AZ-305: Azure Infrastructure Solutions

AZ-305 Practice Exam 2

60 questions

AZ-305 Practice Exam 3

60 questions

AZ-305 Practice Exam 4

60 questions

Flashcards

How do CAF and the Well-Architected Framework differ?

Architecture foundations and design method

CAF guides organizational adoption and the shared Azure foundation; the Well-Architected Framework evaluates the quality of an individual workload.

Source guide: PDF page(s) 4.

What should an architect do before choosing Azure services?

Architecture foundations and design method

Identify business outcomes, functional requirements, measurable quality targets, constraints, dependencies, and operating responsibilities.

Source guide: PDF page(s) 4.

What distinguishes a functional requirement from a quality requirement?

Architecture foundations and design method

A functional requirement states what the system does; a quality requirement states how well it does it, such as checkout latency or availability.

Source guide: PDF page(s) 4.

How should the requirement 'highly available' be made testable?

Architecture foundations and design method

Define a service level objective for a specified user journey, measurement window, and failure conditions.

Source guide: PDF page(s) 4.

How should 'recover quickly' and 'lose little data' be translated into targets?

Architecture foundations and design method

Define a recovery time objective for restoring acceptable service and a recovery point objective for tolerated data loss measured in time.

Source guide: PDF page(s) 4.

What are the seven phases in the current CAF overview?

Architecture foundations and design method

Strategy, Plan, Ready, Adopt, Govern, Secure, and Manage.

Source guide: PDF page(s) 4.

What does CAF Strategy establish?

Architecture foundations and design method

Business motivations, desired outcomes, and the basis for evaluating the value of cloud adoption.

Source guide: PDF page(s) 4.

What does CAF Plan prepare?

Architecture foundations and design method

People, skills, costs, workload priorities, ownership, funding, and the adoption backlog.

Source guide: PDF page(s) 4.

What does CAF Ready establish?

Architecture foundations and design method

The Azure foundation and landing zones needed before workloads are adopted.

Source guide: PDF page(s) 4.

Which activities does the current CAF Adopt phase include?

Architecture foundations and design method

Migration, modernization, and building cloud-native workloads.

Source guide: PDF page(s) 4.

Why do CAF Govern, Secure, and Manage continue during adoption?

Architecture foundations and design method

Guardrails, protection, and operations must evolve as workloads are adopted and optimized.

Source guide: PDF page(s) 4.

What is an Azure landing zone?

Architecture foundations and design method

An architecture and operating foundation with management, identity, connectivity, security, governance, and operational capabilities; it is not a single service.

Source guide: PDF page(s) 4-5.

What does a platform landing zone provide?

Architecture foundations and design method

Shared capabilities such as connectivity, identity integration, policy, security, and management for workload environments.

Source guide: PDF page(s) 4-5.

What is the purpose of a workload landing zone?

Architecture foundations and design method

Give an application team a governed environment in which to deploy and operate its workload.

Source guide: PDF page(s) 4-5.

Why must platform and workload ownership be documented?

Architecture foundations and design method

Shared connectivity and policy ownership differ from application configuration, data, and recovery ownership; gaps otherwise create operational failures.

Source guide: PDF page(s) 5.

What are the five Well-Architected pillars?

Architecture foundations and design method

Reliability, Security, Cost Optimization, Operational Excellence, and Performance Efficiency.

Source guide: PDF page(s) 5.

What does the Reliability pillar prioritize?

Architecture foundations and design method

Meeting availability and recovery targets through redundancy, fault isolation, capacity planning, and tested recovery.

Source guide: PDF page(s) 5.

What does the Security pillar prioritize?

Architecture foundations and design method

Protecting confidentiality, integrity, and availability with verified identity, least privilege, segmentation, encryption, detection, and response.

Source guide: PDF page(s) 5.

What does the Cost Optimization pillar prioritize?

Architecture foundations and design method

Getting required business value from spending through rightsizing, waste removal, demand modeling, and total operating cost analysis.

Source guide: PDF page(s) 5.

What does Operational Excellence prioritize?

Architecture foundations and design method

Safe deployment, observation, operation, and improvement through automation, telemetry, runbooks, and controlled change.

Source guide: PDF page(s) 5.

What does Performance Efficiency prioritize?

Architecture foundations and design method

Capacity and design that deliver the required user experience as demand changes, based on measured bottlenecks and scaling patterns.

Source guide: PDF page(s) 5.

Why should a design record tradeoffs among WAF pillars?

Architecture foundations and design method

Improving one quality can affect another: extra regional copies improve resilience but add cost and operational work.

Source guide: PDF page(s) 5.

What is an Azure region?

Architecture foundations and design method

A geographic deployment area containing datacenters and regional services.

Source guide: PDF page(s) 6.

What is an availability zone?

Architecture foundations and design method

A separated logical grouping of one or more datacenters within a region with independent power, cooling, and networking.

Source guide: PDF page(s) 6.

How does a zonal resource differ from a zone-redundant service?

Architecture foundations and design method

A zonal resource is placed in a chosen zone; a zone-redundant service distributes supported components across zones according to its service design.

Source guide: PDF page(s) 6.

Must VMs in different zones use different subnets solely because of zone placement?

Architecture foundations and design method

No. A subnet normally spans zones within its region.

Source guide: PDF page(s) 6.

Does logical zone 1 identify the same physical zone across all subscriptions?

Architecture foundations and design method

No. Logical-to-physical zone mappings are subscription-specific; validate mappings when coordinating cross-subscription deployments.

Source guide: PDF page(s) 6.

Is Azure data transfer between availability zones in the same region currently charged?

Architecture foundations and design method

Azure currently does not charge for that transfer. Additional replicas and supported service tiers can still increase cost.

Source guide: PDF page(s) 6.

What failure boundary does multi-region design address beyond availability zones?

Architecture foundations and design method

Regional incidents; it requires routing, data replication, identity and dependency availability, and recovery procedures.

Source guide: PDF page(s) 6.

Does deploying in a paired region automatically provide application failover?

Architecture foundations and design method

No. Replication and failover are service-specific and must be configured and tested with application recovery.

Source guide: PDF page(s) 6.

Do all Azure regions have region pairs?

Architecture foundations and design method

No. Many regions are unpaired, and service replication choices differ; verify actual destinations and residency.

Source guide: PDF page(s) 6.

What remains the customer's responsibility for Azure IaaS VMs?

Architecture foundations and design method

Guest OS, applications, patching, data, permissions, and much configuration, while Microsoft operates physical infrastructure.

Source guide: PDF page(s) 6.

What responsibilities remain with a PaaS customer?

Architecture foundations and design method

Application code, data, permissions, and relevant security and recovery configuration, despite more platform maintenance moving to Microsoft.

Source guide: PDF page(s) 6.

What responsibilities remain with a SaaS customer?

Architecture foundations and design method

Identity, authorized use, data governance, and application configuration within the service's shared-responsibility model.

Source guide: PDF page(s) 6.

How do SLA, SLO, and SLI differ?

Architecture foundations and design method

SLA is a provider's contractual commitment; SLO is the workload's target; SLI is the measurement used to evaluate that target.

Source guide: PDF page(s) 7.

Why is multiplying component SLA percentages insufficient for workload availability planning?

Architecture foundations and design method

Contracts have different conditions and downtime definitions, and dependencies can share failure modes. Analyze measured user journeys and end-to-end failures.

Source guide: PDF page(s) 7.

Under an explicitly independent serial-component model, what is 99.9% times 99.9%?

Architecture foundations and design method

0.999 × 0.999 = 0.998001, or 99.8001%. This is mathematical intuition, not an application contractual SLA or a reliable availability estimate.

Source guide: PDF page(s) 7.

Which costs belong in a workload's total operating cost model?

Architecture foundations and design method

Compute, storage, requests, telemetry, backup, networking, support, licensing, labor, and normal, peak, and recovery operation.

Source guide: PDF page(s) 7.

When can committed pricing suit a workload?

Architecture foundations and design method

When demand is predictable and the commitment matches expected use; variable workloads may favor flexible consumption.

Source guide: PDF page(s) 7.

Why can a technically capable service still be the wrong recommendation?

Architecture foundations and design method

It may violate residency, require unavailable skills, miss recovery targets, introduce excessive administration, or exceed the budget.

Source guide: PDF page(s) 4.

What monitoring design choices should be made together?

Monitoring and logging

Choose the operational questions, signals, collection paths, destinations, retention, access, and response process together. A workspace alone does not make a workload observable.

Source: AZ-305 Study Guide.pdf, PDF page(s) 8; reference [I07]. Newly generated study item; human review pending.

When are metrics the most suitable telemetry signal?

Monitoring and logging

Use numeric time series such as CPU, latency, request count, and queue depth for trends, dashboards, and supported threshold alerts.

Source: AZ-305 Study Guide.pdf, PDF page(s) 8; reference [I07]. Newly generated study item; human review pending.

When are logs more useful than metrics?

Monitoring and logging

Use timestamped structured records for detailed investigation, audit evidence, correlation, and queries across components.

Source: AZ-305 Study Guide.pdf, PDF page(s) 8; reference [I07]. Newly generated study item; human review pending.

What question does distributed tracing answer?

Monitoring and logging

It follows one request through services and dependencies to identify where latency or failure occurs.

Source: AZ-305 Study Guide.pdf, PDF page(s) 8; reference [I15]. Newly generated study item; human review pending.

How do activity logs and resource logs differ?

Monitoring and logging

Activity logs record subscription-level management events. Resource logs record service-specific operations, often including data-plane activity.

Source: AZ-305 Study Guide.pdf, PDF page(s) 8; reference [I08]. Newly generated study item; human review pending.

Which telemetry is generally collected automatically, and which needs configuration?

Monitoring and logging

Supported platform metrics and activity logs are automatic. Resource logs generally need diagnostic settings; guest logs need an agent and collection configuration; application telemetry needs instrumentation.

Source: AZ-305 Study Guide.pdf, PDF page(s) 8; reference [I08]. Newly generated study item; human review pending.

Why does installing Azure Monitor Agent not collect every workload log?

Monitoring and logging

AMA collects supported guest telemetry through its collection configuration. Resource diagnostic logs and application instrumentation use separate collection paths.

Source: AZ-305 Study Guide.pdf, PDF page(s) 8; reference [I09]. Newly generated study item; human review pending.

What signals should a customer-journey health model include?

Monitoring and logging

Monitor availability, error rate, latency, throughput, and saturation, then add dependency and capacity signals. CPU alone does not establish customer impact.

Source: AZ-305 Study Guide.pdf, PDF page(s) 8; reference [I15]. Newly generated study item; human review pending.

How do synthetic availability tests complement application telemetry?

Monitoring and logging

Synthetic tests discover externally visible failures; application requests, exceptions, and traces explain the failing path and dependencies.

Source: AZ-305 Study Guide.pdf, PDF page(s) 8; reference [I15]. Newly generated study item; human review pending.

What does an Azure diagnostic setting specify?

Monitoring and logging

It selects supported resource log categories or category groups and sends them to configured destinations. Select collection breadth according to purpose and volume.

Source: AZ-305 Study Guide.pdf, PDF page(s) 9; reference [I08]. Newly generated study item; human review pending.

When should diagnostic logs go to Log Analytics?

Monitoring and logging

When operators need KQL investigation, cross-component correlation, workbooks, and supported log alerts. Plan ingestion, table plans, retention, and permissions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 9; reference [I08]. Newly generated study item; human review pending.

When is Azure Storage an appropriate diagnostic destination?

Monitoring and logging

For economical archives, static analysis, or immutable audit retention. Configure lifecycle and immutability and plan how evidence will be retrieved.

Source: AZ-305 Study Guide.pdf, PDF page(s) 9; reference [I08]. Newly generated study item; human review pending.

When is Event Hubs an appropriate diagnostic destination?

Monitoring and logging

When an external SIEM or processing system needs a continuous log stream. Design throughput, retention, consumers, and credential protection.

Source: AZ-305 Study Guide.pdf, PDF page(s) 9; reference [I08]. Newly generated study item; human review pending.

How can one resource support operational queries and an independent audit archive?

Monitoring and logging

Configure diagnostic settings for multiple destination types, such as Log Analytics and Storage. Validate delivery to each destination and justify duplicate ingestion.

Source: AZ-305 Study Guide.pdf, PDF page(s) 9; reference [I08]. Newly generated study item; human review pending.

What regional constraint applies to diagnostic destinations?

Monitoring and logging

For a regional monitored resource, Storage and Event Hubs destinations must be in that resource's region. Log Analytics does not have the same destination-region restriction.

Source: AZ-305 Study Guide.pdf, PDF page(s) 9; reference [I08]. Newly generated study item; human review pending.

What are the per-setting and per-resource diagnostic destination limits?

Monitoring and logging

One setting permits one destination of each type. A resource supports up to five diagnostic settings, allowing additional destinations of a given type through separate settings.

Source: AZ-305 Study Guide.pdf, PDF page(s) 9; reference [I08]. Newly generated study item; human review pending.

How do diagnostic settings reach Storage or Event Hubs with firewalls enabled?

Monitoring and logging

Use the documented trusted Microsoft services bypass. A private endpoint alone does not route diagnostic export through the customer's private network.

Source: AZ-305 Study Guide.pdf, PDF page(s) 9; reference [I08]. Newly generated study item; human review pending.

Can diagnostic destinations be in another subscription or tenant?

Monitoring and logging

Another subscription is supported with appropriate configuring-identity permissions. Azure Lighthouse supports relevant cross-tenant destination scenarios; tenant access must be designed explicitly.

Source: AZ-305 Study Guide.pdf, PDF page(s) 9; reference [I08]. Newly generated study item; human review pending.

What roles do AMA, DCR, and DCR association play?

Monitoring and logging

AMA collects supported guest telemetry; a DCR specifies sources, streams, transformations, and destinations; an association connects that rule to the monitored resource.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I09]. Newly generated study item; human review pending.

How should a mixed Windows and Linux server fleet share collection configuration?

Monitoring and logging

Reuse suitable DCRs across resources, and split rules where operating systems, destinations, sensitivity, or collection requirements differ. Validate with representative generated events.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I09]. Newly generated study item; human review pending.

How can supported non-Azure servers join an AMA collection design?

Monitoring and logging

Represent supported servers through Azure Arc and deploy the Azure Monitor Agent extension with the required DCR association.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I09]. Newly generated study item; human review pending.

How does a DCE differ from a DCR?

Monitoring and logging

A DCR is collection policy; a data collection endpoint provides configuration and ingestion connectivity for supported scenarios. A DCE is not required for every AMA deployment.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I11]. Newly generated study item; human review pending.

When does Azure Monitor private collection require extra endpoint planning?

Monitoring and logging

Private Link configurations need appropriate DCE and DNS arrangements. Check source-specific requirements and newer DCR ingestion endpoints rather than assuming all paths use a DCE.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I11]. Newly generated study item; human review pending.

What is the tradeoff of filtering logs with DCR transformations?

Monitoring and logging

Supported incoming streams can be filtered or reshaped before ingestion to reduce cost or sensitive data. Discarded data is irrecoverable through that collection path, so preserve required evidence.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I09]. Newly generated study item; human review pending.

Which agent should replace MMA or OMS in a new Azure monitoring design?

Monitoring and logging

Use Azure Monitor Agent for supported guest telemetry. The Log Analytics agent retired August 31, 2024; Azure ingestion can stop without further notice after March 2, 2026.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I10]. Newly generated study item; human review pending.

What is the starting point for a Log Analytics workspace architecture?

Monitoring and logging

Start with one workspace and add boundaries when residency, tenants, access, ownership, region, or cost requirements justify them. A subscription boundary alone does not require a workspace.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I12]. Newly generated study item; human review pending.

What is the drawback of copying all operational logs to a separate security workspace?

Monitoring and logging

It can duplicate ingestion and administration. Evaluate shared collection, access isolation, Sentinel billing, and the actual need for separate security data boundaries.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I12]. Newly generated study item; human review pending.

How do workspace-context and resource-context log access differ?

Monitoring and logging

Workspace-context access can allow broad queries; supported resource-context access limits queries to data from accessible resources. Table controls can refine access, and table plans have limitations.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10; reference [I13]. Newly generated study item; human review pending.

When should a supported log table use the Analytics plan?

Monitoring and logging

For high-value operational or security data needing full analytics, supported alerts, and Insights. Interactive analytics retention can extend to two years.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10-11; reference [I13]. Newly generated study item; human review pending.

When should a supported log table use the Basic plan?

Monitoring and logging

For mainly troubleshooting data with lower ingestion cost and query charges. Direct queries cover 30 days; Simple Log Alerts are supported, but Insights and resource-context queries are not.

Source: AZ-305 Study Guide.pdf, PDF page(s) 10-11; reference [I13]. Newly generated study item; human review pending.

When should a supported log table use the Auxiliary plan?

Monitoring and logging

For large volumes of infrequently queried verbose or audit data. It emphasizes low ingestion cost, charges for queries, remains queryable through total retention, and has no direct alerts or Insights.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I13]. Newly generated study item; human review pending.

Are table plans chosen for an entire Log Analytics workspace?

Monitoring and logging

No. Choose a plan per supported table so critical error data and verbose diagnostics can have different capabilities and economics.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I13]. Newly generated study item; human review pending.

Is the claim that Basic and Auxiliary only support universally restricted single-table KQL current?

Monitoring and logging

No. Current documentation supports full KQL with feature and context limitations. Summary rules still have plan-specific constraints; confirm requirements against the current plan.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I13]. Newly generated study item; human review pending.

How do analytics retention and total retention differ?

Monitoring and logging

Analytics retention is the interactive monitoring period for Analytics data. Total retention includes long-term retention; current documented maxima are two years for Analytics retention and 12 years total.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I14]. Newly generated study item; human review pending.

How are older Basic logs investigated beyond the direct-query window?

Monitoring and logging

Use supported search scenarios such as asynchronous search jobs, which place results in an Analytics table for further investigation. Long retention does not imply immediate full-feature queries.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I14]. Newly generated study item; human review pending.

Why can a lower-ingestion-cost log plan still be expensive?

Monitoring and logging

Basic and Auxiliary queries and dashboard refreshes incur query scanning charges. Model ingestion, retention, scanning, exports, and query frequency together.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I13]. Newly generated study item; human review pending.

Why should a hard daily ingestion cap be used cautiously?

Monitoring and logging

A cap can stop collection during the noisy incident that most needs evidence. Prefer appropriate source selection and supported transformations while preserving essential telemetry.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I09]. Newly generated study item; human review pending.

How can summary rules help log cost and investigation?

Monitoring and logging

They maintain useful aggregates while raw data follows its appropriate plan and retention. Verify plan-specific query constraints and retain raw evidence where required.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I13]. Newly generated study item; human review pending.

What does OpenTelemetry instrumentation contribute to Application Insights?

Monitoring and logging

Standardized traces, metrics, and logs, connected with request and dependency information. Propagated correlation context enables investigation across multiple services.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I15]. Newly generated study item; human review pending.

What must be considered when sampling application telemetry?

Monitoring and logging

Sampling can reduce volume and cost but reduces forensic detail. Choose it deliberately according to diagnostic and audit requirements.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11; reference [I15]. Newly generated study item; human review pending.

Why must a KQL query match its actual query context?

Monitoring and logging

Application Insights and workspace schemas can use different table and field names, such as requests/timestamp and AppRequests/TimeGenerated. Filter time early and use the actual schema.

Source: AZ-305 Study Guide.pdf, PDF page(s) 11-12; reference [I13]. Newly generated study item; human review pending.

Where do AKS logs and managed Prometheus metrics go?

