AZ-305 Practice Exam 54 — 20 Questions

Question 1

Your company is migrating on-premises applications to Azure. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without duplicating accounts. Which identity solution should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct solution because it synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to sign in with their existing credentials via password hash synchronization, pass-through authentication, or federation. This avoids duplicating accounts by maintaining a single identity source of truth, with optional seamless single sign-on (SSO) for a transparent experience.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra External ID

Answer

Microsoft Entra Domain Services

Question 2

A company has an on-premises data center and wants to connect it to Azure with a dedicated, private network connection that is not routed over the public internet. They also need a higher service-level agreement (SLA) compared to VPN-based connections. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that bypasses the public internet, ensuring lower latency, higher reliability, and a 99.95% SLA (for dedicated circuits) compared to VPN-based connections. This meets the requirement for a private network connection with a higher SLA than VPN Gateway, which relies on internet-based IPSec tunnels with a 99.9% SLA.

Answer

Azure VPN Gateway

Answer

Azure Bastion

Answer

Azure Virtual WAN

Question 3

You need to configure a monitoring solution for Azure virtual machines that collects performance counters, event logs, and enables alerting based on CPU usage exceeding 90%. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a unified platform for collecting performance counters and event logs from Azure VMs via the Log Analytics agent or Azure Monitor Agent, and it supports metric-based alert rules that can trigger when CPU usage exceeds a defined threshold (e.g., 90%). This directly meets the requirements for monitoring, log collection, and alerting without additional services.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Update Manager

Question 4

Refer to the exhibit. A custom role is created. A user assigned this role reports being unable to view the VM's boot diagnostics in the Azure portal. What is the most likely reason?

Accepted Answer

The role lacks permissions to the diagnostics storage account. Boot diagnostics in Azure require access to a storage account where the serial console output and screenshots are stored. Even if the user has Microsoft.Compute/virtualMachines/read permission on the VM, they must also have the appropriate role (e.g., Storage Blob Data Reader) on the diagnostics storage account to read the boot diagnostics data. Without this, the portal will show an error or blank boot diagnostics pane.

Answer

The user does not have permission to start or restart the VM

Answer

The VM is stopped and deallocated

Answer

The role does not include Microsoft.Compute/virtualMachines/read

Question 5

Which THREE conditions should be met to implement a successful Azure landing zone for a new enterprise subscription? (Choose three.)

Accepted Answer

A management group hierarchy that separates environments.. A management group hierarchy that separates environments (e.g., production, non-production, and management) is a core design principle of an Azure landing zone. It enables policy inheritance, role-based access control (RBAC) isolation, and cost tracking across different workloads, aligning with the Cloud Adoption Framework's governance best practices.

Answer

A dedicated Azure Active Directory tenant.

Answer

Microsoft Sentinel enabled for security monitoring.

Question 6

You need to design a network topology for a global e-commerce platform on Azure. The solution must provide low-latency access to static content and protect the backend APIs from DDoS attacks. The backend APIs are deployed in multiple regions behind an internal load balancer. Which services should you use?

Accepted Answer

Azure Front Door with WAF and Azure API Management.. Azure Front Door with WAF provides global load balancing and low-latency access to static content via its anycast-based routing, while the integrated Web Application Firewall (WAF) protects backend APIs from DDoS and application-layer attacks. Azure API Management secures and manages the backend APIs, offering policies for throttling, authentication, and transformation. This combination meets the requirements for global low-latency content delivery and DDoS protection for multi-region backend APIs.

Answer

Azure Traffic Manager and Azure Firewall.

Answer

Azure Content Delivery Network (CDN) and Azure Load Balancer.

Answer

Azure Application Gateway with WAF and Azure API Management.

Question 7

A company wants to deploy containerized microservices on Azure without managing virtual machines. The solution must support automatic scaling based on demand, built-in load balancing, rolling updates for zero-downtime deployments, and a fully managed platform. Which Azure compute service should they choose?

