AZ-305 practice questions and answers

Correct answer: A — Azure Files with an SMB share

Azure Files exposes SMB and NFS shares that operating systems can mount natively. Blob and Data Lake storage are object stores accessed over REST or their own drivers, and Queue Storage is a messaging service.

Correct answer: A — Azure Cache for Redis

An in-memory cache removes repeated reads from the database entirely and is the standard fit for session state. Adding databases to an elastic pool does not create a cache, Data Factory orchestrates data movement, and queues buffer messages.

Correct answer: A — Azure Firewall in the hub with user-defined routes forcing spoke egress through it

Central inspection requires both a firewall in the hub and user-defined routes that force spoke traffic through it, otherwise traffic takes the default internet path. Network security groups filter without inspecting, public IPs bypass the hub entirely, and peering alone does not redirect egress.

Correct answer: A — Azure SQL Database

Azure SQL Database is the fully managed PaaS relational service supporting T-SQL with platform-managed patching, backup, and availability. A SQL Server virtual machine leaves the operating system and engine to you, and the MySQL and MongoDB options are different query languages and engines.

Correct answer: A — A private endpoint for the storage account with public network access disabled

A private endpoint gives the storage account a private IP in the virtual network, and disabling public access ensures it cannot be reached any other way. An open firewall leaves it publicly reachable, a NAT gateway provides outbound internet access, and storage accounts do not take public IPs in that sense.

Correct answer: A, B — Active geo-replication to a secondary region · A failover group with automatic failover policy

Active geo-replication maintains a continuously replicated readable secondary and failover groups add automatic failover with a stable connection endpoint. Weekly backups and nightly exports give RPOs of days, and scaling up improves performance rather than recoverability.

Correct answer: A — Deploy across availability zones with a zone-redundant load balancer

Availability zones are physically separate datacentres within a region, so spreading instances across them with a zone-redundant front end survives the loss of one. Two instances in one zone share the same failure domain, a single virtual machine has no redundancy, and backups are recovery rather than availability.

Correct answer: A — Serve static assets from Azure Front Door or a CDN in front of blob storage

Caching static content at edge locations in front of object storage cuts latency for global users and removes that load from the origin. A single-region virtual machine gives poor global latency, embedding assets bloats deployments, and Service Bus is a messaging service.

Correct answer: A — Azure Bastion

Bastion provides browser-based RDP and SSH over TLS from the Azure portal with no public IP or open management port on the target virtual machines. A public jump box and an open RDP rule are the exposure being removed, and Front Door publishes HTTP applications.

Correct answer: A — An autoscale rule based on a custom metric for the queue length

Autoscale can evaluate a metric other than CPU, so a rule driven by queue length grows the fleet when backlog builds and shrinks it when the queue drains. Manual changes do not react to load, locks prevent modification, and a bigger fixed instance still has no elasticity.

Correct answer: A — Azure Cosmos DB

Cosmos DB is the globally distributed NoSQL database with turnkey multi-region writes and single-digit millisecond latency backed by SLA. Azure SQL is relational and does not offer multi-region writes in the same way, single-region Table storage is not globally distributed, and Azure Files is a file share.

Correct answer: A, B — A Log Analytics workspace · Diagnostic settings on each resource sending data to the workspace

The workspace is the query target and diagnostic settings are the mechanism that routes platform logs and metrics into it. Static website hosting, Service Bus, and Batch serve unrelated purposes.

Correct answer: A — An Azure Monitor metric alert rule with an action group

A metric alert evaluates the metric against a threshold over a window and an action group delivers the notification. Policy audits configuration, locks prevent changes, and retention settings only control how long data is kept.

Correct answer: A — A managed identity for the virtual machine with an appropriate Key Vault role assignment

A managed identity is issued and rotated by the platform, so the application authenticates with no secret to store or leak. A client secret in a config file is exactly the credential being removed, SAS tokens apply to storage, and using owner credentials is a severe privilege violation.

Correct answer: A — Immutable vaults and soft delete in the Recovery Services vault, with multi-user authorisation

Immutability, soft delete, and multi-user authorisation together stop a single compromised identity from destroying recovery points. Storing backups on the protected machine defeats the purpose, tags carry no enforcement, and more frequent backups do not prevent deletion.