Monitoring and logging

Container Insights sends supported container logs, events, and inventory to Log Analytics. Managed Prometheus metrics use an Azure Monitor workspace, which is a different resource.

Source: AZ-305 Study Guide.pdf, PDF page(s) 12; reference [I55]. Newly generated study item; human review pending.

How do metric, log, and activity-log alerts differ?

Monitoring and logging

Metric alerts evaluate numeric signals and supported dynamic thresholds; log alerts evaluate queried records or aggregates; activity-log alerts detect supported management events.

Source: AZ-305 Study Guide.pdf, PDF page(s) 12; reference [I16]. Newly generated study item; human review pending.

What makes an alert operationally actionable?

Monitoring and logging

Define an owner, condition, severity, evaluation interval, threshold, dimensions, suppression, and response. Use reusable action groups for notifications or automation and test escalation.

Source: AZ-305 Study Guide.pdf, PDF page(s) 12; reference [I16]. Newly generated study item; human review pending.

How do Azure Service Health, Azure Status, and Resource Health differ?

Monitoring and logging

Service Health reports relevant provider issues, maintenance, and advisories; Azure Status gives the public global view; Resource Health describes individual resource health. They complement application telemetry.

Source: AZ-305 Study Guide.pdf, PDF page(s) 12; reference [I46]. Newly generated study item; human review pending.

How do authentication and authorization differ?

Identity and access

Authentication proves an identity; authorization determines what it may do. A successful sign-in does not grant access to a blob, application, or database.

Source: AZ-305 Study Guide.pdf, PDF page(s) 13; reference [I49]. Newly generated study item; human review pending.

How does Microsoft Entra ID differ from Windows Server AD DS?

Identity and access

Entra ID provides cloud identity. AD DS provides traditional domain services such as LDAP, Kerberos, and domain join; Entra ID alone is not an LDAP or Kerberos domain endpoint.

Source: AZ-305 Study Guide.pdf, PDF page(s) 13; reference [I41]. Newly generated study item; human review pending.

How do Entra directory roles and Azure resource roles differ?

Identity and access

Directory roles administer identity objects; Azure roles authorize operations on Azure resources. Global Administrator and subscription Owner are different assignments and are not interchangeable.

Source: AZ-305 Study Guide.pdf, PDF page(s) 13; reference [I21]. Newly generated study item; human review pending.

How do an application registration and service principal relate?

Identity and access

The registration defines the application's identity and configuration. A service principal represents that application within a tenant; managed identities are a special service-principal type.

Source: AZ-305 Study Guide.pdf, PDF page(s) 13; reference [I49]. Newly generated study item; human review pending.

Which protocols typically provide modern application sign-in and API access?

Identity and access

OpenID Connect normally provides authentication and OAuth 2.0 access tokens authorize protected API access. Existing applications may require SAML or Windows authentication instead.

Source: AZ-305 Study Guide.pdf, PDF page(s) 13; reference [I49]. Newly generated study item; human review pending.

Why must hybrid synchronization and authentication be designed separately?

Identity and access

Synchronization provisions or updates directory objects. Authentication selects where credentials are validated, with different dependencies for PHS, PTA, and federation.

Source: AZ-305 Study Guide.pdf, PDF page(s) 13; reference [I43]. Newly generated study item; human review pending.

What distinguishes Cloud Sync's architecture from Connect Sync?

Identity and access

Cloud Sync uses lightweight on-premises provisioning agents and cloud-managed orchestration. Choose against current forest, attribute, device, writeback, and availability requirements.

Source: AZ-305 Study Guide.pdf, PDF page(s) 13; reference [I43]. Newly generated study item; human review pending.

Where does password hash synchronization validate a cloud sign-in?

Identity and access

Entra ID validates against a synchronized derived representation of the on-premises password hash. It does not require an on-premises validation request for each sign-in.

Source: AZ-305 Study Guide.pdf, PDF page(s) 13-14; reference [I17]. Newly generated study item; human review pending.

Does password hash synchronization send a reversible password to Azure?

Identity and access

No. It synchronizes a derived representation, not plaintext or a reversibly stored password.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I17]. Newly generated study item; human review pending.

What happens to PHS cloud sign-in during a synchronization-server outage?

Identity and access

Existing synchronized users can continue cloud password authentication. New password and account changes cannot synchronize until the synchronization path recovers.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I17]. Newly generated study item; human review pending.

Why might an on-premises account disable not immediately block a PHS cloud sign-in?

Identity and access

Cloud account state depends on synchronization timing, and some AD states behave differently. PHS does not validate current AD state directly at every cloud sign-in.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I17]. Newly generated study item; human review pending.

When should pass-through authentication be considered?

Identity and access

When on-premises AD account state, password policies, or sign-in hours must be checked at sign-in and reliable validation agents and domain controllers can be operated.

Source: AZ-305 Study Guide.pdf, PDF page(s) 13-14; reference [I17]. Newly generated study item; human review pending.

What dependencies and resilience design does PTA need?

Identity and access

Agents need outbound service connectivity and domain-controller connectivity. Microsoft recommends three agents, but a site-wide domain-controller or network failure can still break validation.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I17]. Newly generated study item; human review pending.

Does PTA automatically fail over to synchronized password hashes?

Identity and access

No. PHS can be prepared as a backup, but switching authentication to it is a planned manual change requiring an operational recovery procedure.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I17]. Newly generated study item; human review pending.

When is federation appropriate rather than cloud authentication?

Identity and access

When a defined requirement needs the external identity provider's capabilities and justifies its infrastructure, certificate, publishing, security, and maintenance dependencies.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I17]. Newly generated study item; human review pending.

What does staged rollout contribute to migration from federation?

Identity and access

It lets suitable user groups adopt cloud authentication incrementally while the transition is validated. Preconfigure and test emergency alternatives and dependency recovery.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I17]. Newly generated study item; human review pending.

What signals and controls does Conditional Access use?

Identity and access

It evaluates user/group, application, device, location, and risk signals and can block, require MFA, authentication strength, or device conditions for supported scenarios.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I37]. Newly generated study item; human review pending.

Where does Conditional Access fit in authentication and authorization?

Identity and access

It is evaluated after first-factor authentication and applies access conditions. It does not replace the authentication method or grant application permissions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I37]. Newly generated study item; human review pending.

How should a restrictive Conditional Access baseline be introduced?

Identity and access

Evaluate report-only results and roll out in stages where appropriate. Maintain tested emergency access so incorrect policies do not block recovery.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I37]. Newly generated study item; human review pending.

Why is requiring any MFA method insufficient to guarantee phishing resistance?

Identity and access

Authentication methods have different protection levels. Use appropriate authentication strength and recovery design for the risk; all MFA methods are not equally resistant to phishing.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14; reference [I37]. Newly generated study item; human review pending.

When should External ID B2B collaboration use a workforce tenant?

Identity and access

For partners needing approved access to workforce resources, often with their existing identity provider. Guest authorization, cross-tenant assurance, and lifecycle still need governance.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14-15; reference [I18]. Newly generated study item; human review pending.

When should External ID use an external tenant?

Identity and access

For customer identity in a public application with an appropriate sign-up and sign-in experience separate from employee resources.

Source: AZ-305 Study Guide.pdf, PDF page(s) 14-15; reference [I18]. Newly generated study item; human review pending.

How do system-assigned and user-assigned managed identities differ in lifecycle?

Identity and access

System-assigned identity is created with a supported resource and removed with it. User-assigned identity is a separate resource that can survive compute replacement and be attached where supported.

Source: AZ-305 Study Guide.pdf, PDF page(s) 15; reference [I19]. Newly generated study item; human review pending.

When is a user-assigned managed identity especially useful?

Identity and access

When permissions must exist before compute, identity continuity is required across replacement, or controlled reuse is needed. Shared identity also shares effective privileges.

Source: AZ-305 Study Guide.pdf, PDF page(s) 15; reference [I19]. Newly generated study item; human review pending.

What does managed identity provide, and what must still be configured?

Identity and access

It provides credential-free token acquisition. The target still requires a data role or database principal, the correct token audience, and working network and DNS access.

Source: AZ-305 Study Guide.pdf, PDF page(s) 15; reference [I19]. Newly generated study item; human review pending.

How does workload identity federation avoid stored client secrets?

Identity and access

Entra trusts a configured external OpenID Connect token and exchanges a matching issuer, subject, and audience token for one usable by the workload's Entra identity.

Source: AZ-305 Study Guide.pdf, PDF page(s) 15; reference [I20]. Newly generated study item; human review pending.

What boundaries must be restricted in workload identity federation?

Identity and access

Restrict the trusted issuer, subject, and audience and scope the target permissions. Federation removes a long-lived secret but does not justify broad trust or access.

Source: AZ-305 Study Guide.pdf, PDF page(s) 15; reference [I20]. Newly generated study item; human review pending.

What are the three parts of an Azure RBAC role assignment?

Identity and access

A security principal, a role definition, and a scope. Applicable assignments inherit from parent scopes to descendants.

Source: AZ-305 Study Guide.pdf, PDF page(s) 15; reference [I21]. Newly generated study item; human review pending.

How do Owner, Contributor, and Reader differ?

Identity and access

Owner manages resources and access; Contributor manages resources but lacks standard role-assignment permissions; Reader views management information. Service data access remains a separate concern.

Source: AZ-305 Study Guide.pdf, PDF page(s) 15; reference [I21]. Newly generated study item; human review pending.

How do control-plane Actions and data-plane DataActions differ?

Identity and access

Actions authorize supported management operations; DataActions authorize supported service data operations. Management Reader on a storage account does not grant blob reads.

Source: AZ-305 Study Guide.pdf, PDF page(s) 15-16; reference [I22]. Newly generated study item; human review pending.

Why does a narrow role assignment not remove a user's broader access?

Identity and access

Azure RBAC is additive across direct, group, and inherited assignments. Review the complete effective access set and remove the broader grant if necessary.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I21]. Newly generated study item; human review pending.

Does NotActions explicitly deny a permission granted by another role?

Identity and access

No. NotActions reduces the permissions granted by that role definition; another applicable role can still grant the excluded operation.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I21]. Newly generated study item; human review pending.

How can management permissions undermine separation from data access?

Identity and access

Some broad management roles can retrieve account keys or change access configuration. Evaluate these indirect escalation paths as well as explicit data roles.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I22]. Newly generated study item; human review pending.

What does Azure ABAC add to supported Azure role assignments?

Identity and access

Conditions can refine supported permissions using attributes, such as blob index tags. ABAC is not a universal condition language for every Azure operation.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I23]. Newly generated study item; human review pending.

Why can a blob ABAC condition fail to restrict effective access?

Identity and access

The condition limits its own assignment. A broader unconditional assignment may still authorize the operation, so inspect all effective grants.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I23]. Newly generated study item; human review pending.

What must a hybrid design preserve for traditional on-premises file-share access?

Identity and access

Preserve AD DS authentication, group/ACL authorization, DNS, domain-controller connectivity, and required device/domain configuration. Cloud sign-in alone does not grant file access.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I25]. Newly generated study item; human review pending.

When should Microsoft Entra Domain Services be recommended?

Identity and access

For supported legacy Azure workloads needing managed domain join, Group Policy, LDAP, and Kerberos/NTLM without customer-managed domain controllers. It is not a full self-managed AD DS forest.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I25]. Newly generated study item; human review pending.

What problem does Microsoft Entra application proxy solve?

Identity and access

It publishes supported internal web applications to remote users through the cloud service and outbound-connected private network connectors, with Entra preauthentication where configured.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I24]. Newly generated study item; human review pending.

What enables application proxy SSO to an integrated Windows-authenticated web app?

Identity and access

Correctly configured Kerberos constrained delegation lets the connector obtain a ticket for the permitted application SPN on behalf of the validated user. Identity mapping and app authorization still matter.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I39]. Newly generated study item; human review pending.

What does cloud Kerberos trust enable for supported passwordless Windows clients?

Identity and access

It supports SSO from supported Entra-joined or hybrid-joined devices to AD resources. On-premises domain controllers still issue service tickets and control authorization, and connectivity remains required.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16; reference [I40]. Newly generated study item; human review pending.

How do Key Vault secrets, keys, and certificates serve different purposes?

Identity and access

Secrets hold retrievable sensitive values; keys support permitted cryptographic operations and CMKs; certificates manage X.509 objects with associated key/secret objects and supported renewal.

Source: AZ-305 Study Guide.pdf, PDF page(s) 16-17; reference [I26]. Newly generated study item; human review pending.

What does Managed HSM provide, and what objects does it exclude?

Identity and access

A dedicated single-tenant cryptographic-key service using FIPS 140-3 Level 3 validated HSMs. It does not store general secrets or manage certificate objects.

Source: AZ-305 Study Guide.pdf, PDF page(s) 17; reference [I28]. Newly generated study item; human review pending.

How does Key Vault Premium differ from Managed HSM?

Identity and access

Premium vaults support HSM-protected keys alongside secrets and certificates. Managed HSM is a separate dedicated single-tenant key offering; validate integration, algorithms, isolation, and recovery.

Source: AZ-305 Study Guide.pdf, PDF page(s) 17; reference [I28]. Newly generated study item; human review pending.

Why is Azure RBAC preferred for separating Key Vault management and data access?

Identity and access

It supports narrowly scoped vault data roles and improved separation. Legacy access policies can be changed through broad management permissions, so escalation paths need control.

Source: AZ-305 Study Guide.pdf, PDF page(s) 17; reference [I27]. Newly generated study item; human review pending.

What is the Key Vault authorization default from API version 2026-02-01?

Identity and access

New vaults created using that API version default to Azure RBAC. Existing access models and deployment settings still need to be reviewed explicitly.

Source: AZ-305 Study Guide.pdf, PDF page(s) 17; reference [I27]. Newly generated study item; human review pending.

How should vault scope and observability be organized?

Identity and access

Prefer a vault per application and environment, with appropriate groups and workload identities. Restrict network access where required and collect audits for denied operations and expiry.

Source: AZ-305 Study Guide.pdf, PDF page(s) 17; reference [I27]. Newly generated study item; human review pending.

How do soft delete and purge protection differ for Key Vault?

Identity and access

Soft delete enables recovery within the retention period. Purge protection prevents permanent deletion before that period ends and cannot be overridden once enabled.

Source: AZ-305 Study Guide.pdf, PDF page(s) 17; reference [I44]. Newly generated study item; human review pending.

Why is recovery protection for customer-managed keys essential?

Identity and access

Losing a required encryption key can make otherwise intact encrypted data unusable. Protect recovery and retain key versions required by consumers and recovery operations.

Source: AZ-305 Study Guide.pdf, PDF page(s) 17; reference [I44]. Newly generated study item; human review pending.

What must accompany an automatic Key Vault key rotation policy?

Identity and access

Ensure consumers adopt new key versions, retain old versions still needed for decryption or recovery, and test transitions before disabling previous versions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 17; reference [I45]. Newly generated study item; human review pending.

Why does creating a new Key Vault secret or certificate version not finish rotation?

Identity and access

A secret workflow must update the external credential and refresh consumers; certificate renewal also requires consuming-service refresh. A vault version alone does not change an external password.

Source: AZ-305 Study Guide.pdf, PDF page(s) 17; reference [I50]. Newly generated study item; human review pending.

What purpose do management groups serve?

Governance and compliance

They apply common governance scopes above subscriptions so Azure policy and applicable access assignments inherit to descendants.

Source: AZ-305 Study Guide.pdf, PDF page(s) 18; reference [I31]. Newly generated study item; human review pending.

What tenant and parent restrictions apply to a management-group hierarchy?

Governance and compliance

All subscriptions must trust the same Entra tenant. Each subscription has one parent management group, and each non-root management group has one parent.

Source: AZ-305 Study Guide.pdf, PDF page(s) 18; reference [I31]. Newly generated study item; human review pending.

How deep may an Azure management-group hierarchy be?

Governance and compliance

It supports six management-group levels excluding the root and subscription levels. Keep the tree understandable and aligned to durable policy requirements.

Source: AZ-305 Study Guide.pdf, PDF page(s) 18; reference [I31]. Newly generated study item; human review pending.

What is a useful basis for management-group structure?

Governance and compliance

Use durable governance needs such as platform, corporate-connected workloads, internet-facing workloads, or sandboxes. Reporting lines or geography alone need not define the tree.

Source: AZ-305 Study Guide.pdf, PDF page(s) 18; reference [I31]. Newly generated study item; human review pending.

What boundaries justify separate subscriptions?

Governance and compliance

Administrative ownership, billing, quotas, environment, scale, and regulatory needs can justify separation. Shared management groups provide common guardrails.

Source: AZ-305 Study Guide.pdf, PDF page(s) 18; reference [I31]. Newly generated study item; human review pending.

Why do separate subscriptions not guarantee complete privilege isolation?

Governance and compliance

Assignments inherited from a common parent can reach multiple subscriptions. Restrict broad parent-scope access and use suitable role and scope boundaries.

Source: AZ-305 Study Guide.pdf, PDF page(s) 18; reference [I31]. Newly generated study item; human review pending.

What should determine resource-group membership?

Governance and compliance

Related lifecycle, ownership, and permissions. Keep a long-lived database separate from disposable resources when deletion or access needs differ.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I51]. Newly generated study item; human review pending.

What resource-group placement rules affect architecture?

Governance and compliance

An ordinary resource-group-scoped resource belongs to one group at a time; groups cannot nest. Groups can contain resources in multiple regions, independently of the metadata location.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I51]. Newly generated study item; human review pending.

What operational consequence follows from deleting a resource group?

Governance and compliance

Deletion initiates deletion of contained resources. Grouping by lifecycle helps prevent disposable deployments from deleting persistent dependencies.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I51]. Newly generated study item; human review pending.

What should a resource-tag taxonomy record?

Governance and compliance

Use consistent key-value metadata for owner group, environment, cost center, application, purpose, or classification. Tags support accountability, inventory, cost allocation, and automation.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I32]. Newly generated study item; human review pending.

Do tags automatically inherit from subscriptions or resource groups?

Governance and compliance

No. Apply appropriate Azure Policy require/modify behavior to populate supported resources. Management groups do not support tags.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I32]. Newly generated study item; human review pending.

What information must not be stored in tags?

Governance and compliance

Secrets and personal data, because tags are plaintext and visible through reports, histories, and APIs. Prefer stable application identifiers and accountable owner groups.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I32]. Newly generated study item; human review pending.

How should tag casing be standardized?

Governance and compliance

Tag names are operationally case-insensitive and values are case-sensitive. Standardize both to prevent fragmented reports.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I32]. Newly generated study item; human review pending.

How do Azure RBAC, Azure Policy, and tags differ?

Governance and compliance

RBAC grants operations to identities; Policy evaluates and constrains supported resource configuration; tags provide metadata. A compliance tag is not evidence that a control is satisfied.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I29]. Newly generated study item; human review pending.

How do a policy definition, initiative, and assignment differ?

Governance and compliance

A definition expresses a rule; an initiative bundles related definitions; an assignment applies either to a scope with parameters, exclusions, and enforcement configuration.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I29]. Newly generated study item; human review pending.

What does the audit effect do?

Governance and compliance

It records noncompliance without blocking or repairing the operation. Use it to understand exposure and rollout impact.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I29]. Newly generated study item; human review pending.

What does the deny effect do, and what does it not do?

Governance and compliance

It rejects operations violating applicable evaluated policy. It does not repair existing noncompliant resources.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19-20; reference [I29]. Newly generated study item; human review pending.

When should AuditIfNotExists be used?

