10 free Microsoft AZ-305 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 286 questions. Work through them, then open each answer to check your reasoning.
Get all 286 questions (US$39) · Download these 10 as a PDF
Question 1
You have an Azure subscription that contains a custom application named Application1. Application1 was developed by an external company named Fabrikam, Ltd. Developers at Fabrikam were assigned role-based access control (RBAC) permissions to the Application1 components. All users are licensed for the Microsoft 365 E5 plan.
You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1. The solution must meet the following requirements:
• To the manager of the developers, send a monthly email message that lists the access permissions to Application1.
• If the manager does not verify an access permission, automatically revoke that permission.
• Minimize development effort.
What should you recommend?
Show answer and explanation
Correct answer: A. In Azure Active Directory (Azure AD), create an access review of Application1.
An access review in Azure AD is built for exactly this pattern. It can be scoped to the roles on Application1, set to recur monthly, and configured so the reviewer is the developers' manager, who receives the review notification by email with the list of assignments to confirm. Setting the action for reviewers who do not respond to remove access is what automatically revokes an unverified permission. All of it is configuration, so development effort is nil.
Why the other options are wrong
- B. Get-AzRoleAssignment lists role assignments, but the runbook would still have to build the email, track responses, and revoke access. That is the development effort the requirement rules out.
- C. Privileged Identity Management governs activation of privileged roles. A custom role assignment does not send a monthly attestation to a manager or revoke access when nobody answers.
- D. Get-AzureADUserAppRoleAssignment has the same problem as option B: it reads the data but leaves the entire review workflow to be written by hand.
Question 2
You have 100 servers that run Windows Server 2012 R2 and host Microsoft SQL Server 2014 instances. The instances host databases that have the following characteristics:
• Stored procedures are implemented by using CLR.
• The largest database is currently 3 TB. None of the databases will ever exceed 4 TB.
You plan to move all the data from SQL Server to Azure.
You need to recommend a service to host the databases. The solution must meet the following requirements:
• Whenever possible, minimize management overhead for the migrated databases.
• Ensure that users can authenticate by using Azure Active Directory (Azure AD) credentials.
• Minimize the number of database changes required to facilitate the migration.
What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Azure SQL Managed Instance
The databases use CLR stored procedures, which Azure SQL Database does not support, so a platform with near full SQL Server surface area is required. Azure SQL Managed Instance provides CLR integration, keeps the migration close to a lift and shift with minimal database changes, supports Azure AD authentication, and is still a managed service, so it beats running SQL Server on a virtual machine on management overhead. The 3 TB size sits inside its limits.
Why the other options are wrong
- A. Elastic pools are built on Azure SQL Database, which does not support CLR stored procedures.
- C. Single databases have the same CLR limitation and would force changes to the databases.
- D. SQL Server on a virtual machine would run the workload, but patching, backups, and high availability all become the customer's responsibility, which is the opposite of minimising management overhead.
Question 3
You have SQL Server on an Azure virtual machine. The databases are written to nightly as part of a batch process.
You need to recommend a disaster recovery solution for the data. The solution must meet the following requirements:
• Provide the ability to recover in the event of a regional outage.
• Support a recovery time objective (RTO) of 15 minutes.
• Support a recovery point objective (RPO) of 24 hours.
• Support automated recovery.
• Minimize costs.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure Site Recovery
Site Recovery replicates the whole virtual machine to a second region and can fail it over with an automated recovery plan, which covers the regional outage, the automation requirement, and an RTO well inside 15 minutes. Because the databases are only written nightly, the generous 24 hour RPO is easily met, and replication is far cheaper than running a second live SQL environment.
Why the other options are wrong
- A. An availability set protects against failures inside a single datacenter. It offers nothing when the whole region is lost.
- B. Azure Disk Backup takes disk snapshots. Restoring from them is a manual rebuild, so neither the RTO nor the automation requirement is met.