Correct answer: A — Azure Compute Gallery

Azure Compute Gallery stores versioned virtual machine image definitions and replicates them across regions with sharing across subscriptions and tenants. Container Registry holds container images, Azure Artifacts holds software packages, and blob storage would require you to build all of this yourself.

Correct answer: A — A required tag for the application, enforced with Azure Policy, and cost analysis grouped by that tag

Tags applied consistently and enforced by policy let Cost Management group spend by application regardless of resource group boundaries. Subscription sprawl is a heavy structural change, manual review does not scale, and a tenant-wide budget gives no per-application breakdown.

Correct answer: A — Microsoft Entra Conditional Access with a named location condition

Conditional Access evaluates signals such as location and role at sign-in and can require MFA only when the conditions match. Azure Policy governs resource configuration, and network security groups and firewalls filter traffic rather than controlling authentication.

Correct answer: A — Azure Data Lake Storage Gen2

Data Lake Storage Gen2 adds a hierarchical namespace to blob storage, which is what makes directory operations efficient for analytics engines. Table Storage is a key-value store, Redis is an in-memory cache, and Azure Files is a general purpose file share.

Correct answer: A — Microsoft Entra External ID with B2B collaboration and guest invitations

B2B collaboration lets partners sign in with their own identity while access is governed by the host tenant, with no manual account provisioning. A shared account removes attribution, VPN access grants far more than the application, and anonymous publishing removes access control entirely.

Correct answer: A — Azure Policy with an allowed locations policy assigned at the management group

Azure Policy evaluates resource properties at creation and can deny anything outside the allowed regions, and assigning it at the management group covers all child subscriptions. RBAC controls who may act rather than what properties are allowed, locks prevent deletion, and alerts only notify.

Correct answer: A, B — Policy and RBAC assignments can be inherited by all child subscriptions · Governance can be applied consistently as new subscriptions are added

Management groups exist to make policy and role assignments inherit down the hierarchy so governance applies consistently, including to subscriptions added later. They do not affect pricing, they do not replace resource groups as a deployment boundary, and they provide no networking.

Correct answer: A, B — Blob versioning · Soft delete for blobs and containers

Versioning keeps prior versions when a blob is overwritten and soft delete retains deleted blobs for a retention period, so both accidents are recoverable. Static website hosting is a feature for serving content, firewall rules control network access, and LRS reduces redundancy rather than protecting against deletion.

Correct answer: A — Backup restores data from point-in-time copies, while Site Recovery replicates workloads for failover to another region

The two address different objectives: Backup protects against data loss and corruption with restorable copies, and Site Recovery keeps a warm replica for regional failover. Their roles are not reversed, they are complementary rather than redundant, and Site Recovery supports Azure virtual machines as well as on-premises workloads.

Correct answer: A — Azure Application Gateway with WAF

Application Gateway is the layer 7 load balancer with TLS termination, URL path routing, and an integrated WAF. Azure Load Balancer works at layer 4, Traffic Manager routes at the DNS layer, and Private Link exposes services privately rather than publishing them publicly.

Correct answer: A — Azure Virtual Machines

Full control over the operating system version and low-level agents requires infrastructure as a service, which is what virtual machines provide. App Service, Functions, and Container Apps are managed platforms that do not expose that level of the stack.

Correct answer: A — Read-access geo-redundant storage

RA-GRS replicates to a secondary region and exposes a read endpoint there, which is what survives a regional loss with read access. LRS keeps copies in one datacentre, ZRS spans zones within one region, and premium file storage is a performance tier rather than a redundancy option.

Correct answer: A — Azure Traffic Manager with priority routing and endpoint monitoring

Traffic Manager is a DNS-based global router that monitors endpoint health and directs clients to the highest priority healthy region. Internal load balancers distribute within a region, peering provides connectivity rather than routing decisions, and Bastion is a management access service.

Correct answer: A — Customer-managed keys in Azure Key Vault linked to the storage account

Customer-managed keys in Key Vault give control over rotation and revocation while the platform continues to encrypt at rest. Microsoft-managed keys offer no such control, base64 is an encoding rather than encryption, and SAS tokens grant access rather than encrypting data.

Correct answer: A, B — Whether the team needs fine-grained control over orchestration and networking · Whether the operational burden of running a cluster is acceptable

The real trade-off is control versus operational cost: AKS offers deep configurability but requires cluster operations, while App Service abstracts that away. Portal styling, resource group counts, and tenant names have no bearing on the decision.

