90 free Microsoft AZ-305 practice questions from the CertStash pack of 382, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 90 free here, all 382 in the pack, and each step includes the one before it.
Get all 382 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
You have an Azure subscription that contains a custom application named Application1. Application1 was developed by an external company named Fabrikam, Ltd. Developers at Fabrikam were assigned role-based access control (RBAC) permissions to the Application1 components. All users are licensed for the Microsoft 365 E5 plan.
You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1. The solution must meet the following requirements:
• To the manager of the developers, send a monthly email message that lists the access permissions to Application1.
• If the manager does not verify an access permission, automatically revoke that permission.
• Minimize development effort.
What should you recommend?
Show answer and explanation
Correct answer: A. In Azure Active Directory (Azure AD), create an access review of Application1.
An access review in Azure AD is built for exactly this pattern. It can be scoped to the roles on Application1, set to recur monthly, and configured so the reviewer is the developers' manager, who receives the review notification by email with the list of assignments to confirm. Setting the action for reviewers who do not respond to remove access is what automatically revokes an unverified permission. All of it is configuration, so development effort is nil.
Why the other options are wrong
- B. Get-AzRoleAssignment lists role assignments, but the runbook would still have to build the email, track responses, and revoke access. That is the development effort the requirement rules out.
- C. Privileged Identity Management governs activation of privileged roles. A custom role assignment does not send a monthly attestation to a manager or revoke access when nobody answers.
- D. Get-AzureADUserAppRoleAssignment has the same problem as option B: it reads the data but leaves the entire review workflow to be written by hand.
Question 2
You have an Azure subscription. The subscription has a blob container that contains multiple blobs.
Ten users in the finance department of your company plan to access the blobs during the month of April.
You need to recommend a solution to enable access to the blobs during the month of April only.
Which security solution should you include in the recommendation?
Show answer and explanation
Correct answer: A. shared access signatures (SAS)
A shared access signature grants access to blob resources for a defined window, with an explicit start and expiry time and a chosen set of permissions. Issuing SAS tokens valid only through April gives the ten finance users access for that month and nothing beyond it, with no change to the account keys.
Why the other options are wrong
- B. Conditional Access governs how an identity signs in, applying controls such as MFA or device state. It does not put an expiry on access to a blob.
- C. Certificates authenticate a client. They do not by themselves limit access to a container for a calendar month.
- D. Access keys grant full, permanent control of the whole storage account. They cannot be scoped to a time window or to specific blobs.
Question 3
You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain.
You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication.
Some users work remotely and do NOT have VPN access to the on-premises network.
You need to provide the remote users with single sign-on (SSO) access to WebApp1.
Which two features should you include in the solution? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, E. Azure AD Application Proxy; Azure AD enterprise applications
Azure AD Application Proxy publishes an internal web app to the internet through an outbound connector, so remote users reach WebApp1 without a VPN, and it supports Kerberos constrained delegation so Integrated Windows authentication still works and single sign-on is preserved. The published app appears in the tenant as an Azure AD enterprise application, which is where the assignment, SSO configuration, and policy for it live. Both pieces are needed.
Why the other options are wrong
- B. Privileged Identity Management provides just-in-time activation of privileged roles. It plays no part in publishing an internal web app.
- C. Conditional Access can add controls once the app is published, but on its own it creates no path to an on-premises app.
- D. Azure Arc projects servers and Kubernetes clusters into Azure for management. It does not publish a web app for remote access.
- F. Azure Application Gateway is a regional layer 7 load balancer inside a virtual network. Reaching an on-premises app through it would still require network connectivity that the remote users do not have.
Question 4
You have an Azure Active Directory (Azure AD) tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned membership. Group1 has 50 members, including 20 guest users.
You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements:
• The evaluation must be repeated automatically every three months.
• Every member must be able to report whether they need to be in Group1.
• Users who report that they do not need to be in Group1 must be removed from Group1 automatically.
• Users who do not report whether they need to be in Group1 must be removed from Group1 automatically.
What should you include in the recommendation?
Show answer and explanation
Correct answer: C. Create an access review.
Every requirement here maps to a setting on an Azure AD access review. The review can be scheduled to recur quarterly, the reviewers can be the members themselves so each person attests to their own membership, and the action applied to denied results removes the user from the group. Setting the behaviour for reviewers who do not respond to remove access covers the users who never answer.
Why the other options are wrong
- A. Identity Protection scores sign-in and user risk. It has no concept of membership attestation.
- B. A dynamic group recalculates membership from user attributes. Nobody is asked whether they still need to be in the group, which is the core requirement.
- D. Privileged Identity Management manages just-in-time elevation into privileged roles, not recurring attestation of an ordinary security group.
Question 5
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.
Several virtual machines exhibit network connectivity issues.
You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.
Solution: Use Azure Traffic Analytics in Azure Network Watcher to analyze the network traffic.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The answer is no. Traffic Analytics processes NSG flow logs to give an aggregated picture of traffic patterns, top talkers, and hotspots across the environment. That is a summarised, delayed view for capacity and security analysis, not a way to determine whether a particular packet to a particular virtual machine is being allowed or denied.
Why the other options are wrong
- A. Answering yes assumes Traffic Analytics reports per-flow allow and deny decisions on demand. It aggregates flow logs rather than evaluating the effective rules for a specific flow.
Question 6
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.
Several virtual machines exhibit network connectivity issues.
You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.
Solution: Use Azure Advisor to analyze the network traffic.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The answer is no. Azure Advisor produces recommendations across cost, security, reliability, operational excellence, and performance. It never inspects network traffic and cannot say whether packets reaching a virtual machine are permitted or blocked.
Why the other options are wrong
- A. Answering yes treats Advisor as a diagnostic tool. It is a recommendation engine and has no traffic data at all.
Question 7
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.
Several virtual machines exhibit network connectivity issues.
You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.
Solution: Use Azure Network Watcher to run IP flow verify to analyze the network traffic.
Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
The answer is yes. IP flow verify in Azure Network Watcher takes a virtual machine, a direction, a protocol, and a local and remote address and port, then evaluates the effective network security group rules for that flow. It returns allowed or denied and names the rule responsible, which is precisely the question being asked.
Why the other options are wrong
- B. Answering no would mean Network Watcher cannot evaluate a specific flow against the applied rules, which is exactly what IP flow verify was built to do.
Question 8
You are designing a large Azure environment that will contain many subscriptions.
You plan to use Azure Policy as part of a governance solution.
To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: C, E, F. subscriptions; resource groups; management groups
Azure Policy assignments follow the Azure Resource Manager hierarchy, so a definition can be assigned at a management group, a subscription, or a resource group, and it then applies to everything beneath that scope. Those three are the assignable scopes.
Why the other options are wrong
- A. Administrative units are an Azure AD construct for delegating user and group administration. They sit outside the resource hierarchy that Azure Policy governs.
- B. An Azure AD tenant is the identity boundary. Policy is assigned to resource scopes, with the management group as the highest one.
- D. An individual compute resource is the target of a policy evaluation, not a scope an assignment is made at.
Question 9
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Azure Activity Log
Every resource deployment through Azure Resource Manager is recorded as a control plane event in the Azure Activity Log, including what was created, by whom, and when. Querying or exporting the Activity Log for write operations over the past month is what produces the report, and it needs nothing to be instrumented in advance.
Why the other options are wrong
- B. Azure Advisor issues recommendations about existing resources. It does not record deployment events.
- C. Azure Analysis Services is an analytical data modelling service. It has no knowledge of subscription activity.
- D. Action groups define who gets notified when an alert fires. They are a notification target, not a source of deployment history.
Question 10
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.
Several virtual machines exhibit network connectivity issues.
You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.
Solution: Install and configure the Azure Monitoring agent and the Dependency Agent on all the virtual machines. Use VM insights in Azure Monitor to analyze the network traffic.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The answer is no. VM insights with the Azure Monitor agent and the Dependency agent maps process-level dependencies and connections between machines, and reports performance. It shows which machines talk to which, but it does not evaluate network security group rules or report whether a packet was allowed or denied.
Why the other options are wrong
- A. Answering yes confuses dependency mapping with rule evaluation. VM insights shows observed connections rather than the allow or deny decision applied to them.
What people say about the full AZ-305 pack 4.8 from 13
I used these dumps to prep for the AZ-305, and they were fantastic. The questions were almost identical to what I saw on the actual exam, and the explanations helped clear up any confusion I had. Passed easily!
I passed the AZ-305 exam with 850 marks with the help of Certstash dumps.
Recommend for AZ-305 prep.
Question 11
You have multiple Azure subscriptions.
You need to ensure that you are notified of planned maintenance in your Azure region if the maintenance will affect the resources in the subscriptions. The solution must minimize administrative effort.
What should you use?
Show answer and explanation
Correct answer: D. Azure Service Health
Azure Service Health gives a personalized view of service issues, planned maintenance, and health advisories that affect the resources and regions you actually use. You can create Service Health alerts for the planned maintenance event type, scoped to the relevant subscriptions, regions, and services, and route them through action groups to email, SMS, push notifications, or webhooks. Because Service Health already filters events to your own resources and alerts are configured once per subscription with no custom queries or code, it meets the requirement with the least administrative effort.
Why the other options are wrong
- A. Azure Monitor provides metrics, logs, and alerting for resource telemetry, but planned maintenance events are surfaced through Service Health rather than through general Azure Monitor configuration.
- B. Defender for Cloud assesses security posture and detects threats; it does not announce planned platform maintenance.
- C. Azure Advisor gives best-practice recommendations for cost, reliability, security, and performance, not notifications of upcoming regional maintenance.
Question 12
You plan to migrate on-premises MySQL databases to Azure Database for MySQL Flexible Server.
You need to recommend a solution for the Azure Database for MySQL Flexible Server configuration. The solution must meet the following requirements:
• The databases must be accessible if a datacenter fails.
• Costs must be minimized.
Which compute tier should you recommend?
Show answer and explanation
Correct answer: B. General Purpose
Surviving the loss of a datacenter means zone-redundant high availability, which places the standby in a different availability zone. On Azure Database for MySQL Flexible Server, zone-redundant HA is not offered on the Burstable tier, so the cheapest tier that can actually meet the availability requirement is General Purpose.
Why the other options are wrong
- A. Burstable is the cheapest tier but it does not support zone-redundant high availability, so it fails the requirement that matters most.
- C. Memory Optimized also supports high availability but costs more than General Purpose, so it loses on the cost requirement.
Question 13
You plan to deploy 10 applications to Azure. The applications will be deployed to two Azure Kubernetes Service (AKS) clusters. Each cluster will be deployed to a separate Azure region.
The application deployment must meet the following requirements:
• Ensure that the applications remain available if a single AKS cluster fails.
• Ensure that the connection traffic over the internet is encrypted by using SSL without having to configure SSL on each container.
Which service should you include in the recommendation?
Show answer and explanation
Correct answer: A. Azure Front Door
Azure Front Door is a global layer 7 entry point. It load balances across the two AKS clusters and takes an unhealthy region out of rotation, so the applications stay available if one cluster fails. It also terminates TLS at the edge, which means the SSL certificate is managed once at Front Door rather than configured on each container.