- C. An Always On availability group across regions would meet the objectives but requires a second running SQL environment plus cluster configuration, which costs more and adds administration the batch workload does not justify.
Question 4
You have an Azure subscription that contains a Basic Azure virtual WAN named VirtualWAN1 and the virtual hubs shown in the following table.
You have an ExpressRoute circuit in the US East Azure region.
You need to create an ExpressRoute association to VirtualWAN1.
What should you do first?
Show answer and explanation
Correct answer: A. Upgrade VirtualWAN1 to Standard.
ExpressRoute association is only available on a Standard virtual WAN. A Basic virtual WAN supports site-to-site VPN connections only, so the first step is to upgrade VirtualWAN1 to Standard before any ExpressRoute gateway or connection can be created in a hub.
Why the other options are wrong
- B. Creating a gateway on the hub is the next step, but it cannot be done while the virtual WAN is still Basic.
- C. The ExpressRoute premium add-on extends the circuit's reach and route limits. It is unrelated to the virtual WAN tier.
- D. Hubs already exist, and adding another does not lift the Basic tier restriction.
Question 5
Show the case study this question is based on
CASE STUDY
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study –
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs.
When you are ready to answer a question, click the Question button to return to the question.
Overview
Contoso, Ltd. is a research company that has a main office in Montreal.
Existing Environment
Technical Environment
The on-premises network contains a single Active Directory domain named contoso.com.
Contoso has a single Azure subscription.
Business Partnerships
Contoso has a business partnership with Fabrikam, Inc. Fabrikam users access some Contoso applications over the internet by using Azure Active
Directory (Azure AD) guest accounts.
Requirements
Planned Changes
Contoso plans to deploy two applications named App1 and App2 to Azure.
App1
App1 will be a Python web app hosted in Azure App Service that requires a Linux runtime. Users from Contoso and Fabrikam will access App1.
App1 will access several services that require third-party credentials and access strings. The credentials and access strings are stored in Azure
Key Vault.
App1 will have six instances: three in the East US Azure region and three in the West Europe Azure region.
App1 has the following data requirements:
Each instance will write data to a data store in the same availability zone as the instance.
Data written by any App1 instance must be visible to all App1 instances.
App1 will only be accessible from the internet. App1 has the following connection requirements:
Connections to App1 must pass through a web application firewall (WAF).
Connections to App1 must be active-active load balanced between instances.
All connections to App1 from North America must be directed to the East US region. All other connections must be directed to the West Europe region.
Every hour, you will run a maintenance task by invoking a PowerShell script that copies files from all the App1 instances. The PowerShell script will run from a central location.
App2
App2 will be a .NET app hosted in App Service that requires a Windows runtime. App2 has the following file storage requirements:
Save files to an Azure Storage account.
Replicate files to an on-premises location.
Ensure that on-premises clients can read the files over the LAN by using the SMB protocol.
You need to monitor App2 to analyze how long it takes to perform different transactions within the application. The solution must not require changes to the application code.
Application Development Requirements
Application developers will constantly develop new versions of App1 and App2. The development process must meet the following requirements:
A staging instance of a new application version must be deployed to the application host before the new version is used in production.
After testing the new version, the staging version of the application will replace the production version.
The switch to the new application version from staging to production must occur without any downtime of the application.
Identity Requirements
Contoso identifies the following requirements for managing Fabrikam access to resources:
Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests.
The solution must minimize development effort.
Security Requirement
All secrets used by Azure services must be stored in Azure Key Vault.
Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services.
You need to recommend a solution for the App1 maintenance task. The solution must minimize costs.
What should you include in the recommendation?
Show answer and explanation
Correct answer: B. an Azure function
The maintenance task runs a PowerShell script once an hour from a central location, and cost has to be minimised. An Azure function with a timer trigger fits exactly: PowerShell is a supported language, the schedule is part of the trigger, and on the Consumption plan it costs only for the seconds it runs each hour rather than for continuously provisioned compute.
Why the other options are wrong
- A. A logic app orchestrates connectors and cannot natively execute a PowerShell script. It would need a function anyway.
