AZ-305 Practice Test 45 — 15 Questions

Question 1

Which THREE of the following are valid methods to securely transfer data to Azure Blob Storage? (Select three.)

Accepted Answer

Azure Data Box. Azure Data Box is a physical data transfer solution that allows you to securely transfer large volumes of data to Azure Blob Storage when network transfer is impractical. It uses AES-256 encryption for data at rest and TLS for data in transit, and after the device is shipped back, data is automatically uploaded to your designated storage account.

Answer

Azure File Sync

Answer

Azure Migrate

Question 2

A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They need to automatically detect users whose credentials have been leaked and require them to reset their password at their next sign-in. Additionally, they want to block sign-ins from anonymous IP addresses (e.g., Tor network). Which combination of Microsoft Entra ID features should they enable to meet both requirements?

Accepted Answer

Identity Protection user risk policy and sign-in risk policy. Identity Protection user risk policy can automatically detect leaked credentials and force a password reset at next sign-in, while the sign-in risk policy can block sign-ins from anonymous IP addresses (e.g., Tor). These two policies together address both requirements without needing additional Conditional Access or MFA policies.

Answer

Conditional Access with MFA policy and Identity Protection sign-in risk policy

Answer

Privileged Identity Management and Conditional Access

Answer

Microsoft Entra ID Connect Health and Identity Protection

Question 3

A company plans to migrate on-premises SQL Server databases to Azure. They need to minimize changes to existing applications and want to use the latest features of SQL Server. Which Azure data service should they use?

Accepted Answer

Azure SQL Managed Instance. Azure SQL Managed Instance is the correct choice because it provides near 100% compatibility with on-premises SQL Server, enabling a lift-and-shift migration with minimal application changes. It also supports the latest SQL Server features, such as native JSON support, temporal tables, and intelligent query processing, while offloading infrastructure management to Azure.

Answer

SQL Server on Azure Virtual Machines

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Question 4

You are designing a solution to securely store and manage secrets for multiple applications deployed in Azure. The solution must support automated rotation of secrets and provide audit logging. Which Azure service should you use?

Accepted Answer

Azure Key Vault with managed identity and rotation policy. Azure Key Vault with a managed identity and a rotation policy is the correct choice because it provides a centralized, secure store for secrets, supports automated rotation via built-in policies or custom logic, and integrates with Azure Monitor for audit logging. Managed identities eliminate the need for hard-coded credentials, and the rotation policy ensures secrets are automatically updated without manual intervention.

Answer

Microsoft Entra ID application registration

Answer

Azure App Service Key Vault references

Answer

Azure Automation with PowerShell runbooks

Question 5

You need to design a solution to monitor the performance of an Azure SQL Database. You want to create a dashboard that shows the top 10 queries by CPU usage over the last hour. What should you use?

Accepted Answer

Azure SQL Analytics. Azure SQL Analytics is a dedicated monitoring solution for Azure SQL Database that provides built-in views and dashboards for top queries by CPU, duration, and other performance metrics. It leverages the Query Store and DMVs to surface the top 10 queries by CPU usage over the last hour without requiring custom queries or additional configuration.

Answer

Azure Monitor Workbooks

Answer

Power BI

Answer

Log Analytics

Question 6

You are designing a monitoring solution for a hybrid environment with on-premises servers and Azure VMs. You need to collect security events and performance data centrally, and create custom alerts. The solution must use the same agent for both environments. Which agent should you deploy?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent (AMA) is the correct choice because it is the next-generation agent that replaces the legacy Log Analytics agent (MMA) and supports both Windows and Linux machines in hybrid and Azure environments. It collects security events and performance data into a single Log Analytics workspace and enables custom alert rules via data collection rules (DCRs), all with a single agent deployment.

Answer

Log Analytics agent (MMA)

Answer

Microsoft Dependency Agent

Answer

Azure Diagnostics extension

Question 7

You are designing a disaster recovery solution for a multi-tier web application on Azure VMs. The solution must meet an RPO of 15 minutes and an RTO of 1 hour. The application includes a SQL Server database. Which THREE actions should you take? (Choose THREE.)

Accepted Answer

Use Azure Premium SSD managed disks for the VMs to ensure low latency replication.. Azure Premium SSD managed disks provide low-latency, high-throughput storage that is essential for synchronous replication in SQL Server Always On Availability Groups. The synchronous commit mode requires fast disk I/O to avoid transaction delays, and Premium SSDs meet the sub-millisecond latency needed to achieve an RPO of 15 minutes and RTO of 1 hour across regions.

Answer

Use Azure Backup for the SQL Server database with 1-hour backup frequency.

Answer

Deploy read-scale replicas of the SQL Server in the secondary region.

Question 8

Refer to the exhibit. An organization deploys this ARM template to create a storage account. They need to ensure that data is replicated synchronously across two Azure regions. Does this template meet the requirement?

Accepted Answer

No, GRS provides asynchronous replication. The template uses GRS (Geo-Redundant Storage), which replicates data asynchronously from the primary region to the secondary region. Because the replication is asynchronous, there is a potential for data loss if a regional disaster occurs before the secondary region is fully updated. The requirement specifies synchronous replication across two Azure regions, which is only provided by Azure Storage’s geo-zone-redundant storage (GZRS) with read-access (RA-GZRS) or by using Azure Files with synchronous replication via Azure File Sync or a third-party solution. Therefore, GRS does not meet the synchronous requirement.

