AZ-305 Practice Exam 52 — 20 Questions

Question 1

A company is planning to migrate its on-premises Active Directory to Microsoft Entra ID. They have a complex on-premises infrastructure with multiple forests and over 50,000 users. They need to synchronize identities and enable single sign-on (SSO) for Office 365. What should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync is the appropriate tool for synchronizing identities from a complex on-premises infrastructure with multiple forests and over 50,000 users to Microsoft Entra ID. It supports full identity synchronization, password hash synchronization, pass-through authentication, and federation for SSO to Office 365, and it can handle multi-forest environments with advanced configuration options. Microsoft Entra Connect Health only monitors the synchronization infrastructure and does not perform identity synchronization.

Answer

Microsoft Entra Connect Cloud Sync

Answer

Microsoft Entra Connect Health

Answer

Microsoft Entra ID synchronization

Question 2

Refer to the exhibit. The ARM template provisions a VM. The deployment succeeds but the VM fails to start. What is the most likely cause?

Accepted Answer

The VM size Standard_D2s_v3 is not available in the region. The VM size Standard_D2s_v3 may not be available in the specified region or subscription. ARM template deployments can succeed in provisioning the resource definition, but the VM fails to start if the scheduler cannot allocate a host that supports this VM size. This is a common issue when the size is restricted or not available in the region, causing a delayed failure after deployment.

Answer

The admin password is in plaintext and does not meet complexity requirements

Answer

The data disk size 1023 GB exceeds the maximum for StandardSSD_LRS

Answer

The network interface resource ID is incorrectly formatted

Question 3

A company has multiple Azure VNets deployed in a hub-spoke topology. They want to inspect all outbound internet traffic from spoke VMs using a central firewall and ensure that traffic from all VNets goes through the firewall before reaching the internet. They also need to log all outbound connections. Which architecture should they implement?

Accepted Answer

Deploy Azure Firewall in the hub VNet and configure a default route (0.0.0.0/0) in each spoke's route table pointing to Azure Firewall as the next hop. Azure Firewall is a managed, stateful firewall-as-a-service that can centrally inspect and log outbound internet traffic. By deploying Azure Firewall in the hub VNet and configuring a default route (0.0.0.0/0) in each spoke's route table with the Azure Firewall private IP as the next hop, all outbound traffic from spoke VMs is forced through the firewall before reaching the internet. This satisfies both the inspection and logging requirements, as Azure Firewall provides built-in outbound connection logging via diagnostic settings.

Answer

Deploy network virtual appliances (NVAs) in each spoke VNet and configure user-defined routes (UDRs) to route internet traffic to the NVAs

Answer

Use Azure Application Gateway with Web Application Firewall (WAF) in the hub VNet to inspect all traffic

Answer

Deploy Azure Firewall in each spoke VNet and use Azure Monitor to aggregate logs

Question 4

You have an Azure subscription that contains 100 virtual machines. You need to monitor the virtual machines for security vulnerabilities and receive recommendations. What should you use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides unified security management and advanced threat protection across hybrid cloud workloads. It continuously assesses your virtual machines for security vulnerabilities, misconfigurations, and missing updates, then delivers actionable recommendations and a secure score to prioritize remediation. This directly matches the requirement to monitor VMs for vulnerabilities and receive recommendations.

Answer

Azure Monitor

Answer

Microsoft Sentinel

Answer

Microsoft Defender XDR

Question 5

A company is building a petabyte-scale data lake for analytics. They need a storage solution that supports a hierarchical namespace, POSIX-like permissions (ACLs), and is optimized for big data analytics workloads using Apache Spark and Hive. The data must be accessible over the Azure Blob Storage API. Which Azure data service should they use?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and is natively optimized for big data analytics workloads like Apache Spark and Hive. It exposes data through the Azure Blob Storage API, meeting all stated requirements for petabyte-scale analytics.

Answer

Azure Blob Storage (with flat namespace)

Answer

Azure NetApp Files

Answer

Azure HPC Cache

Question 6

A media company stores raw video files and processed output in Azure. These files are accessed via REST APIs by a processing application. After processing, the files are rarely accessed but must be retained. To minimize costs, the company wants to automatically move files to a cheaper storage tier after 30 days and archive them after 90 days. Which Azure storage solution and feature should they use?

Accepted Answer

Azure Blob Storage with lifecycle management policies. Azure Blob Storage with lifecycle management policies is correct because it allows you to define rules that automatically transition blobs from the hot tier to the cool tier after 30 days and then to the archive tier after 90 days. This directly meets the cost-minimization requirement for rarely accessed files that must be retained, as lifecycle management automates tier transitions without manual intervention.