- C. A virtual machine would run the script but bills continuously for compute that is used for a few seconds an hour.
- D. A WebJob runs inside an App Service plan, so it is tied to App1's hosting rather than running from a central location, and it needs an Always On plan to be triggered reliably.
Question 6
Show the case study this question is based on
CASE STUDY
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study –
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs.
When you are ready to answer a question, click the Question button to return to the question.
Overview
Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main office in London and three branch offices in Amsterdam, Berlin, and Rome.
Existing Environment: Active Directory Environment
The network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com. There are no trust relationships between the forests.
Corp.fabrikam.com is a production forest that contains identities used for internal user and computer authentication.
Rd.fabrikam.com is used by the research and development (R&D) department only. The R&D department is restricted to using on-premises resources only.
Existing Environment: Network Infrastructure
Each office contains at least one domain controller from the corp.fabrikam.com domain. The main office contains all the domain controllers for the rd.fabrikam.com forest.
All the offices have a high-speed connection to the internet.
An existing application named WebApp1 is hosted in the data center of the London office. WebApp1 is used by customers to place and track orders. WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database tier that runs Microsoft SQL Server 2016.
The web tier and the database tier are deployed to virtual machines that run on Hyper-V.
The IT department currently uses a separate Hyper-V environment to test updates to WebApp1.
Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software Assurance.
Existing Environment: Problem Statements The use of WebApp1 is unpredictable. At peak times, users often report delays. At other times, many resources for WebApp1 are underutilized.
Requirements: Planned Changes
Fabrikam plans to move most of its production workloads to Azure during the next few years, including virtual machines that rely on Active Directory for authentication.
As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming Microsoft 365 deployment.
All R&D operations will remain on-premises.
Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.
Requirements: Technical Requirements
Fabrikam identifies the following technical requirements:
Website content must be easily updated from a single point.
User input must be minimized when provisioning new web app instances.
Whenever possible, existing on-premises licenses must be used to reduce cost.
Users must always authenticate by using their corp.fabrikam.com UPN identity.
Any new deployments to Azure must be redundant in case an Azure region fails.
Whenever possible, solutions must be deployed to Azure by using the Standard pricing tier of Azure App Service.
An email distribution group named IT Support must be notified of any issues relating to the directory synchronization services.
In the event that a link fails between Azure and the on-premises network, ensure that the virtual machines hosted in Azure can authenticate to Active Directory.
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not be affected by a link failure between Azure and the o-remises network.
Requirements: Database Requirements
Fabrikam identifies the following database requirements:
Database metrics for the production instance of WebApp1 must be available for analysis so that database administrators can optimize the performance settings.
To avoid disrupting customer access, database downtime must be minimized when databases are migrated.
Database backups must be retained for a minimum of seven years to meet compliance requirements.
Requirements: Security Requirements
Fabrikam identifies the following security requirements:
Company information including policies, templates, and data must be inaccessible to anyone outside the company.
Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an internet link fails.
Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com credentials.
All administrative access to the Azure portal must be secured by using multi-factor authentication (MFA).
The testing of WebApp1 updates must not be visible to anyone outside the company.
You need to recommend a data storage strategy for WebApp1.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. a vCore-based Azure SQL database
Two of the stated requirements decide this together. The technical requirements say that wherever possible the existing on-premises licences must be reused to reduce cost, and Fabrikam holds Software Assurance, so Azure Hybrid Benefit has to be applied. Azure Hybrid Benefit is only available under the vCore purchasing model, which rules out the DTU-based options immediately. A vCore-based Azure SQL database also scales its compute up and down to absorb the unpredictable peaks that are causing the delays, while remaining a managed service so there is no operating system to patch.
Why the other options are wrong
- A. SQL Server on a virtual machine would take the licence but hands back responsibility for the operating system, patching, backups, and high availability, which is more administration than the requirements accept.
