AZ-305 Azure Solutions Architect Expert Practice Questions with Explanations
Free AZ-305 Azure Solutions Architect Expert practice questions with an explanation for every answer. Covers identity and governance, data storage, business continuity, infrastructure design, and migration planning.
Questions
Logs from 40 subscriptions must be stored centrally and queried together with KQL. What should you recommend?
- A Log Analytics workspace
- A storage account per subscription
- An Event Hubs namespace
- An Azure Monitor workbook
Security wants Azure platform logs streamed in near real time to a third-party SIEM. Where should diagnostic settings send them?
- Azure Event Hubs
- Azure Storage queues
- A Recovery Services vault
- Azure App Configuration
Audit logs must be kept for 7 years at the lowest cost and are almost never queried. Which destination fits best?
- A storage account, using cool or archive tiers
- A Log Analytics workspace on the Analytics plan
- An Event Hubs namespace with capture disabled
- An Azure Cache for Redis instance
Developers need request rates, exceptions, dependency calls, and response times for a web app. What should you recommend?
- Application Insights
- Azure Advisor
- Network Watcher
- Azure Resource Graph
Operations wants interactive reports that combine metrics, logs, and text in one shareable view. What should you recommend?
- Azure Workbooks
- Azure Blueprints
- Activity log alerts
- Azure Policy initiatives
You need a notification when an Azure platform outage affects the regions and services you use. What should you recommend?
- Azure Service Health alerts
- VM insights
- Application Insights availability tests
- A budget alert
An alert must fire when a KQL query over a workspace returns more than 10 failed sign-ins in 5 minutes. Which alert type fits?
- A log search alert
- A metric alert
- An activity log alert
- A Service Health alert
Users should sign in to cloud apps with their on-premises password, and sign-in must keep working even if the on-premises network is down. Which method fits?
- Password hash synchronization
- Pass-through authentication
- Federation with AD FS
- Seamless single sign-on configured by itself
Policy says password hashes must never be stored in the cloud, and the company doesn't want to run federation servers. Which method fits?
- Pass-through authentication
- Password hash synchronization
- Federation with AD FS
- Cloud-only accounts
A company with several disconnected AD forests wants lightweight agents to sync users to Microsoft Entra ID. What should you recommend?
- Microsoft Entra Cloud Sync
- Microsoft Entra Connect Sync on one server
- Azure AD B2C
- Microsoft Entra Domain Services
MFA must be required only when users sign in from outside the corporate network. What should you recommend?
- A Conditional Access policy
- Security defaults
- Self-service password reset
- An Azure Policy assignment
What is the minimum Microsoft Entra ID license needed for Conditional Access?
- P1
- Free
- P2
- Office 365 E1
Sign-ins flagged as risky, such as impossible travel, should automatically require MFA. Which feature provides the risk detection?
- Microsoft Entra ID Protection
- Privileged Identity Management
- Entitlement management
- Microsoft Entra Connect Health
Admins should have no standing Global Administrator access, and should activate the role for a few hours with approval. What should you recommend?
- Privileged Identity Management
- Conditional Access
- Azure Policy
- Conditional Access with a sign-in frequency policy
Managers must confirm every quarter whether guest users still need access to a team's resources. What should you recommend?
- Access reviews
- Azure Policy compliance scans
- Activity log alerts
- Resource locks
External partners need a bundle of groups, apps, and SharePoint sites they can request, with access that expires automatically. What should you recommend?
- Entitlement management access packages
- A dynamic security group
- A custom RBAC role
- A management group
An app running on a VM must read secrets from Key Vault without storing any credentials in code or config. What should you recommend?
- A managed identity
- A service principal with a client secret
- A shared access signature
- A storage account key
Fifty function apps need the same identity and permissions, and the identity must survive if any app is deleted. Which type fits?
- User-assigned managed identity
- System-assigned managed identity
- A separate guest account per app
- A shared administrator account
What happens to a system-assigned managed identity when its resource is deleted?
- It is deleted with the resource
- It becomes a user-assigned identity
- It stays until an admin removes it
- It moves to the resource group
Where should an architect recommend storing application secrets, certificates, and encryption keys?
- Azure Key Vault
- App Service application settings
- A private GitHub repository
- Azure Table storage
A bank requires keys in a single-tenant, fully customer-controlled hardware security module pool in Azure. What should you recommend?
- Azure Key Vault Managed HSM
- Azure Key Vault Standard tier
- Storage service encryption with Microsoft-managed keys
- Azure App Configuration
Deleted Key Vault secrets must be recoverable and must not be permanently removable even by an admin during the retention period. What should you enable?
- Soft delete with purge protection
- A ReadOnly lock on the vault
- A private endpoint for the vault
- Geo-redundant storage for the vault
Which permission model does Microsoft recommend for controlling access to Key Vault data?
- Azure RBAC
- Vault access policies
- Shared access signatures
- Storage account keys
A new public-facing app must let customers sign up with email or social accounts. What should you recommend?
- Microsoft Entra External ID
- Microsoft Entra Domain Services
- Microsoft Entra Connect
- A guest user per customer in the workforce tenant
Remote employees must reach an on-premises web app with Entra sign-in and MFA, without a VPN. What should you recommend?