Governance and compliance

When compliance depends on a required related resource or configuration that may be missing or noncompliant. It reports the finding without deploying the related configuration.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19; reference [I29]. Newly generated study item; human review pending.

When should DeployIfNotExists be used?

Governance and compliance

To deploy supported related configuration, such as diagnostic settings, when its conditions and timing allow. Existing resources need appropriate remediation tasks.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19-20; reference [I30]. Newly generated study item; human review pending.

When should modify be used?

Governance and compliance

For supported property changes or added values, such as standardized tags. An assignment identity with required permissions and a remediation task may be needed for existing resources.

Source: AZ-305 Study Guide.pdf, PDF page(s) 19-20; reference [I30]. Newly generated study item; human review pending.

What is required to remediate existing resources with policy?

Governance and compliance

Use a supported modify or DeployIfNotExists definition, an assignment managed identity with required roles, and a remediation task. A compliance scan alone does not perform repair.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I30]. Newly generated study item; human review pending.

Why review permissions after changing a remediation policy?

Governance and compliance

Changing a definition does not automatically update the assignment identity's permissions. Confirm role requirements and test that remediation can perform the new actions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I30]. Newly generated study item; human review pending.

What is a practical policy-enforcement rollout sequence?

Governance and compliance

Assess with audit and compliance reports, fix templates and existing resources, then enforce restrictions. Document exceptions with owners, justification, expiry, and ongoing review.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I29]. Newly generated study item; human review pending.

How does a policy exemption differ from excluding a scope?

Governance and compliance

An exclusion removes a scope from evaluation. An exemption records an accepted exception against an assignment and can preserve governance context, with accountable ownership and expiry.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I52]. Newly generated study item; human review pending.

When is Azure Machine Configuration needed instead of only an ARM property policy?

Governance and compliance

For supported configuration compliance inside a guest OS, such as security baselines. Validate guest extension, identity, package, assignment mode, or Arc prerequisites.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I56]. Newly generated study item; human review pending.

How do Defender for Cloud, Sentinel, and Azure Monitor differ?

Governance and compliance

Defender for Cloud assesses security posture and supported workload threats; Sentinel correlates security events and supports incidents and response; Azure Monitor provides operational observability.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I36]. Newly generated study item; human review pending.

Does a green policy result or secure score establish legal compliance?

Governance and compliance

No. It shows assessed technical controls. Legal or regulatory obligations also need procedures, accountable owners, and the required audit evidence.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I36]. Newly generated study item; human review pending.

What should replace Azure Blueprints in new governance designs?

Governance and compliance

Use current infrastructure as code, deployment stacks for lifecycle/governance needs, and template specs for versioned reusable templates. Blueprints is in phased retirement as of October 20, 2026.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I35]. Newly generated study item; human review pending.

What is the Azure Blueprints phased retirement schedule?

Governance and compliance

New definitions/versions stopped July 31, 2026; definition changes/new assignments stop October 31; assignment changes stop December 31; final retirement is January 31, 2027.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I35]. Newly generated study item; human review pending.

What remains when Azure Blueprints retires?

Governance and compliance

Previously deployed workload resources remain. Unexported blueprint definitions, versions, and assignments are deleted and blueprint lock enforcement ends, so migrate governance and protection.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20; reference [I35]. Newly generated study item; human review pending.

How do synchronization, provisioning, and identity governance complement each other?

Governance and compliance

Synchronization aligns directories; provisioning manages supported application accounts and assignments; governance decides whether access should exist and how its lifecycle is controlled.

Source: AZ-305 Study Guide.pdf, PDF page(s) 20-21; reference [I33]. Newly generated study item; human review pending.

How do PIM eligible and active assignments differ?

Governance and compliance

Eligibility permits activation when needed; active assignment grants the role's permissions for its active duration. Activation can require approval, MFA, justification, and expiry where configured.

Source: AZ-305 Study Guide.pdf, PDF page(s) 21; reference [I34]. Newly generated study item; human review pending.

What must still be controlled when PIM is used?

Governance and compliance

Choose a narrow role and scope, review eligibility and activations, keep emergency access, and ensure incident approvers are available. PIM limits duration but not permissions while active.

Source: AZ-305 Study Guide.pdf, PDF page(s) 21; reference [I34]. Newly generated study item; human review pending.

What requirement does entitlement management address?

Governance and compliance

Approved, expiring bundles of supported group, team, application, and SharePoint access through access packages with request policies, approvals, and reviews. Group membership can provide indirect Azure access.

Source: AZ-305 Study Guide.pdf, PDF page(s) 21; reference [I33]. Newly generated study item; human review pending.

What makes access reviews and lifecycle workflows effective?

Governance and compliance

Reviews need scope, recurrence, reviewers, fallback, and applied decisions; check alternate effective grants. Workflows need reliable identity attributes and lifecycle triggers. Verify feature-specific Governance, Suite, or P2 licensing.

Source: AZ-305 Study Guide.pdf, PDF page(s) 21; reference [I33]. Newly generated study item; human review pending.

What does ACID describe in a relational transaction?

Relational data

Atomicity: all operations commit together. Consistency: database rules hold. Isolation: concurrent transactions are controlled. Durability: a committed write survives.

Source: validated AZ-305 Study Guide, PDF page 22; reference D01. Original learning item; review required.

Which requirements should precede choosing an Azure relational database?

Relational data

Required engine/version/extensions, instance features, operating-system access, latency, transaction demand, growth, licensing, and recovery objectives.

Source: validated AZ-305 Study Guide, PDF page 22-23; reference D01. Original learning item; review required.

When is Azure SQL Database a strong starting point?

Relational data

A database-focused SQL Server-compatible workload whose required features fit the managed database model and do not require operating-system control.

Source: validated AZ-305 Study Guide, PDF page 22-23; reference D01. Original learning item; review required.

Which migration dependencies often favor Azure SQL Managed Instance?

Relational data

High SQL Server instance compatibility, supported cross-database queries, and SQL Agent jobs; assess actual compatibility because it is not unlimited.

Source: validated AZ-305 Study Guide, PDF page 22-23; reference D01. Original learning item; review required.

When can SQL Server on Azure VMs be necessary?

Relational data

When the application needs operating-system access, a specific engine version, full deployment control, or features unsupported by SQL PaaS.

Source: validated AZ-305 Study Guide, PDF page 22-23; reference D01. Original learning item; review required.

What does the customer operate for SQL Server on an Azure VM?

Relational data

Guest OS, SQL engine, patch policy, storage, security, backups, and the HA topology; Azure tooling assists rather than removes these duties.

Source: validated AZ-305 Study Guide, PDF page 22; reference D01. Original learning item; review required.

What database responsibilities remain with SQL PaaS customers?

Relational data

Schema, permissions, query performance, connectivity, retention configuration, and testing application recovery.

Source: validated AZ-305 Study Guide, PDF page 22; reference D01. Original learning item; review required.

Why might PostgreSQL flexible server be preferable to Azure SQL?

Relational data

It preserves the required PostgreSQL engine and supported extensions with managed operations; an SQL Server service is not engine-compatible merely because both use SQL.

Source: validated AZ-305 Study Guide, PDF page 23; reference D11. Original learning item; review required.

How do purchasing model, service tier, and compute tier differ in Azure SQL Database?

Relational data

Purchasing model expresses/bills resources; service tier defines architecture and capabilities; compute tier determines provisioned versus automatically scaled compute.

Source: validated AZ-305 Study Guide, PDF page 23; reference D02. Original learning item; review required.

What is a DTU, and which Azure SQL Database tiers use it?

Relational data

A database transaction unit bundles relative CPU, memory, and I/O. The DTU tiers are Basic, Standard, and Premium.

Source: validated AZ-305 Study Guide, PDF page 23; reference D54. Original learning item; review required.

What does the Azure SQL vCore purchasing model expose?

Relational data

Compute cores and clearer separation of compute, storage, and backup costs. SQL Database tiers include General Purpose, Business Critical, and Hyperscale.

Source: validated AZ-305 Study Guide, PDF page 23; reference D02. Original learning item; review required.

What characterizes Azure SQL Database General Purpose?

Relational data

Separated compute and remote durable storage, suited to many ordinary transactional workloads with balanced price and performance.

Source: validated AZ-305 Study Guide, PDF page 23; reference D02. Original learning item; review required.

What characterizes Azure SQL Database Business Critical?

Relational data

Local SSD storage and multiple replicas for low storage latency and high I/O; eligible read-only replicas can offload reads at higher cost.

Source: validated AZ-305 Study Guide, PDF page 23; reference D02. Original learning item; review required.

What characterizes Azure SQL Database Hyperscale?

Relational data

Distributed page-server/log-service storage decoupled from compute, supporting large growth and read replicas; documented maximum can reach 128 TB in supported configurations.

Source: validated AZ-305 Study Guide, PDF page 23; reference D02. Original learning item; review required.

Which Hyperscale deployment choices invalidate older provisioned-only notes?

Relational data

Supported offerings include serverless or provisioned single databases and Hyperscale elastic pools; verify each configuration's feature matrix.

Source: validated AZ-305 Study Guide, PDF page 23; reference D02. Original learning item; review required.

Which service tiers should be evaluated for SQL Managed Instance?

Relational data

Its vCore General Purpose and Business Critical tiers, including the documented Next-gen General Purpose option. Do not assume SQL Database Hyperscale exists for Managed Instance.

Source: validated AZ-305 Study Guide, PDF page 23; reference D55. Original learning item; review required.

When does provisioned SQL compute fit best?

Relational data

Sustained demand and predictable capacity where allocated compute remains useful over time.

Source: validated AZ-305 Study Guide, PDF page 23; reference D03. Original learning item; review required.

What does SQL Database serverless automatically scale?

Relational data

Compute within configured minimum and maximum vCores. It does not fix poor queries, unlimited storage growth, or an insufficient maximum.

Source: validated AZ-305 Study Guide, PDF page 23; reference D03. Original learning item; review required.

Why can a SQL serverless database cost more than expected?

Relational data

Storage stays billed, a high compute minimum and continuous activity sustain charges, and frequent resumes can reduce savings.

Source: validated AZ-305 Study Guide, PDF page 23-24; reference D03. Original learning item; review required.

Why must SQL serverless autoscaling and auto-pause be considered separately?

Relational data

Autoscaling changes compute while online; eligible idle databases can separately pause and later resume, introducing latency and feature restrictions.

Source: validated AZ-305 Study Guide, PDF page 24; reference D04. Original learning item; review required.

Which SQL serverless conditions can prevent auto-pause?

Relational data

Open sessions, active geo-replication or failover groups, and long-term backup retention can keep a database online even with little useful workload.

Source: validated AZ-305 Study Guide, PDF page 24; reference D04. Original learning item; review required.

What is the status of Hyperscale serverless auto-pause in the guide?

Relational data

Preview. Designs requiring mature generally available behavior should not depend on it; General Purpose serverless supports auto-pause.

Source: validated AZ-305 Study Guide, PDF page 24; reference D04. Original learning item; review required.

Which measurements should guide database scaling?

Relational data

CPU, data/log I/O, memory pressure, locks, and query plans. Correct the actual bottleneck before increasing resources.

Source: validated AZ-305 Study Guide, PDF page 24; reference D01. Original learning item; review required.

Why might increasing vCores fail to fix slow transactions?

Relational data

Lock contention or inefficient queries can remain dominant. Indexes, reduced scanning, shorter transactions, and query tuning may address the cause.

Source: validated AZ-305 Study Guide, PDF page 24; reference D01. Original learning item; review required.

What is an Azure SQL elastic pool?

Relational data

A shared resource budget for multiple separate SQL databases, constrained by pool and per-database limits. It preserves database separation.

Source: validated AZ-305 Study Guide, PDF page 24; reference D05. Original learning item; review required.

When does an elastic pool save capacity?

Relational data

When tenant databases have differing peak times, allowing quiet databases' spare capacity to support busy databases.

Source: validated AZ-305 Study Guide, PDF page 24; reference D05. Original learning item; review required.

Why do simultaneous tenant peaks challenge an elastic pool?

Relational data

The pool must cover overlapping demand; it cannot guarantee that every database reaches its individual maximum simultaneously.

Source: validated AZ-305 Study Guide, PDF page 24; reference D05. Original learning item; review required.

What does read scale-out improve, and what does it not improve?

Relational data

It offloads eligible read-only work using supported replica routing. It does not increase the primary's write capacity.

Source: validated AZ-305 Study Guide, PDF page 24; reference D06. Original learning item; review required.

What design change usually supports horizontal write scaling?

Relational data

Partitioning/sharding records across databases with an access-aligned shard key, accepting more complex cross-shard queries and transactions.

Source: validated AZ-305 Study Guide, PDF page 24; reference D01. Original learning item; review required.

What does transparent data encryption protect?

Relational data

Database files, logs, and backups at rest. It does not prevent an authorized SELECT or replace TLS, access controls, or retention.

Source: validated AZ-305 Study Guide, PDF page 24; reference D09. Original learning item; review required.

What dependency accompanies a customer-managed TDE protector?

Relational data

The database must retain permission and access to required key versions in Key Vault or an eligible managed HSM; plan rotation and key recovery.

Source: validated AZ-305 Study Guide, PDF page 24; reference D09. Original learning item; review required.

How do Entra authentication and database authorization differ?

Relational data

Entra/managed identity establishes the principal; database roles and permissions determine allowed data operations. ARM management rights do not confer all data permissions.

Source: validated AZ-305 Study Guide, PDF page 24; reference D10. Original learning item; review required.

What does a private endpoint fail to replace for a SQL database?

Relational data

Authentication, data permissions, correct DNS, and a usable route from the client. Private connectivity limits exposure but does not authorize queries.

Source: validated AZ-305 Study Guide, PDF page 24; reference D10. Original learning item; review required.

Which SQL capability can protect eligible sensitive values from database administrators?

Relational data

Always Encrypted protects values client-side with separately managed keys; assess supported operations and enclave requirements.

Source: validated AZ-305 Study Guide, PDF page 25; reference D01. Original learning item; review required.

How do dynamic masking and row-level security differ?

Relational data

Masking changes displayed values for selected users and is not encryption. Row-level security filters rows using authorization predicates.

Source: validated AZ-305 Study Guide, PDF page 25; reference D01. Original learning item; review required.

What are Azure SQL Database short- and long-term backup retention ranges in the guide?

Relational data

Default PITR retention is seven days; ordinary configuration is one to thirty-five days, Basic one to seven. LTR can retain selected backups up to ten years.

Source: validated AZ-305 Study Guide, PDF page 25; reference D08. Original learning item; review required.

Why do Azure SQL geo-replicas not replace PITR backups?

Relational data

Deletion/corruption can replicate. Geographic replication maintains a current copy; retained backups preserve earlier good states.

Source: validated AZ-305 Study Guide, PDF page 25; reference D06. Original learning item; review required.

How do PostgreSQL read replicas differ from HA standbys?

Relational data

Read replicas asynchronously offload reads. Supported HA uses a synchronous availability standby, which is not the normal reporting endpoint.

Source: validated AZ-305 Study Guide, PDF page 25; reference D46. Original learning item; review required.

How do semi-structured and unstructured data differ?

Object, file, and NoSQL data

Semi-structured records have flexible fields, such as varying JSON documents. Unstructured objects include images, video, and binary files not normally queried as database columns.

Source: validated AZ-305 Study Guide, PDF page 26; reference D59. Original learning item; review required.

How do object, file, and block storage access semantics differ?

Object, file, and NoSQL data

Object storage exposes objects via APIs; file storage exposes directories and shared file protocols; block storage exposes disks to an OS.

Source: validated AZ-305 Study Guide, PDF page 26; reference D20. Original learning item; review required.

Which storage service fits millions of website images accessed through an object API?

Object, file, and NoSQL data

Azure Blob Storage, with appropriate object security, access tiers, lifecycle, and recovery controls.

Source: validated AZ-305 Study Guide, PDF page 26; reference D20. Original learning item; review required.

Which storage service fits a legacy application requiring an SMB share?

Object, file, and NoSQL data

Azure Files in a compatible configuration; Blob object APIs do not transparently satisfy shared filesystem semantics.

Source: validated AZ-305 Study Guide, PDF page 26; reference D24. Original learning item; review required.

What is the usual Azure abstraction for durable VM disks?

Object, file, and NoSQL data

Azure managed disks, sized for IOPS/throughput/latency and constrained by supported region and VM limits.

Source: validated AZ-305 Study Guide, PDF page 26-27; reference D50. Original learning item; review required.

When is Azure Table storage suitable?

Object, file, and NoSQL data

Simple low-cost key-and-attribute entities using PartitionKey and RowKey, when its indexing and query model satisfy the application.

Source: validated AZ-305 Study Guide, PDF page 26; reference D51. Original learning item; review required.

What Blob type typically stores images, documents, and object uploads?

Object, file, and NoSQL data

Block blobs.

Source: validated AZ-305 Study Guide, PDF page 26; reference D20. Original learning item; review required.

What Blob types suit append-oriented versus random range I/O?

Object, file, and NoSQL data

Append blobs suit supported append-oriented patterns. Page blobs provide random read/write access to ranges.

Source: validated AZ-305 Study Guide, PDF page 26; reference D20. Original learning item; review required.

Why do slashes in flat Blob names not provide full directory semantics?

Object, file, and NoSQL data

They resemble folders in naming, but flat namespace operations and permissions differ from first-class hierarchical directories.

Source: validated AZ-305 Study Guide, PDF page 26-27; reference D19. Original learning item; review required.

What Azure Files measurements guide performance and billing selection?

Object, file, and NoSQL data

IOPS, throughput, capacity, file count, and transaction patterns, along with supported protocol, identity, redundancy, and backup behavior.

Source: validated AZ-305 Study Guide, PDF page 26; reference D24. Original learning item; review required.

What does Azure File Sync cloud tiering accomplish?

Object, file, and NoSQL data

It synchronizes supported Windows Server endpoints with an Azure Files cloud share while retaining hot files locally and tiering cold files.

Source: validated AZ-305 Study Guide, PDF page 26-27; reference D25. Original learning item; review required.

Why does Azure File Sync not substitute for backups?

Object, file, and NoSQL data

It synchronizes changes, including potentially destructive changes; independent historical recovery points protect earlier good states.

Source: validated AZ-305 Study Guide, PDF page 27; reference D25. Original learning item; review required.

Why might an Ultra Disk upgrade fail to increase VM storage throughput?

Object, file, and NoSQL data

The VM's own I/O limits can remain the bottleneck even when its disk supports higher performance.

Source: validated AZ-305 Study Guide, PDF page 27; reference D50. Original learning item; review required.

Where should irreplaceable VM business data not be stored?

Object, file, and NoSQL data

Temporary disks or ephemeral OS disks; use durable storage and appropriate recovery controls.

Source: validated AZ-305 Study Guide, PDF page 27; reference D50. Original learning item; review required.

What is Azure Data Lake Storage hierarchical namespace?

Object, file, and NoSQL data

Blob-based storage with first-class directories, efficient directory operations, and POSIX-style path ACLs for analytics workloads.

Source: validated AZ-305 Study Guide, PDF page 27; reference D19. Original learning item; review required.

Why does hierarchical namespace help Spark output commit patterns?

Object, file, and NoSQL data

Renaming a directory can be efficient instead of rewriting potentially millions of object names after processing temporary output.

Source: validated AZ-305 Study Guide, PDF page 27; reference D19. Original learning item; review required.

What does an ADLS lake provide versus its analytics engine?

Object, file, and NoSQL data

The lake stores files; Synapse, Databricks, Fabric, or another engine processes and analyzes them.

