AZ-305 sample exam questions

Azure Policy can be assigned at management group, subscription, resource group (and individual resource) scope within the ARM hierarchy. Entra ID tenants and administrative units are identity scopes, not ARM policy scopes; 'compute resources' is not a valid answer in this question's intended set.

A managed identity is an app-only identity, so it uses the OAuth 2.0 client credentials flow with no user involved. Code on the VM gets the token with a simple REST call to the Instance Metadata Service (IMDS) endpoint 169.254.169.254, which needs no secrets. The Entra token endpoints would require client credentials.

Azure Cosmos DB for PostgreSQL stores data relationally, supports standard SQL queries, and can be geo-replicated with cross-region read replicas. The NoSQL API supports SQL-like queries but is document-based, not relational, and Cassandra and MongoDB APIs are non-relational and do not use SQL.

Point-in-time restore works only for block blobs in general purpose v2 accounts and requires blob versioning, soft delete and the blob change feed to be enabled. Page and append blobs are not supported, and immutability, object replication and stored access policies are unrelated.

A 500 TB database that must not cross the internet is moved offline with Azure Data Box (Data Box Heavy) devices. Azure Migrate server migration supports test migrations before cutover and replication-based migration that minimizes downtime. DMA and Site Recovery are not the intended tools here.

Spot Priority Mix is a feature of Flexible orchestration scale sets: a base of standard VMs guarantees minimum capacity while extra scale-out capacity uses cheap Spot VMs. Capacity reservations add cost, an eviction policy alone does not mix priorities, and availability sets do not autoscale.

Enabling availability zones on the AKS cluster spreads nodes across separate datacenters in the region, so the app stays up during datacenter maintenance or failure, and the cluster autoscaler still scales dynamically. Single-zone clusters share one datacenter, and a single AKS cluster cannot span multiple regions.

Azure Service Bus sessions guarantee ordered, first-in first-out processing of related messages by locking a session to one receiver. Storage queues do not guarantee ordering regardless of metadata or access policies, and partitioning spreads messages across brokers, which can break ordering.

All the VNets share the same DNS, so Microsoft recommends a single AMPLS to avoid conflicting DNS records. Peered VNet1 and VNet2 can share one private endpoint, but isolated VNet3 needs its own, which makes two private endpoints.

The requirement that App1 data cannot be modified or deleted for a set period is met by a time-based retention (immutability) policy, configured as an access policy on the blob container. Resource locks protect only the storage account resource, RBAC can be bypassed by owners, and the public access level does not stop modification.

A scheduled Azure Function in the Consumption plan runs the maintenance task on a timer trigger and is billed only per execution, so it is the cheapest option. A virtual machine runs continuously, a WebJob needs an always-on App Service plan, and a Logic App is less suited to running custom maintenance code.

Deploying additional domain controllers for the existing corp.fabrikam.com domain to Azure virtual networks lets Azure-hosted workloads authenticate locally and keeps authentication available if on-premises connectivity fails. Moving all DCs removes on-premises resilience, and a new tenant or the rd.fabrikam.com forest does not meet the planned changes.

Assigning Network Contributor to the required groups at the appropriate scopes (for example, once per resource group or subscription that contains the networking resources) means the minimum is two assignments rather than one per user or VNet. Assigning to groups instead of individual users keeps the count minimal.

Azure SQL Database long-term retention (LTR) keeps weekly, monthly or yearly full backups for up to 10 years, meeting retention beyond the 1 to 35 days of automatic backups. Site Recovery is for VMs, and geo-replication provides availability, not historical backup retention.

Azure Application Insights provides application performance monitoring for App2, including request rates, response times, dependencies, exceptions and availability tests. VM insights and Container insights monitor infrastructure, and Microsoft Sentinel is a SIEM for security analytics.