AZ-305 Practice Test 40 — 15 Questions

Question 1

A company wants to implement a backup strategy for their Azure virtual machines. They need to retain backups for 7 years for compliance and ensure backups are encrypted at rest. Which solution should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Backup with a vault configured for 7-year retention and encryption at rest.. Azure Backup is the correct solution because it provides long-term retention (up to 99 years) and supports encryption at rest using platform-managed keys (PMK) or customer-managed keys (CMK). It meets the 7-year compliance requirement and ensures backups are encrypted by default using Azure Storage Service Encryption (SSE).

Answer

Azure Disk Snapshot with a lifecycle management policy.

Answer

Azure Files Backup to a Recovery Services vault.

Answer

Azure Site Recovery with custom retention policies.

Question 2

A startup is building a social media analytics platform that processes streaming data. They need a data store for time-series events with high write throughput and fast timestamp-based range queries. Which Azure data store is most suitable for this workload?

Accepted Answer

Azure Table Storage. Azure Table Storage is a NoSQL key-value store that supports high-volume, low-latency writes and efficient range queries on the PartitionKey and RowKey, which can be structured as a timestamp for time-series data. Its schema-less design and ability to scale to massive throughput without sharding overhead make it ideal for streaming event ingestion and timestamp-based retrieval.

Answer

Azure Cosmos DB with SQL API

Answer

Azure SQL Database with columnstore index

Answer

Azure Data Lake Storage Gen2

Question 3

A company runs a critical OLTP application on Azure SQL Database in the West US region. They need to ensure business continuity if a regional outage occurs. The solution must have a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of less than 1 hour. They also want to use the secondary region for read-only query offloading. Which Azure SQL Database feature should they enable?

Accepted Answer

Active geo-replication with automatic failover group. Active geo-replication with automatic failover groups is the correct choice because it provides continuous asynchronous data replication to a secondary Azure SQL Database in a paired region, achieving an RPO of 5 seconds and an RTO of under 1 hour. The automatic failover group enables coordinated failover of multiple databases and allows the secondary region to be used for read-only query offloading by connecting with ApplicationIntent=ReadOnly.

Answer

Geo-restore

Answer

Azure Site Recovery

Answer

Read scale-out with manual regional failover

Question 4

Which THREE considerations are important when designing a highly available Azure SQL Database solution?

Accepted Answer

Auto-failover groups. Auto-failover groups (A) are correct because they enable automatic, policy-driven failover of one or more databases to a secondary region, providing a readable/writable listener endpoint and reducing RTO/RPO for a highly available Azure SQL Database solution. Active geo-replication (C) is correct because it lets you create up to four readable secondaries in different regions and manually fail over, which is a core mechanism for cross-region high availability and disaster recovery. Zone redundancy (D) is correct because it distributes the database across availability zones within a region, protecting against datacenter-level failures and improving local availability with an SLA up to 99.995%. Transparent Data Encryption (B) is not a high-availability consideration; it is a data-at-rest encryption feature that protects confidentiality but does not affect failover or uptime. Read scale-out (E) is a performance/read-offload capability using read-only replicas, not a high-availability design consideration, since it does not provide failover or redundancy.

Answer

Transparent Data Encryption

Answer

Read scale-out

Question 5

A company wants to run a containerized application on Azure without managing virtual machines. They need automatic scaling, load balancing, and rolling updates. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes orchestration platform that handles containerized applications with automatic scaling (via Horizontal Pod Autoscaler), built-in load balancing (via Azure Load Balancer integration), and rolling updates (via Kubernetes deployment strategies). This meets the requirement of running containers without managing VMs, as AKS abstracts the underlying node management.

Answer

Azure Virtual Machine Scale Sets

Answer

Azure App Service

Answer

Azure Container Instances

Question 6

A company uses Microsoft Entra ID. They need to monitor sign-in logs for anomalous activity (e.g., sign-ins from unfamiliar locations) and automatically take action such as requiring MFA or blocking sign-in. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Identity Protection. Identity Protection is the correct feature because it is specifically designed to detect anomalous sign-in activities, such as sign-ins from unfamiliar locations or anonymous IP addresses, and can automatically trigger risk-based remediation actions like requiring MFA or blocking sign-ins. It leverages machine learning models and real-time risk detections to assess sign-in risks and apply policies accordingly, directly meeting the requirement for monitoring and automated response.

Answer

Conditional Access

Answer

Access Reviews

Answer

Privileged Identity Management

Question 7

Your company has an Azure subscription that contains 100 virtual machines (VMs). You are designing a monitoring solution that must meet the following requirements: - Alert when any VM's CPU usage exceeds 90% for 15 minutes. - Alert when any VM's available memory drops below 1 GB. - Provide a centralized dashboard showing real-time performance metrics for all VMs. Which TWO Azure services should you include in the solution? (Choose two.)