Source: validated AZ-305 Study Guide, PDF page 27; reference D19. Original learning item; review required.

What compatibility caveat applies when enabling HNS?

Object, file, and NoSQL data

Check every needed Blob capability and recovery feature; ordinary block-blob PITR does not support hierarchical namespace accounts.

Source: validated AZ-305 Study Guide, PDF page 27; reference D21. Original learning item; review required.

Can an ADLS ACL deny access already granted by a sufficient data RBAC role?

Object, file, and NoSQL data

No. Roles and role conditions are evaluated first; an ACL cannot narrow already sufficient role-granted access.

Source: validated AZ-305 Study Guide, PDF page 27; reference D22. Original learning item; review required.

What permissions allow traversal of ADLS directories?

Object, file, and NoSQL data

Necessary execute permissions along the path, combined with suitable data-role/ACL authorization for the intended file operation.

Source: validated AZ-305 Study Guide, PDF page 27; reference D22. Original learning item; review required.

Which Blob tiers support immediate normal reads?

Object, file, and NoSQL data

Hot, cool, and cold are online. Archive is offline and requires rehydration before normal access.

Source: validated AZ-305 Study Guide, PDF page 27-28; reference D18. Original learning item; review required.

What minimum storage durations ordinarily affect cool, cold, and archive early-deletion charges?

Object, file, and NoSQL data

Cool thirty days, cold ninety days, archive 180 days in the stated general-purpose-v2 context; these are billing rules, not deletion bans.

Source: validated AZ-305 Study Guide, PDF page 27-28; reference D18. Original learning item; review required.

Why is the lowest Blob storage price per GB not always the lowest total cost?

Object, file, and NoSQL data

Retrieval, transaction, early-deletion, and rehydration charges can dominate for frequently read or short-lived objects.

Source: validated AZ-305 Study Guide, PDF page 27-28; reference D18. Original learning item; review required.

What must happen before an archived Blob can serve normal reads?

Object, file, and NoSQL data

Rehydrate it to an online tier; priority, object size, and service conditions affect completion.

Source: validated AZ-305 Study Guide, PDF page 28; reference D18. Original learning item; review required.

Which storage redundancy options support archive in the guide?

Object, file, and NoSQL data

LRS, GRS, and RA-GRS. ZRS, GZRS, and RA-GZRS do not support archive.

Source: validated AZ-305 Study Guide, PDF page 28; reference D18. Original learning item; review required.

What does Blob lifecycle management do?

Object, file, and NoSQL data

Asynchronously tiers/deletes eligible objects using age and supported filters/properties; it requires explicit business retention rules.

Source: validated AZ-305 Study Guide, PDF page 28; reference D49. Original learning item; review required.

Why should lifecycle policies distinguish current versions, old versions, and snapshots?

Object, file, and NoSQL data

They have different recovery and retention purposes; indiscriminate deletion can remove required recovery history.

Source: validated AZ-305 Study Guide, PDF page 28; reference D49. Original learning item; review required.

What can prevent a lifecycle policy's intended deletion?

Object, file, and NoSQL data

An applicable immutable retention policy or legal hold; automatic lifecycle actions must obey protection requirements.

Source: validated AZ-305 Study Guide, PDF page 28; reference D26. Original learning item; review required.

How do storage durability and availability differ?

Object, file, and NoSQL data

Durability concerns data survival; availability concerns current request access. Durable copies may still be inaccessible during an outage.

Source: validated AZ-305 Study Guide, PDF page 28; reference D17. Original learning item; review required.

What does LRS protect and where are its copies?

Object, file, and NoSQL data

Multiple synchronous copies within one physical datacenter, protecting local hardware failures without a separate zone or geographic copy.

Source: validated AZ-305 Study Guide, PDF page 28; reference D17. Original learning item; review required.

What does ZRS add over LRS?

Object, file, and NoSQL data

Synchronous copies across supported availability zones in the primary region, protecting a zone failure; it adds no geographic copy.

Source: validated AZ-305 Study Guide, PDF page 28; reference D17. Original learning item; review required.

How does GRS replicate storage data?

Object, file, and NoSQL data

LRS in the primary plus asynchronous replication to LRS in a secondary region; secondary access normally requires failover.

Source: validated AZ-305 Study Guide, PDF page 29; reference D17. Original learning item; review required.

How does GZRS combine local and regional resilience?

Object, file, and NoSQL data

ZRS in the primary plus asynchronous geographic replication to locally redundant copies in the secondary.

Source: validated AZ-305 Study Guide, PDF page 29; reference D17. Original learning item; review required.

What do RA-GRS and RA-GZRS add?

Object, file, and NoSQL data

Supported secondary-region read access before failover. The secondary may lag and is not a second normal writable primary.

Source: validated AZ-305 Study Guide, PDF page 29; reference D17. Original learning item; review required.

Why use separate storage accounts when workloads need different redundancy?

Object, file, and NoSQL data

Services within a storage account share its redundancy setting; incompatible requirements need separate accounts.

Source: validated AZ-305 Study Guide, PDF page 29; reference D17. Original learning item; review required.

What does storage Last Sync Time help estimate?

Object, file, and NoSQL data

Which writes reached the geographic secondary before failover and the potential data gap, rather than a universal zero-loss guarantee.

Source: validated AZ-305 Study Guide, PDF page 29; reference D17. Original learning item; review required.

Why does read-access storage redundancy not provide a readable Azure Files secondary?

Object, file, and NoSQL data

Azure Files has different supported access/failover semantics; readable secondaries for other services do not create a secondary Files share endpoint.

Source: validated AZ-305 Study Guide, PDF page 29; reference D25. Original learning item; review required.

What regional redundancy limitation applies to SSD Azure Files shares?

Object, file, and NoSQL data

They do not support GRS or GZRS; use a different compatible regional recovery design.

Source: validated AZ-305 Study Guide, PDF page 29; reference D25. Original learning item; review required.

What does Geo Priority Replication's specific SLA cover?

Object, file, and NoSQL data

For eligible opt-in workloads, block-blob Last Sync Time lag of fifteen minutes or less for 99% of the billing month, subject to documented exclusions.

Source: validated AZ-305 Study Guide, PDF page 29; reference D68. Original learning item; review required.

Why does Geo Priority Replication not imply zero RPO for all storage?

Object, file, and NoSQL data

It remains asynchronous, requires eligibility/enablement, has exclusions, and its specific block-blob SLA does not extend universally to Azure Files.

Source: validated AZ-305 Study Guide, PDF page 29; reference D68. Original learning item; review required.

What does Azure Storage service-side encryption protect?

Object, file, and NoSQL data

Data at rest using Microsoft-managed or eligible customer-managed keys; valid authorized readers can still receive plaintext.

Source: validated AZ-305 Study Guide, PDF page 29; reference D60. Original learning item; review required.

What is a shared access signature?

Object, file, and NoSQL data

A bearer token delegating limited supported storage operations/resources over a defined interval, with available request restrictions.

Source: validated AZ-305 Study Guide, PDF page 29; reference D23. Original learning item; review required.

How do user delegation SAS and service/account SAS differ in signing?

Object, file, and NoSQL data

Blob user delegation SAS uses a key obtained with Entra credentials. Service/account SAS use an account key.

Source: validated AZ-305 Study Guide, PDF page 29; reference D23. Original learning item; review required.

How should SAS credentials be constrained?

Object, file, and NoSQL data

Least necessary permissions/resources, short lifetime, suitable protocol restrictions, secure handling, and a revocation plan.

Source: validated AZ-305 Study Guide, PDF page 29; reference D23. Original learning item; review required.

Does a stored access policy apply to every SAS type?

Object, file, and NoSQL data

No. It controls eligible service SAS tokens; it is not a universal revocation mechanism for account or user delegation SAS.

Source: validated AZ-305 Study Guide, PDF page 29; reference D23. Original learning item; review required.

How do Blob soft delete and container soft delete differ?

Object, file, and NoSQL data

Blob soft delete retains deleted objects for a period; container soft delete protects against container deletion.

Source: validated AZ-305 Study Guide, PDF page 29; reference D20. Original learning item; review required.

Which capabilities underpin eligible block-blob point-in-time restore?

Object, file, and NoSQL data

Soft delete, versioning, and change feed. It does not protect against deleting the whole storage account.

Source: validated AZ-305 Study Guide, PDF page 29; reference D21. Original learning item; review required.

What limitation does HNS soft delete have compared with overwrite version history?

Object, file, and NoSQL data

It protects deleted files/directories but does not offer equivalent overwrite recovery; choose compatible independent protection.

Source: validated AZ-305 Study Guide, PDF page 29; reference D20. Original learning item; review required.

What does immutable Blob storage enforce?

Object, file, and NoSQL data

Eligible WORM retention via time-based policies or legal holds, resisting modification/deletion during the protected period.

Source: validated AZ-305 Study Guide, PDF page 29-30; reference D26. Original learning item; review required.

Why must locked immutable retention be planned carefully?

Object, file, and NoSQL data

A locked time-based policy cannot casually be shortened and can block legitimate overwrites or deletion; verify scope and write behavior first.

Source: validated AZ-305 Study Guide, PDF page 30; reference D26. Original learning item; review required.

What does a Cosmos DB logical partition represent?

Object, file, and NoSQL data

Records sharing the same full partition-key value. Azure maps logical partitions to managed physical partitions and replica sets.

Source: validated AZ-305 Study Guide, PDF page 30; reference D13. Original learning item; review required.

What properties make a useful Cosmos partition key?

Object, file, and NoSQL data

High enough cardinality and balanced storage/traffic distribution, aligned with frequent query access patterns.

Source: validated AZ-305 Study Guide, PDF page 30; reference D13. Original learning item; review required.

Why can a country partition key cause a hot partition?

Object, file, and NoSQL data

Low cardinality or concentrated demand puts most requests into a few key values despite available account-wide throughput.

Source: validated AZ-305 Study Guide, PDF page 30; reference D13. Original learning item; review required.

What tradeoff can a random Cosmos partition key create?

Object, file, and NoSQL data

Balanced writes but inefficient business queries that must scan across partitions.

Source: validated AZ-305 Study Guide, PDF page 30; reference D13. Original learning item; review required.

What conventional single-level Cosmos logical-partition storage limit is documented?

Object, file, and NoSQL data

20 GB; its throughput is also bounded by a physical partition. Hierarchical keys can spread tenant prefixes across lower-level values.

Source: validated AZ-305 Study Guide, PDF page 30; reference D13. Original learning item; review required.

What is the ordinary transaction scope in Cosmos DB for NoSQL?

Object, file, and NoSQL data

One logical partition. Partition choice affects atomic business operations as well as query efficiency.

Source: validated AZ-305 Study Guide, PDF page 30; reference D13. Original learning item; review required.

What is the difference between a request's RU charge and provisioned RU/s?

Object, file, and NoSQL data

RU charge is the normalized cost of one request; RU/s is the throughput budget each second. Measure representative operations for sizing.

Source: validated AZ-305 Study Guide, PDF page 30; reference D15. Original learning item; review required.

What Cosmos throughput models suit steady, fluctuating, and long-idle demand?

Object, file, and NoSQL data

Manual provisioned throughput for steady use; autoscale provisioned throughput for fluctuating demand; serverless consumed-RU billing for appropriate intermittent single-region use.

Source: validated AZ-305 Study Guide, PDF page 30-31; reference D14. Original learning item; review required.

How do the five Cosmos consistency levels differ?

Object, file, and NoSQL data

Strong: latest committed value. Bounded staleness: bounded versions/time lag. Session: session guarantees including read-your-writes. Consistent prefix: write order. Eventual: convergence without fixed freshness.

Source: validated AZ-305 Study Guide, PDF page 31; reference D12. Original learning item; review required.

What restrictions and business risk accompany Cosmos multi-region writes?

Object, file, and NoSQL data

Strong consistency is unsupported; serverless is single-region. Concurrent updates need supported conflict handling, and last-write-wins can discard a business update.

Source: validated AZ-305 Study Guide, PDF page 31; reference D16. Original learning item; review required.

What activities comprise data integration?

Integration and analytics

Extraction, movement, cleansing, transformation, orchestration, and monitoring combine source data into usable forms.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

How do data integration and analysis differ?

Integration and analytics

Integration prepares/combines data; analysis queries, aggregates, models, and reports on prepared data.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

Why does copying data into a lake not complete an analytics architecture?

Integration and analytics

Storage/ingestion alone does not define transformations, quality, orchestration, serving models, or reporting freshness.

Source: validated AZ-305 Study Guide, PDF page 32; reference D19. Original learning item; review required.

How do OLTP and OLAP workloads differ?

Integration and analytics

OLTP performs many short transactional operations enforcing application rules; OLAP scans/aggregates large historical datasets for analysis.

Source: validated AZ-305 Study Guide, PDF page 32; reference D28. Original learning item; review required.

Why separate large historical reports from an OLTP database?

Integration and analytics

Independent analytical capacity and data layout reduce interference with customer transactions and support historical retention.

Source: validated AZ-305 Study Guide, PDF page 32; reference D28. Original learning item; review required.

Which requirement should decide batch versus streaming ingestion?

Integration and analytics

Required end-to-end data/report freshness, alongside correctness, cost, replay, and source capabilities.

Source: validated AZ-305 Study Guide, PDF page 32; reference D48. Original learning item; review required.

What is ETL?

Integration and analytics

Extract, transform, load: transformations precede arrival at the final destination; useful for excluding sensitive/irrelevant fields early.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

What is ELT?

Integration and analytics

Extract, load, transform: raw source detail lands before transformation by a destination/associated scalable engine, supporting later reprocessing.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

How do full and incremental loads differ?

Integration and analytics

Full load copies everything; incremental load copies changes since a tracked point, reducing time/traffic when correctly implemented.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

What complications can a timestamp watermark miss?

Integration and analytics

Equal timestamps, late updates, time-zone boundaries, and deletion records; use robust boundaries/change tracking and reconciliation.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

What does change data capture contribute to incremental integration?

Integration and analytics

Supported source change events for inserts, updates, and deletes, instead of inferring every change from a timestamp.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

Why retain pipeline checkpoints?

Integration and analytics

They record processed progress so recovery can resume/replay from a known location; safe replay still requires correct sink semantics.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

What does idempotent pipeline processing accomplish?

Integration and analytics

Rerunning the same input produces the same intended business result rather than duplicate orders or repeated side effects.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

Which validation exceeds pipeline activity success?

Integration and analytics

Reconcile row counts, business totals, expected changes, and quality boundaries to establish that the resulting data is correct.

Source: validated AZ-305 Study Guide, PDF page 32; reference D47. Original learning item; review required.

What are raw, refined, and curated lake layers?

Integration and analytics

Raw preserves source data; refined standardizes/cleans records; curated exposes business-ready tables/aggregates. Often called bronze, silver, gold.

Source: validated AZ-305 Study Guide, PDF page 33; reference D29. Original learning item; review required.

Why preserve raw data when transformation logic can change?

Integration and analytics

It enables controlled reprocessing after a logic defect without recollecting every original source record.

Source: validated AZ-305 Study Guide, PDF page 33; reference D29. Original learning item; review required.

Where must sensitive fields remain protected in a layered lake?

Integration and analytics

Every layer plus quarantine records and temporary output; moving/cleansing data does not remove security duties.

Source: validated AZ-305 Study Guide, PDF page 33; reference D29. Original learning item; review required.

What do Data Factory pipelines, linked services, datasets, and triggers represent?

Integration and analytics

Pipeline: activities/workflow. Linked service: connection. Dataset: referenced data. Trigger: schedule/supported event starting execution.

Source: validated AZ-305 Study Guide, PDF page 33; reference D47. Original learning item; review required.

What does Data Factory Copy Activity do?

Integration and analytics

Moves data through supported connectors. Transformations can use mapping data flows or be dispatched to other engines.

Source: validated AZ-305 Study Guide, PDF page 33; reference D47. Original learning item; review required.

What does an Azure Integration Runtime provide?

Integration and analytics

Managed cloud execution/connectivity for supported data movement and transformation capabilities.

Source: validated AZ-305 Study Guide, PDF page 33; reference D27. Original learning item; review required.

When is a self-hosted integration runtime useful?

Integration and analytics

To reach supported on-premises/private sources unavailable directly to managed execution; deploy, protect, and monitor supported nodes.

Source: validated AZ-305 Study Guide, PDF page 33; reference D27. Original learning item; review required.

What is Azure-SSIS Integration Runtime for?

Integration and analytics

Running supported existing SQL Server Integration Services packages in Azure.

Source: validated AZ-305 Study Guide, PDF page 33; reference D27. Original learning item; review required.

Why do linked-service credentials not guarantee source connectivity?

Integration and analytics

Authentication does not create routes, firewall permissions, DNS, or network reachability; runtime placement must meet these requirements.

Source: validated AZ-305 Study Guide, PDF page 33; reference D27. Original learning item; review required.

How can self-hosted runtime availability be improved?

Integration and analytics

Use multiple supported nodes with protected credentials and monitoring, while testing source/destination throughput and connectivity.

Source: validated AZ-305 Study Guide, PDF page 33; reference D27. Original learning item; review required.

How do Synapse dedicated and serverless SQL differ?

Integration and analytics

Dedicated pools allocate distributed warehouse capacity; serverless SQL queries eligible lake files with data-scanning cost and different feature limits.

Source: validated AZ-305 Study Guide, PDF page 33-34; reference D28. Original learning item; review required.

What can reduce Synapse serverless data-scanning cost?

Integration and analytics

Partition files by common filters and use suitable columnar formats, reducing eligible data read by queries.

Source: validated AZ-305 Study Guide, PDF page 34; reference D28. Original learning item; review required.

When do Databricks, Fabric, and ADX fit analytics?

Integration and analytics

Databricks: Spark engineering/streaming/lakehouse/data science. Fabric: integrated OneLake/SaaS/reporting platform. ADX: interactive telemetry/log/time-series exploration using KQL.

Source: validated AZ-305 Study Guide, PDF page 33-34; reference D29. Original learning item; review required.

What streaming correctness decisions must be explicit?

Integration and analytics

Event versus processing time, windows, late-arrival/ordering policy, checkpoints, duplicate handling, and replayable input.

Source: validated AZ-305 Study Guide, PDF page 34; reference D48. Original learning item; review required.

How do tumbling and sliding windows differ?

Integration and analytics

Tumbling windows partition time into non-overlapping intervals; sliding windows evaluate a moving interval.

Source: validated AZ-305 Study Guide, PDF page 34; reference D48. Original learning item; review required.

What does Microsoft Purview governance provide and not automatically provide?

Integration and analytics

Discovery, classification, cataloging, and lineage; it does not automatically grant underlying data access or execute transformations.

Source: validated AZ-305 Study Guide, PDF page 34; reference D32. Original learning item; review required.

What is RPO?

Backup and disaster recovery

Maximum acceptable loss of recent data as a time interval backward from an incident; define it for the workload and failure scenario.

Source: validated AZ-305 Study Guide, PDF page 36; reference D58. Original learning item; review required.

What is RTO?

Backup and disaster recovery

Target elapsed time to restore required business service after disruption, including detection, dependencies, validation, and routing.

Source: validated AZ-305 Study Guide, PDF page 36; reference D58. Original learning item; review required.

If an incident occurs at 10:00, the usable point is 09:55, and users return at 10:30, what are the realized gap and duration?

Backup and disaster recovery

Five-minute data gap and thirty-minute recovery duration.

Source: validated AZ-305 Study Guide, PDF page 36; reference D58. Original learning item; review required.

Why is an hourly backup schedule insufficient for a five-minute RPO?

