AZ-305 Practice Test 50 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing a backup policy for an Azure VM. The policy is defined using the Azure Backup REST API. What is the maximum number of recovery points that can be retained according to this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

24. The weekly retention keeps 12 weekly points (count=12, durationType=Weeks). The monthly retention keeps 12 monthly points (count=12, durationType=Months). Instant RP retention adds up to 5 days, but those are additional recovery points not counted in the long-term retention. So total long-term recovery points = 12 (weekly) + 12 (monthly) = 24. Option A is correct.

Answer

17

Answer

29

Answer

12

Question 2

Your company has an Azure subscription that contains several virtual machines (VMs) running Windows Server. You need to ensure that all VMs are compliant with a baseline security policy that includes specific registry key settings. The solution must automatically remediate non-compliant settings without manual intervention. What should you use?

Accepted Answer

Azure Policy with Guest Configuration. Azure Policy with Guest Configuration is designed to audit and enforce settings inside VMs, including registry keys, and supports automatic remediation via DeployIfNotExists and Modify effects. It uses a guest configuration extension to evaluate the VM's configuration and can remediate non-compliant settings without manual intervention. This meets the requirement of ensuring compliance with a baseline security policy and automatic remediation.

Answer

Azure Automation State Configuration (DSC)

Answer

Microsoft Defender for Cloud with custom recommendations

Answer

Microsoft Intune

Question 3

Your organization needs to ensure that all Azure resources are compliant with corporate security policies. You need to design a solution that can enforce policies at scale, audit compliance, and automatically remediate non-compliant resources. Which THREE Azure services should you include?

Accepted Answer

Azure Policy. Azure Policy (A) is the core governance service that defines, assigns, and evaluates policy definitions and initiatives at management-group, subscription, and resource-group scopes, providing the enforce and audit-at-scale capabilities required. Azure Automation (C) supplies runbooks and, via its integration with Azure Policy's deployIfNotExists and modify effects (or remediation tasks), performs the automatic remediation of non-compliant resources. Azure Blueprints is deprecated/retired and should not be used for new designs, so it is not a valid AZ-305 answer. Azure Monitor (B) is for telemetry, metrics, and alerts rather than policy enforcement or remediation, and Azure RBAC (D) governs who can perform actions on resources through role assignments, not whether resource configurations comply with security policies.

Answer

Azure Monitor

Answer

Azure RBAC

Answer

Azure Blueprints

Question 4

A company runs a critical application on Azure VMs in a single region. They need to ensure business continuity with an RPO of 1 hour and RTO of 4 hours. The application has dependencies on virtual networks, storage accounts, and other Azure resources. They want to use Azure Backup as the primary disaster recovery tool and must be able to restore the entire application in a secondary region if the primary region fails. Which backup strategy should they recommend?

Accepted Answer

Azure Site Recovery with replication to a secondary region. Azure Site Recovery can replicate Azure VMs to a secondary region with an RPO as low as 15 minutes and an RTO of a few hours, meeting the 1-hour RPO and 4-hour RTO requirements. It also supports recovery plans that include virtual networks, storage accounts, and other dependencies, enabling restore of the entire application. Option C is incorrect because Azure Backup for VMs has a minimum backup frequency of every 4 hours for VM backups, not hourly, so it cannot achieve the required 1-hour RPO.

Answer

Azure Backup for VMs with daily backups and cross-region restore

Answer

Azure Backup for VMs with hourly backups and cross-region restore

Answer

Azure Backup for files with daily backups and geo-redundant storage

Question 5

A company is designing a solution for storing sensitive documents in Azure Blob Storage. They require that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they want to prevent any accidental deletion of the key vault and its keys. Which combination of actions should they take?

Accepted Answer

Enable soft-delete and purge protection on the key vault. Enabling soft-delete and purge protection on the Azure Key Vault prevents accidental or malicious deletion of the key vault and its keys, which is essential when using customer-managed keys for encryption at rest. Soft-delete allows recovery of deleted vaults and keys within a retention period, while purge protection prevents permanent deletion until the retention period expires. Option A is incorrect because Key Vault Contributor role allows management of the vault but does not prevent deletion; in fact, it could allow authorized users to delete the vault. Option B is incorrect because firewall rules restrict network access but do not prevent deletion of the vault itself. Option D is incorrect because diagnostic settings and logging only provide monitoring and auditing, not protection against deletion.

Answer

Assign the Key Vault Contributor role to only the security team

Answer

Configure firewall rules to restrict network access

Answer

Enable diagnostic settings and send logs to a Log Analytics workspace

Question 6

You are designing a network topology for a multi-tier application in Azure. The application has a web tier, an API tier, and a database tier. You need to ensure that the web tier can communicate with the API tier, and the API tier can communicate with the database tier, but the web tier cannot directly access the database tier. Which Azure networking solution should you implement?

Accepted Answer

Azure Application Security Groups (ASGs). Azure Application Security Groups (ASGs) let you group VMs by workload role (web, API, database) and then write NSG rules that reference those groups as source and destination, so you can allow web-to-API and API-to-database while implicitly denying web-to-database. This provides the tiered, role-based segmentation the scenario requires without managing individual IP addresses. ASGs are the purpose-built Azure construct for application-centric micro-segmentation within a VNet.

Answer

Azure Firewall

Answer

Network Security Groups (NSGs) with service tags

Answer

VNet peering

Question 7

Your company is designing a hybrid network architecture to connect an on-premises data center to Azure. The requirements include: high availability, low latency, and cost optimization. Which TWO options should you recommend?

Accepted Answer

ExpressRoute Gateway. ExpressRoute Gateway is correct because it provides a dedicated, private connection from on-premises to Azure, bypassing the public internet for lower latency and more consistent performance. It supports high availability through active-active configurations and can be paired with multiple circuits for redundancy, meeting the hybrid network requirements.