Accepted Answer

Azure Monitor. Azure Monitor is the core service for collecting, analyzing, and acting on telemetry from Azure resources. It can collect CPU and memory metrics from VMs via the Azure Monitor Agent, and its alerting engine can trigger actions when CPU exceeds 90% for 15 minutes or available memory drops below 1 GB, meeting both alerting requirements.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Automation

Question 8

A company wants to monitor sign-in activity for their Microsoft Entra ID-integrated applications. They need to detect risky sign-ins, such as sign-ins from anonymous IP addresses or unfamiliar locations, and automatically block or require multi-factor authentication. They also need a dashboard showing risk events and the ability to investigate and remediate. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it specifically detects and responds to risky sign-ins, such as those from anonymous IP addresses or unfamiliar locations, by automatically blocking access or requiring multi-factor authentication. It provides a dashboard of risk events (e.g., leaked credentials, impossible travel) and supports investigation and remediation workflows, directly matching the requirements for monitoring sign-in activity and enforcing conditional access policies.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Self-Service Password Reset (SSPR)

Question 9

Your company has a Microsoft Entra ID tenant with 50,000 users. You need to design a solution to ensure that users can reset their own passwords without help desk intervention, while preventing password reuse for the last 10 passwords. Which feature should you enable?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention. Additionally, SSPR can be configured with password protection policies that enforce password history, preventing reuse of the last 10 passwords. This directly meets both requirements stated in the question.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Connect

Answer

Privileged Identity Management (PIM)

Question 10

Drag and drop the steps to set up Azure Private Link for an Azure SQL Database into the correct order.

Accepted Answer

Create endpoint, then approve, then configure DNS, then test, then disable public access. The correct sequence for setting up Azure Private Link for an Azure SQL Database is: first create the private endpoint in the virtual network, then approve the private link connection from the Azure SQL Database side, next configure DNS (typically using a private DNS zone) to resolve the database's FQDN to the private endpoint IP, test connectivity from within the virtual network, and finally disable public access to the database to enforce private connectivity. This order ensures each step builds on the previous one, avoiding connectivity issues or premature security restrictions.

Answer

Create endpoint, then approve, then test, then configure DNS, then disable public access

Answer

Approve, then create endpoint, then configure DNS, then test, then disable public access

Answer

Create endpoint, then configure DNS, then approve, then test, then disable public access

Question 11

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Accepted Answer

Use managed identities for Azure resources instead of service principals with secrets. Managed identities for Azure resources eliminate the need to manage credentials by automatically rotating them and binding them to a resource lifecycle. This removes the risk of secret leakage or mismanagement that exists with service principal secrets, directly supporting a least-privilege identity strategy by ensuring identities are scoped and ephemeral.

Answer

Assign the Contributor role at the subscription scope to allow flexibility

Answer

Use storage account keys for access to blob data

Answer

Use a single service principal for all applications

Question 12

A company runs a critical SAP HANA database on an Azure large instance. They need a disaster recovery solution that provides automatic failover to a secondary region with an RPO of 15 minutes and RTO of 30 minutes. The solution must not require manual intervention to start replication. What should they use?

Accepted Answer

SAP HANA System Replication with HANA Pacemaker. SAP HANA System Replication with HANA Pacemaker is the correct choice because it provides automatic, synchronous or asynchronous replication of SAP HANA data to a secondary region, meeting the RPO of 15 minutes and RTO of 30 minutes. HANA Pacemaker handles automatic failover without manual intervention, ensuring the database is promoted to primary in the disaster recovery region within the required timeframes. This solution is specifically designed for SAP HANA on Azure large instances, offering native integration and support for the required recovery objectives.

Answer

Azure Site Recovery with replication policy for SAP HANA

Answer

Azure NetApp Files with cross-region replication

Answer

Azure Backup for SAP HANA

Question 13

A company deploys a web application across multiple Azure VMs in a single region. They want to distribute incoming HTTP traffic evenly across the VMs, offload SSL encryption, and provide a fixed public IP address for clients. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports HTTP/HTTPS traffic, SSL termination, and cookie-based session affinity. It can distribute incoming HTTP traffic evenly across VMs, offload SSL encryption to reduce backend processing, and provide a fixed public IP address (VIP) for client access. This aligns with all three requirements: load balancing, SSL offload, and a static public IP.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 14

A company wants to ensure that their Azure Storage account containing blobs is protected against accidental deletion or corruption. The solution must enable recovery of previous versions up to 30 days. Which TWO features should they enable? (Choose TWO.)

Accepted Answer

Blob versioning. Blob versioning automatically maintains previous versions of a blob when it is modified or deleted, enabling recovery of any version from the last 30 days if combined with a lifecycle management policy to retain versions for that period. Blob soft delete protects against accidental deletion by preserving deleted blobs in a soft-deleted state for a specified retention period (up to 30 days), allowing restoration within that window. Together, they provide comprehensive protection against both accidental deletion and corruption.

Answer

Change feed

Answer

Azure Backup for Azure Blobs

Answer

Point-in-time restore for Azure Files

Question 15

A company has 10 branch offices, each with Windows file servers. They want to centralize file storage in Azure and allow each branch office to cache files locally for fast access. The solution must support cloud tiering so that only frequently accessed files are kept locally. Which Azure service should they implement?

Accepted Answer

Azure File Sync. Azure File Sync is the correct choice because it enables centralizing file shares in Azure Files while providing local caching on Windows file servers at each branch office. It supports cloud tiering, which automatically keeps only frequently accessed files locally and moves cold data to the cloud, meeting the requirement for fast local access and efficient storage.

Answer

Azure Files

Answer

Azure Blob Storage with Azure File Sync

Answer

Azure NetApp Files