Accepted Answer

Azure Container Apps. Azure Container Apps is the correct choice because it provides a fully managed, serverless platform for running containerized microservices without managing virtual machines. It supports automatic scaling based on HTTP traffic or events, built-in load balancing via Envoy, and rolling updates with revision management to ensure zero-downtime deployments. This aligns perfectly with the requirement for a fully managed platform that abstracts away infrastructure.

Answer

Azure Container Instances

Answer

Azure Batch

Answer

Azure Functions

Question 8

A company backs up their Azure VMs using Azure Backup. They need to meet compliance that requires backups to be stored in a separate geographic region. Additionally, they want to be able to restore the entire VM to that secondary region in case of a regional disaster. What should they configure?

Accepted Answer

Use a Recovery Services vault with Geo-Redundant Storage (GRS) and enable cross-region restore. Azure Backup with a Recovery Services vault using Geo-Redundant Storage (GRS) replicates backup data to a paired secondary region, meeting the compliance requirement for geographic separation. Enabling cross-region restore allows the entire VM to be restored in that secondary region during a regional disaster, as the backup data is already available there.

Answer

Use a Recovery Services vault with Locally Redundant Storage (LRS) and enable cross-region restore

Answer

Use Azure Site Recovery to replicate the entire VM to the secondary region

Answer

Manually copy backup snapshots to a storage account in the secondary region

Question 9

A company is designing an Azure Kubernetes Service (AKS) cluster for a microservices application. They need to ensure that pods can securely access Azure resources such as Azure Key Vault and Azure SQL Database without using service principals or connection strings. Which AKS feature should they enable?

Accepted Answer

Microsoft Entra Workload ID. Microsoft Entra Workload ID (formerly Azure AD Workload Identity) enables pods in AKS to authenticate to Azure resources like Key Vault and Azure SQL Database using federated identity credentials, eliminating the need for service principals or connection strings. It works by projecting an Entra ID-managed identity into the pod via a sidecar or mutating webhook, allowing the pod to obtain tokens directly from the Microsoft identity platform.

Answer

Azure RBAC for Kubernetes authorization

Answer

Azure Policy for AKS

Answer

Azure CNI network plugin

Question 10

A company stores sensitive customer data in Azure Blob Storage. They need to ensure that data at rest is encrypted using a customer-managed key stored in Azure Key Vault. Which of the following should they use?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys in Azure Key Vault. Azure Storage Service Encryption (SSE) encrypts data at rest in Azure Blob Storage. When configured with customer-managed keys (CMK) stored in Azure Key Vault, the customer controls the encryption key lifecycle, including rotation and revocation, meeting the requirement for customer-managed key control. This is the only option that directly applies to Blob Storage data at rest with CMK support.

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption with Microsoft-managed keys

Answer

Azure Information Protection

Question 11

Your organization uses Azure Monitor Logs to analyze application performance. You need to create a custom log query that calculates the 95th percentile of response times for a web app over the last 24 hours. Which THREE KQL functions should you use? (Choose three.)

Accepted Answer

percentile. Option A, percentile, is correct because it is the KQL aggregation function that computes the 95th percentile value of a numeric column such as response time. Option B, summarize, is correct because percentile must be invoked inside a summarize operator to group and aggregate the data over the desired window. Option E, where, is correct because it filters the dataset to the last 24 hours (for example, where TimeGenerated > ago(24h)) before aggregation. Option C, project, is not required since it only selects or renames columns and does not perform percentile calculation. Option D, sort, is not required because ordering rows does not contribute to computing a percentile aggregate.

