AZ-305 Practice Test 41 — 15 Questions

Question 1

A multinational company uses Microsoft Entra ID. The company has regional IT teams that need to manage users and groups within their respective regions. Each region has a distinct set of users in specific organizational units. The company wants to assign the User Administrator role to regional IT staff, but limit their scope to only the users in their region. Which Microsoft Entra ID feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Administrative Units. Administrative Units in Microsoft Entra ID allow you to delegate administrative roles, such as User Administrator, to a specific subset of users and groups defined by organizational boundaries (e.g., region). By creating an Administrative Unit for each region and adding the regional users and groups to it, you can assign the User Administrator role scoped to that unit, ensuring regional IT staff can only manage their own region's identities.

Answer

Dynamic Groups

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection

Question 2

You need to ensure that only authorized users can access the Azure portal. What should you use?

Accepted Answer

Conditional Access policies. Conditional Access policies are the correct choice because they enforce access control decisions at the Microsoft Entra ID authentication layer, allowing you to require specific conditions (e.g., MFA, compliant device, trusted IP) before a user can sign in to the Azure portal. This directly ensures that only authorized users—those meeting the defined conditions—can access the portal, regardless of their role assignments. Azure RBAC controls what actions a user can perform after authentication, not whether they can sign in at all.

Answer

Azure RBAC

Answer

Privileged Identity Management (PIM)

Answer

Azure AD Identity Protection

Question 3

Refer to the exhibit. You are reviewing an Azure Policy definition. Which virtual machines will be denied?

Accepted Answer

All virtual machines except those with SKU Standard_DS2_v2. The Azure Policy definition uses a 'deny' effect with a condition that checks if the virtual machine's SKU field is not equal to 'Standard_DS2_v2'. This means any VM whose SKU does not match 'Standard_DS2_v2' will be denied. Only VMs with the exact SKU 'Standard_DS2_v2' will be allowed, making option D correct.

Answer

No virtual machines because the condition is invalid

Answer

All virtual machines regardless of SKU

Answer

Only virtual machines with SKU Standard_DS2_v2

Question 4

You are a cloud architect at a healthcare company. They have an existing application running on Azure VMs in a single region. The application uses SQL Server on a VM for its database. The company is migrating to Azure SQL Managed Instance for better manageability and compliance. The database is 2 TB and requires point-in-time restore (PITR) capability with a retention period of 35 days. The workload is critical with an RPO of 5 minutes and an RTO of 2 hours. The company wants to minimize costs while meeting these requirements. Which of the following should you recommend?

Accepted Answer

Use Azure SQL Managed Instance with automated backups configured for 35-day retention and a backup storage redundancy of Locally Redundant Storage (LRS). Azure SQL Managed Instance's automated backups with a 35-day retention period and LRS storage meet the PITR requirement while minimizing cost. LRS is the cheapest redundancy option and sufficient for PITR within a single region, as the RPO of 5 minutes is satisfied by the default transaction log backup frequency (every 5-10 minutes). The RTO of 2 hours is achievable by restoring from these backups, and no cross-region replication is needed since the workload is single-region.

Answer

Use Azure SQL Managed Instance with active geo-replication to a secondary region

Answer

Use Azure SQL Managed Instance with long-term retention (LTR) backups

Answer

Use Azure SQL Database with the Hyperscale service tier

Question 5

A company stores backup data for Azure VMs in a Recovery Services vault. They need to ensure that the backup data is protected from accidental deletion and remains available even if the entire Azure region fails. What should you configure?

Accepted Answer

Enable soft delete in the vault and use geo-redundant storage (GRS).. Enabling soft delete protects backup data from accidental deletion by retaining deleted data for a default retention period of 14 days, allowing recovery. Using geo-redundant storage (GRS) replicates vault data to a paired secondary Azure region, ensuring availability even if the entire primary region fails. Together, these features meet both protection and regional failover requirements.

Answer

Assign Azure RBAC roles to limit access to the vault.

Answer

Enable immutable storage for the vault.

Answer

Enable locally redundant storage (LRS) for the vault.

Question 6

Match each Azure monitoring service to its function.

Accepted Answer

Azure Monitor: Collects and analyzes telemetry from Azure resources. The correct matches are: Azure Monitor for telemetry collection, Log Analytics for log analysis, Application Insights for APM, and Azure Sentinel for security. Common confusions include swapping Azure Monitor with Application Insights or Log Analytics.