Backup and disaster recovery

An incident just before the next backup can lose almost an hour; use a mechanism whose usable recovery points and operations meet the objective.

Source: validated AZ-305 Study Guide, PDF page 36; reference D58. Original learning item; review required.

Why is VM boot time not equal to application RTO?

Backup and disaster recovery

Identity, networks, DNS, databases, secrets, startup ordering, capacity, validation, and traffic routing also contribute to user recovery.

Source: validated AZ-305 Study Guide, PDF page 36; reference D58. Original learning item; review required.

How do backup, HA, and DR differ?

Backup and disaster recovery

Backup preserves historical states; HA reduces interruption within intended fault boundaries; DR restores service after larger disruption such as regional loss.

Source: validated AZ-305 Study Guide, PDF page 36; reference D33. Original learning item; review required.

Why retain isolated known-good backups in addition to replication?

Backup and disaster recovery

Replication can copy deletion, corruption, or malware changes; a protected earlier state must survive relevant account/admin compromise.

Source: validated AZ-305 Study Guide, PDF page 36; reference D33. Original learning item; review required.

What Azure Backup workloads commonly use a Recovery Services vault?

Backup and disaster recovery

Azure VMs, supported SQL/SAP HANA in VMs, Azure Files, and hybrid protection via MARS/MABS/DPM; it also manages supported Site Recovery.

Source: validated AZ-305 Study Guide, PDF page 36; reference D35. Original learning item; review required.

What workloads commonly use a Backup vault?

Backup and disaster recovery

Newer supported data-protection workloads such as Blob, disks, and supported PostgreSQL/Kubernetes; verify the current matrix.

Source: validated AZ-305 Study Guide, PDF page 36; reference D36. Original learning item; review required.

Why should vault type not be chosen from its name alone?

Backup and disaster recovery

Vaults support different workloads and storage/recovery behaviors; Recovery Services vault and Backup vault are not interchangeable.

Source: validated AZ-305 Study Guide, PDF page 36-37; reference D34. Original learning item; review required.

Does every Azure Backup recovery point mean bytes were copied into vault storage?

Backup and disaster recovery

No. Operational disk/Blob protection can rely on source snapshots/capabilities; verify where data actually resides.

Source: validated AZ-305 Study Guide, PDF page 37; reference D36. Original learning item; review required.

Why must Cross Region Restore support be checked separately from GRS?

Backup and disaster recovery

Support varies by workload/vault; GRS does not make every point immediately customer-restorable in any chosen region.

Source: validated AZ-305 Study Guide, PDF page 37; reference D34. Original learning item; review required.

What does Azure Backup soft delete provide?

Backup and disaster recovery

A recovery window for deleted backup data. The guide states fourteen-day default and eligible extension up to 180 days, with configuration/rollout qualifications.

Source: validated AZ-305 Study Guide, PDF page 37; reference D37. Original learning item; review required.

What does locked backup-vault immutability protect?

Backup and disaster recovery

It blocks destructive changes that would remove protected recovery points before retention expires; locking is irreversible and has support qualifications.

Source: validated AZ-305 Study Guide, PDF page 37; reference D38. Original learning item; review required.

How does Resource Guard strengthen backup administration?

Backup and disaster recovery

Multiuser authorization adds independent permission control for supported sensitive operations; separate Resource Guard control from vault administration.

Source: validated AZ-305 Study Guide, PDF page 37; reference D39. Original learning item; review required.

Why does soft delete still require monitoring?

Backup and disaster recovery

Destructive actions must be detected and recovery performed before the recoverable window expires.

Source: validated AZ-305 Study Guide, PDF page 37; reference D37. Original learning item; review required.

How do application-consistent and crash-consistent recovery points differ?

Backup and disaster recovery

Application-consistent points coordinate eligible application state; crash-consistent points resemble sudden power loss and can need log replay.

Source: validated AZ-305 Study Guide, PDF page 37-38; reference D34. Original learning item; review required.

What should a whole-service VM backup inventory include?

Backup and disaster recovery

Relevant OS/data disks, application state, external shared storage, and dependencies whose loss prevents the application from working.

Source: validated AZ-305 Study Guide, PDF page 37-38; reference D33. Original learning item; review required.

Why does infrastructure as code not replace business-data backups?

Backup and disaster recovery

It can rebuild disposable configuration and compute, but cannot recreate irreplaceable data never retained.

Source: validated AZ-305 Study Guide, PDF page 38; reference D33. Original learning item; review required.

What is MARS suitable for, and what should not be assumed?

Backup and disaster recovery

Eligible Windows file/folder protection. It is not a universal Linux or whole-application backup agent.

Source: validated AZ-305 Study Guide, PDF page 37-38; reference D34. Original learning item; review required.

What additional obligations accompany Azure Backup Server or DPM?

Backup and disaster recovery

Their own supported server, local storage, maintenance, monitoring, and operations, in return for broader supported workload protection.

Source: validated AZ-305 Study Guide, PDF page 38; reference D34. Original learning item; review required.

Why are Kubernetes worker-VM images an incomplete application backup?

Backup and disaster recovery

Cluster resources, supported persistent volumes, external secrets/databases, and other state need explicit protection and restore.

Source: validated AZ-305 Study Guide, PDF page 38; reference D34. Original learning item; review required.

What does Azure Site Recovery do?

Backup and disaster recovery

Replicates and orchestrates failover/recovery for supported machine workloads; source OS/disks/networking and target configuration must meet support rules.

Source: validated AZ-305 Study Guide, PDF page 38; reference D41. Original learning item; review required.

Which source families can Site Recovery support?

Backup and disaster recovery

Supported Azure VMs and on-premises VMware, Hyper-V, and physical Windows/Linux systems; not every configuration or PaaS service.

Source: validated AZ-305 Study Guide, PDF page 38; reference D42. Original learning item; review required.

What is the documented failback target for physical servers replicated to Azure?

Backup and disaster recovery

A supported VMware VM rather than the original physical hardware; failback procedures differ by source platform.

Source: validated AZ-305 Study Guide, PDF page 38; reference D42. Original learning item; review required.

What belongs in a Site Recovery recovery plan?

Backup and disaster recovery

Machine groups, startup order, and supported automation/manual actions, with networks/identity ready before dependent database, middleware, and web services.

Source: validated AZ-305 Study Guide, PDF page 38; reference D57. Original learning item; review required.

What must be prepared outside replicated disks for regional machine recovery?

Backup and disaster recovery

Target networks, DNS, identities/permissions, secrets, quotas/capacity, connectivity, and external dependencies.

Source: validated AZ-305 Study Guide, PDF page 38; reference D57. Original learning item; review required.

Why can unplanned failover lose data?

Backup and disaster recovery

The source is unavailable and an available recovery point may omit changes that never replicated; select consistency/recovery point against RPO.

Source: validated AZ-305 Study Guide, PDF page 38; reference D41. Original learning item; review required.

What do reprotection and supported failback accomplish?

Backup and disaster recovery

Establish reverse-direction protection and return service in a controlled supported flow, reconciling writes as needed.

Source: validated AZ-305 Study Guide, PDF page 38; reference D42. Original learning item; review required.

How should a Site Recovery test failover be conducted?

Backup and disaster recovery

Use an isolated target network while production replication continues, validate the complete application and RTO, then clean up.

Source: validated AZ-305 Study Guide, PDF page 38; reference D56. Original learning item; review required.

Why isolate a test-failover network?

Backup and disaster recovery

To prevent conflicting names, duplicate writers, and accidental production access during the drill.

Source: validated AZ-305 Study Guide, PDF page 38; reference D56. Original learning item; review required.

How do SQL PaaS PITR/geo-restore and a warm geo-secondary differ?

Backup and disaster recovery

Native backups restore an earlier/new database; geo-restore can take longer than activating a ready secondary. Forced asynchronous geo-failover can lose recent writes.

Source: validated AZ-305 Study Guide, PDF page 38-39; reference D08. Original learning item; review required.

How do full, differential, and log backups support SQL Server recovery?

Backup and disaster recovery

Full supplies baseline; differential includes changes since that full baseline; a valid log chain supports selected-time recovery. Preserve required chain members.

Source: validated AZ-305 Study Guide, PDF page 38-39; reference D52. Original learning item; review required.

What SQL Server-in-VM log-backup interval is highlighted for a supported Azure Backup RPO?

Backup and disaster recovery

Frequent workload-aware log backups can support a fifteen-minute RPO when configured and operating as intended; verify successful jobs and usable chain.

Source: validated AZ-305 Study Guide, PDF page 38-39; reference D52. Original learning item; review required.

How does Cosmos continuous backup complement regional availability?

Backup and disaster recovery

Continuous backup supports PITR within selected retention/API support; regions retain current copies while backup restores an earlier good state.

Source: validated AZ-305 Study Guide, PDF page 39; reference D53. Original learning item; review required.

How do operational and vaulted Blob backups differ?

Backup and disaster recovery

Operational protection uses supported source-account PITR/versioning/soft-delete/change-feed; vaulted backup copies eligible data into a Backup vault and protects against source-account deletion.

Source: validated AZ-305 Study Guide, PDF page 39; reference D40. Original learning item; review required.

Why do Azure Files redundancy and File Sync still need retained recovery points?

Backup and disaster recovery

Replication/sync can propagate bad changes; supported snapshots/backup recover history, while redundancy addresses outage/durability boundaries.

Source: validated AZ-305 Study Guide, PDF page 39; reference D25. Original learning item; review required.

Which boundaries do availability sets, zones, and regions address?

High availability

Sets distribute eligible VMs across local fault/update domains; zones separate supported regional infrastructure; multiregion design addresses regional loss.

Source: validated AZ-305 Study Guide, PDF page 40; reference D63. Original learning item; review required.

How do zonal resources and zone-redundant services differ?

High availability

A zonal resource occupies a selected zone; a zone-redundant service distributes supported components across zones, requiring explicit supported configuration.

Source: validated AZ-305 Study Guide, PDF page 40; reference D63. Original learning item; review required.

Why does merely choosing a zoned region not ensure zone resilience?

High availability

Each resource, service tier, configuration, dependency, and surviving capacity must actually support/enable the required fault isolation.

Source: validated AZ-305 Study Guide, PDF page 40; reference D63. Original learning item; review required.

What surviving-capacity requirement follows from tolerating one of three zones failing?

High availability

The remaining two zones must handle required demand or scale within allowed disruption; nominal replica count alone is insufficient.

Source: validated AZ-305 Study Guide, PDF page 40; reference D63. Original learning item; review required.

What must accompany redundant VM workers?

High availability

Supported spread, healthy traffic routing, replicated/resilient state, sufficient capacity, and equally resilient disks/endpoints/dependencies.

Source: validated AZ-305 Study Guide, PDF page 40; reference D63. Original learning item; review required.

Why externalize application state from replaceable workers?

High availability

Worker failure/replacement should not destroy sessions or business records; put state in a resilient service or explicitly replicate it.

Source: validated AZ-305 Study Guide, PDF page 40; reference D63. Original learning item; review required.

What must be verified for App Service zone resilience?

High availability

Supported plan/region, enabled zone redundancy, enough instances, and surviving capacity; regional zones and multiregion deployment differ.

Source: validated AZ-305 Study Guide, PDF page 40; reference D64. Original learning item; review required.

Why does an AKS managed control plane not make a single pod highly available?

High availability

Pod/node placement, replicas, probes, storage, and capacity are workload concerns; a healthy control plane cannot supply an absent application replica.

Source: validated AZ-305 Study Guide, PDF page 40-41; reference D65. Original learning item; review required.

What do pod disruption budgets help with, and what can they not prevent?

High availability

They constrain eligible voluntary disruption during controlled maintenance; they cannot prevent every involuntary infrastructure failure.

Source: validated AZ-305 Study Guide, PDF page 40-41; reference D65. Original learning item; review required.

What retry behavior supports availability during transient failures?

High availability

Bounded retries, exponential backoff, timeouts, and idempotent operations, avoiding synchronized overload and endless backlog.

Source: validated AZ-305 Study Guide, PDF page 41; reference D58. Original learning item; review required.

Why must clients retry after a covered database HA failover?

High availability

A failover can interrupt active connections even if committed data survives; reconnect/retry safely rather than assuming connection continuity.

Source: validated AZ-305 Study Guide, PDF page 41; reference D44. Original learning item; review required.

What should a health probe evaluate?

High availability

Useful ability to serve the intended request, including critical dependency effects, so unhealthy workers do not receive traffic merely because the process runs.

Source: validated AZ-305 Study Guide, PDF page 40-41; reference D63. Original learning item; review required.

What does Azure SQL Database managed local HA not automatically provide?

High availability

Every required zone/recovery configuration, regional failover, historical recovery, or uninterrupted client connections.

Source: validated AZ-305 Study Guide, PDF page 41; reference D44. Original learning item; review required.

Which factors affect SQL Database zone-redundancy support?

High availability

Tier, hardware, region, and replica configuration; verify the exact supported deployment rather than applying a blanket tier assumption.

Source: validated AZ-305 Study Guide, PDF page 41; reference D44. Original learning item; review required.

What zone qualification applies to Managed Instance Next-gen General Purpose in the guide?

High availability

Zone redundancy is preview and depends on supported underlying Elastic SAN ZRS availability; configuration-specific checks are necessary.

Source: validated AZ-305 Study Guide, PDF page 41; reference D66. Original learning item; review required.

What must a SQL Server-on-VM HA topology include beyond VM placement?

High availability

Supported availability groups or failover clusters, quorum, synchronization, listener connectivity, client retries, and operational testing.

Source: validated AZ-305 Study Guide, PDF page 41; reference D67. Original learning item; review required.

How do synchronous local and asynchronous remote SQL replicas differ?

High availability

Covered synchronous failovers can preserve committed transactions but add coordination/latency; asynchronous regional replicas can lose recent writes.

Source: validated AZ-305 Study Guide, PDF page 41; reference D67. Original learning item; review required.

How do PostgreSQL same-zone and zone-redundant HA differ?

High availability

Both use supported synchronous availability standbys; only cross-zone placement isolates a full zone failure.

Source: validated AZ-305 Study Guide, PDF page 41; reference D46. Original learning item; review required.

Why is a PostgreSQL cross-region read replica not equivalent to its HA standby?

High availability

It is asynchronous and needs promotion/connection planning; local HA standby provides supported synchronous automatic failover.

Source: validated AZ-305 Study Guide, PDF page 41; reference D46. Original learning item; review required.

How do ZRS and GZRS support object/ADLS availability?

High availability

ZRS supplies synchronous primary-region zone copies; GZRS adds asynchronous geographic copies, requiring application regional recovery design.

Source: validated AZ-305 Study Guide, PDF page 41; reference D17. Original learning item; review required.

What must a Blob application tolerate when reading a geographic secondary?

High availability

Potential older/missing object versions and read-only behavior; recovery of compute/network/identity/secrets must accompany data access.

Source: validated AZ-305 Study Guide, PDF page 41; reference D17. Original learning item; review required.

What Azure Files HA distinctions matter for regional designs?

High availability

Use supported ZRS for zone failure; eligible geo-redundant HDD shares can use account failover; SSD lacks GRS/GZRS; clients may need session reconnection.

Source: validated AZ-305 Study Guide, PDF page 41-42; reference D25. Original learning item; review required.

What Cosmos settings must be selected together for availability?

High availability

Per-region zone redundancy, single-/multi-write topology, consistency, SDK preferred regions, failover, conflict handling, and independent backup.

Source: validated AZ-305 Study Guide, PDF page 42; reference D45. Original learning item; review required.

How do active-passive and active-active regional applications differ?

High availability

Active-passive prepares a secondary and may need scale-up/recovery; active-active serves multiple regions but complicates writes/conflicts/consistency.

Source: validated AZ-305 Study Guide, PDF page 42; reference D43. Original learning item; review required.

Why does a region pair not configure disaster recovery?

High availability

Pairing varies and some regions are unpaired; application dependencies still need supported replication, traffic routing, and tested failover.

Source: validated AZ-305 Study Guide, PDF page 42; reference D43. Original learning item; review required.

What does multiplying two independent required-component availability values illustrate?

High availability

For serial dependencies, 0.999 × 0.9995 = 0.9985005 ≈ 99.85%. It models measured independent availability and does not create a contractual application SLA.

Source: validated AZ-305 Study Guide, PDF page 42; reference D58. Original learning item; review required.

Which workload characteristics should drive the initial compute service choice?

Compute design

OS and runtime, packaging, CPU and memory, storage, concurrency, network access, execution duration, startup latency, state, retryability, availability, and the team's operating skills.

Source: AZ-305 Study Guide.pdf, PDF page(s) 43; reference N01. Original study item; requires human review.

Which Azure compute service best fits unchanged software requiring administrator access to a guest OS?

Compute design

Azure Virtual Machines; the customer manages guest software, patching, images, disks, networking, availability, and recovery.

Source: AZ-305 Study Guide.pdf, PDF page(s) 43; reference N01. Original study item; requires human review.

Which managed service is a strong starting point for a supported web app or HTTP API?

Compute design

Azure App Service, after validating runtime, plan capacity, inbound and outbound networking, deployment, and resilience requirements.

Source: AZ-305 Study Guide.pdf, PDF page(s) 43; reference N01. Original study item; requires human review.

When do container workloads justify AKS rather than Container Apps?

Compute design

When they need direct Kubernetes APIs, custom controllers, ecosystem extensions, or deep cluster control that Container Apps abstracts away.

Source: AZ-305 Study Guide.pdf, PDF page(s) 43, 46-47; reference N50. Original study item; requires human review.

What does Azure Container Apps provide for event-driven container services?

Compute design

Managed environments, versioned revisions, KEDA-based scaling, and optional Dapr integration with less cluster management.

Source: AZ-305 Study Guide.pdf, PDF page(s) 43, 46-47; reference N66. Original study item; requires human review.

What type of workload is a strong fit for Azure Container Instances?

Compute design

Simple isolated container or container-group execution, such as a one-off task or sidecar group without full application orchestration requirements.

Source: AZ-305 Study Guide.pdf, PDF page(s) 43, 47; reference N50. Original study item; requires human review.

Why can adding compute instances fail to increase application throughput?

Compute design

Databases, storage, downstream APIs, or connection limits can become bottlenecks; scale must respect the entire dependency path.

Source: AZ-305 Study Guide.pdf, PDF page(s) 44; reference N01. Original study item; requires human review.

How does Azure Compute Gallery help a VM image strategy?

Compute design

It stores and shares controlled image versions so deployments are repeatable instead of relying on undocumented manual changes to servers.

Source: AZ-305 Study Guide.pdf, PDF page(s) 44; reference N69. Original study item; requires human review.

What does Azure Hybrid Benefit require before reducing licensing costs?

Compute design

Eligible Windows Server or SQL Server licenses and compliance with the applicable licensing conditions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 44; reference N70. Original study item; requires human review.

How can a VM application authenticate to supported Azure services without embedding a password?

Compute design

Use a managed identity and grant that identity the required service permissions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 44; reference N01. Original study item; requires human review.

How should general-purpose, memory-optimized, compute-optimized, GPU, and HPC VM families be selected?

Compute design

Match measured balanced demand, large working sets, sustained CPU work, supported graphics or ML acceleration, or specialized parallel computation respectively; then check the exact SKU limits.

Source: AZ-305 Study Guide.pdf, PDF page(s) 44; reference N01. Original study item; requires human review.

Why must both VM and disk I/O limits be checked?

Compute design

The lower disk-level or aggregate VM limit constrains achievable IOPS and throughput even when an attached disk has higher advertised performance.