- B. A fixed-size DTU database cannot use Azure Hybrid Benefit, since the benefit applies only to the vCore model, and a fixed size has to be provisioned for the peak.
- C. An elastic pool shares capacity between databases, but WebApp1 is a single workload, and the pool would still have to be purchased in the vCore model for the licence benefit to apply.
Question 7
You have an Azure subscription. The subscription has a blob container that contains multiple blobs.
Ten users in the finance department of your company plan to access the blobs during the month of April.
You need to recommend a solution to enable access to the blobs during the month of April only.
Which security solution should you include in the recommendation?
Show answer and explanation
Correct answer: A. shared access signatures (SAS)
A shared access signature grants access to blob resources for a defined window, with an explicit start and expiry time and a chosen set of permissions. Issuing SAS tokens valid only through April gives the ten finance users access for that month and nothing beyond it, with no change to the account keys.
Why the other options are wrong
- B. Conditional Access governs how an identity signs in, applying controls such as MFA or device state. It does not put an expiry on access to a blob.
- C. Certificates authenticate a client. They do not by themselves limit access to a container for a calendar month.
- D. Access keys grant full, permanent control of the whole storage account. They cannot be scoped to a time window or to specific blobs.
Question 8
You have an Azure subscription that contains a storage account.
An application sometimes writes duplicate files to the storage account.
You have a PowerShell script that identifies and deletes duplicate files in the storage account. Currently, the script is run manually after approval from the operations manager.
You need to recommend a serverless solution that performs the following actions:
• Runs the script once an hour to identify whether duplicate files exist
• Sends an email notification to the operations manager requesting approval to delete the duplicate files
• Processes an email response from the operations manager specifying whether the deletion was approved
• Runs the script if the deletion was approved
What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Azure Logic Apps and Azure Functions
Azure Logic Apps supplies the parts that involve waiting and approval: a recurrence trigger fires hourly, an approval email action sends the request to the operations manager and then waits for the reply, and a condition branches on the answer. Azure Functions is where the existing PowerShell script runs, called by the logic app both to detect duplicates and to delete them once approved. Both are serverless.
Why the other options are wrong
- A. Event Grid routes events as they occur. It provides neither an hourly schedule nor an approval wait.
- C. Azure Pipelines is a CI/CD system and Service Fabric is a microservices platform. Neither is a serverless approval workflow.
- D. Functions alone cannot wait days for an email reply, and Azure Batch is for larg-cale compute jobs.
Question 9
After you migrate App1 to Azure, you need to enforce the data modification requirements to meet the security and compliance requirements.
What should you do?
Show answer and explanation
Correct answer: A. Create an access policy for the blob service.
The data modification requirement is met at the blob service, by applying a policy to the container that governs how long data must remain and prevents it from being changed or deleted while that applies. Because the control is attached to the blob service itself it holds regardless of who connects or with what permissions.
Why the other options are wrong
- B. Resource locks stop the Azure resource being deleted or reconfigured. They do not stop the contents of a blob being modified.
- C. RBAC assignments decide who may perform operations. Anyone still authorised could modify the data.
- D. The access level controls whether the container is publicly readable, which is a different concern from preventing modification.
Question 10
You need to recommend a solution that meets the application development requirements.
What should you include in the recommendation?
Show answer and explanation
Correct answer: C. deployment slots
The requirement is to deploy a new version alongside the running one, test it, and then make it live with no downtime. App Service deployment slots do precisely this: the new version is deployed to a staging slot, tested there on its own hostname, and a swap exchanges staging and production. Because the swap redirects traffic after the new instances are already warm, users see no interruption.
Why the other options are wrong
- A. App Configuration centralises application settings and feature flags. It does not host or swap application versions.
- B. A container registry stores images, but App1 and App2 are App Service apps rather than containers, and a registry does not perform a zero-downtime cutover.
- D. CI/CD sources automate getting the build to the host. The zero-downtime switch itself is what slots provide.
That was 10 of 286.
The full Microsoft AZ-305 pack has all 286 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.