AZ-305 Practice Test 44 — 15 Questions

Question 1

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

Accepted Answer

Peer each spoke VNet with the hub VNet. B is correct because VNet peering is required to establish connectivity between the spoke VNets and the hub VNet, enabling traffic to flow through the central Azure Firewall. Without peering, the spoke VNets would be isolated and unable to route traffic to the hub. C is correct because a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP ensures that all outbound internet traffic from spoke subnets is forced through the firewall for inspection and control.

Answer

Enable public IP addresses on all workload VMs

Answer

Deploy a NAT gateway in every spoke subnet

Question 2

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to allow external business partners to request access to a specific application. The access must be time-limited and require approval from the partner's manager. Additionally, access must automatically expire after the defined period. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management enables organizations to manage access for external business partners through access packages. These packages can enforce time-limited access, require manager approval, and automatically expire access after a defined period, directly meeting all the stated requirements.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Access Reviews

Question 3

Your company has an Azure subscription that contains a hub virtual network and multiple spoke virtual networks connected via VNet peering. You need to ensure that all traffic between spokes is routed through a network virtual appliance (NVA) in the hub. The NVA is configured with IP forwarding enabled. What should you configure in the spoke virtual networks?

Accepted Answer

Add route tables to the spoke subnets with a default route (0.0.0.0/0) pointing to the NVA's private IP.. Adding a route table to the spoke subnets with a default route (0.0.0.0/0) pointing to the NVA's private IP forces all outbound traffic from the spoke, including traffic destined for other spokes, to be forwarded to the NVA. The NVA, with IP forwarding enabled, can then inspect and route the traffic to the target spoke. This ensures the desired traffic flow through the hub without requiring any changes to the VNet peering configuration.

Answer

Deploy a VPN gateway in each spoke and configure site-to-site VPNs.

Answer

Configure NSG rules to block direct spoke-to-spoke traffic.

Answer

Enable BGP on the VNet peerings.

Question 4

Your organization plans to use Azure Policy to enforce tagging on all resources. The tags must include 'CostCenter' and 'Environment'. Resources that do not have these tags should be automatically remediated. What should you use?

Accepted Answer

A policy with 'deployIfNotExists' effect and a remediation task. The 'deployIfNotExists' effect is correct because it allows Azure Policy to evaluate resources for missing tags and then deploy a remediation task that automatically adds the required tags. This effect is specifically designed for scenarios where non-compliance can be corrected by deploying or modifying resources, such as adding tags via a policy definition that triggers a remediation task.

Answer

A policy with 'append' effect

Answer

A policy with 'audit' effect

Answer

A policy with 'deny' effect

Question 5

A company is designing a data storage solution for an IoT pipeline that ingests time-series data from millions of devices. The data is append-only and queried by time range. The solution must support low-latency queries and automated retention policies. Which Azure data store should they choose?

Accepted Answer

Azure Data Explorer (ADX). Azure Data Explorer (ADX) is purpose-built for interactive analytics on large volumes of streaming, time-series data. It supports append-only ingestion, low-latency queries over time ranges via its Kusto Query Language (KQL), and native automated retention policies (e.g., soft-delete and hard-delete periods) without manual management.

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Answer

Azure Blob Storage with Azure Data Lake Storage Gen2

Question 6

An organization is designing a storage solution for Azure VMs running a database that requires low latency and high IOPS. The data is critical and must be durable with automatic replication across multiple datacenters in the same region. Which Azure managed disk type and redundancy option should they choose?

Accepted Answer

Premium SSD with ZRS. Premium SSD with ZRS is correct because the database requires low latency and high IOPS, which Premium SSD provides, and ZRS (Zone-Redundant Storage) automatically replicates data synchronously across three Azure availability zones within the same region, ensuring durability and high availability without the cross-region latency of GRS.

Answer

Standard SSD with GRS

Answer

Ultra Disk with LRS

Answer

Premium SSD v2 with LRS

Question 7

Your company is designing a new application that will process large volumes of streaming data from IoT devices. The data will be ingested, processed in near real-time, and stored for long-term analytics. You need to design a solution that meets the following requirements: (1) Ingest up to 1 million events per second. (2) Process events with a latency of less than 10 seconds. (3) Store processed data for 7 years for compliance. (4) Enable ad-hoc querying of the stored data. Which combination of Azure services should you recommend?

Accepted Answer

Azure Event Hubs, Azure Stream Analytics, and Azure Data Lake Storage Gen2.. Azure Event Hubs can ingest up to 1 million events per second with low latency, Azure Stream Analytics processes the streaming data in near real-time (sub-10-second latency) using temporal windowing and SQL-like queries, and Azure Data Lake Storage Gen2 provides cost-effective, scalable storage for 7 years of compliance data while supporting ad-hoc querying via tools like Azure Synapse Analytics or PolyBase. This combination meets all requirements: high-throughput ingestion, low-latency processing, long-term retention, and queryability.

Answer

Azure IoT Hub, Azure Stream Analytics, and Azure Cosmos DB.

Answer

Azure Service Bus, Azure Functions, and Azure SQL Database.

Answer

Azure Event Hubs, Azure Functions, and Azure Cosmos DB.

