AZ-305 Practice Test 40 — 15 Questions

Question 1

You are designing a monitoring solution for a cloud-native application that uses Azure Functions, Azure Storage, and Azure Cosmos DB. The solution must provide centralized log collection and analysis, enable proactive alerting on application errors, and support long-term log retention for compliance (7 years). What should you include in the design?

Accepted Answer

Configure diagnostic settings for each Azure resource to send logs and metrics to a Log Analytics workspace.. Option A is correct because Azure Log Analytics workspace provides centralized log storage, analysis, and retention up to 7 years. Option B is wrong because Application Insights is for application performance monitoring, not long-term retention. Option C is wrong because Azure Monitor Metrics store numeric data only, not logs. Option D is wrong because Azure Storage with archive tier is for raw log files, not analysis.

Answer

Use Azure Storage with cool tier for logs and enable Azure Storage Analytics logs.

Answer

Store logs in Azure Monitor Metrics with a retention of 93 days.

Answer

Use Application Insights to collect logs and set retention to 90 days, then export to Azure Blob Storage for archival.

Question 2

You are designing an identity solution for a multinational company that has a Microsoft Entra ID tenant. The company plans to acquire a smaller company that currently uses an on-premises Active Directory (AD) forest. The acquired company's users need to access Microsoft 365 applications and Azure resources. The solution must minimize identity management overhead. Which TWO actions should you include in the design? (Choose two.)

Accepted Answer

Configure Microsoft Entra Connect Sync to synchronize users from the on-premises AD to the new Entra ID tenant.. Option A is correct because configuring a new Microsoft Entra tenant for the acquired company isolates identity management and minimizes overhead. Option C is correct because synchronizing users using Microsoft Entra Connect Sync brings on-premises identities to the cloud. Option B is wrong because a cross-tenant trust between Entra ID tenants is not supported for authentication. Option D is wrong because federation requires additional infrastructure and overhead. Option E is wrong because B2B collaboration is for external users, not for employees of an acquired company.

Answer

Federate the on-premises AD with the existing Microsoft Entra ID tenant.

Answer

Establish a cross-tenant trust between the existing and new Entra ID tenants.

Answer

Use Microsoft Entra B2B collaboration to invite users from the acquired company.

Question 3

You are reviewing a JSON policy for Microsoft Entra Privileged Identity Management (PIM) that governs activation of a privileged role for an Azure App Service. You notice that the policy has the configuration shown in the exhibit. You need to ensure that only members of the 'group-app-admins@contoso.com' group can activate the role and that activations are limited to 8 hours with approval required. However, users report that they cannot activate the role even though they are members of the group. What is the most likely cause?

Accepted Answer

The PIM role has not been scoped to the 'myapp' App Service resource.. Option C is correct because PIM role assignments must be scoped to the specific resource (e.g., the App Service) in order for the policy to apply. Without proper scoping, the policy may not be accessible. Option A is wrong because the policy does not specify an expiration for the group membership. Option B is wrong because PIM does not require global admin approval by default. Option D is wrong because there is no indication that the group is a mail-enabled security group.

Answer

The group 'group-app-admins@contoso.com' has an expiration policy that has expired.

Answer

The group 'group-app-admins@contoso.com' is a mail-enabled security group, which is not supported for PIM.

Answer

The approval required setting is incorrectly configured and requires a global administrator as approver.

Question 4

Refer to the exhibit. You are reviewing a backup policy for an Azure VM. The policy is defined using the Azure Backup REST API. What is the maximum number of recovery points that can be retained according to this policy?

Accepted Answer

24. The weekly retention keeps 12 weekly points (count=12, durationType=Weeks). The monthly retention keeps 12 monthly points (count=12, durationType=Months). Instant RP retention adds up to 5 days, but those are additional recovery points not counted in the long-term retention. So total long-term recovery points = 12 (weekly) + 12 (monthly) = 24. Option B is correct.

Answer

17

Answer

29

Answer

12

Question 5

A company stores sensitive customer data in Azure Blob Storage. They need to ensure that data at rest is encrypted using a customer-managed key stored in Azure Key Vault. Which of the following should they use?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys in Azure Key Vault. Azure Storage Service Encryption with customer-managed keys allows encryption using keys from Azure Key Vault. Option B is correct because it supports customer-managed keys. Option A is wrong because it uses Microsoft-managed keys. Option C is wrong because Azure Information Protection is for classification and labeling. Option D is wrong because Azure Disk Encryption is for virtual machine disks.