Answer

Azure Files with snapshot schedules

Answer

Azure Disk Storage with incremental snapshots

Answer

Azure NetApp Files with snapshot policies

Question 7

You are designing a highly available architecture for a web application that runs on Azure VMs. The solution must distribute incoming traffic across multiple VMs in an availability set. Which TWO Azure components should you include? (Choose two.)

Accepted Answer

Azure Load Balancer. Azure Load Balancer (A) is correct because it distributes incoming traffic across multiple VMs in an availability set at the transport layer (TCP/UDP), providing high availability by rerouting traffic away from failed instances. An availability set (D) is required to ensure VMs are placed in different fault domains and update domains, protecting against hardware failures and planned maintenance. Together, they form the core of a highly available architecture for VMs within a single Azure region.

Answer

Azure Traffic Manager

Answer

Azure Front Door

Answer

Azure Application Gateway

Question 8

Match each Azure governance tool to its description.

Accepted Answer

Azure Policy: Enforces rules and compliance across resources.. Azure Policy enforces rules; Azure Blueprints provides repeatable templates; Management Groups organize subscriptions; RBAC controls access. Confusions often arise between policy enforcement and access control, or between blueprints and management groups.

Answer

Azure Policy: Controls access to resources by assigning roles.

Answer

Azure Blueprints: Organizes subscriptions into a hierarchy.

Question 9

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to provide external business partners with access to an internal application. The access must be time-limited to 60 days, approved by a manager within the partner company, and automatically expire. The company also needs to generate reports of who has access. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra ID B2B collaboration with entitlement management. Microsoft Entra ID B2B collaboration with entitlement management allows you to invite external users from partner companies and manage their access through access packages. These packages can enforce time-limited access (e.g., 60 days), require approval from the partner's manager, and automatically expire. Entitlement management also provides built-in reporting to track who has access, meeting all stated requirements.

Answer

Microsoft Entra ID B2C custom policies

Answer

Microsoft Entra ID Identity Governance with Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access with session controls

Question 10

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically review and remove guest accounts that have not signed in for 90 days. They also need to generate reports for auditors. Which Microsoft Entra ID feature should they use?

Accepted Answer

Access Reviews. Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews of guest users' access. By configuring a review with a 'days since last sign-in' condition (e.g., 90 days), Entra ID automatically flags and can remove guest accounts that have not authenticated within that period. The review process also generates detailed audit logs and reports suitable for auditor compliance, directly meeting the stated requirements.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Conditional Access

Question 11

A company has an Azure SQL Database that they need to access from an on-premises data center over ExpressRoute. They want to use a private IP address to connect to the database, ensuring traffic never traverses the public internet. Which Azure service should they use?

Accepted Answer

Azure Private Link. Azure Private Link allows you to access Azure SQL Database over a private endpoint within your virtual network, using a private IP address. When combined with ExpressRoute, traffic from your on-premises data center to the database traverses the Microsoft backbone network and never touches the public internet, meeting the requirement for a private, secure connection.

Answer

Azure Service Endpoints

Answer

Azure VPN Gateway

Answer

Azure Front Door

Question 12

A company deploys a web application on Azure VMs. They need to distribute incoming HTTP and HTTPS traffic based on the URL path: requests to /api/* go to one VM pool, requests to /images/* go to another pool. They also need to offload SSL/TLS termination. Which Azure load balancing solution should they use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer-7 load balancer that can route traffic based on URL path (e.g., /api/* vs /images/*) and provides SSL/TLS termination at the gateway, offloading the decryption from the backend VMs. This matches both requirements exactly, whereas other solutions either lack layer-7 path-based routing or are designed for global traffic distribution.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 13

A company deploys a web application on Azure VMs. The application stores session state and frequently accessed product data. They need a low-latency, in-memory cache to reduce database load and improve response times. The cache must be managed and support data persistence with replication across availability zones within the region. Which Azure service and tier should they choose?

Accepted Answer

Azure Cache for Redis (Premium tier). Azure Cache for Redis Premium tier is the correct choice because it supports data persistence (RDB/AOF), replication across availability zones via zone redundancy, and provides low-latency, in-memory caching for session state and product data. The Basic tier lacks replication and persistence, Standard tier offers replication but not zone redundancy or persistence, and Enterprise tier is overkill for this scenario, adding unnecessary cost and complexity.