Why the other options are wrong
- B. Traffic Manager works at DNS level and cannot terminate TLS, so SSL would still have to be handled behind it.
- C. An ingress controller lives inside a single cluster, so it cannot provide availability if that whole cluster fails.
- D. Azure Load Balancer is a regional layer 4 service. It neither spans regions nor terminates TLS.
Question 14
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
Your company, named Contoso, Ltd., has a Microsoft Entra tenant named contoso.com that uses Privileged Identity Management (PIM) and is linked to an Azure subscription named Sub1.
You use Azure Backup to back up all the resources in Sub1 to a Recovery Services vault named Vault1.
An external company named Fabrikam, Inc. provides security management services to Contoso. Fabrikam has a Microsoft Entra tenant named fabrikam.com and an Azure subscription.
You need to prevent a compromised administrator account in contoso.com from modifying backup policies in and deleting backups from Sub1.
Solution: You configure a PIM role assignment that requires approval for activation by an administrator in contoso.com.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
A PIM approval requirement adds a gate before a role can be activated, but the approver is an administrator in the same contoso.com tenant. If an administrator account in contoso.com is compromised, the attacker remains inside the trust boundary that grants the approval, so backup policies can still be changed and backups deleted. Protecting Vault1 against this threat requires multi-user authorization with a Resource Guard owned by a separate tenant, such as fabrikam.com, so that critical operations need permission from someone outside contoso.com.
Why the other options are wrong
- A. Approval by another contoso.com administrator keeps control within the same tenant, so a compromised contoso.com administrator account is not reliably blocked from modifying backup policies or deleting backups.
Question 15
You are building an app named App1 that will store structured and unstructured data by using the Azure Table storage REST API.
You need to recommend a solution that meets the following requirements:
• Provides dedicated throughput and the fastest possible read and write times for the data.
• Minimizes storage costs.
What should you include in the recommendation?
Show answer and explanation
Correct answer: A. an Azure Cosmos DB database
Azure Cosmos DB for Table is compatible with the Azure Table storage REST API and SDKs, so App1 can use the same code while gaining Cosmos DB capabilities. Cosmos DB provides dedicated throughput through provisioned request units and offers single-digit millisecond latency for reads and writes backed by SLAs, which standard Table storage does not guarantee. Because App1 stores structured and unstructured data as flexible entities, Cosmos DB for Table also indexes all properties automatically for fast queries. To keep throughput costs low, the account can use autoscale throughput, which scales provisioned request units down to 10 percent of the maximum when demand is low, so you avoid paying for peak capacity while idle. Among the options, it is the only one that meets the throughput and latency requirements through the Table API.
Why the other options are wrong
- B. Table storage in a standard storage account uses shared, multi-tenant throughput with no dedicated capacity or latency guarantees, so it does not provide the fastest possible read and write times.
- C. Premium storage accounts are available for block blobs, page blobs, and file shares, not for Table storage, so they cannot host data accessed through the Table storage REST API.
- D. Azure Cache for Redis is an in-memory cache with its own protocol, not a persistent store that supports the Table storage REST API, and holding all data in memory raises costs.
Question 16
You plan to develop, deploy, and maintain 100 React-based web apps that will NOT require server-side rendering.
You need to recommend a hosting solution for the apps. The solution must meet the following requirements:
• Automatically deploy new versions of the apps when changes to the apps' source code are committed in Azure Repos.
• Automatically stage a preview version of an app when a pull request is processed.
• Support Azure API Management by using the /api path.
• Minimize costs.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure Static Web Apps
Azure Static Web Apps is built for client-rendered frameworks such as React. It connects to a repository in Azure Repos through an Azure Pipelines task, so every commit triggers an automatic build and deployment, and it can stage a pre-production environment for a pull request (with Azure Repos, by configuring a named environment in the pipeline) so changes are reviewed before they reach production. Requests to the /api route can be served by a linked backend, including Azure API Management, without any extra proxy configuration. Because the static content is served from a globally distributed platform with a Free plan and a low-cost Standard plan, hosting 100 apps this way costs far less than running compute for each app.
Why the other options are wrong
- A. Blob Storage static websites only serve files; they provide no built-in pull request preview environments and no /api route integration with API Management.
- B. App Service web apps run dedicated compute that is unnecessary for apps without server-side rendering, so hosting 100 apps this way does not minimize costs.
- C. Azure Functions runs event-driven backend code and is not a hosting platform for a React front end with commit-based deployment and pull request previews.
Question 17
You are designing an application that will be hosted in Azure.
The application will host video files that range from 50 MB to 12 GB. The application will use certificate-based authentication and will be available to users on the internet.
You need to recommend a storage option for the video files. The solution must provide the fastest read performance and must minimize storage costs.
What should you recommend?
Show answer and explanation
Correct answer: C. Azure Blob Storage
Blob Storage is built for large unstructured objects, handles the 50 MB to 12 GB range comfortably as block blobs, serves them over HTTPS to internet users, and is the cheapest of these options per gigabyte with access tiers to tune cost further. That combination gives the fast reads and low storage cost the requirement asks for.
Why the other options are wrong
- A. Azure Files provides an SMB or NFS file share, which costs more per gigabyte and is aimed at applications expecting a file system rather than internet delivery.
- B. Data Lake Storage Gen2 adds a hierarchical namespace for analytics workloads. That is overhead this scenario has no use for.
- D. Azure SQL Database is a relational store. Holding multi-gigabyte video files in it would be both slow and far more expensive.
Question 18
You are designing an application that will aggregate content for users.
You need to recommend a database solution for the application. The solution must meet the following requirements:
• Support SQL commands.
• Support multi-master writes.
• Guarantee low latency read operations.
What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Azure Cosmos DB SQL API
Only Azure Cosmos DB satisfies all three at once. The SQL API accepts SQL queries over the documents, multi-region writes give the multi-master behaviour, and replicating to regions near the users with a single-digit millisecond read guarantee delivers the low latency reads.
Why the other options are wrong
- B. Active geo-replication creates read-only secondaries. Writes still go to one primary, so there is no multi-master.
- C. Hyperscale scales storage and read replicas but keeps a single write replica.
- D. Azure Database for PostgreSQL is a single-writer relational service and offers no multi-master write capability of this kind.
Question 19
You have an Azure subscription that contains 10 Azure SQL databases in an elastic pool. Each database is 600 GB.
You need to ensure that you can increase the size of each database to 15 TB. The solution must minimize database downtime.
What should you do?
Show answer and explanation
Correct answer: B. Remove the elastic pool. Update each database to the Hyperscale service tier.
Each database must grow to 15 TB, which exceeds the maximum size of the General Purpose and Business Critical service tiers (4 TB) and of the DTU-based tiers. The Hyperscale service tier uses a distributed architecture in which compute is separated from page servers that hold the data, so a single database can grow up to 128 TB. Moving each database out of the pool and converting it to Hyperscale is an online operation: the database remains available during the data copy and only a brief disconnection occurs at the final cutover, which keeps downtime to a minimum.
Why the other options are wrong
- A. Geo-replication creates readable secondaries for disaster recovery and does not raise the maximum database size.
- C. The Premium tier caps database size well below 15 TB, so the databases still could not grow to the required size.
- D. Business Critical databases are limited to 4 TB, which is far below the 15 TB requirement.
Question 20
You have 12 Azure subscriptions and three projects. Each project uses resources across multiple subscriptions.
You need to use Microsoft Cost Management to monitor costs on a per project basis. The solution must minimize administrative effort.
Which two components should you include in the solution? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, D. resource tags; management groups
The projects cut across subscriptions, so costs have to be attributed by something other than the subscription boundary. Resource tags carry the project name onto every resource, and Cost Management can group and filter by tag. Management groups then give a single scope above the 12 subscriptions to run that analysis against, so one cost view covers everything rather than 12 separate ones. Together they need no custom tooling.
Why the other options are wrong
- A. Budgets raise an alert when spend passes a threshold. They report against a scope that already exists rather than creating the per-project view.
- C. Custom RBAC roles decide who may see or change things. They have no effect on how costs are grouped.
- E. Azure Boards is work item tracking in Azure DevOps and has no cost data.
Question 21
You have an Azure subscription.
You plan to deploy a monitoring solution that will include the following:
• Azure Monitor Network Insights
• Application Insights
• Microsoft Sentinel
• VM insights
The monitoring solution will be managed by a single team.
What is the minimum number of Azure Monitor workspaces required?
Show answer and explanation
Correct answer: A. 1
All four capabilities store their data in Log Analytics workspaces, and none of them requires a workspace of its own. Network Insights, VM insights, and Microsoft Sentinel can all target the same workspace, and Application Insights in its workspace-based form points at one too. Because a single team manages the solution there is no access boundary forcing a split, so the minimum is one workspace.
Why the other options are wrong
- B. Two would only be needed if something forced a split, such as separate teams, differing retention, or a data residency boundary. None applies here.
- C. Three assumes Sentinel or Application Insights needs a dedicated workspace, which is not the case.
- D. Four assumes each capability needs its own workspace, which is the opposite of how these services are designed to be consolidated.
Question 22
You have an Azure virtual machine named VM1 that contains a third-party application named App1. App1 is installed in a folder named D:\App1.
You back up the files on VM1 by using the Microsoft Azure Recovery Services (MARS) agent and include only D:\App1 in the backup.
You discover that the OS disk of VM1 is corrupted, and the virtual machine cannot start.
You need to recover VM1. The solution must minimize how long it takes to recover VM1.
What should you do?
Show answer and explanation
Correct answer: A. Create a new virtual machine from an Azure Marketplace image, and then restore D:\App1 from the backup.
The MARS agent backs up only files and folders, and here it protected only D:\App1, so the vault holds no copy of the operating system disk or of the virtual machine. With the OS disk corrupted, the fastest path is to deploy a new virtual machine from an Azure Marketplace image, which provides a working operating system in minutes, then install the MARS agent, register it with the vault, and restore D:\App1 to the new machine. This rebuilds a running VM with the application data without depending on any disk-level backup that does not exist.
Why the other options are wrong
- B. MARS restores files and folders, not VHDs, and attaching a data disk to the existing configuration does not repair the corrupted OS disk that prevents VM1 from starting.
- C. No VM-level backup or snapshot of VM1 exists, so there is no VHD in the portal to recover from.
- D. Restored disks come only from an Azure VM backup restore point, and the MARS file backup of D:\App1 provides no disks to create a VHD from.
Question 23
You need to design a highly available Azure SQL database that meets the following requirements:
• Failover between replicas of the database must occur without any data loss.
• The database must remain available in the event of a zone outage.
• Costs must be minimized.
Which deployment option should you use?
Show answer and explanation
Correct answer: B. Azure SQL Database Premium
Zero data loss on failover needs synchronous replicas, and surviving a zone outage needs them spread across zones. Azure SQL Database Premium supports a zone-redundant configuration with synchronous replicas, so a failover loses nothing, and it is the cheaper of the options capable of that.
Why the other options are wrong
- A. Managed Instance Business Critical also provides synchronous replicas but a managed instance costs considerably more than a single database, so it loses on the cost requirement.
- C. Basic is a single-replica tier with no zone redundancy.
- D. Managed Instance General Purpose stores data remotely and recovers by attaching it to new compute, which is not a zero data loss replica failover.