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption with Microsoft-managed keys

Answer

Azure Information Protection

Question 6

You are designing a disaster recovery solution for an Azure SQL Database. The database is in the West US region. You need to ensure that if the entire West US region becomes unavailable, the database can be failed over to another region within 1 hour with minimal data loss. The solution must be cost-effective for a development environment. What should you recommend?

Accepted Answer

Configure active geo-replication to a secondary database in a paired region. Active geo-replication provides a readable secondary in a paired region with a configurable failover. For a dev environment, cost is a concern; active geo-replication is the most cost-effective option that meets the RPO/RTO. Option B (auto-failover groups) is a higher-level abstraction but still uses geo-replication; however, for dev, it may be overkill. Option C (backup to another region) has longer RTO. Option D (always on availability groups) is for IaaS, not PaaS.

Answer

Configure auto-failover groups with a secondary in a paired region

Answer

Deploy an Always On availability group across two regions using Azure VMs

Answer

Take daily backups and store them in a different region

Question 7

Refer to the exhibit. You have an Azure Storage account with hierarchical namespace enabled. You create this JSON policy to assign to a container. Users report that they can access the container from any IP, not just the specified range. What is the most likely reason?

Accepted Answer

IP address conditions are not supported in RBAC for Azure Storage data plane operations. The policy shown is an Azure RBAC role assignment JSON, but the correct way to restrict IP access is via a service endpoint or firewall rule on the storage account, not in RBAC. RBAC conditions for IP are not supported for data plane operations. Option A is correct because the Condition element does not work as intended; IP restrictions are set at the storage account firewall. Option B is wrong because anonymous access is disabled by default. Option C is wrong because hierarchical namespace does not affect IP restriction. Option D is wrong because RBAC can be applied to containers.

Answer

Hierarchical namespace disables IP-based restrictions

Answer

Anonymous access is enabled on the container

Answer

The resource scope is incorrect; RBAC cannot be assigned at the container level

Question 8

Which TWO options are valid methods to secure access to Azure Cosmos DB?

Accepted Answer

Azure RBAC roles. Cosmos DB supports primary/secondary keys, Azure RBAC, managed identities, and Microsoft Entra ID authentication. Option A is correct because primary keys provide access. Option B is correct because RBAC can be used for fine-grained access control. Option C is wrong because SAS tokens are not used for Cosmos DB; they are for Azure Storage. Option D is wrong because certificates are not a native authentication method. Option E is wrong because shared access signatures are for storage, not Cosmos DB.

Answer

X.509 certificate-based authentication

Answer

Azure Storage account keys

Answer

Shared access signatures (SAS)

Question 9

A company is designing a hybrid network architecture that connects an on-premises data center to Azure. The requirements include high availability (99.99% SLA), low latency, and the ability to use existing MPLS connections. Which THREE Azure connectivity options should be considered?

Accepted Answer

Azure VPN Gateway (active-active). Azure ExpressRoute provides dedicated private connections with high SLA and low latency; VPN Gateway with active-active configuration provides redundant IPsec tunnels; and ExpressRoute with ExpressRoute Global Reach extends connectivity across regions. All can use MPLS or existing circuits.

Answer

Azure Traffic Manager

Answer

Azure Private Link

Question 10

Contoso Ltd. runs a mission-critical application on Azure VMs in the West US region. They require an RPO of 15 minutes and an RTO of 1 hour in case of a regional disaster. They plan to use Azure Site Recovery. The application stores data on managed disks and uses a Premium SSD v2 disk for the database. The application also uses Azure SQL Database for some transactional data. What should Contoso do to meet the recovery objectives for the entire solution?

Accepted Answer

Configure Azure Site Recovery for the VMs with Premium SSD v2 disks and configure active geo-replication with auto-failover groups for Azure SQL Database.. Option D is correct because Azure Site Recovery supports Premium SSD v2 disks for replication, and for Azure SQL Database, active geo-replication with a failover group can achieve RPO of 5 seconds and RTO of 1 hour. Option A is wrong because Azure SQL Database replication is not part of ASR; ASR does not replicate Azure SQL Database. Option B is wrong because Azure Backup is for data backup, not replication with the required RPO/RTO. Option C is wrong because the application requires both VM and database recovery; only focusing on one component fails the overall solution.

Answer

Use Azure Backup for the VMs and configure long-term retention for the Azure SQL Database backups.

Answer

Configure Azure Site Recovery for the VMs and also for the Azure SQL Database by adding it to the replication group.

Answer

Deploy the application across two Azure regions using Azure Front Door and active geo-replication for Azure SQL Database.

Question 11

Your company is migrating a legacy on-premises application to Azure. The application requires persistent storage for configuration files that must be accessible from multiple virtual machines in a virtual network. The storage must be accessible only from within the virtual network and should not be exposed to the internet. Which Azure storage solution should you use?