Answer

Azure Cache for Redis (Basic tier)

Answer

Azure Cache for Redis (Standard tier)

Answer

Azure Cache for Redis (Enterprise tier)

Question 14

A company runs a critical SQL Server database on an Azure virtual machine. They need a high-availability solution within a single region that provides automatic failover, zero data loss (synchronous replication), and support read-only routing for reporting workloads. Which solution should they implement?

Accepted Answer

SQL Server Always On Availability Group with synchronous replication across availability zones. SQL Server Always On Availability Group with synchronous replication across availability zones meets all requirements: it provides automatic failover, zero data loss through synchronous commit mode, and supports read-only routing by directing reporting workloads to readable secondary replicas. This solution operates within a single Azure region using availability zones for high availability.

Answer

SQL Server Always On Failover Cluster Instance (FCI) with shared disks

Answer

Azure SQL Database Managed Instance with active geo-replication

Answer

Azure SQL Database with active geo-replication

Question 15

A company needs to store sensor data from IoT devices. Each device sends a message every second. The data is time-series and will be queried for real-time dashboards and historical analysis. The solution must support high ingestion rates and low-latency queries on recent data. Which Azure service should they use?

Accepted Answer

Azure Event Hubs and Azure Data Explorer. Azure Event Hubs is designed for high-throughput data ingestion from millions of IoT devices, capable of handling millions of events per second. Azure Data Explorer (ADX) is optimized for time-series data, providing sub-second query latency on recent data and efficient historical analysis. Together, they form a serverless pipeline that ingests sensor data via Event Hubs and stores it in ADX for real-time dashboards and long-term analytics.

Answer

Azure Blob Storage with Azure Data Lake Storage Gen2

Answer

Azure Cosmos DB with SQL API

Answer

Azure Table Storage

Question 16

A company deploys a web application in two Azure regions for high availability. They need to automatically direct users to the nearest healthy region based on geographic location and endpoint health. Which Azure service should they use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that directs users to the nearest healthy region based on geographic location and endpoint health. It uses DNS resolution to route traffic to the closest available endpoint, making it ideal for global high-availability scenarios where users need automatic failover across regions.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 17

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to automatically remove guest users who have not signed in for 60 days. Additionally, they must generate a report of all guest access for auditors. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Access Reviews. Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews that automatically remove guest users who have not signed in within a specified period (e.g., 60 days) by configuring the 'Inactive users (in days)' setting. Additionally, Access Reviews generate a detailed report of all guest access decisions, which can be exported for auditors, meeting both requirements directly.

Answer

Entitlement Management

Answer

Identity Protection

Answer

Terms of Use

Question 18

A company runs a critical application on Azure virtual machines in the West US region. They need a disaster recovery solution that replicates VMs to East US with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. They also need to perform non-disruptive disaster recovery drills. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions. It supports RPOs as low as 15 minutes (continuous replication with crash-consistent or app-consistent snapshots) and RTOs of 2 hours or less, and it enables non-disruptive disaster recovery drills via test failover that isolates replicated VMs in a separate virtual network without impacting production.

Answer

Azure Backup

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 19

A SaaS company uses Azure SQL Database for a multi-tenant application. They have 80 tenant databases, each with varying and unpredictable usage patterns. The company wants to optimize costs without sacrificing performance and wants the ability to easily add new tenant databases without over-provisioning. Which deployment option should they use?

Accepted Answer

Azure SQL Database elastic pool. Azure SQL Database elastic pool is the correct choice because it allows multiple tenant databases to share a fixed set of resources (DTUs or vCores), automatically absorbing the unpredictable usage spikes of individual tenants without over-provisioning. This model optimizes cost by paying for the pooled resources rather than each database's peak capacity, and new tenant databases can be added seamlessly to the pool without upfront resource allocation.

Answer

Single Azure SQL Database per tenant

Answer

Azure SQL Managed Instance

Answer

Azure SQL Database Hyperscale

Question 20

A company has an Azure virtual network (VNet) in the East US region hosting a web application. They need to securely connect to an on-premises data center in the same region using a dedicated, private network connection with high throughput and low latency. They also need a backup connection for redundancy in case the primary connection fails. Which connectivity solution should they implement?

Accepted Answer

ExpressRoute as primary with Site-to-Site VPN as backup. ExpressRoute provides a dedicated, private, high-throughput, low-latency connection to Azure, ideal for the primary link. A Site-to-Site VPN over the internet serves as a cost-effective, encrypted backup path that activates if the ExpressRoute circuit fails, meeting the redundancy requirement without relying on the same physical infrastructure.

Answer

Site-to-Site VPN only

Answer

ExpressRoute only

Answer

Azure Virtual WAN with VPN