AZ-305 Multiple Select — 10 Questions

Question 1

Which TWO of the following Azure storage services support hosting static websites?

Accepted Answer

Azure Storage Account (general-purpose v2). Azure Storage Account (general-purpose v2) supports hosting static websites by enabling the 'Static website' feature, which configures a container named '$web' to serve static content (HTML, CSS, JS) directly via a public endpoint. This feature is built into the storage account's blob service and provides automatic routing for index and error documents, making it a cost-effective solution for static site hosting.

Answer

Azure Cosmos DB

Answer

Azure NetApp Files

Answer

Azure Files

Question 2

You are designing a solution to monitor and analyze security events across your Azure environment. Which TWO Azure services should you include in your design to provide centralized logging and threat detection? (Choose two.)

Accepted Answer

Azure Log Analytics. B is correct because Azure Log Analytics is the central repository for log data in Azure Monitor, enabling you to collect, correlate, and query security events from multiple sources using Kusto Query Language (KQL). C is correct because Microsoft Sentinel is a cloud-native SIEM and SOAR solution that ingests logs from Log Analytics and provides advanced threat detection, investigation, and automated response. Together, they form the foundation for centralized logging and threat detection in Azure.

Answer

Azure Firewall

Answer

Azure Policy

Answer

Azure Network Watcher

Question 3

Which TWO of the following are benefits of using Azure Policy? (Choose two.)

Accepted Answer

Assess compliance of resources against defined policies. Azure Policy is a service that enables you to create, assign, and manage policies that enforce rules and effects over your Azure resources. Option A is correct because one of its primary benefits is the ability to assess the compliance state of existing and newly deployed resources against defined policy definitions, providing a clear compliance dashboard and reports. This assessment is continuous and can be viewed at the subscription, management group, or resource group level.

Answer

Manage access control for resources

Answer

Create new Azure resources based on a template

Answer

Automatically remediate non-compliant resources without manual intervention

Question 4

A company is designing a backup strategy for Azure resources. They have the following resources: Azure VMs, Azure SQL Database, and Azure Files shares. They need to meet the following requirements: 1) Backup of VMs must be application-consistent. 2) SQL Database backups must be retained for 10 years. 3) Azure Files backups must support soft delete. Which THREE services or features should they use?

Accepted Answer

Azure Backup. Azure Backup is the correct service for VM backups because it supports application-consistent backups for Windows VMs via Volume Shadow Copy Service (VSS) and for Linux VMs via file-system-consistent snapshots with pre/post-scripts, ensuring that applications are in a consistent state at the time of backup. This directly meets requirement 1.

Answer

Azure Site Recovery

Answer

Azure Policy

Question 5

Which TWO actions should you take to ensure business continuity for an Azure SQL Managed Instance? (Choose two.)

Accepted Answer

Enable automated backups with a retention period that meets your RPO. Automated backups are a fundamental component of business continuity for Azure SQL Managed Instance. They provide point-in-time restore capabilities within a configurable retention period (7-35 days), directly supporting your Recovery Point Objective (RPO) by allowing you to restore to any point within that window. This ensures that data loss is minimized to the backup frequency, which is typically every 5-10 minutes for transaction log backups.

Answer

Use Azure Site Recovery to replicate the instance to another region

Answer

Configure a readable secondary replica in the same region

Answer

Enable long-term retention (LTR) for backups

Question 6

Which TWO options are valid methods to secure access to Azure Cosmos DB?

Accepted Answer

Azure RBAC roles. Azure RBAC roles (Option C) provide fine-grained, role-based access control to Azure Cosmos DB, allowing you to assign permissions to users, groups, or service principals for operations like read, write, or delete on specific resources. Primary and secondary keys (Option D) are the default authentication method, enabling full access to the Cosmos DB account for data plane operations, and are commonly used for application connections.

Answer

X.509 certificate-based authentication

Answer

Azure Storage account keys

Answer

Shared access signatures (SAS)

Question 7

Your organization uses Azure Monitor to collect metrics from Azure resources. You need to create a custom metric alert that triggers when the average CPU usage of a specific virtual machine exceeds 80% for 10 minutes. Which TWO components are required? (Choose two.)

Accepted Answer

Metric alert rule. A metric alert rule is required because it defines the condition (average CPU > 80%) and the evaluation frequency (every 1 minute over a 10-minute aggregation window) that triggers the alert. Without the rule, Azure Monitor has no logic to evaluate the metric data and fire the alert.

Answer

Automation runbook

Answer

Log Analytics workspace

Answer

Diagnostic setting

Question 8

Which THREE considerations are important when designing a storage solution for Azure Virtual Desktop (AVD) user profiles using FSLogix? (Choose three.)

Accepted Answer

Use Azure Files as the storage solution.. Azure Files is the recommended storage solution for FSLogix profile containers in AVD because it supports SMB protocol, which FSLogix requires for proper locking and concurrent access. It also integrates natively with Microsoft Entra ID for identity-based access control, eliminating the need for domain-joined storage. This ensures seamless user profile roaming across session hosts with minimal latency when deployed in the same region.

Answer

Use a public endpoint for profile storage.

Answer

Enable geo-redundant storage (GRS) for disaster recovery.

Question 9

Which TWO Microsoft Entra ID features should you use to protect against credential attacks?

Accepted Answer

Password Protection. Password Protection is correct because it specifically targets credential attacks by blocking weak passwords and common variations (e.g., 'Password123!') using a global banned password list and the option to add custom terms. Identity Protection is correct because it uses real-time risk detection (e.g., leaked credentials, anonymous IP addresses) to automatically block or require MFA for suspicious sign-ins, directly mitigating credential-based attacks like password spray or brute force.

Answer

Group-based licensing

Answer

Self-Service Password Reset (SSPR)

Answer

Application Proxy

Question 10

Your company is designing a hybrid network architecture that connects multiple on-premises sites to Azure. You need to ensure high availability and redundancy for the connection. Which TWO solutions should you recommend? (Choose two.)

Accepted Answer

Deploy two ExpressRoute circuits in active-passive mode. Deploying two ExpressRoute circuits in active-passive mode provides redundancy for the on-premises-to-Azure connection. If the primary circuit fails, traffic automatically fails over to the passive circuit, ensuring high availability. Option C is correct because an Azure VPN Gateway in active-active mode uses two active tunnels to provide redundancy and load balancing, which is essential for a highly available hybrid network.

Answer

Implement Azure DNS Private Resolver for resolution

Answer

Use a single VPN gateway with active-standby mode

Answer

Use a single ExpressRoute circuit with a VPN gateway as failover