Accepted Answer

Azure Files with a private endpoint. Azure Files shares can be mounted via SMB and accessed from multiple VMs simultaneously. Private endpoints ensure traffic stays within the virtual network, preventing internet exposure.

Answer

Azure Disk Storage with shared disks

Answer

Azure NetApp Files with network security groups

Answer

Azure Blob Storage with a service endpoint

Question 12

Your company is designing a disaster recovery solution for a three-tier application hosted on Azure VMs. The solution must meet the following requirements:
- RPO: 1 hour
- RTO: 4 hours
- Automated failover to a secondary region
- Cost optimization is a priority
Which TWO actions should you include in the design?

Accepted Answer

Deploy an Azure Load Balancer in the secondary region with health probes to automatically route traffic after failover.. Options A and C are correct. Azure Site Recovery provides replication and automated failover for VMs, meeting RPO and RTO. Using an Azure Load Balancer with health probes allows traffic to be redirected to the secondary region after failover. Option B is wrong because Azure Backup is not designed for automated failover and has higher RTO. Option D is wrong because read-only replicas are for read scaling, not failover. Option E is wrong because Azure Front Door is for global load balancing, not regional failover for VMs.

Answer

Use Azure Backup to take hourly backups of the VMs and restore them in the secondary region.

Answer

Configure a read-only replica of the application tier in the secondary region using Availability Zones.

Answer

Deploy Azure Front Door with a backend pool containing both primary and secondary regions.

Question 13

A multinational corporation is designing a disaster recovery strategy for a critical application running on Azure VMs. The application must have a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The primary region is East US, and the secondary region is West US. The solution must minimize costs while meeting the requirements. What should you recommend?

Accepted Answer

Implement Azure Site Recovery for the VMs. Azure Site Recovery provides orchestrated replication with RPO as low as 15 minutes and RTO of minutes. It is the most cost-effective option for VM-level DR.

Answer

Deploy an active-passive configuration with Azure Front Door and Traffic Manager

Answer

Configure the VMs in an availability zone across East US and West US

Answer

Use Azure Backup with cross-region restore for the VMs

Question 14

You are a Solutions Architect for an e-commerce company that runs its online store on Azure. The application consists of:
- Azure App Service (Windows) hosting the web frontend
- Azure SQL Database (General Purpose, serverless) for product catalog and orders
- Azure Cache for Redis for session state
- Azure Blob Storage for product images
The application is deployed in the East US region. The company wants to implement a disaster recovery (DR) plan that can fail over to a secondary region (West US) with minimal data loss. The requirements are:
- RPO: 5 minutes for the database
- RTO: 30 minutes for the entire application
- The solution must be cost-effective and not require manual intervention during failover.
Which of the following is the BEST course of action to meet these requirements?

Accepted Answer

Configure Azure SQL Database active geo-replication with auto-failover group, deploy App Service in West US with a separate App Service plan, enable geo-replication for Cache for Redis, and use RA-GRS for Blob Storage. Use Azure Traffic Manager with priority routing for the web app.. Option C is correct. Azure SQL Database active geo-replication with auto-failover groups achieves RPO of 5 seconds and RTO of 1 hour (with auto-failover, typically <1 hour). App Service can be deployed in paired region with traffic manager or Front Door for quick failover. Blob Storage can use geo-redundant storage (GRS) with read access (RA-GRS) for fast failover. Redis can be configured with geo-replication. Option A is wrong because Azure Backup does not provide 5-minute RPO. Option B is wrong because read-only replicas are not for failover. Option D is wrong because manual steps increase RTO beyond 30 minutes, and Azure Backup is not suitable for the required RPO.

Answer

Use Azure Backup for the SQL database with 5-minute backup frequency, deploy App Service in West US with staging slots, and use Azure Traffic Manager with priority routing.

Answer

Configure Azure SQL Database geo-replication with readable secondary, deploy App Service in West US with deployment slots, and use Azure Front Door with health probes. Cache for Redis is not critical and can be rebuilt.

Answer

Deploy the entire application in an active-active configuration using Azure Front Door, with Azure SQL Database using failover groups and manual failover. Use Azure Backup for the database with 1-hour backup frequency.

Question 15

You are designing a cloud-native application that will run on Azure Kubernetes Service (AKS). The application needs to authenticate users and manage access to resources. Which identity service should you use?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID is the cloud-based identity and access management service for Azure, providing authentication and authorization for AKS workloads.

Answer

Microsoft Entra External ID

Answer

Microsoft Account

Answer

Azure Active Directory Domain Services