Answer

No, the template uses RA-GRS

Answer

Yes, GRS provides synchronous replication

Answer

No, the template uses LRS

Question 9

A startup is building a new mobile app backend. They need a fully managed relational database service with built-in high availability, automatic backups, and built-in intelligence to optimize performance. They want to minimize administrative overhead for tasks like patching and scaling. Which Azure service should they use?

Accepted Answer

Azure SQL Database. Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) relational database that includes built-in high availability (99.99% SLA), automatic backups with point-in-time restore, and built-in intelligence features like automatic tuning, adaptive query processing, and intelligent insights. This minimizes administrative overhead for patching, scaling, and performance optimization, making it ideal for a startup that wants to focus on app development rather than database management.

Answer

SQL Server on Azure Virtual Machines

Answer

Azure Database for MySQL

Answer

Azure Cosmos DB

Question 10

You need to design a storage solution for an application that stores large amounts of unstructured data that is accessed frequently for the first 30 days, then rarely after that. Compliance requirements mandate that data be retained for 7 years. Which of the following is the most cost-effective storage solution?

Accepted Answer

Use Azure Blob Storage with lifecycle management to transition blobs from Hot to Cool to Archive tiers.. Azure Blob Storage lifecycle management allows you to automatically transition blobs from Hot to Cool after 30 days (once the initial frequent access period ends), and then to Archive after an additional period of low access (e.g., another 30 days) to meet the 7-year retention requirement at the lowest cost. The Archive tier provides the cheapest storage for rarely accessed data, while Hot and Cool tiers optimize for the initial high-access period.

Answer

Use Azure Files with snapshots and keep files in the Premium tier for 30 days, then move to Standard tier.

Answer

Use Azure Managed Disks with read-only snapshots and delete snapshots after 7 years.

Answer

Store all data in Blob Storage Hot tier and delete after 7 years.

Question 11

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution to detect when a user account is created in Microsoft Entra ID with Global Administrator privileges. When detected, an incident must be created in Sentinel and the account should be disabled temporarily until reviewed. You want to use built-in capabilities where possible. What should you do?

Accepted Answer

Use a Microsoft Sentinel analytics rule template for 'Suspicious Entra ID role assignment' and configure a playbook to disable the account via Microsoft Graph API.. It uses a built-in Sentinel analytics rule template specifically designed to detect suspicious Entra ID role assignments, which meets the requirement for built-in capabilities. The playbook, triggered by the rule, can use the Microsoft Graph API to disable the account temporarily, providing automated remediation without custom code or external services.

Answer

Use Microsoft Entra Privileged Identity Management to require approval for role activation, and audit logs to detect permanent assignments.

Answer

Use Microsoft Defender for Cloud Apps to monitor for privileged role assignments and send an alert to Sentinel.

Answer

Create a custom KQL query in Log Analytics and schedule it as a Sentinel analytics rule, then use an Azure Function to disable the account.

Question 12

Refer to the exhibit. You are deploying an ARM template to configure backup for an Azure Web App. The deployment fails with an error: 'The resource 'Microsoft.Web/sites/config' cannot be nested under a parent resource that is not deployed.' What is the MOST LIKELY cause?

Accepted Answer

The parent web app resource is not defined in the template. The error indicates that the ARM template is trying to define a child resource (Microsoft.Web/sites/config) under a parent web app that has not been deployed within the same template. In ARM templates, nested resources require the parent resource to be defined in the same template, typically with a dependsOn element or by nesting the child resource inside the parent's resources array. Since the parent web app is missing from the template, the deployment fails because the resource manager cannot resolve the parent scope.

Answer

The storageAccountUrl property uses a reference() that cannot be resolved

Answer

The apiVersion '2022-03-01' is not supported for this resource type

Answer

The backup schedule frequency interval is invalid

Question 13

Which TWO Azure services can be used to implement a serverless event-driven architecture that processes messages from a queue and stores results in a database? (Choose two.)

Accepted Answer

Azure Logic Apps. Azure Logic Apps is correct because it provides a serverless workflow engine that can be triggered by a queue (e.g., Azure Service Bus queue or Storage queue) and then process messages using built-in connectors to write results into a database like Azure SQL Database or Cosmos DB. It supports event-driven execution without managing infrastructure, making it ideal for orchestrating message processing and persistence.

Answer

Azure Event Grid

Answer

Azure Service Bus

Answer

Azure Batch

Question 14

A company runs a critical application on Azure VMs in a single region. They need to improve availability to meet an SLA of 99.99% while minimizing costs. The application is stateless and can run on multiple VMs. Which solution should you recommend?

Accepted Answer

Deploy a virtual machine scale set across multiple availability zones in a single region.. A virtual machine scale set deployed across multiple availability zones in a single region provides zone-level redundancy, protecting against datacenter failures while keeping traffic within a single region for low latency. This configuration can achieve up to 99.99% availability (when using two or more zones) without the cost and complexity of multi-region replication, making it the most cost-effective solution for a stateless application.

Answer

Deploy two VMs in the same availability set in a single region.

Answer

Deploy a single VM with Azure Site Recovery to another region.

Answer

Deploy two VMs in two different Azure regions with Azure Traffic Manager.

Question 15

Your company is planning to use Azure Monitor Workbooks to create custom dashboards for IT operations. You need to select the data sources that can be used in a workbook. Which TWO data sources are supported? (Choose two.)

Accepted Answer

Azure Resource Graph. Azure Monitor Workbooks support Azure Resource Graph as a data source, allowing you to query Azure resources and their properties across subscriptions. This enables rich, resource-centric visualizations in custom dashboards without needing to export data to a separate store.

Answer

Azure SQL Database

Answer

Microsoft Sentinel

Answer

Azure Blob Storage