Answer

project

Answer

sort

Question 12

Which TWO are benefits of using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Automate the deprovisioning of user accounts when an employee leaves the organization. Option A is correct because Microsoft Entra ID Governance includes lifecycle workflows that automate the joiner-mover-leaver process, including automatically disabling or deleting user accounts and revoking access when an employee leaves the organization. Option B is correct because entitlement management is a core capability of Entra ID Governance, providing access packages, catalogs, and approval-based access request workflows so users can request and be granted time-bound access. Option C is not correct because just-in-time privileged access to Azure resources is delivered by Microsoft Entra Privileged Identity Management (PIM), which is a separate product from Entra ID Governance. Option D is not correct because single sign-on to SaaS applications is a core Microsoft Entra ID feature (via SAML/OIDC enterprise applications), not a specific benefit of Entra ID Governance. Option E is not correct because VPN connectivity for remote users is provided by Azure VPN Gateway or similar networking services, not by Entra ID Governance.

Answer

Enable just-in-time privileged access to Azure resources

Answer

Provide single sign-on to all SaaS applications

Answer

Provide VPN connectivity for remote users

Question 13

A company wants to store log data from multiple applications for up to 30 days for analysis. The data is append-only, and queries are infrequent but need to be fast when run. Which Azure data storage solution should you recommend?

Accepted Answer

Azure Log Analytics Workspace. Azure Log Analytics Workspace is the correct choice because it is purpose-built for ingesting, storing, and querying log data from multiple sources. It supports append-only log ingestion, retains data for up to 30 days in its interactive retention tier (configurable), and provides fast Kusto Query Language (KQL) queries for infrequent analysis. The workspace integrates natively with Azure Monitor and other services, making it ideal for centralized log analysis.

Answer

Azure Table Storage

Answer

Azure Data Lake Storage Gen2

Answer

Azure Blob Storage (archive tier)

Question 14

A company runs a critical line-of-business application on 10 Azure VMs. They need a disaster recovery solution that replicates the VMs to a secondary region with a recovery point objective (RPO) of 30 minutes and a recovery time objective (RTO) of 1 hour. The solution must support non-disruptive testing of failover for quarterly compliance drills. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs to a secondary region, meeting the RPO of 30 minutes (continuous replication with 30-second RPO) and RTO of 1 hour (orchestrated recovery). It supports non-disruptive test failovers via isolated networks, which is essential for quarterly compliance drills without impacting production.

Answer

Azure Backup

Answer

Azure Migrate

Answer

Manual VM replication to secondary region

Question 15

Which THREE of the following are valid strategies for designing a disaster recovery plan for Azure Virtual Desktop? (Choose three.)

Accepted Answer

Use Azure File Sync to replicate FSLogix profile shares to a secondary region. Option B is correct because Azure File Sync can replicate the SMB file shares that host FSLogix profile containers and Office container VHDX files to a secondary region, giving users access to their profiles during a regional failover. Option C is correct because pre-deploying a secondary host pool in the DR region and using Azure Traffic Manager (or a similar global load balancer) to redirect user connections is a standard AVD multi-region DR pattern that reduces recovery time. Option E is correct because Azure Site Recovery can continuously replicate session host VMs to a secondary region so they can be failed over and brought online as replacement session hosts during a disaster. Option A is not valid because Azure Front Door does not proxy RDP traffic (TCP 3389); it is an HTTP/HTTPS layer-7 service, and AVD clients connect to the gateway/broker, not through Front Door. Option D is not a valid DR strategy because Azure Backup restores data and VMs but does not provide the low-RTO regional failover or the AVD control-plane/broker redirection needed for a disaster recovery plan.

Answer

Use Azure Front Door to route RDP traffic to the secondary region

Answer

Rely on Azure Backup to restore session hosts in the secondary region

Question 16

A company is planning to migrate on-premises SQL Server databases to Azure. They want to minimize administrative overhead and ensure high availability with automatic failover. Which TWO Azure SQL deployment options should they consider?