Source: AZ-305 Study Guide.pdf, PDF page(s) 44; reference N34. Original study item; requires human review.

Which workload tends to stress IOPS rather than throughput?

Compute design

Many small random reads or writes stress operations per second; large sequential transfers tend to stress MB/s.

Source: AZ-305 Study Guide.pdf, PDF page(s) 44; reference N34. Original study item; requires human review.

Where should durable business data live for a replaceable VM?

Compute design

On managed data disks or an appropriate managed data service, rather than temporary local storage.

Source: AZ-305 Study Guide.pdf, PDF page(s) 44; reference N34. Original study item; requires human review.

What is an ephemeral OS disk appropriate for?

Compute design

Stateless replaceable instances whose OS can be recreated from a controlled image; it is local storage and is unsuitable for preserving stateful OS changes.

Source: AZ-305 Study Guide.pdf, PDF page(s) 44; reference N34. Original study item; requires human review.

Which disk families are designed as data disks rather than OS disks?

Compute design

Premium SSD v2 and Ultra Disk; verify supported VMs, regions, zones, and feature constraints.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N34. Original study item; requires human review.

What distinguishes Premium SSD v2 sizing from capacity-linked disk performance?

Compute design

Capacity, provisioned IOPS, and throughput can be configured separately, within supported constraints.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N34. Original study item; requires human review.

How do Standard SSD, Premium SSD, and Ultra Disk differ as initial workload candidates?

Compute design

Standard SSD suits moderate and cost-sensitive workloads; Premium SSD suits production needing lower latency; Ultra Disk suits supported demanding high-performance data workloads.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N34. Original study item; requires human review.

What current lifecycle caveat applies to Standard HDD OS disks?

Compute design

Their use as OS disks retires on September 8, 2028; prefer an SSD-based OS disk design and review migration guidance.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N34. Original study item; requires human review.

How do scale out, scale in, and scale up differ?

Compute design

Scale out adds instances; scale in removes instances; scale up increases resources per instance.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N02. Original study item; requires human review.

What autoscale settings prevent unstable VM scale-set oscillation?

Compute design

Realistic thresholds, aggregation windows, cooldowns, and minimum and maximum counts, using a metric that represents the workload bottleneck.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N02. Original study item; requires human review.

Why can queue depth be a better worker autoscale signal than CPU?

Compute design

It measures pending work directly; CPU may stay low while workers wait on a constrained dependency.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N02. Original study item; requires human review.

What protects in-progress work during scale in?

Compute design

Graceful task draining and appropriate instance protection, combined with retry-safe processing and durable state.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N02. Original study item; requires human review.

What is the principal API distinction between Uniform and Flexible VM scale-set orchestration?

Compute design

Uniform uses common-profile scale-set child instance APIs; Flexible manages standard Azure VMs with ordinary VM APIs and more individual control.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N02. Original study item; requires human review.

Does Flexible VM scale-set orchestration support autoscaling and upgrade policies?

Compute design

Yes. Current support includes autoscaling and upgrade policies; verify the exact feature matrix instead of repeating obsolete no-autoscale claims.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N02. Original study item; requires human review.

Why can Flexible orchestration matter for VM backup or disaster recovery integration?

Compute design

Its instances are standard Azure VMs, enabling standard supported integrations such as Azure Backup and Site Recovery that are not equivalent for Uniform child instances.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N02. Original study item; requires human review.

How do availability sets differ from availability zones?

Compute design

Sets distribute supported VMs across local fault and update domains; zones separate supported resources across independent regional power, cooling, and networking locations.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N02. Original study item; requires human review.

Why must a zonal compute design reserve surviving capacity?

Compute design

The remaining zones must absorb the failed zone's work without breaching latency or availability objectives.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N02. Original study item; requires human review.

How do VM quota and physical capacity differ?

Compute design

Quota is the subscription's allocation permission; capacity is available hardware for the SKU and location. A quota increase does not create capacity.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N03. Original study item; requires human review.

How do on-demand capacity reservations differ from Reserved VM Instances?

Compute design

A successful supported capacity reservation secures quantity and location; Reserved VM Instances provide a term billing discount without guaranteeing hardware availability.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N03. Original study item; requires human review.

Why are Spot VMs unsuitable as the sole host for an uninterrupted critical service?

Compute design

Spare capacity can be reclaimed and Spot VMs evicted; the workload needs interruption tolerance or a dedicated-capacity baseline.

Source: AZ-305 Study Guide.pdf, PDF page(s) 45; reference N33. Original study item; requires human review.

What does an App Service plan define?

Compute design

Worker location, operating system, pricing tier, size, and count; one or more apps and their slots use those workers.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N04. Original study item; requires human review.

Why can a staging-slot load test affect production?

Compute design

Apps and slots on the same App Service plan share compute resources.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N04. Original study item; requires human review.

When should web apps use separate App Service plans?

Compute design

When they need independent scaling, resource isolation, different operating systems, or separate failure boundaries.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N04. Original study item; requires human review.

Does stopping a single web app normally stop App Service plan charges?

Compute design

No. Allocated plan compute generally continues to incur charges while the plan exists.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N04. Original study item; requires human review.

Which App Service tier family adds deployment slots and autoscale beyond Basic?

Compute design

Standard and higher tiers; other capabilities, such as zones or private access, have separate tier and infrastructure prerequisites.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N04. Original study item; requires human review.

What is the current minimum-instance guidance for supported zone-redundant Premium App Service plans?

Compute design

At least two plan instances for supported Premium v2 through v4 configurations; check region, infrastructure, available zones, and autoscale minimums.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N05. Original study item; requires human review.

Why does a zone-redundant plan not prove a one-worker app has a second hot replica?

Compute design

Plan worker distribution and per-app worker limits differ; a limit of one can leave no simultaneous hot app instance elsewhere.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N05. Original study item; requires human review.

What does marking an App Service setting as a slot setting accomplish?

Compute design

It keeps environment-specific configuration, such as a production connection string, attached to the intended slot during swaps.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N45. Original study item; requires human review.

What can an App Service slot swap fail to roll back?

Compute design

An incompatible database schema or data change; routing or application rollback needs data compatibility.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N45. Original study item; requires human review.

How do App Service inbound private access and outbound VNet integration differ?

Compute design

Private endpoints or access restrictions control inbound callers; VNet integration lets the app reach private outbound dependencies and does not itself privatize ingress.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N01. Original study item; requires human review.

What security lifecycle belongs to a container image?

Compute design

Authorize registry pulls, scan and patch dependencies, rebuild controlled images, and deploy versioned artifacts or immutable digests.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N50. Original study item; requires human review.

Does Azure Container Registry execute the images it stores?

Compute design

No. It stores and distributes artifacts; a compute host executes them.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N50. Original study item; requires human review.

What do Kubernetes deployment, service, and ingress provide?

Compute design

A deployment maintains pod replicas; a service provides stable access; an ingress implementation handles application routing.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N65. Original study item; requires human review.

How do horizontal pod autoscaling and cluster autoscaling differ?

Compute design

Pod autoscaling changes replica counts; cluster autoscaling adds node capacity when schedulable pods cannot fit.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N65. Original study item; requires human review.

What workload controls help AKS survive upgrades and failures?

Compute design

Resource requests and limits, multiple replicas, topology spread, readiness and liveness probes, disruption budgets, and appropriate persistent data replication.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46; reference N65. Original study item; requires human review.

How do Container Apps revisions and minimum replicas support release and latency requirements?

Compute design

Multiple active revisions enable gradual traffic shifts; a positive minimum replica count reduces scale-to-zero startup delay.

Source: AZ-305 Study Guide.pdf, PDF page(s) 46-47; reference N66. Original study item; requires human review.

Why should an ordinary Azure Function keep important state outside process memory?

Compute design

Hosts can be replaced and concurrent executions can run on different instances, so memory is not a durable shared state store.

Source: AZ-305 Study Guide.pdf, PDF page(s) 47; reference N06. Original study item; requires human review.

Which Functions plan is a strong current starting point for variable code demand and outbound VNet integration?

Compute design

Flex Consumption, subject to supported OS, language, resource, and networking requirements; optional always-ready capacity can reduce startup delay.

Source: AZ-305 Study Guide.pdf, PDF page(s) 47; reference N06. Original study item; requires human review.

When is Functions Premium a strong hosting candidate?

Compute design

When prewarmed capacity, low startup latency, sustained demand, private networking, or supported custom Linux containers are required, accepting minimum provisioned cost.

Source: AZ-305 Study Guide.pdf, PDF page(s) 47; reference N06. Original study item; requires human review.

How does a Dedicated Functions plan scale and support continuous trigger processing?

Compute design

It uses allocated App Service capacity with manual or plan autoscale; enable Always On when required.

Source: AZ-305 Study Guide.pdf, PDF page(s) 47; reference N06. Original study item; requires human review.

What problem does Durable Functions solve?

Compute design

It persists workflow progress and orchestrates activities for patterns such as chaining, fan-out/fan-in, asynchronous processing, monitoring, and human approval.

Source: AZ-305 Study Guide.pdf, PDF page(s) 47; reference N53. Original study item; requires human review.

Why must Durable Functions orchestrator logic be deterministic?

Compute design

History is replayed to rebuild workflow state; put external calls and nondeterministic work into activities or use documented deterministic orchestration APIs.

Source: AZ-305 Study Guide.pdf, PDF page(s) 47; reference N63. Original study item; requires human review.

Does durable orchestration guarantee exactly-once external business effects?

Compute design

No. Activities can be retried, so idempotency and correct transaction boundaries remain necessary.

Source: AZ-305 Study Guide.pdf, PDF page(s) 47; reference N53. Original study item; requires human review.

How do legacy Consumption and current Flex, Premium, and Dedicated execution timeout settings differ?

Compute design

Legacy Consumption defaults to five minutes and permits ten; Flex, Premium, and Dedicated default to 30 minutes and permit unbounded configuration under documented conditions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 47-48; reference N06. Original study item; requires human review.

Why does a longer function execution timeout not solve a long synchronous HTTP response?

Compute design

The documented HTTP response limit is 230 seconds; use an accepted response with status tracking and asynchronous queued or durable work.

Source: AZ-305 Study Guide.pdf, PDF page(s) 47-48; reference N06. Original study item; requires human review.

How do Batch pools, jobs, tasks, and start tasks differ?

Compute design

A pool defines compute nodes, a job groups work and policies, a task executes a command, and a start task prepares a node's software environment.

Source: AZ-305 Study Guide.pdf, PDF page(s) 48; reference N51. Original study item; requires human review.

How should Batch results and interruption-sensitive deadlines influence pool design?

Compute design

Persist results in durable storage; use retryable or checkpointed Spot tasks for flexible work and dedicated or mixed capacity for reliable completion.

Source: AZ-305 Study Guide.pdf, PDF page(s) 48; reference N51. Original study item; requires human review.

When are Batch multi-instance tasks or CycleCloud useful?

Compute design

Multi-instance tasks fit supported tightly coupled jobs such as MPI; CycleCloud fits HPC needing a specific scheduler and custom cluster topology that the team operates.

Source: AZ-305 Study Guide.pdf, PDF page(s) 48; reference N51. Original study item; requires human review.

How do commands, discrete events, and streams differ?

Application architecture

A command requests an operation; an event announces something that happened; a stream records a retained sequence of observations.

Source: AZ-305 Study Guide.pdf, PDF page(s) 49; reference N07. Original study item; requires human review.

When should a component call another service synchronously?

Application architecture

When an immediate result is required and the call fits the supported latency and timeout budget, accounting for dependency failure.

Source: AZ-305 Study Guide.pdf, PDF page(s) 49; reference N07. Original study item; requires human review.

What does asynchronous queue-based load leveling provide, and what must the user experience expose?

Application architecture

It buffers bursts for sustainable consumer processing; users need accepted or pending state, status tracking, and meaningful eventual failure handling.

Source: AZ-305 Study Guide.pdf, PDF page(s) 49; reference N29. Original study item; requires human review.

Which Azure messaging service is a strong fit for durable business commands?

Application architecture

Azure Service Bus queues, using brokered messages, acknowledgments, locks, and supported reliability features.

Source: AZ-305 Study Guide.pdf, PDF page(s) 49; reference N07. Original study item; requires human review.

How do a queue's competing consumers differ from topic subscriptions?

Application architecture

Queue consumers divide one work stream; each topic subscription receives an independent logical copy, with competing workers within that subscription.

Source: AZ-305 Study Guide.pdf, PDF page(s) 49-50; reference N08. Original study item; requires human review.

Which messaging service best fits discrete resource-change notifications?

Application architecture

Azure Event Grid; subscriptions filter and route events to interested handlers.

Source: AZ-305 Study Guide.pdf, PDF page(s) 49, 51; reference N07. Original study item; requires human review.

Which messaging service fits high-volume telemetry with independent replaying consumers?

Application architecture

Azure Event Hubs, using retained partitions, consumer groups, and checkpoints.

Source: AZ-305 Study Guide.pdf, PDF page(s) 49, 51; reference N43. Original study item; requires human review.

When is Azure Queue Storage an appropriate messaging choice?

Application architecture

For straightforward inexpensive durable work queues when application-supplied poison handling and simpler processing semantics are acceptable.

Source: AZ-305 Study Guide.pdf, PDF page(s) 49, 51; reference N29. Original study item; requires human review.

How does Service Bus Peek Lock work?

Application architecture

A receiver locks a message, processes it, and completes it after success; abandonment or lock expiry permits redelivery.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50; reference N08. Original study item; requires human review.

What failure risk does Service Bus Receive and Delete introduce?

Application architecture

The message is removed at receipt, so a consumer crash before processing can lose the work.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50; reference N08. Original study item; requires human review.

When is Service Bus lock renewal useful?

Application architecture

For supported processing that legitimately outlasts a delivery lock; avoid holding a lock through unnecessarily long interactions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50; reference N08. Original study item; requires human review.

What does Service Bus duplicate detection actually deduplicate?

Application architecture

Repeated sends with the same application-supplied MessageId inside the configured deduplication window.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50; reference N30. Original study item; requires human review.

Why does broker duplicate detection not guarantee one database order per message?

Application architecture

A worker can commit the database write and lose the message lock before completion; redelivery still needs idempotent business processing.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50; reference N30. Original study item; requires human review.

How can a message worker prevent duplicate business records?

Application architecture

Use a stable business identifier with a uniqueness constraint or a transactional processed-message record.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50; reference N08. Original study item; requires human review.

How do Service Bus subscription filters affect publication?

Application architecture

Each subscription selects messages using supported broker properties or SQL-style rules while maintaining its independent receipt and processing.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50; reference N08. Original study item; requires human review.

What do Service Bus sessions provide?

Application architecture

Exclusive session ownership and ordered processing for related messages sharing a SessionId, with supported session state.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50; reference N29. Original study item; requires human review.

Why should message ordering be scoped to an order or account rather than all customers?

Application architecture

Independent sessions preserve required local order while allowing concurrency; one global order unnecessarily serializes unrelated work.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50; reference N29. Original study item; requires human review.

What is the role of a Service Bus dead-letter queue?

Application architecture

It retains unsuccessfully delivered or explicitly rejected messages for inspection; monitoring, ownership, correction, and controlled replay are still required.

Source: AZ-305 Study Guide.pdf, PDF page(s) 50-51; reference N08. Original study item; requires human review.

How do message deferral and scheduled delivery differ?

Application architecture

Deferral retains a received message for later retrieval when prerequisites are missing; scheduling delays the message's initial availability.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N08. Original study item; requires human review.

What business requirement does message TTL express?

Application architecture

How long the work remains useful; expired work should follow explicit business handling rather than unlimited retries.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N08. Original study item; requires human review.

How do Service Bus Basic, Standard, and Premium differ as design candidates?

Application architecture

Basic supplies simpler queues; Standard adds topics, sessions, transactions, and duplicate detection; Premium supplies dedicated messaging capacity and supported private connectivity.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N29. Original study item; requires human review.

What is the scope limitation of a Service Bus transaction?

Application architecture

It coordinates supported broker operations, not an arbitrary database write and message publication as one distributed transaction.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N29. Original study item; requires human review.

How does the transactional outbox pattern close the database-to-message publication gap?

Application architecture

Commit the business change and outgoing-message record in one database transaction, then use a reliable dispatcher to publish the record.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N29. Original study item; requires human review.

Why should an Event Grid event contain a stable ID and a reference to source data?

Application architecture

The ID supports idempotent handling, and a reference avoids putting large content inside a notification.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N44. Original study item; requires human review.

Does Event Grid delivery guarantee arrival in original publication order?

Application architecture

No; consumers must handle repeated and potentially out-of-order events appropriately.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N44. Original study item; requires human review.

What belongs in Event Grid push-delivery failure design?

Application architecture

Configure supported retries and dead-letter storage, distinguish permanent response failures, monitor delivery failures and latency, and acknowledge only after safe acceptance.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N44. Original study item; requires human review.

What additional delivery model do Event Grid namespaces support?

Application architecture

Pull delivery with receive, acknowledge, release, reject, and lock-renewal semantics; Event Grid is not universally webhook-only.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N31. Original study item; requires human review.

What does an Event Hubs partition key accomplish?

Application architecture

It groups related events on one ordered partition, while other partitions progress independently.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N43. Original study item; requires human review.

What does an Event Hubs consumer group provide?

Application architecture

An independent reading view for an application, with its own progression and checkpoints.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N43. Original study item; requires human review.

Why should an Event Hubs checkpoint follow durable processing?

Application architecture

A checkpoint records progress; committing it first can skip work after a crash.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N43. Original study item; requires human review.

Why can additional Event Hubs consumers fail to improve throughput?

Application architecture

Useful parallelism is constrained by partitions, ownership, capacity, and key distribution; a hot partition can dominate.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N43. Original study item; requires human review.

What does Event Hubs Capture provide?

Application architecture

Automatic storage of events in supported Blob Storage or Data Lake storage for archival and batch analysis; it does not replace live-consumer lag monitoring.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N43. Original study item; requires human review.

How does Queue Storage visibility timeout support retry?

Application architecture

Retrieved messages are temporarily hidden; consumers delete after success, while failure can make the message visible again.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N29. Original study item; requires human review.

How is poison-message handling commonly implemented with Queue Storage?

Application architecture

Inspect dequeue count and move repeatedly failing messages to a separate application-managed poison queue.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N29. Original study item; requires human review.

What is a suitable pattern for a queue work item with a large payload?

Application architecture

Put the payload in Blob Storage and send a secure reference, respecting message limits and encoding overhead.

Source: AZ-305 Study Guide.pdf, PDF page(s) 51; reference N29. Original study item; requires human review.

How do exponential backoff, jitter, and circuit breakers protect a failed dependency?

Application architecture

Backoff spaces retries, jitter spreads them across clients, and a circuit breaker limits repeated calls while the dependency remains unhealthy.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N29. Original study item; requires human review.

Which metrics expose accumulating asynchronous work?

Application architecture

Queue age, backlog, and consumer lag; cap worker concurrency to the downstream service's sustainable rate.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N07. Original study item; requires human review.

What functions does Azure API Management centralize?

Application architecture

API publication, contracts, versions, subscriptions, gateway policies, usage controls, observability, and a developer portal.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N64. Original study item; requires human review.

What access-token properties should an API gateway validate?

Application architecture

Issuer, audience, expiry, and required permissions or claims; a token valid for another API is insufficient.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N64. Original study item; requires human review.

Why is an API Management subscription key insufficient as the sole sensitive-user identity check?

Application architecture

It identifies an APIM subscription for usage controls; sensitive APIs also require authenticated identity and authorization.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N64. Original study item; requires human review.