Question 24
You have the following Azure subscriptions:
• Multiple subscriptions that host workloads
• A dedicated management subscription for the workloads
Your company runs platform and application resources across several subscriptions and has on-premises Azure Arc-enabled virtual machines.
Development teams have permission to deploy monitoring components to their own subscriptions.
Operations teams find it difficult to correlate platform with workload telemetry across Azure and hybrid resources.
You need to recommend a monitoring solution that provides centralized querying for log and trace data. The solution must meet the following requirements:
• Support the hybrid resources.
• Prevent the teams from storing monitoring data in disparate locations.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Deploy a Log Analytics workspace to the management subscription.
A single Log Analytics workspace in the dedicated management subscription gives the operations teams one place to run Kusto queries that correlate platform logs with workload telemetry. Azure resources in every workload subscription can send resource logs to it through diagnostic settings, Azure Arc-enabled on-premises virtual machines send logs through the Azure Monitor Agent and data collection rules, and workspace-based Application Insights stores application traces in the same workspace. Centralizing on one workspace, backed by Azure Policy and permissions, stops teams from scattering monitoring data across separate locations while still supporting the hybrid resources.
Why the other options are wrong
- A. Azure Service Health alerts report Azure platform incidents and maintenance; they do not collect or query log and trace data from workloads or Arc-enabled machines.
- B. An Azure Monitor workspace in each workload subscription stores Prometheus metrics, not log and trace data, and deploying one per subscription creates the disparate locations the requirements prohibit.
- C. Azure Managed Grafana visualizes data from other sources but does not store logs or traces, so it cannot by itself centralize the monitoring data.
Question 25
You have an on-premises storage solution.
You need to migrate the solution to Azure. The solution must support Hadoop Distributed File System (HDFS).
What should you use?
Show answer and explanation
Correct answer: A. Azure Data Lake Storage Gen2
Azure Data Lake Storage Gen2 adds a hierarchical namespace to Blob Storage and exposes an ABFS driver that is compatible with the Hadoop Distributed File System, so Hadoop and Spark workloads read and write it as though it were HDFS. That is exactly the compatibility the migration requires.
Why the other options are wrong
- B. Azure NetApp Files serves NFS and SMB shares. It is not an HDFS-compatible store.
- C. Azure Data Share is a service for sharing data with external organisations, not a storage platform.
- D. Table storage is a key-value store with no file system semantics at all.
Question 26
Your company, named Contoso, Ltd., implements several Azure logic apps that have HTTP triggers. The logic apps provide access to an on-premises web service.
Contoso establishes a partnership with another company named Fabrikam, Inc.
Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0 identity management to authenticate its users.
Developers at Fabrikam plan to use a subset of the logic apps to build applications that will integrate with the on-premises web service of Contoso.
You need to design a solution to provide the Fabrikam developers with access to the logic apps. The solution must meet the following requirements:
• Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso.
• The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps.
• The solution must NOT require changes to the logic apps.
• The solution must NOT use Azure AD guest accounts.
What should you include in the solution?
Show answer and explanation
Correct answer: D. Azure API Management
Azure API Management sits in front of the logic apps and satisfies every constraint at once. Rate limit policies applied per product or subscription give the Fabrikam developers a lower request rate than Contoso users. Its validate-jwt policy accepts tokens from any third-party OAuth 2.0 provider, so the developers keep their existing identity provider and no Azure AD guest accounts are needed. Because the enforcement lives in the gateway, the logic apps themselves are untouched.
Why the other options are wrong
- A. Azure Front Door is a global entry point with WAF and routing. It does not validate third-party OAuth 2.0 tokens or apply per-consumer rate limits.
- B. Application Proxy publishes on-premises apps to Azure AD identities. The logic apps are already in Azure and Azure AD accounts are explicitly excluded.
- C. Azure AD B2B works by inviting external users as guests, which the requirements rule out.
Question 27
You have an Azure subscription.
You plan to deploy an app that will store data across multiple databases.
You need to recommend a storage solution for the app. The solution must meet the following requirements:
• Ensure that queries can be executed simultaneously across all the databases.
• Minimize development effort.
• Minimize query latency.
What should you include in the recommendation?
Show answer and explanation
Correct answer: C. Azure SQL Database
Azure SQL Database supports elastic query, which lets a single Transact-SQL query span multiple databases by using external data sources and external tables. The app can therefore query all of its databases simultaneously through standard T-SQL, without writing custom code to fan out queries and merge results, which minimizes development effort. As a fully managed platform service, Azure SQL Database also avoids the overhead of running and tuning database servers, and the queries execute within the Azure SQL service close to the data for low latency.
Why the other options are wrong
- A. SQL Server on Azure Virtual Machines requires you to deploy, patch and manage the database servers yourself, which adds effort that a managed service avoids.
- B. Azure SQL Edge is a database engine for IoT and edge devices, not a cloud storage solution for an app spanning multiple databases.
- D. Azure SQL Managed Instance is designed for lift-and-shift compatibility with on-premises SQL Server and costs more to provision than Azure SQL Database for this app.
Question 28
You have an Azure subscription that contains an Azure Blob Storage account named store1.
You have an on-premises file server named Server1 that runs Windows Server 2016. Server1 stores 500 GB of company files.
You need to store a copy of the company files from Server1 in store1.
Which two possible Azure services achieve this goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C. an Azure Import/Export job; Azure Data Factory
Both options move bulk file data from an on-premises server into a blob container as a complete solution. An Azure Import/Export job ships the data physically on disks and Microsoft loads it into the account, and Azure Data Factory copies it over the network using a self-hosted integration runtime installed on the on-premises network. Either one gets the 500 GB into store1.
Why the other options are wrong
- A. An integration account stores B2B artifacts such as trading partners and schemas for Logic Apps. It is not a data transfer mechanism.
- D. An on-premises data gateway lets Azure services query on-premises sources for reporting. It does not copy files into a storage account.
- E. Azure Batch runs large-scale compute jobs. It is not a data movement service.
Question 29
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:
• Provide access to the full .NET framework.
Provide redundancy if an Azure region fails.
• Grant administrators access to the operating system to install custom application dependencies.
Solution: You deploy two Azure virtual machines to two Azure regions, and you create an Azure Traffic Manager profile.
Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
The answer is yes. Virtual machines give access to the full .NET Framework and administrative access to the operating system, so custom dependencies can be installed. Placing one in each of two Azure regions and putting Traffic Manager in front provides DNS-level routing that fails traffic over when a region is lost, which satisfies the redundancy requirement.
Why the other options are wrong
- B. Answering no would mean this design misses a requirement. It covers all three: full framework, OS access, and cross-region redundancy through a global traffic router.
Question 30
You need to design a highly available Azure SQL database that meets the following requirements:
• Failover between replicas of the database must occur without any data loss.
• The database must remain available in the event of a zone outage.
• Costs must be minimized.
Which deployment option should you use?
Show answer and explanation
Correct answer: B. Azure SQL Database Premium
Azure SQL Database Premium is the option that combines synchronous replicas, which give failover with no data loss, with a zone-redundant configuration that keeps those replicas in separate availability zones. It also costs less than the managed instance alternative.
Why the other options are wrong
- A. Managed Instance Business Critical meets the technical requirements but at a much higher price than a Premium database.
- C. Basic offers no zone redundancy and no synchronous replica set.
- D. Hyperscale uses a single primary compute replica over page servers, which is a different availability model from the synchronous replicas this requirement needs.
Question 31
You have 12 on-premises data sources that contain customer information and consist of Microsoft SQL Server, MySQL, and Oracle databases.
You have an Azure subscription.
You plan to create an Azure Data Lake Storage account that will consolidate the customer information for analysis and reporting.
You need to recommend a solution to automatically copy new information from the data sources to the Data Lake Storage account by using extract, transform and load (ETL). The solution must minimize administrative effort.
What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Azure Data Factory
Azure Data Factory connects to SQL Server, MySQL, and Oracle through a self-hosted integration runtime installed on the on-premises network, and copies from all 12 sources into Data Lake Storage on a schedule. Mapping data flows handle the transform step, and because it is a managed service with built-in connectors and triggers, the administrative effort is far lower than building the movement by hand.
Why the other options are wrong
- B. Azure Data Explorer is an analytics engine for telemetry. It is a query destination rather than an ETL orchestrator.
- C. Azure Data Share publishes datasets to other organisations. It does not extract from on-premises databases.
- D. Azure Data Studio is a desktop client for querying and managing databases.
Question 32
You plan to deploy an Azure SQL database that will store Personally Identifiable Information (PII).
You need to ensure that only privileged users can view the PII.
What should you include in the solution?
Show answer and explanation
Correct answer: A. dynamic data masking
Dynamic data masking hides sensitive values in the result of a query for users who are not authorised to see them, while privileged users see the real data. The data itself is unchanged on disk, so this is the control that lets ordinary users work with the table while personally identifiable information stays hidden from them.
Why the other options are wrong
- B. Role-based access control decides who can reach the database or the resource. It cannot show one user a masked column and another the real value.
- C. Data Discovery and Classification finds and labels sensitive columns. It reports on where the data is rather than hiding it.
- D. Transparent Data Encryption encrypts the data at rest. Any user who can query the database still sees the plaintext values.
Question 33
You are designing an app that will use Azure Cosmos DB to collate sales from multiple countries.
You need to recommend an API for the app. The solution must meet the following requirements:
• Support SQL queries.
• Support geo-replication.
• Store and access data relationally.
Which API should you recommend?
Show answer and explanation
Correct answer: B. PostgreSQL
The requirement to store and access data relationally alongside SQL queries and geo-replication points at Azure Cosmos DB for PostgreSQL. It is a distributed relational engine, so tables, joins, and relational modelling all work, it speaks SQL natively, and it can be distributed across regions.
Why the other options are wrong
- A. The Cassandra API is a wide-column store queried with CQL, and it does not model data relationally.
- C. The MongoDB API is document oriented, so data is stored as documents rather than in relations.
- D. The NoSQL API stores JSON documents. It accepts SQL-like queries but the data is not relational.
Question 34
You are designing an Azure governance solution.
All Azure resources must be easily identifiable based on the following operational information: environment, owner, department and cost center.
You need to ensure that you can use the operational information when you generate reports for the Azure resources.
What should you include in the solution?
Show answer and explanation
Correct answer: C. an Azure policy that enforces tagging rules
The operational information named here, environment, owner, department, and cost centre, is exactly what resource tags carry, and Cost Management and the resource reports group and filter by them. An Azure Policy that enforces tagging rules makes sure every resource actually carries those tags, which is what keeps the reports complete.
Why the other options are wrong
- A. A data catalog documents data assets. It does not attach operational metadata to Azure resources or drive resource reporting.
- B. A management group hierarchy organises subscriptions. It cannot record an owner or a cost centre against an individual resource.
- D. Administrative units delegate administration of users and groups in Azure AD and have no bearing on resource reporting.
Question 35
You plan to deploy an application named App1 that will run on five Azure virtual machines. Additional virtual machines will be deployed later to run App1.
You need to recommend a solution to meet the following requirements for the virtual machines that will run App1:
• Ensure that the virtual machines can authenticate to Azure Active Directory (Azure AD) to gain access to an Azure key vault, Azure Logic Apps instances, and an Azure SQL database.