Question 8

A company wants to automatically detect sign-in attempts from anonymous IP addresses and sign-ins from unfamiliar locations. When such a risk is detected, they want to require multi-factor authentication (MFA) or block the sign-in in real time. Additionally, they need a dashboard that shows risk events and allows generating weekly risk reports. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it specifically detects sign-in risks such as anonymous IP addresses and unfamiliar locations, and it can automatically enforce conditional access policies like requiring MFA or blocking sign-ins in real time. It also provides a dashboard for risk events and supports generating weekly risk reports, directly matching all stated requirements.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Identity Governance

Question 9

A retail company runs its e-commerce platform on Azure VMs. The application uses Azure SQL Database. You are designing a business continuity plan. The company wants to minimize recovery time for a regional outage. Which Azure service should you use to replicate the VMs to a secondary region?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs from a primary to a secondary region, enabling rapid recovery during a regional outage. It provides continuous replication with a recovery point objective (RPO) of seconds and a recovery time objective (RTO) of minutes, directly meeting the requirement to minimize recovery time for the e-commerce platform's VMs.

Answer

Azure Traffic Manager

Answer

Azure Backup

Answer

Azure Load Balancer

Question 10

Your company has an Azure subscription with 100 virtual machines. You need to monitor the performance of these VMs and be alerted when the average CPU usage across a set of VMs exceeds 80% for 10 minutes. The set of VMs is defined by a tag (Environment=Production). Which Azure Monitor solution should you implement?

Accepted Answer

Use a Log Analytics query to calculate average CPU and set a log alert.. The requirement is to alert when the average CPU usage across a set of VMs (tagged Environment=Production) exceeds 80% for 10 minutes. Metric alert rules (including dynamic thresholds) evaluate per resource, not across multiple resources. Option D uses a Log Analytics query to calculate the average CPU usage across all VMs with the specified tag and then creates a log alert based on that query, which correctly aggregates the metric. Therefore, Option D is the correct solution.

Answer

Use Azure Monitor VM Insights to visualize performance and set alerts per VM.

Answer

Create a metric alert rule with a dynamic threshold and scope it to a resource group containing Production VMs.

Answer

Create a metric alert rule with a static threshold of 80% for each Production VM individually.

Question 11

Your company is migrating a legacy on-premises application to Azure. The application requires low-latency access to a shared file system that supports SMB protocol. The solution must be highly available within a single Azure region and must not require the application to be modified. Which Azure service should you recommend?

Accepted Answer

Azure Files (premium tier). Azure Files (premium tier) provides fully managed SMB file shares with low-latency access, high availability within a single Azure region, and supports the SMB protocol natively without requiring any application modifications. This makes it the ideal choice for migrating legacy on-premises applications that rely on SMB-based file sharing.

Answer

Azure Managed Disks (SSD)

Answer

Azure NetApp Files

Answer

Azure Blob Storage

Question 12

A multinational corporation is designing a hybrid identity solution using Microsoft Entra ID. The company has multiple on-premises Active Directory forests with complex trust relationships. They require that users can authenticate to both cloud and on-premises resources using the same credentials, and they want to minimize changes to the existing infrastructure. Which THREE components should be part of the solution? (Choose three.)

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync is correct because it synchronizes user identities from multiple on-premises Active Directory forests to Microsoft Entra ID, enabling single sign-on and unified credential usage across cloud and on-premises resources. It supports complex forest trust relationships by using the source anchor and UPN mapping to ensure each user has a unique identity in the cloud without requiring changes to the existing on-premises infrastructure.

Answer

Microsoft Entra Connect Health

Answer

Microsoft Entra Domain Services

Question 13

A company has a disaster recovery plan that requires testing failover of Azure VMs regularly without impacting the production environment. Which feature of Azure Site Recovery should they use?

Accepted Answer

Test failover. Test failover (Option B) is the correct feature for validating disaster recovery readiness without affecting the production environment. Azure Site Recovery's test failover creates an isolated copy of the replicated VMs in a separate virtual network, allowing you to run validation exercises, perform application testing, and verify recovery plans without any impact on the production VMs or ongoing replication. This ensures that the failover process works correctly while maintaining production continuity.

Answer

Planned failover

Answer

Unplanned failover

Answer

Failback

Question 14

A company needs a data storage solution for a global application that frequently accesses recent data and less frequently older data. Data is unstructured blobs. They want to automatically move blobs to cool storage after 30 days and to archive storage after 90 days. Additionally, blobs must be retained for 7 years and cannot be deleted or modified during that period. Which Azure Blob Storage features should they combine?

Accepted Answer

Use blob lifecycle management policies and time-based retention policies.. Blob lifecycle management policies automatically transition blobs from hot to cool after 30 days and to archive after 90 days, while time-based retention policies enforce immutability for a fixed period (7 years), preventing deletion or modification. This combination meets both the tiering and retention requirements without manual intervention.

Answer

Use blob lifecycle management policies and legal hold (immutable blobs).

Answer

Use Azure Storage Analytics and immutability policies.

Answer

Use Azure File Sync and lifecycle management.

Question 15

You are designing a disaster recovery plan for a web application hosted on Azure App Service. The application uses Azure SQL Database. The company wants to minimize downtime during a regional outage. Which approach should you recommend?

Accepted Answer

Deploy App Service in two regions with Azure Front Door for global load balancing and Azure SQL Database active geo-replication.. It combines multi-region App Service deployment with Azure Front Door for global load balancing and Azure SQL Database active geo-replication. This ensures that during a regional outage, traffic is automatically routed to the healthy secondary region, and the database is continuously replicated with a readable secondary, enabling near-zero RPO and minimal RTO without manual intervention.

Answer

Deploy App Service in a single region with Azure Backup for the app and database.

Answer

Deploy App Service across availability zones in one region and use Azure SQL Database zone-redundant configuration.

Answer

Deploy App Service in two regions with Azure Traffic Manager and use manual database restore.