Answer

Single ExpressRoute circuit

Answer

Site-to-Site VPN

Answer

ExpressRoute Direct

Question 8

A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones in the East US region. The application receives HTTPS traffic. They need to distribute incoming traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Which Azure load balancing solution should they choose?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports SSL/TLS termination, cookie-based session persistence (affinity), and can distribute HTTPS traffic across VMs in multiple availability zones. These features directly match all three requirements: SSL offloading, session persistence, and cross-zone traffic distribution.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 9

Your company is migrating on-premises virtual machines to Azure. You need to assess the current environment and get a cost estimate for Azure. Which tool should you use?

Accepted Answer

Azure Migrate. Azure Migrate provides assessment and migration capabilities for on-premises workloads to Azure. It can discover on-premises VMs and provide a cost estimate for running them in Azure. Option A (Azure Cost Management) is for cost analysis after migration, not for initial assessment. Option C (Azure Monitor) is for monitoring, not assessment. Option D (Azure Advisor) gives optimization recommendations after deployment.

Answer

Azure Cost Management

Answer

Azure Monitor

Answer

Azure Advisor

Question 10

Which TWO of the following are valid Azure Policy effects that can be used to enforce compliance?

Accepted Answer

DeployIfNotExists. DeployIfNotExists (A) is a valid Azure Policy effect that enforces compliance by deploying a related resource when a specified resource does not exist, using a managed identity to perform the deployment. Deny (B) is also a valid effect that enforces compliance by blocking a resource request that violates the policy definition, causing the deployment to fail. AuditIfNotExists (C) is a real effect, but it only logs a non-compliance warning rather than enforcing compliance, so it is not one of the two enforcement effects. Modify (D) is a valid effect that adds or updates properties during deployment, but it is not marked correct here. AutoRemediate (E) is not an Azure Policy effect; remediation is a separate task performed via remediation tasks, not an effect name.

Answer

AuditIfNotExists

Answer

Modify

Answer

AutoRemediate

Question 11

A company runs a critical database on Azure SQL Database in the West US region. They need to implement disaster recovery to East US with an RPO of 1 minute and RTO of 1 hour. They also want to use the secondary database for read-only workloads during normal operations. The solution must be fully managed. Which Azure SQL Database feature should they enable?

Accepted Answer

Auto-failover group with read-scale. Auto-failover groups with read-scale (Option B) provide a fully managed disaster recovery solution with an RPO of 1 minute and RTO of 1 hour. They allow the secondary database in East US to be used for read-only workloads during normal operations via the read-scale listener endpoint. This meets all requirements: fully managed, low RPO/RTO, and read-only access to the secondary. Option A (Active geo-replication with failover group) does not support automatic failover and does not provide a read-scale endpoint for the secondary, so it does not meet the RTO requirement or the read-only workload requirement.

Answer

Active geo-replication with failover group

Answer

Geo-restore

Answer

Zone-redundant configuration

Question 12

A multinational organization is designing a Microsoft 365 deployment for 10,000 users. The organization requires that all users have a consistent experience and that desktop settings follow users across devices. The solution must also support offline access to files and automatic sync. Which Microsoft 365 service should the organization use?

Accepted Answer

OneDrive for Business. OneDrive for Business is the correct choice because it provides per-user cloud storage with offline file access via Files On-Demand and automatic sync through the OneDrive sync client. It also enables desktop settings (such as desktop, documents, and pictures folders) to follow users across devices via Known Folder Move, ensuring a consistent experience. This directly meets the requirements for offline access, automatic sync, and cross-device settings roaming.

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Answer

Enterprise State Roaming

Question 13

Your organization has a hybrid identity solution using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to use their on-premises credentials to authenticate to cloud applications, but you want to avoid synchronizing password hashes to the cloud. Which authentication method should you choose?

Accepted Answer

Pass-through Authentication. Pass-through Authentication (PTA) is the correct choice because it validates users' passwords directly against on-premises Active Directory without ever storing password hashes in the cloud. This meets the requirement to avoid synchronizing password hashes while still enabling authentication to cloud applications via Microsoft Entra ID.

Answer

Seamless Single Sign-On

Answer

Active Directory Federation Services (AD FS)

Answer

Password Hash Synchronization

Question 14

A company has Microsoft Entra ID Premium P2 licenses and wants to ensure that privileged roles (e.g., Global Administrator) are only activated when needed and with approval. They also need to regularly review who has access to these roles. Which combination of features should they use?

Accepted Answer

Privileged Identity Management (PIM) and Microsoft Entra ID Access Reviews. Privileged Identity Management (PIM) provides just-in-time (JIT) activation of privileged roles with approval workflows, meeting the requirement for activation only when needed and with approval. Microsoft Entra ID Access Reviews then enable recurring certification of role assignments, ensuring that access is regularly reviewed and stale or inappropriate assignments are removed. Together, they form the correct combination for managing and governing privileged roles.

Answer

Identity Protection and Conditional Access

Answer

Entitlement Management and Conditional Access

Answer

Microsoft Entra ID Access Reviews and Identity Protection

Question 15

Which TWO are valid methods to authenticate users in a Microsoft Entra ID hybrid identity solution? (Select TWO.)

Accepted Answer

Password hash synchronization. Password hash synchronization (B), Federation with Active Directory Federation Services (ADFS) (C), and Pass-through Authentication (D) are all valid authentication methods in a Microsoft Entra ID hybrid identity solution. Cloud-only authentication (A) is not hybrid, and Seamless Single Sign-On (E) is a supplementary feature rather than a standalone authentication method.

Answer

Cloud-only authentication

Answer

Seamless Single Sign-On