• Avoid assigning new roles and permissions for Azure services when you deploy additional virtual machines.
• Avoid storing secrets and certificates on the virtual machines.
• Minimize administrative effort for managing identities.
Which type of identity should you include in the recommendation?
Show answer and explanation
Correct answer: D. a user-assigned managed identity
A user-assigned managed identity is created once as its own resource, granted the required access to the key vault, the logic apps, and the SQL database once, and then attached to each virtual machine that runs App1. Adding a machine later means attaching the existing identity, with no new role assignments to make. Azure manages the credential, so nothing is stored on the machines.
Why the other options are wrong
- A. A system-assigned identity is tied to one virtual machine and dies with it, so every additional machine would need its own set of role assignments.
- B. A service principal using a certificate means placing and rotating a certificate on each machine, which the requirements forbid.
- C. A service principal using a client secret likewise requires storing a secret on the machines and managing its expiry.
Question 36
You have an Azure subscription.
You plan to deploy an app named App1 that will be hosted on multiple virtual machines. App1 requires a service-level agreement (SLA) of 99.99%.
You need to recommend a high availability solution for the virtual machines.
What should you include in the recommendation?
Show answer and explanation
Correct answer: B. availability zones
Microsoft offers a 99.99 percent virtual machine connectivity SLA when two or more instances are deployed across two or more availability zones in the same region. Each zone is a physically separate datacenter location with independent power, cooling, and networking, so the loss of an entire datacenter leaves the other instances of App1 running. Placing the App1 virtual machines in availability zones is therefore the high availability design that meets the required SLA.
Why the other options are wrong
- A. Azure Site Recovery replicates virtual machines for disaster recovery failover and does not provide a 99.99 percent availability SLA for running instances.
- C. Application groups are an Azure Virtual Desktop construct for publishing apps and desktops, not a virtual machine availability feature.
- D. Availability sets spread VMs across fault and update domains within one datacenter and carry a 99.95 percent SLA, which is below the 99.99 percent requirement.
Question 37
You store web access logs data in Azure Blob Storage.
You plan to generate monthly reports from the access logs.
You need to recommend an automated process to upload the data to Azure SQL Database every month.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure Data Factory
Azure Data Factory is the managed service for scheduled data movement. A pipeline with a copy activity reads the access logs from Blob Storage and writes them into Azure SQL Database, and a monthly trigger runs it automatically, which is exactly the automated process the requirement describes.
Why the other options are wrong
- A. SQL Server Migration Assistant converts schemas and data from other database engines during a one-time migration.
- B. Data Migration Assistant assesses a SQL Server estate for migration blockers. It is an assessment tool, not a recurring pipeline.
- C. AzCopy copies data to and from storage from the command line, and it has no scheduler and no path into a SQL database.
Question 38
You have an Azure subscription that contains two applications named App1 and App2. App1 is a sales processing application.
When a transaction in App1 requires shipping, a message is added to an Azure Storage account queue, and then App2 listens to the queue for relevant transactions.
In the future, additional applications will be added that will process some of the shipping requests based on the specific details of the transactions.
You need to recommend a replacement for the storage account queue to ensure that each additional application will be able to read the relevant transactions.
What should you recommend?
Show answer and explanation
Correct answer: D. one Azure Service Bus topic
A queue delivers each message to exactly one consumer, so once several applications need to see the same shipping transactions a queue cannot work. A Service Bus topic is publish and subscribe: each application gets its own subscription, and a subscription filter selects only the transactions whose details are relevant to it, which is precisely the future requirement described.
Why the other options are wrong
- A. A Data Factory pipeline is scheduled batch data movement, not a messaging fabric for a transactional flow.
- B. Multiple queues would mean the publisher writing the same message to each one and knowing every consumer in advance, which is what a topic removes.
- C. A Service Bus queue improves on a storage queue but still delivers each message once, so additional applications could not read the same transaction.
Question 39
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Azure Log Analytics
With the Activity Log absent from the options, Log Analytics is the answer. A diagnostic setting routes the Activity Log into a workspace, and a scheduled Kusto query over AzureActivity filtered to write operations produces the monthly list of new deployments.
Why the other options are wrong
- A. Azure Arc manages resources outside Azure.
- C. Application Insights collects application telemetry such as requests, dependencies, and exceptions, not Resource Manager operations.
- D. Action groups are the notification mechanism attached to alerts.
Question 40
You plan to deploy an Azure Database for MySQL flexible server named Server1 to the East US Azure region.
You need to implement a business continuity solution for Server1. The solution must minimize downtime in the event of a failover to a paired region.
What should you do?
Show answer and explanation
Correct answer: C. Implement Geo-redundant backup.
Geo-redundant backup copies the server's backups to the paired region, and from them the server can be restored there if the primary region is lost. Among the options it is the business continuity feature designed for a regional failover, and it keeps the recovery within the managed service rather than requiring a hand-built replica.
Why the other options are wrong
- A. A read replica serves read traffic and requires a manual promotion, and it is aimed at scaling reads rather than at regional business continuity.
- B. Where the database files sit is not a customer choice on a flexible server, and premium file shares are not part of its architecture.
- D. Native MySQL replication configured by hand undoes the point of using a managed service and leaves the failover entirely manual.
Question 41
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
Show answer and explanation
Correct answer: C. Azure Log Analytics
Azure Log Analytics is the option that can produce this report. The subscription's Activity Log is routed into a workspace by a diagnostic setting, after which a Kusto query over AzureActivity restricted to write operations lists every new deployment for the month and can be scheduled.
Why the other options are wrong
- A. Application Insights is for application-level telemetry rather than subscription control plane events.
- B. Azure Arc brings external machines under Azure management.
- D. Metrics are numeric time series and do not represent deployment events.
Question 42
You have an Azure subscription that contains a storage account.
An application sometimes writes duplicate files to the storage account.
You have a PowerShell script that identifies and deletes duplicate files in the storage account. Currently, the script is run manually after approval from the operations manager.
You need to recommend a serverless solution that performs the following actions:
• Runs the script once an hour to identify whether duplicate files exist
• Sends an email notification to the operations manager requesting approval to delete the duplicate files
• Processes an email response from the operations manager specifying whether the deletion was approved
• Runs the script if the deletion was approved
What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Azure Logic Apps and Azure Functions
Azure Logic Apps supplies the parts that involve waiting and approval: a recurrence trigger fires hourly, an approval email action sends the request to the operations manager and then waits for the reply, and a condition branches on the answer. Azure Functions is where the existing PowerShell script runs, called by the logic app both to detect duplicates and to delete them once approved. Both are serverless.
Why the other options are wrong
- A. Event Grid routes events as they occur. It provides neither an hourly schedule nor an approval wait.
- C. Azure Pipelines is a CI/CD system and Service Fabric is a microservices platform. Neither is a serverless approval workflow.
- D. Functions alone cannot wait days for an email reply, and Azure Batch is for large-scale compute jobs.
Question 43
You have an Azure subscription that contains a storage account named storage1.
You need to provide developers with the ability to read and write the data in storage1. The solution must meet the following requirements:
• Limit the exposure of sensitive data.
• Follow the principle of least privilege.
What should you use?
Show answer and explanation
Correct answer: A. a role-based access control (RBAC) role
Azure RBAC lets you assign a built-in data role such as Storage Blob Data Contributor to the developers' Microsoft Entra identities, scoped as narrowly as a single container. Developers authenticate with their own identities, so no shared secret is distributed, access can be revoked centrally, and every operation is attributable to a specific user. Granting only read and write data permissions at the smallest required scope follows the principle of least privilege and limits the exposure of sensitive data. Microsoft recommends Microsoft Entra authorization with RBAC over key-based or token-based access for these reasons.
Why the other options are wrong
- B. A certificate is not an authorization mechanism for reading and writing data in a storage account.
- C. A SAS is a bearer token: anyone who obtains it can use it until it expires, and it is not tied to a developer's identity, so it exposes more risk than RBAC.
- D. A storage account key grants full access to all data and operations in the account, which violates least privilege and maximizes exposure.
Question 44
You need to design a highly available Azure SQL database that meets the following requirements:
• Failover between replicas of the database must occur without any data loss.
• The database must remain available in the event of a zone outage.
• Costs must be minimized.
Which deployment option should you use?
Show answer and explanation
Correct answer: B. Azure SQL Database Business Critical
Business Critical is the service tier built on a cluster of synchronous replicas, which is what allows a failover to complete without losing a committed transaction, and it can be deployed zone redundantly so the replicas sit in different availability zones. Of the options offered here it is the only one that satisfies both requirements.
Why the other options are wrong
- A. Serverless is a compute billing model on the General Purpose tier, which separates compute from remote storage and pauses when idle. That is not a synchronous replica architecture.
- C. Basic is a single small replica with no zone redundancy.
- D. Standard likewise uses the General Purpose style architecture and does not provide the synchronous replica set required for zero data loss.
Question 45
You have an Azure subscription.
You are designing a data solution that will process millions of items nightly. The solution must meet the following requirements:
• Support integration with Microsoft Dataverse.
• Support dynamic data masking.
• Support auto scaling.
What should you include in the solution?
Show answer and explanation
Correct answer: B. Azure Databricks
Azure Databricks is built for large-scale batch processing such as handling millions of items nightly, and its clusters support autoscaling between a minimum and maximum number of workers so compute grows during the nightly run and shrinks afterward. Dataverse data can be exported in Delta Lake format through Azure Synapse Link for Dataverse and read directly by Databricks. Unity Catalog column masks apply a masking function at query time based on who runs the query, which provides dynamic data masking of sensitive columns. Databricks therefore satisfies the integration, masking, and auto scaling requirements in one processing platform.
Why the other options are wrong
- A. Microsoft Power BI is a reporting and visualization service, not a processing engine for transforming millions of items in a nightly batch.
- C. In Microsoft Fabric, dynamic data masking is available only through T-SQL in SQL items such as a Warehouse, a SQL analytics endpoint, or a SQL database, and OneLake security, which governs access from notebooks and lakehouses, does not support it.
- D. Azure Synapse Analytics dedicated SQL pools, which provide dynamic data masking, scale only when DWUs are changed manually or by a script, so they do not auto scale.
Question 46
You need to design a highly available Azure SQL database that meets the following requirements:
• Failover between replicas of the database must occur without any data loss.
• The database must remain available in the event of a zone outage.
• Costs must be minimized.
Which deployment option should you use?
Show answer and explanation
Correct answer: B. Azure SQL Database Premium
Failover with no data loss requires synchronous replicas, and surviving a zone outage requires those replicas to be spread across availability zones. Azure SQL Database Premium supports a zone-redundant configuration and keeps its replicas in sync, so a failover loses nothing. Of the options that can do this, it is also the cheapest.
Why the other options are wrong
- A. Hyperscale keeps a single primary compute replica with page servers behind it, and it does not offer the same synchronous replica model for zero data loss failover in this comparison.
- C. Basic is a small single-replica tier with no zone redundancy at all.
- D. Managed Instance General Purpose separates compute from remote storage, so a failover involves a restart on new compute rather than a synchronous replica, and it costs more than Premium.
Question 47
You have an Azure subscription.
