AZ-305 Practice Questions 1 — 50 Questions

Question 1

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center connected via ExpressRoute. They need to implement a hub-and-spoke topology where a hub VNet hosts shared network virtual appliances (NVAs) for traffic inspection. All traffic between spokes and between spokes and on-premises must be routed through the hub. The company wants to minimize the administrative overhead of configuring and maintaining routing. Which Azure solution should they implement?

Accepted Answer

Use Azure Virtual WAN with a secured virtual hub.. Azure Virtual WAN with a secured virtual hub is the correct choice because it provides a managed hub-and-spoke topology with built-in routing, eliminating the need for manual user-defined routes (UDRs) and route tables. The secured virtual hub includes Azure Firewall for traffic inspection, and all inter-spoke and on-premises traffic is automatically routed through the hub via the Virtual WAN routing engine, which uses the Border Gateway Protocol (BGP) to propagate routes dynamically. This minimizes administrative overhead by centralizing routing and security management.

Answer

Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.

Answer

Create a single large VNet and use network security groups (NSGs) to isolate traffic.

Answer

Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.

Question 2

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

Accepted Answer

Peer each spoke VNet with the hub VNet. B is correct because VNet peering is required to establish connectivity between the spoke VNets and the hub VNet, enabling traffic to flow through the central Azure Firewall. Without peering, the spoke VNets would be isolated and unable to route traffic to the hub. C is correct because a route table with a default route (0.0.0.0/0) pointing to the firewall's private IP ensures that all outbound internet traffic from spoke subnets is forced through the firewall for inspection and control.

Answer

Enable public IP addresses on all workload VMs

Answer

Deploy a NAT gateway in every spoke subnet

Question 3

A company has virtual machines in Azure that need to be grouped across multiple fault domains and update domains to ensure high availability. They plan to deploy three VMs running the same application tier. Which Azure feature should they use to provide redundancy within a single region?

Accepted Answer

Availability Set. An Availability Set distributes VMs across multiple fault domains (shared hardware, power, and networking) and update domains (planned maintenance) within a single Azure datacenter. This ensures that at least one VM remains available during both hardware failures and Azure patching cycles. For three VMs running the same application tier, an Availability Set provides the required redundancy without the complexity of zone-level isolation.

Answer

Availability Zone

Answer

Virtual Machine Scale Set with manual scaling

Answer

Azure Site Recovery

Question 4

A company plans to migrate on-premises applications to Azure. They require users to authenticate using their existing on-premises Active Directory credentials without syncing password hashes to the cloud. Which Microsoft Entra ID authentication method should they use?

Accepted Answer

Microsoft Entra ID Pass-through Authentication. Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud. A lightweight agent on-premises forwards authentication requests to the local domain controller, meeting the requirement to avoid password hash synchronization.

Answer

Microsoft Entra ID Password Hash Sync

Answer

Microsoft Entra ID Federation Services (AD FS)

Answer

Microsoft Entra ID Connect with Seamless SSO

Question 5

A company has multiple Azure subscriptions and wants to enforce that all administrators must use multi-factor authentication (MFA) when accessing the Azure portal. They also want to monitor and report on any policy changes that affect this enforcement. Which combination of Azure services should they use?

Accepted Answer

Microsoft Entra ID Conditional Access policy to require MFA for Azure management and Azure Monitor with Log Analytics for monitoring.. Option B is correct because Microsoft Entra ID Conditional Access policies can enforce MFA specifically for Azure management (including the Azure portal), and Azure Monitor with Log Analytics provides the monitoring and reporting of policy changes via the Azure Activity Log. This combination directly addresses both requirements: enforcing MFA for administrators and auditing changes to the Conditional Access policy itself.

Answer

Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.

Answer

Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.

Answer

Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.

Question 6

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

Accepted Answer

A. Azure ExpressRoute provides a private, high-bandwidth, and reliable connection from on-premises data centers to Azure, bypassing the public internet. To meet the low-cost backup requirement, Azure VPN Gateway (Site-to-Site VPN) offers a secure, encrypted connection over the internet as a failover path, which is significantly cheaper than a second ExpressRoute circuit. This combination ensures primary connectivity via ExpressRoute and cost-effective redundancy via VPN.

Answer

B

Answer

C

Answer

D

Question 7

A company has multiple Azure virtual networks (VNets) spread across three Azure regions (West US, East US, and West Europe). They also have an on-premises network connected to East US via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. They require centralized management of routing and the ability to enforce security policies such as forcing all internet-bound traffic from any VNet to pass through a central firewall in East US. Which Azure solution should they implement?

Accepted Answer

Azure Virtual WAN with a secured hub in East US.. Azure Virtual WAN with a secured hub in East US provides a centralized hub-and-spoke architecture that connects all VNets and the on-premises network via ExpressRoute. The secured hub includes Azure Firewall, enabling forced tunneling of all internet-bound traffic from any VNet through the central firewall in East US, while Virtual WAN automatically manages routing between all spokes and the on-premises network.

Answer

VNet peering between all VNets and use route tables for forced tunneling.

Answer

ExpressRoute Global Reach with VNet peering to connect all VNets.

Answer

VPN gateways with BGP to connect all VNets.

Question 8

A company runs a critical application on an Azure virtual machine in the West US region. They want to enable disaster recovery to East US with the ability to perform non-disruptive DR drills. They need an RPO of a few minutes. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct service because it provides continuous replication of Azure VMs from a primary region (West US) to a secondary region (East US) with a Recovery Point Objective (RPO) of a few minutes. It also supports non-disruptive disaster recovery drills by allowing you to perform test failovers in an isolated network without impacting the production workload.