Answer

Azure Monitor: Application performance management (APM) and diagnostics

Answer

Log Analytics: Collects and analyzes telemetry from Azure resources

Question 7

Your organization is migrating an on-premises application to Azure. The application consists of a load-balanced web tier and a backend SQL Server database. The web tier requires session persistence (sticky sessions) and SSL offload. You need to design a solution that meets these requirements with minimal operational overhead. Which Azure service should you use for the web tier load balancing?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that natively supports HTTP-based session persistence (sticky sessions) via cookie affinity and SSL termination (offload) at the gateway. This meets both requirements while minimizing operational overhead, as it handles SSL certificates and session affinity without requiring changes to the web tier.

Answer

Azure Traffic Manager

Answer

Azure Front Door

Answer

Azure Load Balancer

Question 8

Which TWO features of Microsoft Entra ID help protect against credential compromise? (Choose two.)

Accepted Answer

Microsoft Entra Password Protection. Microsoft Entra Password Protection automatically blocks weak passwords and common password variations (e.g., 'Password123!') by comparing them against a global banned password list and an optional custom banned password list. This directly prevents users from setting easily guessable credentials, reducing the risk of credential compromise.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra access reviews

Question 9

A company runs a multi-tier application on Azure VMs. The application has front-end and back-end VMs that must be started in a specific order during failover (front-end first, then back-end). The company uses Azure Site Recovery to replicate to a secondary region. After failover, they also need to run custom PowerShell scripts to update DNS records. Which Azure Site Recovery feature should they configure?

Accepted Answer

Recovery plan with automation runbooks and order groups. Azure Site Recovery recovery plans support order groups to enforce the startup sequence of VMs (front-end first, then back-end) and can include automation runbooks to execute custom PowerShell scripts, such as updating DNS records after failover. This provides a structured, automated failover workflow that meets both the sequencing and scripting requirements.

Answer

Recovery plan with manual steps

Answer

Failover with network mapping

Answer

Test failover with isolation

Question 10

A company runs a critical application on Azure VMs. They need a backup strategy that meets the following requirements:
- Daily backups retained for 35 days
- Weekly backups retained for 12 weeks
- Monthly backups retained for 36 months
- Yearly backups retained for 10 years
- Backups must be stored in a geo-redundant storage account
Which THREE items must be configured? (Choose three.)

Accepted Answer

A backup policy with GFS retention. Option B is correct because the required retention scheme (daily 35 days, weekly 12 weeks, monthly 36 months, yearly 10 years) is exactly the Grandfather-Father-Son (GFS) retention pattern, which Azure Backup implements through a backup policy configured with daily, weekly, monthly, and yearly retention rules. Option C is correct because the requirement to store backups in geo-redundant storage is satisfied by setting the Recovery Services vault's storage replication type to Geo-Redundant Storage (GRS), which replicates backup data to the Azure paired region. Option E is correct because a Recovery Services vault must be created in the same region as the VMs it protects; the vault is a regional resource and cannot directly back up VMs located in a different region. Option A is incorrect because a simple daily backup policy only provides daily retention and cannot express weekly, monthly, and yearly GFS retention tiers. Option D is incorrect because the vault itself is created in the VMs' region, not the paired region; geo-redundancy is achieved via the GRS storage setting, which asynchronously replicates data to the paired region.

Answer

A simple daily backup policy

Answer

A Recovery Services vault in the paired region

Question 11

A company has multiple Azure virtual networks (VNets) spread across three Azure regions (West US, East US, and West Europe). They also have an on-premises network connected to East US via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. They require centralized management of routing and the ability to enforce security policies such as forcing all internet-bound traffic from any VNet to pass through a central firewall in East US. Which Azure solution should they implement?

Accepted Answer

Azure Virtual WAN with a secured hub in East US.. Azure Virtual WAN with a secured hub in East US provides a centralized hub-and-spoke architecture that connects all VNets and the on-premises network via ExpressRoute. The secured hub includes Azure Firewall, enabling forced tunneling of all internet-bound traffic from any VNet through the central firewall in East US, while Virtual WAN automatically manages routing between all spokes and the on-premises network.

Answer

VNet peering between all VNets and use route tables for forced tunneling.

Answer

ExpressRoute Global Reach with VNet peering to connect all VNets.

Answer

VPN gateways with BGP to connect all VNets.

Question 12

You executed the above Azure CLI commands. The remote VNet (yourVNet) has address space 10.1.0.0/16. What is the result?