Your on-premises network contains a file server named Server1. Server1 stores 5 TB of company files that are accessed rarely.
You plan to copy the files to Azure Storage.
You need to implement a storage solution for the files that meets the following requirements:
• The files must be available within 24 hours of being requested.
• Storage costs must be minimized.
Which two possible storage solutions achieve this goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D. Create an Azure Blob Storage account that is configured for the Cool default access tier. Create a blob container, copy the files to the blob container, and set each file to the Archive access tier; Create a general-purpose v2 storage account that is configured for the Hot default access tier. Create a blob container, copy the files to the blob container, and set each file to the Archive access tier.
Both solutions put the blobs in the Archive tier, which is the cheapest storage available and whose standard rehydration returns data within hours, comfortably inside the 24 hour requirement. The account's default access tier does not matter, because each blob is explicitly set to Archive after upload. What does matter is that the data goes into a blob container, since Archive is a blob tier.
Why the other options are wrong
- B. A general purpose v1 account does not support access tiers at all, so the files would sit at full price.
- C. Archive is not available for file shares, so a file share cannot reach the lowest cost tier.
- E. This combines the v1 limitation with a file share, so it neither supports tiering nor archiving.
Question 48
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
Your company, named Contoso, Ltd., has a Microsoft Entra tenant named contoso.com that uses Privileged Identity Management (PIM) and is linked to an Azure subscription named Sub1.
You use Azure Backup to back up all the resources in Sub1 to a Recovery Services vault named Vault1.
An external company named Fabrikam, Inc. provides security management services to Contoso. Fabrikam has a Microsoft Entra tenant named fabrikam.com and an Azure subscription.
You need to prevent a compromised administrator account in contoso.com from modifying backup policies in and deleting backups from Sub1.
Solution: You configure a PIM role assignment that requires approval for activation by an administrator in fabrikam.com.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
A PIM approval requirement only controls how a role is activated in contoso.com, and it remains entirely under the control of the contoso.com directory. A compromised privileged administrator in contoso.com can change PIM role settings, remove the approval requirement, or use an existing assignment, and the backup operations in Vault1 are then authorized only by contoso.com RBAC. The goal requires protection that sits outside the compromised tenant: multi-user authorization (MUA) with a Resource Guard owned by fabrikam.com. With MUA, critical operations such as modifying backup policies or deleting backup data require an additional permission on the Resource Guard, which a contoso.com administrator cannot grant to themselves.
Why the other options are wrong
- A. PIM approval settings are managed within contoso.com, so a compromised privileged account there can bypass or change them, and Vault1 operations still rely only on contoso.com permissions.
Question 49
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure Log Analytics
The Activity Log is not among the options, so Azure Log Analytics is the answer. Sending the Activity Log to a Log Analytics workspace with a diagnostic setting makes the deployment events queryable with Kusto, and a scheduled query over the AzureActivity table produces the monthly report.
Why the other options are wrong
- A. Azure Arc manages resources outside Azure and does not report on in-subscription deployments.
- B. Metrics are numeric time series about performance. A deployment is a discrete event, not a metric.
- C. Azure Advisor makes recommendations rather than recording what was deployed.
Question 50
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure Activity Log
The Azure Activity Log records every Resource Manager control plane operation in the subscription. Filtering it to write operations over the past month produces the list of new deployments, complete with who performed each one and when, without anything having to be configured beforehand.
Why the other options are wrong
- A. Application Insights collects telemetry from inside an application.
- B. Azure Analysis Services is an analytical modelling service.
- C. Azure Advisor produces recommendations, not a deployment history.
Question 51
A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with Microsoft 365 and an Azure subscription.
Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory Domain Services (AD DS) and Azure AD Connect.
Contoso has a partnership with a company named Fabrikam. Inc. Fabrikam has an Active Directory forest and a Microsoft 365 tenant. Fabrikam has the same on-premises identity infrastructure components as Contoso.
A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription of Contoso. The developers must be added to the Contributor role for a resource group in the Contoso subscription.
You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The solution must ensure that the Fabrikam developers use their existing credentials to access resources
What should you recommend?
Show answer and explanation
Correct answer: D. In the Azure AD tenant of Contoso, create guest accounts for the Fabnkam developers.
Creating guest accounts in the Contoso tenant invites the ten Fabrikam developers as B2B users. A guest object exists in the Contoso directory so a Contributor role assignment can be made against it, but authentication is redirected to Fabrikam's own tenant, so the developers keep using their existing credentials and Contoso never manages passwords for them.
Why the other options are wrong
- A. Cloud-only accounts would give each developer a second set of credentials to manage, which is the opposite of using their existing ones.
- B. A forest trust joins the on-premises directories. It does nothing for role assignment in an Azure subscription.
- C. An organization relationship between Microsoft 365 tenants shares free or busy calendar information. It grants no access to Azure resources.
Question 52
You have an app named App1 that uses an on-premises Microsoft SQL Server database named DB1.
You plan to migrate DB1 to an Azure SQL managed instance.
You need to enable customer managed Transparent Data Encryption (TDE) for the instance. The solution must maximize encryption strength.
Which type of encryption algorithm and key length should you use for the TDE protector?
Show answer and explanation
Correct answer: A. RSA 3072
The TDE protector for a managed instance is an asymmetric key held in Azure Key Vault, and SQL supports RSA keys of 2048 or 3072 bits for this purpose. RSA 3072 is the strongest of the supported lengths, so it is the right choice when the requirement is to maximise encryption strength.
Why the other options are wrong
- B. AES 256 is the symmetric algorithm used for the database encryption key itself. The protector that wraps it is asymmetric, so AES is not an option here.
- C. RSA 4096 is not a supported key length for the TDE protector, so it cannot be used however strong it sounds.
- D. RSA 2048 is supported but is the weaker of the two available lengths.
Question 53
You have SQL Server on an Azure virtual machine. The databases are written to nightly as part of a batch process.
You need to recommend a disaster recovery solution for the data. The solution must meet the following requirements:
• Provide the ability to recover in the event of a regional outage.
• Support a recovery time objective (RTO) of 15 minutes.
• Support a recovery point objective (RPO) of 24 hours.
• Support automated recovery.
• Minimize costs.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure Site Recovery
Site Recovery replicates the whole virtual machine to a second region and can fail it over with an automated recovery plan, which covers the regional outage, the automation requirement, and an RTO well inside 15 minutes. Because the databases are only written nightly, the generous 24 hour RPO is easily met, and replication is far cheaper than running a second live SQL environment.
Why the other options are wrong
- A. An availability set protects against failures inside a single datacenter. It offers nothing when the whole region is lost.
- B. Azure Disk Backup takes disk snapshots. Restoring from them is a manual rebuild, so neither the RTO nor the automation requirement is met.
- C. An Always On availability group across regions would meet the objectives but requires a second running SQL environment plus cluster configuration, which costs more and adds administration the batch workload does not justify.
Question 54
You have an on-premises datacenter that contains 100 network shares. Each share contains more than 20 TB of data.
You have an Azure subscription.
You need to recommend a solution to migrate the network shares to Azure. The solution must provide bandwidth management for repeated transfers after the initial sync.
Which two services should you include in the recommendation? Each correct answer presents part of the solution.
NOTE: Each correct answer is worth one point.
Show answer and explanation
Correct answer: A, C. Azure Storage Mover; Azure Data Box
The shares hold more than 2 PB in total, so the initial copy is best done offline with Azure Data Box, which ships physical devices to the datacenter and avoids saturating the network for the bulk transfer. After the seed, the shares continue to change, and Azure Storage Mover handles the online catch-up copies. Storage Mover is a managed migration service with agents running on premises, centrally managed projects and jobs for many shares, and bandwidth management schedules that limit how much network capacity repeated transfers consume. Together they provide a fast initial sync and controlled incremental migrations.
Why the other options are wrong
- B. Azure Data Factory is a data integration and ETL service, not a file share migration tool with agent-based bandwidth management for repeated share transfers.
- D. Azure Storage Explorer is a desktop management tool for interactive transfers and does not provide scheduled, managed migration jobs with bandwidth management.
- E. AzCopy is a command-line copy utility without centrally managed migration projects or scheduled bandwidth management across 100 shares.
Question 55
You plan to deploy an app that will use an Azure Storage account.
You need to deploy the storage account. The storage account must meet the following requirements:
• Store the data for multiple users.
• Encrypt each user's data by using a separate key.
• Encrypt all the data in the storage account by using customer-managed keys.
What should you deploy?
Show answer and explanation
Correct answer: B. blobs in a general purpose v2 storage account
Encryption scopes are a blob feature. They let a single storage account hold data encrypted under different keys, so each user's data can be assigned its own scope backed by its own customer-managed key, while the account default also uses a customer-managed key. A general purpose v2 account with blobs supports encryption scopes and therefore meets all three requirements.
Why the other options are wrong
- A. Encryption scopes are not available for file shares, so a premium file share account cannot give each user a separate key.
- C. Data Lake Storage Gen2 adds a hierarchical namespace for analytics workloads. It does not provide the per-user key separation asked for here.
- D. Files in a general purpose v2 account have the same limitation as option A: no encryption scopes, so no separate key per user.
Question 56
You have an app named App1 that uses an Azure Blob Storage container named app1data.
App1 uploads a cumulative transaction log file named File1.txt to a block blob in app1data once every hour. File1.txt only stores transaction data from the current day.
You need to ensure that you can restore the last uploaded version of File1.txt from any day for up to 30 days after the file was overwritten. The solution must minimize storage space.
What should you include in the solution?
Show answer and explanation
Correct answer: D. blob versioning
Blob versioning automatically preserves a version of the blob every time it is overwritten, so each hourly upload keeps the one it replaced and any previous state can be restored. Combined with a lifecycle rule that deletes versions older than 30 days, it meets the retention window while storing only the changed blocks, which is what keeps the space use down.
Why the other options are wrong
- A. Container soft delete restores a deleted container. It does nothing when a blob inside a live container is overwritten.
- B. Snapshots would work but each one has to be created explicitly by the application, so the solution stops being automatic.
- C. Blob soft delete recovers a deleted or overwritten blob for a retention period, but it is aimed at accidental deletion recovery rather than keeping an addressable version of each day's file.
Question 57
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:
• Provide access to the full .NET framework.
• Provide redundancy if an Azure region fails.
• Grant administrators access to the operating system to install custom application dependencies.
Solution: You deploy an Azure virtual machine scale set that uses autoscaling.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The answer is no. A virtual machine scale set does provide the full framework and operating system access, and autoscaling handles load, but a scale set is deployed into a single region. If that region fails the application is unavailable, so the redundancy requirement is not met.
Why the other options are wrong
- A. Answering yes confuses scaling with redundancy. Autoscaling adds instances within a region; it does not survive the loss of that region.
Question 58
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
Your company, named Contoso, Ltd., has a Microsoft Entra tenant named contoso.com that uses Privileged Identity Management (PIM) and is linked to an Azure subscription named Sub1.
You use Azure Backup to back up all the resources in Sub1 to a Recovery Services vault named Vault1.
An external company named Fabrikam, Inc. provides security management services to Contoso. Fabrikam has a Microsoft Entra tenant named fabrikam.com and an Azure subscription.