- Microsoft Entra application proxy
- Azure Bastion
- A site-to-site VPN from each employee's home
- Azure Front Door
Legacy apps moving to Azure VMs need LDAP and Kerberos, and the company doesn't want to manage domain controllers. What should you recommend?
- Microsoft Entra Domain Services
- Microsoft Entra External ID
- Microsoft Entra Connect Sync with password writeback
- Conditional Access
A security baseline policy must apply to every current and future subscription in the company. Where should you assign it?
- At a management group above all subscriptions
- On each resource group individually
- On each subscription by hand
- On every individual resource in each subscription
Production and development need separate billing, separate quotas, and a hard access boundary. What should you recommend?
- Separate subscriptions
- Separate resource groups in one subscription
- Separate tags in one subscription
- Separate regions in one subscription
Every resource must have a CostCenter tag, or it can't be created. What should you recommend?
- Azure Policy with a Require a tag definition
- A Delete lock on each resource group
- An RBAC role on each subscription
- An Azure Advisor operational excellence recommendation
Leadership wants a dashboard showing compliance against standards such as ISO 27001 across subscriptions. What should you recommend?
- Microsoft Defender for Cloud regulatory compliance
- Azure Monitor metrics explorer
- Azure Cost Management budgets
- Azure Resource Mover
You need to query properties of thousands of resources across many subscriptions in seconds. What should you recommend?
- Azure Resource Graph
- Azure Advisor
- Azure Data Factory
- Azure Activity log
Which Microsoft framework provides guidance and landing zone designs for adopting Azure at scale?
- Cloud Adoption Framework
- Microsoft Security Development Lifecycle
- Azure Advisor score
- Azure Service Health
To follow least privilege and simplify management, who should Azure roles usually be assigned to?
- Groups
- Individual users
- Every guest user
- The subscription owner only
Built-in roles grant more permissions than a support team needs. What should you recommend?
- A custom role with only the needed actions
- The Owner role scoped to the support team's resource group
- The Contributor role at the subscription
- A Global Administrator assignment
Data for EU customers must never be stored outside EU regions. What should you recommend?
- Azure Policy with Allowed locations
- A Delete resource lock
- A Conditional Access policy blocking non-EU sign-ins
- Microsoft Entra ID Protection
Which features require Microsoft Entra ID P2?
- Privileged Identity Management
- Risk-based Conditional Access
- Basic Conditional Access
- Dynamic membership groups
With pass-through authentication, users can still sign in if every on-premises authentication agent is offline.
A tagging strategy must support chargeback to departments. Which tag is most important for that goal?
- CostCenter
- CreatedDate
- OSVersion
- PatchGroup
Activity logs need to be kept longer than 90 days and queried with other logs. What should you recommend?
- Send them to a Log Analytics workspace
- Increase the activity log retention setting
- Export them to a Service Bus queue
- Enable soft delete on the subscription
Which Azure Monitor component defines what data an Azure Monitor Agent collects and where it sends it?
- A data collection rule
- An action group
- An alert processing rule
- A diagnostic setting on the VM
A company is moving an on-premises SQL Server that uses SQL Agent jobs and cross-database queries. They want PaaS with near-100% compatibility. What should you recommend?
- Azure SQL Managed Instance
- Azure SQL Database single database
- Azure Cosmos DB for NoSQL
- Azure Table storage
An app needs SQL Server features that require full operating system access and a custom install. What should you recommend?
- SQL Server on an Azure VM
- Azure SQL Database serverless
- Azure SQL Managed Instance
- Azure Database for MySQL
A new cloud-native app needs one fully managed relational database with no instance-level features. What should you recommend?
- Azure SQL Database
- SQL Server on an Azure VM
- Azure SQL Managed Instance
- Azure Data Lake Storage
An Azure SQL database will grow to 50 TB and needs fast scaling and near-instant backups. Which service tier fits?
- Hyperscale
- Basic
- General Purpose
- Standard (DTU)
A SaaS vendor runs 200 small databases with unpredictable, uneven usage. What keeps cost low while handling the peaks?
- An elastic pool
- Hyperscale for each database
- A separate Business Critical database each
- SQL Server on a single large VM
A dev database is used a few hours a week and should cost almost nothing when idle. Which compute tier fits?
- Serverless
- Provisioned
- Business Critical
- Hyperscale named replicas
Why might you choose the vCore purchasing model over DTU for Azure SQL Database?
- To size compute and storage separately
- Because DTU doesn't support backups
- Because vCore is always the cheapest
- Because DTU databases can't use any SSD-based storage
An Azure SQL workload needs the lowest I/O latency and a built-in readable secondary replica. Which service tier fits?
- Business Critical
- General Purpose
- Basic
- Standard (DTU)
Heavy reporting queries slow down a Business Critical database. How can you offload them at no extra cost?
- Use read scale-out with ApplicationIntent=ReadOnly
- Add a second elastic pool for the same data
- Switch the database to the Basic service tier
- Turn on transparent data encryption
Which feature encrypts an Azure SQL database at rest and is enabled by default?
- Transparent data encryption
- Always Encrypted
- Dynamic data masking
- Row-level security