How can API Management authenticate to supported Azure backends without a stored password?

Application architecture

Use a gateway managed identity with the backend's required permissions; protect other credentials with Key Vault where needed.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N48. Original study item; requires human review.

Which API Management tier is intended for feature testing without a production SLA?

Application architecture

Developer classic; production use requires an appropriate production tier and design.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N48. Original study item; requires human review.

What APIM Consumption caching restriction matters?

Application architecture

It lacks a built-in internal cache; use a supported external cache if the design needs gateway caching.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52-53; reference N10. Original study item; requires human review.

What does Standard v2 outbound VNet integration accomplish?

Application architecture

It lets the gateway reach private VNet backends while its public gateway remains reachable; it does not itself imply fully private ingress.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N09. Original study item; requires human review.

Which APIM tier is the candidate when a design requires both built-in multiregion deployment and self-hosted gateways?

Application architecture

Premium classic where supported; Premium v2 does not imply these classic capabilities.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N48. Original study item; requires human review.

How do API rate limits differ from quotas?

Application architecture

Rate limits constrain short-window bursts; quotas constrain consumption allowance over a longer interval.

Source: AZ-305 Study Guide.pdf, PDF page(s) 52; reference N48. Original study item; requires human review.

What is the cache-aside read sequence?

Application architecture

Check cache, read the authoritative database on a miss, then cache the result for a suitable TTL.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N68. Original study item; requires human review.

What should happen to affected cache entries after a database update?

Application architecture

Invalidate or update them so stale copies do not outlive the acceptable freshness period.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N68. Original study item; requires human review.

How do in-process and distributed caches differ across scaled application instances?

Application architecture

In-process caches are separate per instance; a distributed cache provides shared cached data across instances.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N10. Original study item; requires human review.

Which managed Redis offering should new application designs evaluate?

Application architecture

Azure Managed Redis, sized for working set, concurrency, throughput, eviction, private access, and resilience.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N11. Original study item; requires human review.

What current Azure Cache for Redis lifecycle dates should architects remember?

Application architecture

Enterprise and Enterprise Flash retire March 31, 2027; Basic, Standard, and Premium retire September 30, 2028. The planned October 2026 existing-customer creation block was removed.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N47. Original study item; requires human review.

How can cache design prevent cross-user or cross-tenant data disclosure?

Application architecture

Scope cache keys and response variation by tenant, identity, query, and relevant headers, and cache only appropriately reusable content.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N10. Original study item; requires human review.

How can an empty shared cache overload its authoritative database?

Application architecture

A cache stampede creates simultaneous misses; request coalescing, staggered expiry, prewarming, and bounded fallback concurrency limit pressure.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N68. Original study item; requires human review.

How do App Configuration labels, snapshots, and feature flags differ?

Application architecture

Labels distinguish environments or versions; snapshots are named immutable selected configuration sets; feature flags control enablement independently of code release.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N52. Original study item; requires human review.

How should secrets and configuration references be authorized?

Application architecture

Keep secrets in Key Vault, use App Configuration references where useful, and grant the application identity separate rights to read configuration and retrieve referenced secrets.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53-54; reference N27. Original study item; requires human review.

What makes an automated application pipeline's deployment artifact repeatable?

Application architecture

Build once, validate and publish an immutable artifact, deploy it to controlled environments, verify useful health, and promote the same version into production with controlled configuration and secret references.

Source: AZ-305 Study Guide.pdf, PDF page(s) 54; reference N67. Original study item; requires human review.

How do ARM templates and Bicep relate?

Application architecture

ARM templates describe deployments as JSON; Bicep is an Azure-native declarative language with reusable modules that compiles to ARM templates.

Source: AZ-305 Study Guide.pdf, PDF page(s) 54; reference N67. Original study item; requires human review.

Why should collaborative Terraform deployments use a secured remote state backend with locking?

Application architecture

State tracks provider-managed resources and can contain sensitive values; a secured shared backend protects it, and locking coordinates competing deployments.

Source: AZ-305 Study Guide.pdf, PDF page(s) 54; reference N67. Original study item; requires human review.

How do rolling, blue-green, and canary application releases differ?

Application architecture

Rolling replaces instances gradually; blue-green runs old and new environments side by side and switches traffic; canary initially routes a small traffic share to the new version and expands on health evidence.

Source: AZ-305 Study Guide.pdf, PDF page(s) 54; reference N45. Original study item; requires human review.

How does expand-and-contract database evolution help application rollback?

Application architecture

Old and new versions share a compatible schema during rollout; remove obsolete fields only after the old version is retired.

Source: AZ-305 Study Guide.pdf, PDF page(s) 54; reference N45. Original study item; requires human review.

Why must a feature-flagged API still enforce server-side authorization?

Application architecture

Feature flags control enablement rather than permissions; a caller can invoke an endpoint even when its UI button is hidden.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N27. Original study item; requires human review.

How does Front Door edge caching differ from a distributed application data cache?

Application architecture

Edge caching reuses HTTP content near users; a distributed cache supplies reusable data to backend application code, so they act at different parts of the request path.

Source: AZ-305 Study Guide.pdf, PDF page(s) 53; reference N10. Original study item; requires human review.

Why should connected Azure and on-premises networks use nonoverlapping CIDR ranges?

Network design

Overlapping ranges prevent ordinary VNet peering and complicate hybrid route selection and address translation.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N35. Original study item; requires human review.

What additional subnet capacity should a VNet address plan reserve?

Network design

Growth, private endpoints, container networking, and dedicated service subnets such as GatewaySubnet, AzureFirewallSubnet, and AzureBastionSubnet.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N35. Original study item; requires human review.

Why is a subnet not automatically an isolation boundary?

Network design

Default routes and allowed communication can connect resources; explicit NSG, firewall, and routing controls enforce the intended restrictions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N39. Original study item; requires human review.

What does VNet peering provide?

Network design

Private IP communication over Microsoft's backbone between two supported nonoverlapping VNets, including supported global peering.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N35. Original study item; requires human review.

Why does hub-to-spoke peering not automatically connect two spokes?

Network design

Ordinary VNet peering is nontransitive; use direct peering or deliberately routed and forwarded hub transit.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N35. Original study item; requires human review.

What does gateway transit provide to a spoke?

Network design

Supported peering settings let it use a hub's gateway; this does not independently establish automatic spoke-to-spoke forwarding.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N35. Original study item; requires human review.

When is Azure Virtual WAN a strong alternative to a customer-managed hub and spoke?

Network design

When many branches, VNets, and regions make connectivity and routing complex; managed virtual hubs can centralize supported connectivity.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N21. Original study item; requires human review.

Why must Virtual WAN routing propagation and segmentation still be designed?

Network design

Managed hubs do not imply unrestricted universal reachability; route tables, propagation, routing intent, and segmentation govern paths.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N21. Original study item; requires human review.

What does NAT Gateway provide to associated private VM subnets?

Network design

Scalable outbound SNAT using a controlled public source-address set, with connection capacity planning.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N40. Original study item; requires human review.

Does NAT Gateway accept unsolicited inbound connections or inspect HTTP content?

Network design

No. It supplies outbound translation, not public application ingress or application-aware inspection.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55; reference N40. Original study item; requires human review.

Does attaching NAT Gateway override a UDR that sends traffic to a firewall?

Network design

No. The chosen route still steers traffic to the appliance; design both the path and final egress address intentionally.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55-56; reference N57. Original study item; requires human review.

Why can outbound connections fail intermittently at high concurrency?

Network design

SNAT port exhaustion or connection pressure can occur; reuse connections and monitor capacity before expanding the egress design.

Source: AZ-305 Study Guide.pdf, PDF page(s) 55-56; reference N40. Original study item; requires human review.

What changed for default outbound access after March 31, 2026?

Network design

New VNets using API versions released after that date default their subnets to private with defaultOutboundAccess false; existing VNets are not automatically converted.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N12. Original study item; requires human review.

What explicit outbound methods can replace implicit VM internet access?

Network design

NAT Gateway, a correctly routed firewall or NVA, Standard public Load Balancer outbound rules, or an explicitly assigned VM public IP.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N12. Original study item; requires human review.

What operational step can clear previously assigned default outbound addresses after making a subnet private?

Network design

Stop and deallocate affected VMs as required so NIC-level default outbound assignment is cleared.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N12. Original study item; requires human review.

Which Load Balancer generation should current Azure designs use?

Network design

Standard; Basic Load Balancer retired September 30, 2025.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N61. Original study item; requires human review.

How do site-to-site and point-to-site VPN differ?

Network design

Site-to-site connects an on-premises network through an IPsec/IKE tunnel; point-to-site connects an individual remote client.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N58. Original study item; requires human review.

What does an Azure local network gateway represent?

Network design

The on-premises VPN device and remote address spaces; the Azure virtual network gateway terminates the Azure tunnel.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N58. Original study item; requires human review.

What components help a site-to-site VPN meet a higher availability target?

Network design

Supported active-active Azure gateways, redundant on-premises devices and tunnels, correct return routes, and verified surviving capacity.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N58. Original study item; requires human review.

What determines which point-to-site authentication options can be used?

Network design

The supported gateway, tunnel protocol, client, and identity combinations, including certificates, RADIUS, or Microsoft Entra ID.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N58. Original study item; requires human review.

How does an ExpressRoute circuit differ from a VNet gateway?

Network design

The circuit is a logical provider or Direct connection with peering location and bandwidth; the gateway connects a VNet to that circuit.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N22. Original study item; requires human review.

How do ExpressRoute private peering and Microsoft peering differ?

Network design

Private peering carries routes between on-premises and Azure VNets; Microsoft peering reaches supported Microsoft public services under documented requirements.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N22. Original study item; requires human review.

Does ExpressRoute provide end-to-end encryption by default?

Network design

No. Private connectivity alone is not encryption; select TLS or supported network encryption according to the required protection scope.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56; reference N22. Original study item; requires human review.

How do TLS, IPsec over ExpressRoute, and ExpressRoute Direct MACsec differ in scope?

Network design

TLS protects application traffic; supported IPsec protects the network tunnel end to end; MACsec protects the supported Direct physical-link segment.

Source: AZ-305 Study Guide.pdf, PDF page(s) 56-57; reference N22. Original study item; requires human review.

What does ExpressRoute FastPath change?

Network design

It lets eligible traffic bypass the gateway data path to improve performance while the gateway remains required for route exchange.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N36. Original study item; requires human review.

What does ExpressRoute Global Reach connect?

Network design

Supported ExpressRoute circuits to connect on-premises sites through Microsoft's backbone; it is not VNet peering.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N37. Original study item; requires human review.

Why can a backup VPN restore reachability but fail the performance requirement?

Network design

Its bandwidth, route coverage, DNS, and firewall behavior may be insufficient for the surviving production load.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N22. Original study item; requires human review.

What is the ordinary first rule in Azure route selection?

Network design

Choose the most specific matching destination prefix, then apply route-type precedence and documented service exceptions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N57. Original study item; requires human review.

For equal applicable destination prefixes, what is ordinary route-type precedence?

Network design

User-defined routes before BGP-learned routes before system routes, subject to documented exceptions.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N57. Original study item; requires human review.

Which important service-endpoint routing exception affects forced tunneling?

Network design

Routes with the Virtual network service endpoint next hop cannot be overridden by a UDR.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N57. Original study item; requires human review.

Can a UDR specify an ExpressRoute gateway as its Virtual network gateway next hop?

Network design

No. That UDR next-hop type is supported for VPN gateways, not ExpressRoute gateways.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N57. Original study item; requires human review.

What must an NVA support beyond appearing as a UDR next hop?

Network design

Appropriate NIC and guest IP forwarding, actual routing, inspection policy, and coherent return paths.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N57. Original study item; requires human review.

Why can asymmetric packet paths break stateful firewall connections?

Network design

The firewall may see only one direction or replies may reach an incompatible state path, preventing valid session tracking.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N57. Original study item; requires human review.

Which investigations help distinguish routing from filtering failures?

Network design

Check effective routes, next hop, applicable NSGs, and packet flow; use Network Watcher connection troubleshooting, IP flow verification, and packet capture.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N57. Original study item; requires human review.

What is an Azure private endpoint?

Network design

A VNet network interface with a private IP that maps through Private Link to a specific supported resource or subresource.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N38. Original study item; requires human review.

Why might one Storage account require multiple private endpoints?

Network design

Blob, file, and other subresources have separate supported endpoint targets and DNS needs.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N38. Original study item; requires human review.

Does creating a private endpoint automatically disable a service's public endpoint?

Network design

Not necessarily; configure public network access and service firewall settings separately.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57; reference N38. Original study item; requires human review.

How does a service endpoint differ from a private endpoint's addressing?

Network design

A service endpoint identifies an allowed VNet subnet while using the service public endpoint; a private endpoint gives a private VNet address to a selected resource connection.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57-58; reference N59. Original study item; requires human review.

What must on-premises clients have to use an Azure PaaS private endpoint?

Network design

VPN or ExpressRoute private reachability, correct service-name DNS resolution to the private IP, approved connection, and valid application authorization.

Source: AZ-305 Study Guide.pdf, PDF page(s) 57-58; reference N38. Original study item; requires human review.

Why should applications keep using the normal service hostname with Private Link?

Network design

It preserves TLS certificate matching and SDK behavior while private DNS resolves that name to the appropriate private endpoint.

Source: AZ-305 Study Guide.pdf, PDF page(s) 58; reference N38. Original study item; requires human review.

What does linking a private DNS zone to a VNet accomplish?

Network design

It makes the zone's private records available for appropriate name resolution in that VNet; links must cover the intended client networks.

Source: AZ-305 Study Guide.pdf, PDF page(s) 58; reference N23. Original study item; requires human review.

How do Azure DNS Private Resolver inbound and outbound endpoints differ?

Network design

Inbound endpoints accept forwarded queries from connected networks; outbound endpoints and forwarding rulesets send selected Azure queries toward external DNS such as on-premises servers.

Source: AZ-305 Study Guide.pdf, PDF page(s) 58; reference N23. Original study item; requires human review.

Why must hybrid DNS forwarding be designed across all spokes?

Network design

Missing links, wrong forwarding, or loops can produce public answers or inconsistent resolution despite valid private packet routes.

Source: AZ-305 Study Guide.pdf, PDF page(s) 58; reference N23. Original study item; requires human review.

How do NSG rule priority and combined subnet/NIC NSGs apply?

Network design

Lower numbers are evaluated first and the first matching rule applies; traffic must pass applicable controls at both subnet and NIC scopes.

Source: AZ-305 Study Guide.pdf, PDF page(s) 58-59; reference N39. Original study item; requires human review.

How do application security groups differ from service tags?

Network design

ASGs group selected NICs by application role; service tags are maintained Azure service-prefix sets and are not user identities.

Source: AZ-305 Study Guide.pdf, PDF page(s) 59; reference N39. Original study item; requires human review.

How do NSGs, Azure Firewall, and WAF differ in purpose?

Network design

NSGs provide stateful network and port filtering; Firewall centralizes network/application inspection; WAF inspects HTTP attacks.

Source: AZ-305 Study Guide.pdf, PDF page(s) 59; reference N41. Original study item; requires human review.

Which advanced inspection capabilities does Azure Firewall Premium add?

Network design

Supported TLS inspection and intrusion detection and prevention, with configuration and application compatibility requirements.

Source: AZ-305 Study Guide.pdf, PDF page(s) 59; reference N41. Original study item; requires human review.

What does Azure Bastion provide for VM administration?

Network design

Managed RDP or SSH over a secure connection without a public IP on each target VM, subject to tier, access, and deployment requirements.

Source: AZ-305 Study Guide.pdf, PDF page(s) 59; reference N42. Original study item; requires human review.

How does DDoS protection differ from WAF?

Network design

DDoS protects against network flooding; WAF filters application-layer HTTP attacks. Paid IP and Network Protection offer different supported resource scopes.

Source: AZ-305 Study Guide.pdf, PDF page(s) 59; reference N26. Original study item; requires human review.

When does Standard Azure Load Balancer fit better than an HTTP application gateway?

Network design

For regional public or private TCP/UDP distribution to healthy VM or scale-set backends without HTTP path routing or TLS termination.

Source: AZ-305 Study Guide.pdf, PDF page(s) 59-60; reference N24. Original study item; requires human review.

What does Application Gateway v2 provide?

Network design

Regional HTTP/HTTPS host and path routing, TLS termination, health probes, and optional WAF in a dedicated VNet subnet.

Source: AZ-305 Study Guide.pdf, PDF page(s) 59-60; reference N24. Original study item; requires human review.

What distinguishes Azure Front Door Premium from Standard for private origins and WAF?

Network design

Both offer global HTTP edge routing and caching; Premium supports Private Link origins and managed WAF rules, while Standard supports custom WAF rules.

Source: AZ-305 Study Guide.pdf, PDF page(s) 59-60; reference N24. Original study item; requires human review.

How do Traffic Manager and global Azure Load Balancer differ?

Network design

Traffic Manager selects global endpoints through DNS without proxying packets; global Load Balancer provides supported cross-region Layer 4 distribution to regional public Standard Load Balancers.

Source: AZ-305 Study Guide.pdf, PDF page(s) 59-60; reference N60. Original study item; requires human review.

Why should frontend failover tests include DNS behavior, origin restriction, and useful readiness probes?

Network design

DNS caches and existing connections can delay changes, exposed origins can bypass policy, and a responding process may still lack required healthy dependencies.

Source: AZ-305 Study Guide.pdf, PDF page(s) 60; reference N24. Original study item; requires human review.

What routing-service lifecycle changes affect current frontend designs?

Network design

Application Gateway v1 retired April 28, 2026; Front Door classic retires March 31, 2027. Use Application Gateway v2 and Front Door Standard or Premium, and plan supported migration.

Source: AZ-305 Study Guide.pdf, PDF page 60; references N13 and N25. Original study item; requires human review.

What is rehosting?

Migration design

Moving a workload with minimal change, such as moving a supported VM to Azure Virtual Machines.

Source guide: PDF page(s) 61.

What is replatforming?

Migration design

Changing hosting with limited code changes, such as moving a compatible web app to App Service or a database to managed SQL.

Source guide: PDF page(s) 61.

How does refactoring differ from rearchitecting?

Migration design

Refactoring changes code to improve cloud operation; rearchitecting changes application structure, such as decomposing a monolith.

Source guide: PDF page(s) 61.

What distinguishes replacement from rebuilding?

Migration design

Replacement adopts another product or service such as SaaS; rebuilding creates a new application to meet future requirements.

Source guide: PDF page(s) 61.

When is retiring a workload appropriate?

Migration design

When it no longer provides business value and dependency and retention checks confirm it can be decommissioned safely.

Source guide: PDF page(s) 61.

When is retaining a workload a legitimate migration decision?

Migration design

When keeping a stable, compliant workload in its current environment offers better near-term value than migrating it.

Source guide: PDF page(s) 61.

Why select a migration strategy per workload?

Migration design

Deadlines, business value, compatibility, licensing, dependencies, and team skills differ between workloads.

Source guide: PDF page(s) 61.

Why prepare the landing zone before production migration?

Migration design

Identity, subscriptions, policy, logging, security, DNS, routes, backup, and operational ownership must be stable when the workload arrives.

Source guide: PDF page(s) 61.

What does Azure Migrate provide?

Migration design

A unified hub for supported discovery, assessment, planning, and migration tools and workflows.

Source guide: PDF page(s) 62.

How do discovery, assessment, and migration differ?

Migration design

Discovery inventories the environment; assessment evaluates readiness and target sizing; migration copies or replicates the workload.

