routed through the hub via the Virtual WAN routing engine, which uses the Border Gateway Protocol (BGP) to propagate routes dynamically. This minimizes administrative overhead by centralizing routing and security management.

Answer

Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.

Answer

Create a single large VNet and use network security groups (NSGs) to isolate traffic.

Answer

Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.