Correct answer: A — Azure Service Bus queue with competing consumers

A queue absorbs the burst and lets consumers process at their own rate, which is the queue-based load levelling pattern. Scaling the front end does not protect the back end, extra addresses do not buffer work, and private DNS zones handle name resolution.

Correct answer: A — Regular test failovers in an isolated network, measuring actual RTO and RPO

Site Recovery test failover creates the recovery environment in an isolated network so the plan is exercised and timed without customer impact. Discussion and documentation produce no evidence, and destroying production is reckless rather than a test.

Correct answer: A, B — Configure the backup retention period to cover the required recovery window · Configure long-term retention policies for backups that must be kept for years

The retention period defines how far back point-in-time restore can reach, and long-term retention covers multi-year regulatory requirements. Automated backups cannot be disabled for Azure SQL Database and would be reckless to avoid, manual exports are unreliable, and ephemeral disks are not how the PaaS service stores data.

Correct answer: A — Azure Front Door with WAF policy

Front Door is the global entry point with edge presence, caching, WAF, and automatic origin failover across regions. Application Gateway is regional, Azure Load Balancer works at layer 4 within a region, and ExpressRoute is a private connectivity circuit.

Correct answer: A — Azure Policy with an allowed resource types definition, plus RBAC granting Contributor scoped to the resource group

Policy constrains what may be created and RBAC constrains where the team may create it, which together express the requirement technically. Owner plus documentation relies on goodwill, locks cannot target resources that do not exist yet, and budget alerts respond to cost rather than resource type.

Correct answer: A — Azure ExpressRoute

ExpressRoute provides a dedicated private circuit through a connectivity provider with predictable bandwidth and latency. Site-to-site and point-to-site VPNs ride the public internet, and Bastion is a managed jump host for RDP and SSH.

Correct answer: A — Microsoft Entra access reviews

Access reviews schedule recurring attestation campaigns and can automatically remove access that reviewers do not approve. Workbooks visualise telemetry, Advisor makes cost recommendations, and Resource Graph queries inventory without driving a review workflow.

Correct answer: A, B — Azure Functions on the Consumption plan triggered by a queue · Azure Container Apps with a scale rule that scales to zero

Consumption Functions and Container Apps scale rules both allow the workload to drop to zero instances so idle time costs nothing. Fixed scale sets, reserved App Service plans, and fixed AKS node pools all bill continuously.

Correct answer: A — A CanNotDelete resource lock on the resource group

A CanNotDelete lock blocks deletion regardless of role, which is exactly the accidental deletion protection required. Removing Contributor assignments does not stop owners, tags carry no enforcement, and an alert fires after the fact.

Correct answer: A — Archive access tier with a lifecycle management policy

The archive tier is the cheapest storage for rarely accessed data and its rehydration latency of hours is acceptable here, with lifecycle policies moving data there automatically. Hot and premium tiers are priced for frequent low-latency access, and cool is more expensive than archive for seven-year retention.

Correct answer: A — Azure Container Apps

Container Apps runs containerised microservices with built-in scaling, revisions, and service discovery without exposing a cluster to manage. AKS gives full Kubernetes control at the cost of managing it, virtual machine scale sets push all orchestration onto you, and Functions targets event-driven functions rather than long-running microservices.

Correct answer: A — Microsoft Entra Privileged Identity Management with eligible role assignments

PIM makes roles eligible rather than active, requiring activation with justification, optional approval, and time limits, and it records the whole flow. Permanent assignments leave standing privilege, shared accounts destroy attribution, and deny assignments block actions rather than granting time-bound access.

Correct answer: A — Zone-redundant storage

ZRS synchronously replicates across three availability zones in one region, which meets zone resilience without leaving the region. LRS keeps all copies in one datacentre, and both geo-redundant options replicate to a second region, which the requirement excludes.

Correct answer: A — Microsoft Defender for Cloud

Defender for Cloud provides secure score, recommendations, and regulatory compliance dashboards across subscriptions. Automation runs operational scripts, Site Recovery handles disaster recovery, and budgets track spend.

Correct answer: A — Azure Site Recovery replicating to a secondary region

Site Recovery replicates virtual machines continuously to another region and orchestrates failover, which is what meets a short RPO and RTO across regions. Daily backups give an RPO measured in a day, availability zones do not protect against regional loss, and Advisor makes recommendations without providing recovery.