You need to prevent a compromised administrator account in contoso.com from modifying backup policies in and deleting backups from Sub1.
Solution: You configure Multi-user authorization (MUA) in Sub1 by using a Resource Guard from fabrikam.com.
Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
Multi-user authorization (MUA) for Azure Backup protects critical operations on a Recovery Services vault, such as modifying backup policies to reduce retention, disabling soft delete, and stopping protection with deletion of backup data. Each protected operation requires permissions on a Resource Guard, which can be hosted in a different subscription and a different Microsoft Entra tenant. When the Resource Guard lives in fabrikam.com and is managed by Fabrikam's security team, an administrator in contoso.com has no rights on it. Even a fully compromised contoso.com administrator account therefore cannot complete the protected operations on Vault1 without approval from the separate tenant, which meets the goal.
Why the other options are wrong
- B. A Resource Guard in another tenant is exactly the design MUA recommends to stop a compromised administrator from changing backup policies or deleting backups, so the solution meets the goal.
Question 59
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
Your company, named Contoso, Ltd., has a Microsoft Entra tenant named contoso.com that uses Privileged Identity Management (PIM) and is linked to an Azure subscription named Sub1.
You use Azure Backup to back up all the resources in Sub1 to a Recovery Services vault named Vault1.
An external company named Fabrikam, Inc. provides security management services to Contoso. Fabrikam has a Microsoft Entra tenant named fabrikam.com and an Azure subscription.
You need to prevent a compromised administrator account in contoso.com from modifying backup policies in and deleting backups from Sub1.
Solution: In Vault1, you generate a security PIN for critical operations.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
A security PIN for critical operations in a Recovery Services vault adds a confirmation step for actions such as stopping protection with data deletion, but the PIN is generated in the Azure portal by any user who already has sufficient permissions on the vault. A compromised administrator account in contoso.com can therefore generate a new PIN and continue to change backup policies and delete backups. To stop a privileged account in the same tenant from performing these operations, critical operations must require authorization from outside that tenant, which multi-user authorization with a Resource Guard owned by the fabrikam.com tenant provides.
Why the other options are wrong
- A. The security PIN can be generated by the same compromised administrator, so it does not prevent that account from modifying backup policies or deleting backups.
Question 60
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:
• Provide access to the full .NET framework.
• Provide redundancy if an Azure region fails.
• Grant administrators access to the operating system to install custom application dependencies.
Solution: You deploy two Azure virtual machines to two Azure regions, and you deploy an Azure Application Gateway.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The answer is no. The virtual machines satisfy the framework and operating system access requirements, but Azure Application Gateway is a regional service that lives inside one virtual network in one region. It cannot distribute traffic across two regions, so the solution fails if the region hosting the gateway goes down.
Why the other options are wrong
- A. Answering yes overlooks that Application Gateway is regional. A global service such as Traffic Manager or Front Door is needed for cross-region failover.
Question 61
You have an Azure subscription that contains an Azure SQL database named DB1.
You need to recommend a long-term retention (LTR) backup solution for DB1. The solution must ensure that backups can be retained for up to seven years.
Which backup periods can you include in the solution?
Show answer and explanation
Correct answer: F. weekly, monthly, and yearly
Long-term retention for Azure SQL Database copies full backups into separate Azure Blob storage containers and keeps them for up to 10 years. An LTR policy is a combination of weekly retention (W), monthly retention (M), and yearly retention (Y), plus the week of the year used for the yearly backup. Any of the three periods can be set alone or together, and each can be configured to retain backups for as long as the policy allows. A policy that keeps weekly, monthly, and yearly backups therefore satisfies the requirement to retain backups for up to seven years, and all three periods can be included in the solution.
Why the other options are wrong
- A. Weekly backups are only one of the available periods; monthly and yearly retention can also be included in the policy.
- B. Monthly retention is only one of the available periods; weekly and yearly retention can also be included.
- C. Yearly retention is only one of the available periods; weekly and monthly retention can also be included.
- D. This omits yearly retention, which is also a supported LTR period and the natural choice for multi-year retention.
- E. This omits weekly retention, which is also a supported LTR period.
Question 62
You have an Azure subscription that contains 1,000 resources.
You need to generate compliance reports for the subscription. The solution must ensure that the resources can be grouped by department.
What should you use to organize the resources?
Show answer and explanation
Correct answer: B. Azure Policy and tags
Tags carry the department against each resource, and Cost Management and the compliance views group and filter by them, so a report can be produced per department across all 1,000 resources. Azure Policy is what makes that reliable, by requiring the department tag on resources and remediating any that lack it, so no resource falls out of the grouping.
Why the other options are wrong
- A. Application groups belong to Azure Virtual Desktop and quotas limit resource consumption. Neither organises resources for reporting.
- C. Administrative units delegate user and group administration, and Azure Lighthouse enables cross-tenant management by a service provider.
- D. Resource groups are a single, rigid grouping and a resource can only be in one, so they cannot express a department view across an existing estate. Role assignments control access rather than reporting.
Question 63
You have an Azure subscription. The subscription contains a tiered app named App1 that is distributed across multiple containers hosted in Azure Container Instances.
You need to deploy an Azure Monitor monitoring solution for App. The solution must meet the following requirements:
• Support using synthetic transaction monitoring to monitor traffic between the App1 components.
• Minimize development effort.
What should you include in the solution?
Show answer and explanation
Correct answer: B. Application Insights
Synthetic transaction monitoring is delivered by Application Insights availability tests, which issue requests on a schedule from selected locations and record the result. A standard or custom test can walk the path between App1's components without the application code being instrumented for it, which keeps development effort down.
Why the other options are wrong
- A. Network insights visualises network resources and their health. It does not run synthetic transactions.
- C. Container insights collects performance and log data from container workloads. It observes what happens rather than generating traffic.
- D. Log Analytics Workspace insights reports on the health and usage of the workspace itself.
Question 64
You have an Azure AD tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned memberships.
Group1 has 50 members, including 20 guest users.
You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements:
• The evaluation must be repeated automatically every three months.
• Every member must be able to report whether they need to be in Group1.
• Users who report that they do not need to be in Group1 must be removed from Group1 automatically.
• Users who do not report whether they need to be in Group1 must be removed from Group1 automatically.
What should you include in the recommendation?
Show answer and explanation
Correct answer: C. Create an access review.
An access review covers all four requirements directly. It can be scheduled to recur every three months, the members themselves can be set as the reviewers so each person reports whether they still need to be in Group1, denied results remove the user, and the setting for reviewers who do not respond removes those who never answer.
Why the other options are wrong
- A. Identity Protection is a risk engine for sign-ins and users. It performs no membership attestation.
- B. A dynamic group derives membership from attributes automatically, so no member is ever asked whether they still belong.
- D. Privileged Identity Management provides just-in-time activation for privileged roles, not recurring review of a security group.
Question 65
You are designing a SQL database solution. The solution will include 20 databases that will be 20 GB each and have varying usage patterns.
You need to recommend a database platform to host the databases. The solution must meet the following requirements:
• The solution must meet a Service Level Agreement (SLA) of 99.99% uptime.
• The compute resources allocated to the databases must scale dynamically.
• The solution must have reserved capacity.
Compute charges must be minimized.
What should you include in the recommendation?
Show answer and explanation
Correct answer: A. an elastic pool that contains 20 Azure SQL databases
Twenty databases of 20 GB with varying usage patterns is the textbook case for an elastic pool: the databases share a pool of compute, so a quiet database releases capacity to a busy one and the total compute purchased is far less than provisioning each database separately. Azure SQL Database carries a 99.99 percent SLA, and reserved capacity can be purchased against the pool to minimise the compute charge.
Why the other options are wrong
- B. SQL Server on a virtual machine in an availability set gives a 99.95 percent SLA, which falls short of the requirement, and compute does not scale dynamically across the databases.
- C. A single virtual machine has an even lower SLA and no dynamic scaling between databases.
- D. Twenty serverless databases each scale independently but cannot share capacity with each other, and serverless is not eligible for reserved capacity.
Question 66
You have 100 servers that run Windows Server 2012 R2 and host Microsoft SQL Server 2014 instances. The instances host databases that have the following characteristics:
• Stored procedures are implemented by using CLR.
• The largest database is currently 3 TB. None of the databases will ever exceed 4 TB.
You plan to move all the data from SQL Server to Azure.
You need to recommend a service to host the databases. The solution must meet the following requirements:
• Whenever possible, minimize management overhead for the migrated databases.
• Ensure that users can authenticate by using Azure Active Directory (Azure AD) credentials.
• Minimize the number of database changes required to facilitate the migration.
What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Azure SQL Managed Instance
The databases use CLR stored procedures, which Azure SQL Database does not support, so a platform with near full SQL Server surface area is required. Azure SQL Managed Instance provides CLR integration, keeps the migration close to a lift and shift with minimal database changes, supports Azure AD authentication, and is still a managed service, so it beats running SQL Server on a virtual machine on management overhead. The 3 TB size sits inside its limits.
Why the other options are wrong
- A. Elastic pools are built on Azure SQL Database, which does not support CLR stored procedures.
- C. Single databases have the same CLR limitation and would force changes to the databases.
- D. SQL Server on a virtual machine would run the workload, but patching, backups, and high availability all become the customer's responsibility, which is the opposite of minimising management overhead.
Question 67
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:
• Provide access to the full .NET framework.
• Provide redundancy if an Azure region fails.
• Grant administrators access to the operating system to install custom application dependencies.
Solution: You deploy a web app in an Isolated App Service plan.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The answer is no. An Isolated App Service plan runs the app on dedicated infrastructure inside an App Service Environment, but App Service is a platform service and does not give administrators access to the underlying operating system to install custom dependencies. A single plan is also deployed to one region, so the redundancy requirement is unmet as well.
Why the other options are wrong
- A. Answering yes assumes the Isolated tier hands over the operating system. Isolation refers to dedicated compute and network, not administrative access to the host.
Question 68
You have an Azure subscription.
You plan to deploy a virtual machine scale set that will contain five virtual machines in a single zone of an Azure region. The virtual machines will use managed disks.
You need to recommend an orchestration mode for the scale sets. The solution must ensure that each virtual machine will reside in its own update domain and fault domain.
What should you recommend?
Show answer and explanation
Correct answer: A. Uniform orchestration
Uniform orchestration is the only scale set mode that still uses update domains. A Uniform scale set provides five update domains, and when it is deployed to a single availability zone it can spread instances across five fault domains, so each of the five virtual machines lands in its own update domain and its own fault domain. Flexible orchestration deprecates update domains and performs platform maintenance fault domain by fault domain instead, so none of the Flexible options can guarantee a separate update domain for each virtual machine.
Why the other options are wrong
- B. Flexible orchestration does not use update domains, and there is no Managed Disks fault domains setting that would place each virtual machine in its own update domain.
- C. Flexible orchestration with fixed spreading distributes virtual machines across a set number of fault domains but does not support update domains.
- D. Flexible orchestration with max spreading uses a fault domain count of 1 and does not support update domains, so it cannot meet the requirement.
Question 69
You have an Azure subscription that contains an Azure key vault named KV1.
You need to ensure that you can review how and when KV1 is accessed. The solution must minimize costs.