Accepted Answer

Azure SQL Database (single database). Azure SQL Database (single database) is correct because it is a fully managed PaaS offering where Microsoft handles patching, backups, and infrastructure, and it supports built-in high availability with automatic failover via the underlying service tier architecture. Azure SQL Database Managed Instance is also correct because it provides near-100% SQL Server compatibility as a PaaS service, reducing administrative overhead while including built-in high availability and automatic failover through Always On availability groups managed by the platform. SQL Server on Azure VMs is not appropriate here because it is IaaS, requiring the customer to manage OS patching, SQL updates, and configure their own Always On availability groups for failover. SQL Server Stretch Database is a deprecated feature for archiving cold data to Azure, not a migration target for high availability. Azure Synapse Analytics is an analytics/data warehousing service, not a transactional SQL Server database migration option.

Answer

SQL Server on Azure VMs

Answer

SQL Server Stretch Database

Answer

Azure Synapse Analytics

Question 17

A company uses Microsoft Entra ID. They want to automatically detect sign-ins from anonymous IP addresses, sign-ins from unfamiliar locations, and other risky activities. When such a risk is detected, they want to block the sign-in or require multi-factor authentication. They also need a dashboard to review risk events. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to detect and respond to identity-based risks such as sign-ins from anonymous IP addresses, unfamiliar locations, and other risky activities. It provides a risk-based conditional access policy that can automatically block sign-ins or require multi-factor authentication (MFA) when a risk is detected, and it includes a dashboard for reviewing risk events and reports.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Access Reviews

Question 18

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution to monitor changes to privileged groups in both directories and ensure that any unauthorized changes trigger an automated response. Which THREE services should you include in the design?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel (A) is correct because it is the cloud-native SIEM/SOAR platform that ingests audit and directory logs from both Microsoft Entra ID and on-premises Active Directory (via connectors and agents), correlates privileged group change events, and uses analytics rules plus playbooks (Logic Apps) to trigger automated responses such as disabling accounts or notifying admins. Microsoft Entra Identity Protection (C) is correct because it detects risky sign-ins and risky users, including risk detections tied to privileged account compromise, and can feed those signals into Conditional Access or Sentinel so that unauthorized privileged activity is flagged and remediated automatically. Microsoft Defender for Identity (E) is correct because it monitors on-premises Active Directory Domain Services traffic and events (e.g., via the sensor on domain controllers) to detect suspicious changes to privileged groups such as Domain Admins, and it forwards alerts to Defender XDR/Sentinel for automated response. Microsoft Purview (B) is not included because it focuses on data governance, compliance, and information protection rather than real-time monitoring and automated response to directory privilege changes. Group Policy Management Console (D) is not included because it is an administrative tool for creating and managing GPOs, not a monitoring or automated-response service for privileged group modifications.

Answer

Microsoft Purview

Answer

Group Policy Management Console

Question 19

A company has several Azure Virtual Machines running Windows Server with critical applications. They need to back up these VMs to a secondary Azure region to protect against regional disasters. The backup must be application-consistent and support file-level restore. Which solution should they implement?

Accepted Answer

Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault. Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault is the correct solution because it provides application-consistent backups of Windows Server VMs using the Volume Shadow Copy Service (VSS) to ensure data integrity, and it supports file-level restore by allowing you to mount the backup as a drive to recover individual files. The GRS option replicates backup data to a paired secondary region, meeting the disaster recovery requirement without additional manual steps.

Answer

Azure Site Recovery

Answer

Azure Snapshot of managed disks stored in a different region

Answer

Azure Managed Disk with incremental snapshots and manual cross-region copy

Question 20

Refer to the exhibit. A KQL query is run against Azure Storage logs. The result shows a high number of 404 errors for 'GetBlob' operations. What is the most likely cause?

Accepted Answer

The blobs being requested do not exist. A 404 (Not Found) error for 'GetBlob' operations in Azure Storage logs specifically indicates that the requested blob resource does not exist at the specified URI. This is distinct from authorization failures (which return 403) or throttling (which returns 503). The high number of 404 errors suggests the client is attempting to retrieve blobs that have been deleted, never created, or are referenced with an incorrect path.

Answer

The client does not have permission to access the blobs

Answer

The storage account is throttling requests

Answer

The client is using an incorrect authentication method