Accepted Answer

A VNet with two subnets is created, and a VNet peering is established.. The Azure CLI commands create a VNet named 'myVNet' with two subnets ('subnet1' and 'subnet2') using the 'az network vnet create' command, which supports multiple subnet configurations in a single call. The subsequent 'az network vnet peering create' command establishes a VNet peering from 'myVNet' to the remote VNet 'yourVNet' (address space 10.1.0.0/16). Since both VNets exist and the commands are syntactically correct, the result is a VNet with two subnets and a successful peering.

Answer

The peering command fails because the remote VNet does not exist.

Answer

A VNet with one subnet is created, and no peering is established.

Answer

Only the first subnet is created, and the peering is established.

Question 13

A company has multiple Azure virtual networks (VNets) in different regions. They want to connect all VNets to each other securely over the Microsoft backbone network, and also connect to their on-premises data center via ExpressRoute. What is the simplest Azure solution to enable connectivity between all VNets and on-premises?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the simplest solution because it provides a hub-and-spoke architecture that automatically connects all VNets and on-premises sites over the Microsoft backbone network. It natively integrates ExpressRoute and VPN gateways into a single managed service, eliminating the need to manually configure multiple peering or gateway connections.

Answer

VNet peering

Answer

ExpressRoute

Answer

VPN Gateway

Question 14

You are the Azure architect for a healthcare organization that needs to store patient medical records (unstructured data) and provide secure access to doctors and nurses via a web application. The data must be encrypted at rest and in transit. Access must be authorized based on the requester's role (doctor, nurse, admin). The solution must be cost-effective and support high concurrency. You decide to use Azure Blob Storage. You need to design the access control mechanism. What should you recommend?

Accepted Answer

Use Azure RBAC with Microsoft Entra ID authentication.. Use Azure RBAC with Microsoft Entra ID authentication. Azure RBAC (Role-Based Access Control) integrated with Microsoft Entra ID (formerly Azure AD) allows you to assign permissions to users based on their roles (e.g., doctor, nurse, admin) for fine-grained access to Blob Storage. This meets the requirement for role-based authorization without managing separate keys or tokens. Option A is incorrect because encryption at rest and HTTPS only address data protection, not access control. Option B is incorrect because shared access signatures (SAS) grant time-limited access to specific resources but are not tied to user roles. Option D is incorrect because storage account access keys provide full administrative access to the entire storage account, not role-based permissions.

Answer

Enable storage service encryption and use HTTPS.

Answer

Use shared access signatures (SAS) with stored access policies.

Answer

Use storage account access keys and distribute them to users.

Question 15

Fabrikam Inc. runs a file-sharing service used by 500 employees globally. The service is deployed on Azure VMs in the North Europe region. The VMs store data on Azure Files shares (Standard performance tier) mounted via SMB. The company's business continuity policy requires:
- RPO: 1 hour for any data loss.
- RTO: 4 hours to restore service after a regional disaster.
- All data must be backed up and recoverable in a different region.
- Budget is a concern; prefer cost-effective solutions.

Currently, there is no backup in place. You need to design a solution. What should you do?

Accepted Answer

Set up Azure Site Recovery (ASR) for the VMs and Azure Files. Replicate to a secondary region (West Europe). Use ASR recovery plans to orchestrate failover.. Azure Site Recovery (ASR) can replicate the VMs to a secondary region (West Europe), meeting the RPO (near-synchronous) and RTO (4 hours achievable). For the Azure Files data, the storage account hosting the file shares should be configured with geo-redundant storage (GRS), which automatically replicates data to a paired region, satisfying the cross-region recoverability requirement. This combination is cost-effective as it uses built-in replication without additional backup infrastructure. Option B is incorrect because Azure Backup for Azure Files does not support a 1-hour backup frequency (minimum is 4 hours), and Azure Backup for Azure VMs also has a minimum 4-hour frequency, so it cannot meet the 1-hour RPO. Option C fails cross-region requirement as snapshots are stored in the same region, and VM backup frequency is daily. Option D requires an on-premises server and does not provide failover to a different Azure region.

Answer

Configure Azure Backup for the Azure Files shares with a backup policy of 1-hour frequency. Also back up the VMs using Azure Backup with a 1-hour policy. Store backups in a Recovery Services vault with geo-redundant storage (GRS). Enable cross-region restore.

Answer

Use Azure Files share snapshots taken every hour and store them in a separate storage account in the same region. For VM backup, use Azure Backup with daily frequency. In a disaster, deploy new VMs and restore from snapshots.

Answer

Implement Azure File Sync between the Azure Files share and an on-premises file server. For disaster recovery, failover to the on-premises server.