What should you use?
Show answer and explanation
Correct answer: C. Azure Monitor
Key Vault records every data plane request, such as reading a secret or a key, in its resource logs, together with the caller identity, the operation and the time it ran. Those resource logs are not kept until a diagnostic setting in Azure Monitor routes them to a destination, and sending them to a storage account keeps the cost low because no workspace ingestion is billed. That diagnostic setting is what makes it possible to review how and when KV1 is accessed. The activity log, by contrast, records only management operations on the vault resource itself.
Why the other options are wrong
- A. Microsoft Purview is a data governance service for cataloging and classifying data, and it does not capture the requests made against a key vault.
- B. The activity log of KV1 records only management operations, such as changes to the vault's configuration, so it does not show when secrets, keys or certificates are read.
- D. Microsoft Sentinel is a SIEM that bills for the data ingested into its workspace, which costs far more than routing the Key Vault resource logs to storage with Azure Monitor.
Question 70
You have an Azure App Service app named App1.
You need to recommend a solution to monitor the response times of App1 for end users. The solution must minimize administrative effort.
What should you include in the recommendation?
Show answer and explanation
Correct answer: C. Azure Monitor Application Insights
Azure Monitor Application Insights is the application performance monitoring feature of Azure Monitor, and it can be enabled for an App Service app directly from the portal, often without code changes. It automatically collects request rates, server response times, dependency durations and failures, and its browser telemetry captures page load and response timings as experienced by end users. These metrics are preaggregated and available immediately in dashboards and alerts, so the response times of App1 can be monitored with minimal administrative effort.
Why the other options are wrong
- A. Health check in App Service pings a path to remove unhealthy instances from the load balancer rotation; it does not measure or report response times experienced by end users.
- B. Log Analytics stores and queries log data, but on its own it does not instrument App1 to collect end-user response times, so additional configuration would be needed.
- D. Network Watcher connection monitor tests network reachability and latency between endpoints, not the application response times that end users experience.
Question 71
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Azure Activity Log
The Azure Activity Log records every control plane operation in the subscription, so each new Resource Manager deployment appears there with its resource, caller, and timestamp. Filtering it to write operations for the month is all the report needs, and the data is collected without any prior configuration.
Why the other options are wrong
- B. Azure Arc brings machines and clusters outside Azure under Azure management. It does not report on deployments in the subscription.
- C. Azure Analysis Services is a modelling engine for business data.
- D. Azure Monitor metrics are numeric time series about resource performance. A deployment is an event rather than a metric.
Question 72
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure Activity Log
The Azure Activity Log holds every control plane operation for the subscription, so each new Resource Manager deployment is recorded there with the resource affected, the caller, and the time. Filtering to write operations over the month gives the report with no prior instrumentation.
Why the other options are wrong
- A. Action groups define notification targets for alerts and record nothing themselves.
- B. Azure Arc extends management to machines outside Azure.
- C. Metrics are performance time series and do not capture deployment events.
Question 73
You are designing an application that will aggregate content for users.
You need to recommend a database solution for the application. The solution must meet the following requirements:
• Support SQL commands.
• Support multi-master writes.
• Guarantee low latency read operations.
What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Azure Cosmos DB for NoSQL
Azure Cosmos DB for NoSQL is the only option that meets all three requirements together. Its query language is SQL, enabling multi-region writes gives true multi-master behaviour, and replicating to regions close to the users delivers the guaranteed low latency reads that its SLA backs.
Why the other options are wrong
- B. Active geo-replication produces readable secondaries but keeps a single writable primary.
- C. Hyperscale scales out reads and storage while writes remain on one replica.
- D. Azure Cosmos DB for PostgreSQL distributes a relational workload across nodes but does not provide multi-region multi-master writes in this sense.
Question 74
You have an Azure subscription that contains a third-party app service app named App1. App1 uses Microsoft Entra for authentication and is licensed on a per-user basis.
The owners of App1 report that the licensing costs for App1 are higher than expected.
You need to recommend a solution that will enable the App1 owners to monitor which users have access to App1 each month. The solution must meet the following requirements:
• Follow the principle of least privilege.
• Minimize administrative effort.
What should you include in the recommendation?
Show answer and explanation
Correct answer: C. access reviews
Access reviews in Microsoft Entra ID let you schedule recurring reviews of who has access to an enterprise application, such as a monthly review of the users assigned to App1. The App1 owners can be set as the reviewers, so they can see every user with access and deny access for users who no longer need it, without being granted any administrative role in the tenant. Because the reviews recur automatically and can apply results automatically, the solution follows the principle of least privilege and minimizes administrative effort while directly addressing the per-user licensing costs.
Why the other options are wrong
- A. Conditional Access policies control the conditions under which users can sign in to App1, but they provide no periodic report or review of which users have been granted access.
- B. Privileged Identity Management manages just-in-time activation of privileged roles; it is not designed to review ordinary user assignments to a third-party app.
- D. Managed identities give Azure resources an identity to authenticate to other services and have nothing to do with tracking which users can access App1.
Question 75
You have an Azure subscription that contains 1,000 virtual machines and a Log Analytics workspace named Workspace1.
You plan to collect custom JSON logs from the virtual machines and store the logs in a custom table in Workspace1.
You need to ensure that the logs are collected by using the Logs Ingestion API. The solution must prevent access to Workspace1 from the internet.
What should you include in the solution?
Show answer and explanation
Correct answer: A. an Azure Monitor Private Link Scope (AMPLS)
The Logs Ingestion API sends data to a data collection endpoint (or a data collection rule endpoint), which routes it through a data collection rule into the custom table in Workspace1. An Azure Monitor Private Link Scope connects a virtual network to Azure Monitor resources, including data collection endpoints and Log Analytics workspaces, through a single private endpoint. After the data collection endpoint and Workspace1 are added to the AMPLS, the virtual machines send their custom JSON logs over private IP addresses, and the workspace network isolation settings can be set to block ingestion and query access from public networks. This keeps the ingestion path private while still supporting the API for all 1,000 virtual machines.
Why the other options are wrong
- B. A linked storage account is used for specific scenarios such as custom logs or saved queries stored in your own storage. It does not provide private network access to the Logs Ingestion API or block internet access to Workspace1.
- C. Service Connector configures connection settings between compute services and backing services. It does not create a private network path for Azure Monitor ingestion.
- D. Azure Peering Service optimizes internet connectivity to Microsoft services through partner providers. Traffic still uses public endpoints, so it cannot prevent internet access to Workspace1.
Question 76
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
Show answer and explanation
Correct answer: A. Azure Log Analytics
With the Activity Log not offered here, Azure Log Analytics is the answer. The Activity Log is routed into a Log Analytics workspace through a diagnostic setting, and a Kusto query over AzureActivity filtered to write operations produces the monthly list of new deployments, which can then be scheduled and exported.
Why the other options are wrong
- B. Azure Arc extends Azure management to machines outside Azure. It does not report on deployments inside the subscription.
- C. Azure Analysis Services builds semantic models over business data and has no view of subscription activity.
- D. Application Insights monitors application telemetry such as requests and exceptions, not Resource Manager operations.
Question 77
You have an app named App1 that uses two on-premises Microsoft SQL Server databases named DB1 and DB2.
You plan to migrate DB1 and DB2 to Azure You need to recommend an Azure solution to host DB1 and DB2. The solution must meet the following requirements:
• Support server-side transactions across DB1 and DB2.
• Minimize administrative effort to update the solution.
What should you recommend?
Show answer and explanation
Correct answer: B. two databases on the same Azure SQL managed instance
Server-side transactions spanning two databases require both databases to live inside one instance. Azure SQL Managed Instance supports cross-database queries and distributed transactions between databases on the same instance, and because it is a managed service, patching, backups, and high availability are handled for you, which keeps the administrative effort down.
Why the other options are wrong
- A. Databases in an elastic pool are still separate Azure SQL databases and cannot take part in a server-side transaction with each other.
- C. Two databases on one SQL Server instance on a virtual machine would support the transactions, but you then own the operating system, patching, and backups.
- D. Databases on different logical servers are even further apart and cannot share a transaction.
Question 78
You are planning an Azure IoT Hub solution that will include 50,000 IoT devices.
Each device will stream data, including temperature, device ID, and time data. Approximately 50,000 records will be written every second. The data will be visualized in near real time.
You need to recommend a service to store and query the data.
Which two services can you recommend? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: C, D. Azure Cosmos DB for NoSQL; Azure Time Series Insights
Azure Cosmos DB for NoSQL scales write throughput to handle 50,000 records per second and serves low latency queries for the visualisation. Azure Time Series Insights is designed specifically for time-stamped device telemetry, taking the IoT Hub stream directly and providing storage, query, and near real time visualisation over it. Either is a complete solution.
Why the other options are wrong
- A. Table Storage cannot sustain this ingest rate and its query model is limited to partition and row key lookups.
- B. Event Grid routes events to handlers. It persists nothing and cannot be queried.
Question 79
You have an application that is used by 6,000 users to validate their vacation requests. The application manages its own credential store.
Users must enter a username and password to access the application. The application does NOT support identity providers.
You plan to upgrade the application to use single sign-on (SSO) authentication by using an Azure Active Directory (Azure AD) application registration.
Which SSO method should you use?
Show answer and explanation
Correct answer: C. password-based
The application manages its own credential store and supports no identity provider, so it cannot be changed to accept a federated token. Password-based SSO is the method for exactly that case: Azure AD stores the credentials for each user and replays them into the app's own sign-in form, so users get single sign-on without the application being modified.
Why the other options are wrong
- A. Header-based SSO requires the app to trust an HTTP header for identity, which is a change to how it authenticates.
- B. SAML requires the application to act as a service provider and consume assertions, which an app with no identity provider support cannot do.
- D. OpenID Connect likewise requires the application to implement a federation protocol.
Question 80
You are developing an app that will read activity logs for an Azure subscription by using Azure Functions.
You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative effort.
What should you include in the recommendation?
Show answer and explanation
Correct answer: B. system-assigned managed identities
A system-assigned managed identity is enabled on the function app itself, and Azure creates and rotates the credential automatically. Granting that identity the Reader role on the subscription lets the function read the activity logs with no secret to store, no application registration to maintain, and no expiry to track, which is the minimum administrative effort.
Why the other options are wrong
- A. An enterprise application represents a service instance in the directory. It still needs credentials configured and managed.
- C. Shared access signatures authorise access to storage resources. They do not authenticate a caller to the Azure management API.
- D. An application registration requires a secret or certificate that has to be stored and rotated, which is exactly the overhead a managed identity removes.
Question 81
You are planning an Azure IoT Hub solution that will include 50,000 IoT devices.
Each device will stream data, including temperature, device ID, and time data. Approximately 50,000 records will be written every second. The data will be visualized in near real time.
You need to recommend a service to store and query the data.
Which two services can you recommend? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: C, D. Azure Cosmos DB SQL API; Azure Time Series Insights
Both of these can absorb 50,000 writes per second and be queried for a near real time visualisation. Azure Cosmos DB with the SQL API scales throughput horizontally and serves low latency queries over the telemetry. Azure Time Series Insights is purpose-built for exactly this shape of data, ingesting time-stamped device readings and providing the query and visualisation layer over them.