Answer

Azure Backup

Answer

Azure Traffic Manager

Answer

Azure Blueprints

Question 9

A company is building a new application that requires a fully managed relational database. The application has varying workloads across different databases. The company wants to pool resources to optimize cost and allow each database to scale as needed. They also need automated backups with point-in-time restore and geo-replication for disaster recovery. Which Azure data service should they use?

Accepted Answer

Azure SQL Database. Azure SQL Database is a fully managed relational database service that supports elastic pools, which allow you to pool resources across multiple databases to optimize cost and enable each database to scale independently based on demand. It also provides automated backups with point-in-time restore (PITR) and active geo-replication for disaster recovery, meeting all the stated requirements.

Answer

Azure SQL Managed Instance

Answer

Azure Database for MySQL

Answer

Azure Database for PostgreSQL

Question 10

A company has multiple virtual networks in different Azure regions. They need to connect all VNets together securely over the Microsoft backbone. They also need to connect to an on-premises data center via ExpressRoute. The solution should support transitive routing between all connected networks. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the correct choice because it provides a hub-and-spoke architecture that supports transitive routing between all connected networks (multiple VNets across regions and on-premises via ExpressRoute) over the Microsoft backbone. It natively integrates ExpressRoute and VPN gateways into a single managed service, enabling seamless connectivity and routing between any spoke VNet, branch, or on-premises site without requiring manual peering or gateway transit configuration.

Answer

Azure Virtual Network Peering

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute Gateway

Question 11

A company plans to deploy a web application on Azure virtual machines. They want to protect against a datacenter failure within a region. The VMs must be distributed across multiple physically separate locations with independent power, cooling, and networking. Which deployment option should they use?

Accepted Answer

Availability Zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application is protected against a single datacenter failure, meeting the requirement for fault isolation at the datacenter level.

Answer

Availability Set

Answer

Virtual Machine Scale Set

Answer

Proximity Placement Group

Question 12

A company wants to cache frequently accessed session state and product data for their e-commerce website. They need the cache to be highly available with a 99.9% SLA and provide fast read and write access. The solution must be fully managed. Which Azure Cache tier should they choose?

Accepted Answer

Azure Redis Cache Standard tier. The Standard tier of Azure Redis Cache provides a 99.9% SLA through built-in replication with two nodes (primary and replica) in the same region, ensuring high availability. It is fully managed, supports fast read/write access for session state and product data, and meets the requirement without the additional cost or complexity of the Premium tier.

Answer

Azure Redis Cache Basic tier

Answer

Azure Redis Cache Premium tier

Answer

Azure Content Delivery Network

Question 13

A company wants to deploy a web application on Azure virtual machines (VMs). The application experiences variable traffic patterns, so the company needs to automatically add or remove VM instances based on CPU utilization. They also want the application to remain highly available even if an Azure datacenter fails. Which combination of Azure services should they use?

Accepted Answer

Virtual Machine Scale Sets configured with autoscale rules based on CPU and distributed across availability zones. Virtual Machine Scale Sets (VMSS) with autoscale rules based on CPU utilization automatically add or remove VM instances to match variable traffic patterns. Distributing the VMSS across availability zones ensures the application remains highly available even if an entire Azure datacenter fails, because availability zones are physically separate datacenters within a region.

Answer

Azure App Service with autoscale rules and deployment slots

Answer

Azure Load Balancer with a backend pool of VMs and autoscale rules applied to individual VMSS

Answer

Azure Traffic Manager with endpoints in separate regions and Manual scaling of VMs

Question 14

A company wants to run a containerized application on Azure without managing virtual machines. They need automatic scaling, load balancing, and rolling updates. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes orchestration platform that handles containerized applications with automatic scaling (via Horizontal Pod Autoscaler), built-in load balancing (via Azure Load Balancer integration), and rolling updates (via Kubernetes deployment strategies). This meets the requirement of running containers without managing VMs, as AKS abstracts the underlying node management.

Answer

Azure Virtual Machine Scale Sets

Answer

Azure App Service

Answer

Azure Container Instances

Question 15

A company uses Microsoft Entra ID. They want to integrate their security operations with a third-party SIEM tool. They need to export all Microsoft Entra ID sign-in logs and audit logs to the SIEM for analysis. The solution should be automated and near real-time. Which Azure service should they configure?

Accepted Answer

Azure Event Hubs. Azure Event Hubs is the correct service because it provides a high-throughput, low-latency data ingestion platform that can receive streaming diagnostic data from Microsoft Entra ID. By configuring diagnostic settings in Entra ID to stream sign-in and audit logs to an Event Hubs namespace, you enable near real-time export to a third-party SIEM tool via the Event Hubs-compatible endpoint, typically using the AMQP or HTTPS protocol.

Answer

Azure Logic Apps

Answer

Azure Monitor

Answer

Azure Storage

Question 16

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to automatically detect sign-ins from users with leaked credentials and prompt those users to reset their password during the next sign-in. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection includes a 'Leaked Credentials' detection capability that continuously monitors for credentials exposed in known data breaches. When a user's credentials are detected as leaked, Identity Protection can automatically trigger a password reset during the next sign-in, ensuring the compromised credentials are no longer usable.

Answer

Conditional Access

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID B2B

Question 17

Match each Azure monitoring service to its function.

Question 18

Match each Azure compute service to its characteristic.

Question 19

Match each Azure migration tool to its use case.

Question 20

Match each Azure identity service to its description.