AZ-305 Practice Test 8 — 10 Questions

Question 1

A company wants to back up their Azure VMs (running Windows and Linux) to a Recovery Services vault. The backup data must be encrypted at rest using customer-managed keys. They also need to retain monthly backups for 5 years for compliance. Which configuration should they use?

Accepted Answer

A. Option A is correct because Azure Backup supports encryption at rest using customer-managed keys (CMK) via Azure Disk Encryption or Azure Disk Encryption Set (DES) with a key vault. For long-term retention, the backup policy can be configured to retain monthly recovery points for up to 5 years, meeting compliance requirements. The Recovery Services vault stores encrypted backup data, and CMK ensures the customer controls the encryption keys.

Answer

B

Answer

C

Answer

D

Question 2

A company wants to migrate its on-premises file server to Azure with minimal application changes. The application accesses files over the SMB protocol and requires identity-based access using the existing on-premises Active Directory Domain Services (AD DS). They need the solution to be fully managed with low latency. Which Azure storage solution should they choose?

Accepted Answer

Azure Files. Azure Files is the correct choice because it provides fully managed SMB file shares that can be accessed over the SMB protocol with identity-based authentication using on-premises AD DS via Azure Files AD DS integration. This allows the application to connect with minimal changes, as it continues to use SMB and existing domain credentials, while Azure Files offers low-latency access when deployed in the same region as the application.

Answer

Azure NetApp Files

Answer

Azure Blob Storage with NFS 3.0

Answer

Azure Disk Storage

Question 3

A financial services company runs a critical SQL Server database on Azure Virtual Machines. They require a disaster recovery solution with an RPO of less than 15 seconds and an RTO of less than 1 hour. Which technology should they implement?

Accepted Answer

SQL Server Always On Availability Groups. SQL Server Always On Availability Groups provide synchronous data replication at the database level, enabling an RPO of less than 15 seconds by committing transactions on both primary and secondary replicas simultaneously. With automatic failover and a secondary replica in a different Azure region, the RTO can be under 1 hour, meeting the critical requirements for a SQL Server workload on Azure VMs.

Answer

Azure Site Recovery

Answer

Azure Backup for SQL Server

Answer

Geo-redundant backups

Question 4

A global e-commerce company runs a product catalog application that requires low-latency reads and writes from multiple geographic regions. The data is key-value structured and must be replicated with multi-region write capability. The company needs a fully managed NoSQL database service with guaranteed 99th percentile latency and automatic conflict resolution. Which Azure data service should they choose?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it is a fully managed NoSQL database that supports multi-region writes with automatic conflict resolution, guarantees 99th percentile latency, and provides low-latency reads and writes globally. Its multi-master replication and tunable consistency models meet the key-value structured data requirements and the need for high availability across geographic regions.

Answer

Azure Table Storage

Answer

Azure Redis Cache

Answer

Azure SQL Database

Question 5

A company wants to monitor sign-in failures for their Microsoft Entra ID-integrated applications. They need a dashboard in Azure Monitor showing sign-in failures by application and user location. Which data source should they stream to a Log Analytics workspace?

Accepted Answer

Microsoft Entra ID Sign-in logs. Microsoft Entra ID Sign-in logs contain detailed information about every sign-in attempt, including success or failure status, application name, user location (IP address), and failure reasons. Streaming these logs to a Log Analytics workspace enables you to build custom dashboards in Azure Monitor that visualize sign-in failures by application and user location. Audit logs track configuration changes, not authentication events; Provisioning logs cover user/group synchronization; and Office 365 Activity logs focus on workload-specific actions, not general sign-in failures.

Answer

Microsoft Entra ID Audit logs

Answer

Microsoft Entra ID Provisioning logs

Answer

Office 365 Activity logs

Question 6

A globally distributed application requires multi-region writes to a NoSQL database and must tolerate regional write outages. Which Azure service capability should be selected?

Accepted Answer

Azure Cosmos DB multi-region writes. Azure Cosmos DB multi-region writes is the correct choice because it provides active-active replication across multiple Azure regions, enabling writes to be accepted in any configured region and automatically replicated. This design ensures that if one region experiences a write outage, the application can continue writing to other regions without interruption, meeting the requirement for multi-region writes and regional write outage tolerance.

Answer

Azure Table Storage RA-GRS

Answer

Azure SQL Database serverless only

Answer

Azure Files geo-redundant storage

Question 7

A multinational company stores large amounts of unstructured data (documents, images) that must be read with low latency from multiple global regions. Data is written primarily in one region but read globally. Cost optimization is a key requirement. Which Azure storage replication option should they use?

Accepted Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS). B is correct because RA-GRS provides geo-redundant storage with read access to the secondary region, enabling low-latency reads from multiple global regions while maintaining cost efficiency. The data is written primarily in one region, but RA-GRS allows read requests to be served from the secondary region without additional compute costs, meeting the global read requirement.

Answer

Azure Blob Storage with geo-redundant storage (GRS)

Answer

Azure Files with premium shares

Answer

Azure NetApp Files

Question 8

A SaaS application must allow external partner users to sign in with their own organization credentials while the company controls application access. What should be used?

Accepted Answer

Microsoft Entra External ID/B2B collaboration with Conditional Access. Microsoft Entra External ID (formerly Azure AD B2B) enables external partner users to sign in using their own organization's credentials (their existing Azure AD or Microsoft account) while the company retains control over application access. By combining B2B collaboration with Conditional Access policies, the company can enforce MFA, device compliance, or location-based controls on guest users without managing their identities or passwords.

Answer

Create local cloud-only accounts for every partner user

Answer

Share one account per partner company

Answer

Use Azure DNS private zones

Question 9

A company stores terabytes of archival data that must be retained for 10 years per regulatory requirements. The data is accessed infrequently (once or twice per year) and retrieval latency of up to 5 hours is acceptable. The company wants the lowest storage cost. They also need to ensure data is encrypted at rest and immutability to prevent deletion or modification during the retention period. Which Azure storage solution should they choose?

Accepted Answer

Azure Blob Storage with Archive tier and immutability policy (time-based retention). Option C is correct because Azure Blob Storage's Archive tier offers the lowest storage cost for infrequently accessed data, and the immutability policy with time-based retention provides WORM (Write Once, Read Many) compliance to prevent deletion or modification for the required 10-year period. The 5-hour retrieval latency is acceptable for archival data accessed once or twice per year, and encryption at rest is automatically enabled for all Azure Blob Storage tiers.

Answer

Azure Blob Storage with Hot tier and lifecycle management to Archive tier with WORM policy

Answer

Azure Blob Storage with Cool tier and lifecycle management to Archive tier with legal hold

Answer

Azure Files with premium tier and soft delete

Question 10

You need to provide a team of developers with access to create and manage Azure resources in a specific resource group. The developers should not be able to modify access policies for other users. Which built-in role should you assign?

Accepted Answer

Contributor. The Contributor role allows full management of resources but cannot manage access (role assignments). Owner can manage access. Reader is read-only. User Access Administrator only manages access, not resources.

Answer

Owner

Answer

Reader

Answer

User Access Administrator