Why the other options are wrong
- A. Table Storage cannot sustain this ingest rate and offers only key based lookups, which is too limited for the queries required.
- B. Event Grid is an event routing service. It delivers notifications and stores nothing to query.
Question 82
You have an Azure subscription that contains 10 web apps. The apps are integrated with Azure AD and are accessed by users on different project teams.
The users frequently move between projects.
You need to recommend an access management solution for the web apps. The solution must meet the following requirements:
• The users must only have access to the app of the project to which they are assigned currently.
• Project managers must verify which users have access to their project’s app and remove users that are no longer assigned to their project.
• Once every 30 days, the project managers must be prompted automatically to verify which users are assigned to their projects.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. Azure AD Identity Governance
Identity Governance is the umbrella that contains entitlement management and access reviews, which together cover all three requirements. Access packages grant a user the app for the project they are currently on and remove it when they move, and a recurring access review set to every 30 days prompts each project manager to confirm who should still have their project's app and removes those who should not.
Why the other options are wrong
- A. Identity Protection detects risky users and sign-ins. It does not manage who is entitled to which app.
- B. Microsoft Defender for Identity monitors on-premises Active Directory for attacks.
- C. Permissions Management discovers and right-sizes permissions across cloud infrastructure. It does not run manager attestations on app assignments.
Question 83
You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a user named User1 that is assigned a Microsoft Entra ID P2 license.
The tenant has security defaults disabled.
You need to ensure that User1 is prompted for multifactor authentication (MFA) when the user attempts to access Azure resources from untrusted networks. The solution must minimize administrative effort.
What should you use?
Show answer and explanation
Correct answer: D. a sign-in risk policy
User1 has a Microsoft Entra ID P2 license, which includes Microsoft Entra ID Protection. A sign-in risk policy evaluates each authentication attempt against built-in detections such as anonymous IP addresses, unfamiliar sign-in properties and atypical travel, which are typical of access from untrusted networks, and requires MFA when the sign-in risk reaches the configured level. The detections are maintained by Microsoft, so the policy is configured once and no list of network locations or IP ranges has to be built and kept current, which minimizes administrative effort.
Why the other options are wrong
- A. A user risk policy responds to the likelihood that the account itself is compromised, such as leaked credentials, and typically forces a password change. It does not evaluate the network of each sign-in.
- B. An access package bundles resources that users request through entitlement management. It does not prompt for MFA at sign-in.
- C. An identity governance policy manages access lifecycle tasks such as requests and reviews. It does not enforce MFA based on the network a user signs in from.
Question 84
You have a business-critical app named App1 that is hosted in an Azure Kubernetes Service (AKS) cluster.
You need to recommend a configuration solution for the cluster. The solution must meet the following requirements:
• Maintain availability during planned datacenter maintenance events.
• Support dynamic scaling in response to workload demands.
• Minimize downtime if a datacenter fails.
What should you recommend?
Show answer and explanation
Correct answer: D. an AKS cluster with availability zones enabled
Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking. An AKS cluster with availability zones enabled spreads its node pools across zones, so planned maintenance or the failure of one datacenter affects only part of the nodes, and the remaining zones keep App1 running with minimal downtime. Zone-spanning node pools are backed by virtual machine scale sets, so the cluster autoscaler can still add and remove nodes dynamically in response to workload demand. This is the only option that satisfies all three requirements within a single cluster.
Why the other options are wrong
- A. A cluster in a single availability zone runs entirely in one datacenter, so a datacenter failure takes the whole cluster down.
- B. Multiple node pools in the same zone still share one datacenter, so they provide no protection if that datacenter fails.
- C. An AKS cluster is a regional resource and its nodes cannot be deployed across different Azure regions; multiregion designs require separate clusters.
Question 85
You have an Azure subscription.
You plan to deploy an Azure SQL database named DB1 that will store the maximum daily temperature.
You need to recommend a solution to query an external website, retrieve the maximum temperature from the previous 24 hours, and write the temperature to DB1. The solution should minimize costs, development effort, and administrative effort.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. an Azure function
The requirement is a small, recurring job: once a day, call an external website, read the maximum temperature for the previous 24 hours, and write one value to DB1. Azure Functions handles this with a timer trigger that runs the code on a schedule, and an Azure SQL output binding writes the result to the database without custom data access plumbing, which minimizes development effort. On the Consumption or Flex Consumption plan you pay only for the brief execution time, so costs are minimal, and because the service is serverless there are no servers, pools, or containers to manage, which minimizes administrative effort.
Why the other options are wrong
- A. Azure Batch is designed for large-scale parallel and HPC jobs and requires defining pools, jobs, and tasks, which adds cost and administrative effort for a single daily lookup.
- B. An event hub is a high-throughput event ingestion service. It cannot query a website or write to a database on its own, so separate compute would still be required.
- C. An Azure container instance requires building and maintaining a container image plus a separate scheduling mechanism, which increases development and administrative effort compared to a timer-triggered function.
Question 86
You have a Microsoft Dataverse instance named dv1 and an Azure Cosmos DB database named db1.
You need to develop a solution to update db1 automatically when a record is updated in dv1. The solution must minimize development effort.
What should you include in the solution?
Show answer and explanation
Correct answer: D. Azure Logic Apps
Azure Logic Apps provides prebuilt connectors for both Microsoft Dataverse and Azure Cosmos DB. A workflow can start with the Dataverse trigger that fires when a row is added, modified or deleted, and then use the Azure Cosmos DB connector action to create or update the matching document in db1. Because the whole integration is assembled from managed connectors in a visual designer, there is no custom code to write, host or maintain, which minimizes development effort.
Why the other options are wrong
- A. Azure Event Grid routes events to handlers, but it has no built-in Dataverse source and cannot write documents to Cosmos DB on its own, so code would still be required.
- B. Azure App Service hosts web apps and APIs, which means writing and deploying custom code to watch Dataverse and update Cosmos DB.
- C. Azure Functions would require writing code to receive Dataverse changes and call the Cosmos DB API, which is more development effort than using ready-made connectors.
Question 87
Your company has IT, security, and finance departments.
You need to implement a new Azure deployment that will include multiple Azure subscriptions and management groups. The solution must meet the following requirements:
• Ensure that all policies are assigned at the management group level.
• Ensure that all the finance department resources have specific encryption policies applied.
• Ensure that only users in the IT department can create virtual machines in any Azure region.
• Ensure that users in the finance department can create virtual machines in only the East US Azure region.
What is the minimum number of management groups you can create for the planned deployment?
Show answer and explanation
Correct answer: B. 2
Azure Policy assignments made at a management group are inherited by every subscription beneath it, while which users can create resources is controlled by Azure RBAC rather than by policy. Only two distinct policy sets are required: a finance management group that carries the encryption policies and an allowed-locations policy limiting virtual machines to East US, and an IT management group with no region restriction. RBAC role assignments then limit virtual machine creation to the IT and finance users. The security department has no policy requirement of its own, and the root management group already exists, so the minimum number of management groups you create is two.
Why the other options are wrong
- A. A single management group cannot apply the finance encryption and East US restrictions without also applying them to the IT subscriptions.
- C. Three groups exceed the minimum because the security department has no distinct policy requirement that needs its own scope.
- D. Four groups exceed the minimum number needed to separate the finance and IT policy sets.
Question 88
You have an Azure subscription.
You have a Microsoft Entra tenant.
You need to recommend a Microsoft Entra Identity Governance solution to manage the user lifecycle. The solution must meet the following requirements:
• Ensure that users have the correct permission for the correct resources and that the permissions are evaluated every quarter.
• If a user is assigned a new role, ensure that the correct permissions are granted for the correct resources and regularly evaluated for the new role.
• When a user leaves the company, ensure that the user’s permissions are revoked.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. access reviews
Access reviews in Microsoft Entra ID Governance let you schedule recurring reviews, such as every quarter, of group memberships, application assignments and role assignments, so that reviewers confirm each user still needs each permission. Because the reviews recur, access granted when a user moves into a new role is included in the next review cycle and evaluated against that role. When reviewers deny access, or a departed user's access is not confirmed, the auto-apply setting removes the assignment, which revokes the permissions of users who have left the company. This covers all three lifecycle requirements with one governance feature.
Why the other options are wrong
- A. Conditional Access evaluates conditions at sign-in and enforces controls such as MFA. It does not periodically review or remove permission assignments.
- B. Privileged Identity Management provides just-in-time activation of privileged roles. It does not govern access to all resources across the joiner, mover and leaver lifecycle.
- C. Microsoft Entra ID Protection detects risky users and risky sign-ins. It does not evaluate or revoke resource permissions on a schedule.
Question 89
You plan to use an Azure Storage account to store data assets.
You need to recommend a solution that meets the following requirements:
• Supports immutable storage
• Disables anonymous access to the storage account
• Supports access control list (ACL)-based Azure AD permissions
What should you include in the recommendation?
Show answer and explanation
Correct answer: B. Azure Data Lake Storage
Azure Data Lake Storage is the only option that covers all three. Its hierarchical namespace provides POSIX-style access control lists that work alongside Azure AD identities, giving the ACL-based permissions asked for. It is built on Blob Storage, so immutability policies apply, and anonymous public access can be disabled at the account level.
Why the other options are wrong
- A. Azure Files uses share-level permissions and NTFS ACLs over SMB rather than Azure AD ACLs of this kind, and it does not support immutable storage policies.
- C. Azure NetApp Files is an NFS and SMB service with its own permission model. It has no Azure AD ACL or immutability support.
- D. Blob Storage supports immutability and disabling anonymous access, but access is governed by RBAC at container and account level. The per-item ACLs come from the hierarchical namespace of Data Lake Storage.
Question 90
You have an Azure subscription that contains an Azure Data Lake Storage Gen2 account named storage1 and an Azure Synapse Analytics workspace named Workspace1. Workspace1 contains a serverless SQL pool and an Apache Spark pool.
You need to recommend a disaster recovery solution for storage1.
What should you include in the recommendation?
Show answer and explanation
Correct answer: D. asynchronous replication
Disaster recovery for an Azure Data Lake Storage Gen2 account is provided by geo-redundant storage. With GRS or GZRS, Azure Storage asynchronously replicates the account's data, including the hierarchical namespace metadata and ACLs, to a secondary region hundreds of miles away. If the primary region becomes unavailable, a customer-managed failover promotes the secondary region so that the serverless SQL pool and the Apache Spark pool in Workspace1 can again read the data. Accounts with a hierarchical namespace support both planned and unplanned customer-managed failover, so asynchronous replication is the recovery mechanism for storage1.
Why the other options are wrong
- A. Vaulted backup of Azure blobs targets standard blob accounts and protects against deletion or corruption; it is not the regional disaster recovery mechanism for a Data Lake Storage Gen2 account.
- B. Operational backup of Azure blobs keeps restore points locally in the source account and does not support accounts with a hierarchical namespace, so it provides no protection from a regional outage.
- C. Geo-backup in Azure Synapse Analytics protects only dedicated SQL pool data warehouses; Workspace1 has no dedicated SQL pool, and geo-backup never covers a storage account.
That was 90 of 382.
The full Microsoft AZ-305 pack has all 382 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 191 free as one PDF by email. Get the Half Pack →