Source guide: PDF page(s) 62.

What does an Azure Migrate appliance generally collect?

Migration design

Configuration and performance metadata from supported sources for discovery and assessment; its support and access requirements must be checked.

Source guide: PDF page(s) 62.

What can be used when an Azure Migrate appliance is unsuitable?

Migration design

Inventory import or other supported discovery methods, selected according to the environment and current support matrix.

Source guide: PDF page(s) 62.

What should a complete application migration inventory include?

Migration design

Owners, servers, identities, jobs, certificates, file shares, ports, addresses, database connections, external APIs, and licensing.

Source guide: PDF page(s) 62.

Why use dependency analysis when grouping migration waves?

Migration design

It reveals communication between components so tightly coupled parts can move as a working application unit.

Source guide: PDF page(s) 62.

Why must assessment observe a representative business period?

Migration design

Quiet periods can miss month-end, seasonal, or other peak demand and lead to inadequate target sizing.

Source guide: PDF page(s) 62.

How does performance-based assessment differ from as-on-premises sizing?

Migration design

Performance-based sizing uses measured utilization; as-on-premises sizing preserves allocated capacity more directly.

Source guide: PDF page(s) 62.

What does low assessment confidence imply for rightsizing?

Migration design

Evidence may be missing or unrepresentative; investigate before aggressively reducing capacity.

Source guide: PDF page(s) 62.

Which factors beyond VM CPU and memory should target assessment check?

Migration design

Readiness blockers, region and SKU support, disk performance, security, monitoring, connectivity, backups, licensing, and total cost.

Source guide: PDF page(s) 62.

Why does continuous server replication not prove target readiness?

Migration design

It reduces final transfer volume but does not validate application consistency, identity, networking, dependencies, or production operation.

Source guide: PDF page(s) 62.

Why start migration waves with a representative lower-risk pilot?

Migration design

It tests tooling, dependencies, sizing, and procedures while limiting the impact of initial mistakes.

Source guide: PDF page(s) 62.

Why test migrated application copies in an isolated network?

Migration design

Prevent duplicate writers, scheduled jobs, production emails, or other real side effects while validating recovery and connectivity.

Source guide: PDF page(s) 62.

What belongs in a migration cutover sequence?

Migration design

Quiesce source writes as required, synchronize final changes, start target dependencies in order, change routes or DNS, and validate the business service.

Source guide: PDF page(s) 62-63.

Why is changing DNS back insufficient after the new target has accepted writes?

Migration design

The old source lacks the new data. Rollback must reconcile or reverse-synchronize accepted writes to avoid loss or conflicting histories.

Source guide: PDF page(s) 63.

What application assumptions often need remediation for PaaS replatforming?

Migration design

Local disk state, configuration and secret storage, runtime support, startup behavior, authentication, backend networking, and scaling.

Source guide: PDF page(s) 63.

When should Azure VMware Solution be evaluated as a migration destination?

Migration design

When preserving a VMware environment and tooling is a justified requirement; compare it with ordinary Azure VM rehosting and long-term operations.

Source guide: PDF page(s) 63.

Why choose the database target before the transfer tool?

Migration design

Compatibility, service model, feature support, and operational requirements constrain which migration workflow is suitable.

Source guide: PDF page(s) 63.

Which SQL dependencies must be assessed beyond tables?

Migration design

Server-level objects, logins, jobs, linked servers, extensions, cross-database dependencies, and application behavior.

Source guide: PDF page(s) 63.

Does current Azure DMS support online migration to Azure SQL Database?

Migration design

No. Current DMS support for Azure SQL Database is offline; online support for other SQL targets is scenario-specific.

Source guide: PDF page(s) 63.

Does online database migration mean zero downtime?

Migration design

No. It performs initial transfer and ongoing synchronization, followed by a final synchronization and cutover outage.

Source guide: PDF page(s) 63.

Does DMS create the source backups for supported SQL backup-based migration?

Migration design

No. It consumes existing full and transaction-log backups; the source backup process, valid log chain, storage access, and final changes must be prepared.

Source guide: PDF page(s) 63.

Can current DMS migrate missing schema for an offline Azure SQL Database migration?

Migration design

Yes, within the supported object list. Schema can alternatively be prepared separately with supported database project tooling.

Source guide: PDF page(s) 63.

Which checks validate a database migration beyond row counts?

Migration design

Critical aggregates, constraints, identities, representative transactions, execution plans, performance, and surrounding jobs.

Source guide: PDF page(s) 63.

What is the status of Azure Data Studio in this guide's October 2026 context?

Migration design

Azure Data Studio retired on February 28, 2026; use supported replacement tooling rather than outdated desktop-extension procedures.

Source guide: PDF page(s) 63.

What must be inventoried before a file migration?

Migration design

Bytes, file count and size distribution, protocol, access patterns, ACLs, timestamps, path depth, and ongoing change rate.

Source guide: PDF page(s) 64.

Why does moving an SMB share to Blob Storage need an application assessment?

Migration design

Object access differs from filesystem semantics, and protocol, permissions, paths, and metadata behavior can change.

Source guide: PDF page(s) 64.

Why can many small files migrate slowly even with adequate bandwidth?

Migration design

Enumeration, metadata operations, and operations per second can bottleneck the transfer independently of byte throughput.

Source guide: PDF page(s) 64.

What does Azure Storage Mover add to data migration?

Migration design

Managed orchestration through projects, endpoints, job definitions, monitoring, and repeatable job runs for supported source-target paths.

Source guide: PDF page(s) 64.

Why verify Storage Mover's current source-target matrix?

Migration design

Supported protocols, cloud paths, agent requirements, preview status, metadata preservation, and target semantics differ by scenario.

Source guide: PDF page(s) 64.

When is AzCopy a suitable migration tool?

Migration design

For controlled command-line copies and synchronization on supported storage paths, with appropriate authorization, logs, and content validation.

Source guide: PDF page(s) 64.

Does a generic AzCopy copy automatically preserve every ACL and timestamp?

Migration design

No. Preservation depends on source, destination, supported options, and the metadata fidelity of the target.

Source guide: PDF page(s) 64.

When can Azure File Sync fit a migration strategy?

Migration design

When a permanent Windows Server cache with cloud tiering and Azure Files is also part of the desired architecture.

Source guide: PDF page(s) 64.

When should Azure Data Box be considered?

Migration design

For large eligible datasets when network bandwidth or the available transfer window makes online upload impractical.

Source guide: PDF page(s) 64.

What time components must a Data Box migration budget include?

Migration design

Ordering, local copying, shipping, Azure ingestion, validation, and any final delta synchronization and cutover.

Source guide: PDF page(s) 64.

Why plan an online delta after an offline bulk migration?

Migration design

The source may change after the bulk copy; those changes must be transferred and reconciled before switching the application.

Source guide: PDF page(s) 64.

When should source systems be decommissioned after migration?

Migration design

After business acceptance, data retention, backup validation, and rollback conditions are satisfied and the new operating model has an owner.

Source guide: PDF page(s) 64.

What should migration closure remove besides old servers?

Migration design

Obsolete DNS records, credentials, connectivity, licenses, and unnecessary costs, in accordance with retention and rollback requirements.

Source guide: PDF page(s) 64.

How is a first-order online transfer-time estimate calculated?

Migration design

Dataset size divided by measured effective throughput, then add allowance for enumeration, retries, changed data, and validation.

Source guide: PDF page(s) 69.

Why should a retailer's global health probe test checkout dependencies?

Integrated architecture scenarios

A healthy frontend can coexist with a failed database; availability should reflect a meaningful business journey.

Source guide: PDF page(s) 65.

What must an asynchronous regional SQL recovery plan account for?

Integrated architecture scenarios

Replication lag, possible lost writes, failover authority, connection behavior, recovery-region capacity, and tested recovery time.

Source guide: PDF page(s) 65.

Why does zone redundancy still require independent recovery points?

Integrated architecture scenarios

Availability replication can propagate deletion or corruption; older retained recovery points address a different failure.

Source guide: PDF page(s) 65.

What three separate conditions must an application meet to use a private data service?

Integrated architecture scenarios

Resolve its service name to the intended private IP, route to that address, and possess valid authentication and data authorization.

Source guide: PDF page(s) 65.

How can two analytics teams independently replay the same telemetry stream?

Integrated architecture scenarios

Use separate Event Hubs consumer groups with independent checkpoints and sufficient retention.

Source guide: PDF page(s) 66.

How should order commands, file-arrival notifications, and telemetry streams be separated?

Integrated architecture scenarios

Service Bus suits business commands, Event Grid discrete notifications, and Event Hubs retained partitioned telemetry streams.

Source guide: PDF page(s) 66.

Why is idempotency needed after a consumer updates a business system but crashes before acknowledgement?

Integrated architecture scenarios

Redelivery can repeat the side effect; acknowledgement or broker duplicate detection alone does not guarantee exactly-once external business updates.

Source guide: PDF page(s) 66.

Why can a hybrid recovery plan need different protection for database and file data?

Integrated architecture scenarios

Their consistency needs and RPOs differ, so one machine-replication setting may not meet every dependency's recovery requirement.

Source guide: PDF page(s) 66.

What must be ready before database and application startup in hybrid recovery?

Integrated architecture scenarios

Network paths, DNS, identity services, permissions, and other dependency prerequisites.

Source guide: PDF page(s) 66.

A recovery sequence takes 10+5+15+5+10 minutes. What remains of a 60-minute RTO budget?

Integrated architecture scenarios

The sequence totals 45 minutes, leaving 15 minutes. All steps and assumptions must be measured under representative failure conditions.

Source guide: PDF page(s) 68.

Does typical replication lag of 5 minutes prove an RPO of 15 minutes is always met?

Integrated architecture scenarios

No. Validate lag under load and outages and identify the latest usable consistent recovery point for all dependencies.

Source guide: PDF page(s) 68.

What should prove a migration wave is operationally successful?

Integrated architecture scenarios

Validated identity, authorization, transactions, performance, connectivity, monitoring, backup, and rollback readiness against agreed acceptance criteria.

Source guide: PDF page(s) 69.

Practice questions

These are original study questions. Multiple-response practice uses exact-set scoring in the app, with no partial credit.

1. An organization needs shared subscription guardrails, connectivity, and operating ownership before moving applications. It also needs to assess the reliability of each application. Which framework pairing best fits these needs?

Architecture foundations and design method · Migration design

A.Azure Monitor for the shared foundation and Azure Policy for workload architecture
B.CAF for both purposes without any workload-level review
C.WAF for subscription ownership and CAF for application fault analysis
D.CAF for the shared foundation and WAF for workload quality

✓ Correct answer

CAF for the shared foundation and WAF for workload quality

CAF connects adoption readiness and shared foundations; WAF reviews workload quality through its pillars. Reversing their roles misses this distinction. Monitor and Policy are useful implementation services rather than substitutes for architecture frameworks. CAF alone does not replace a workload quality review. Source guide: PDF page(s) 4-5.

This item is flagged for content review.

2. A project states that its application must be highly available and recover quickly. What should the architect establish before selecting redundancy and recovery services?

Architecture foundations and design method

A.Adopt the best component SLA as the whole-application recovery target
B.Choose the nearest region before agreeing failure and data-loss targets
C.Define journey SLOs, RTO, and RPO
D.Choose a standard VM count without measuring the customer journey

✓ Correct answer

Define journey SLOs, RTO, and RPO

Measurable objectives guide the actual design and testing. VM counts follow capacity and failure analysis, region choice also depends on constraints, and component SLAs do not define the end-to-end journey. Source guide: PDF page(s) 4.

This item is flagged for content review.

3. Two hosting options satisfy runtime, security, and recovery requirements. One requires a team to patch guest operating systems; the other is managed hosting. The team has limited operational capacity. What is the strongest reason to prefer managed hosting?

Architecture foundations and design method

A.It guarantees recovery without customer configuration
B.It reduces guest maintenance while retaining the necessary capabilities
C.It transfers ownership of application data to Microsoft
D.It removes the need to authorize application users

✓ Correct answer

It reduces guest maintenance while retaining the necessary capabilities

Managed hosting reduces maintenance when its capabilities meet requirements. The customer still owns application permissions, data governance, and relevant recovery settings. None of those duties disappears merely because the service is PaaS. Source guide: PDF page(s) 4.

This item is flagged for content review.

4. An adoption team has agreed on business outcomes but has not prepared skills, workload priorities, ownership, or funding. Which CAF phase most directly addresses the missing work?

Architecture foundations and design method

A.Plan
B.Adopt
C.Ready
D.Manage

✓ Correct answer

Plan

Plan prepares skills, costs, priorities, ownership, and adoption work. Ready establishes the Azure foundation; Adopt executes migration and modernization; Manage operates and improves adopted workloads. Source guide: PDF page(s) 4.

This item is flagged for content review.

5. A platform team delivers a landing zone and says application recovery is now covered automatically. Which two responsibilities should be made explicit? Select two answers.

Architecture foundations and design method · Migration design

A.Workload ownership of application configuration and recovery tests
B.Microsoft ownership of every workload recovery runbook
C.A single service that eliminates workload architecture decisions
D.Automatic failover for any application using the subscription
E.Platform ownership of shared connectivity and guardrails

✓ Correct answers

Workload ownership of application configuration and recovery tests
Platform ownership of shared connectivity and guardrails

Shared platform responsibilities and application responsibilities must both be assigned. Microsoft does not own every customer runbook; subscription placement supplies no universal failover; a landing zone is an architecture and operating foundation rather than one service. Source guide: PDF page(s) 4-5.

This item is flagged for content review.

6. A workload review finds that releases are manual, incidents lack runbooks, and configuration drift is common. Which WAF pillar most directly guides improvements?

Architecture foundations and design method

A.Cost Optimization
B.Reliability alone
C.Performance Efficiency
D.Operational Excellence

✓ Correct answer

Operational Excellence

Operational Excellence addresses controlled deployment, automation, observability, and operations. Performance focuses on user experience and bottlenecks; Cost focuses on value and spending; Reliability is related but does not replace the operating practices needed here. Source guide: PDF page(s) 5.

This item is flagged for content review.

7. An architect proposes a regional replica to reduce outage exposure. Which two accompanying evaluations are necessary? Select two answers.

Architecture foundations and design method · High availability

A.Additional infrastructure and operating costs
B.A guarantee that all replication is synchronous
C.Removal of the need for retained backups
D.Automatic transfer of all workload ownership to the provider
E.Replication and failover behavior against recovery targets

✓ Correct answers

Additional infrastructure and operating costs
Replication and failover behavior against recovery targets

The design must meet recovery objectives and account for additional spending and operations. Replication mechanisms vary, replicated copies do not replace retained recovery points, and ownership remains shared. Source guide: PDF page(s) 5.

This item is flagged for content review.

8. Two application VMs must run in different availability zones in the same region. No additional subnet segmentation requirement exists. Which network design is valid?

Architecture foundations and design method · Network design

A.Use separate VNets because a subnet cannot span zones
B.Use one regional subnet and place the VMs in different zones
C.Use a region pair because zones are separate regions
D.Use one VM because a subnet automatically replicates it

✓ Correct answer

Use one regional subnet and place the VMs in different zones

A regional subnet normally spans zones, so zone placement alone does not require new subnets. Separate VNets are not mandatory, zones are not regions, and a subnet does not replicate a VM. Source guide: PDF page(s) 6.

This item is flagged for content review.

9. Two subscriptions deploy resources into logical zone 1. A design requires both resources to share a particular physical zone for latency analysis. What must be checked?

Architecture foundations and design method

A.Whether both use the same management group
B.Whether their subnet names match
C.The subscriptions’ logical-to-physical zone mappings
D.Whether both subscriptions have the same tags

✓ Correct answer

The subscriptions’ logical-to-physical zone mappings

Logical zone labels are subscription-specific mappings. Names, tags, and management-group placement do not prove physical-zone correspondence. Source guide: PDF page(s) 6.

This item is flagged for content review.

10. A team places standby resources in a region paired with its primary and assumes application recovery is complete. Which remaining requirement is decisive?

Architecture foundations and design method · Backup and disaster recovery

A.Design and test replication, dependencies, routing, and failover
B.Put both regional deployments in one resource group to enable application failover
C.Match logical zone numbers and use the pair without application recovery procedures
D.Duplicate resource names so paired-region recovery inherits the primary configuration

✓ Correct answer

Design and test replication, dependencies, routing, and failover

A region pair supplies no automatic application recovery. The application needs configured replication and recovery paths. Resource names, grouping, and logical-zone labels do not supply those mechanisms. Source guide: PDF page(s) 6.

This item is flagged for content review.

11. A regulated workload must keep all replicated data within an approved geography. An architect has chosen a primary Azure region. What is the appropriate next check?

Architecture foundations and design method · Object, file, and NoSQL data

A.Use each region pair as proof that every service replicates only within that geography
B.Replace regional recovery with zone redundancy without revisiting the disaster objective
C.Check actual service replication destinations and residency
D.Treat every pair as symmetric and assume the same replication destination for all data

✓ Correct answer

Check actual service replication destinations and residency

Residency must be checked per service and actual destination. Some regions are unpaired and service replication choices vary; pair relationships have exceptions and can be asymmetric. Zones address a different failure boundary. Source guide: PDF page(s) 6.

This item is flagged for content review.

12. An application moves from Azure VMs to PaaS. Which two duties remain with the customer? Select two answers.

Architecture foundations and design method

A.Configuring supported application security and recovery settings
B.Replacing physical disks in the datacenter
C.Maintaining datacenter power and cooling
D.Managing application permissions and data
E.Patching every underlying platform host operating system

✓ Correct answers

Configuring supported application security and recovery settings
Managing application permissions and data

PaaS retains customer duties for applications, data, permissions, and configuration. Physical infrastructure and underlying host maintenance belong to the provider within the service model. Source guide: PDF page(s) 6.

This item is flagged for content review.

13. A report multiplies two provider SLAs and declares the result the application’s guaranteed contractual availability. What is the best correction?

Architecture foundations and design method

A.Treat multiplication as the composite contractual guarantee without comparing SLA terms
B.Add SLA percentages and use the capped result without examining dependency behavior
C.Assign the highest component SLA to the journey even when every dependency is essential
D.Measure journey objectives and analyze shared failures and conditions

✓ Correct answer

Measure journey objectives and analyze shared failures and conditions

Contracts have distinct definitions and conditions; real dependencies can fail together. User-journey measurement and end-to-end analysis are required. Multiplication can illustrate an explicit independent model but establishes no composite contractual guarantee; maximum or summed values are also invalid. Source guide: PDF page(s) 7.

This item is flagged for content review.

14. In a deliberately simplified model, two indispensable serial components fail independently and each has measured availability of 99.9%. What is their combined availability in that model?

Architecture foundations and design method

A.99.8001%
B.99.9999%
C.199.8%
D.99.9000%

✓ Correct answer

99.8001%

For the stated independent serial model, 0.999 × 0.999 = 0.998001, or 99.8001%. The other values do not follow this multiplication. The calculation is mathematical intuition and does not establish a contractual SLA or realistic workload estimate. Source guide: PDF page(s) 7.

This item is flagged for content review.

15. A cost comparison counts only VM compute in the primary region. The workload also needs regional recovery and ongoing operations. Which revision is appropriate?

Architecture foundations and design method

A.Use the largest advertised commitment discount without modeling eligible utilization
B.Model complete normal, peak, and recovery operating costs
C.Count the first recovery VM but omit replication, backups, and operational labor
D.Exclude standby capacity and transfer charges because disasters are infrequent

✓ Correct answer

Model complete normal, peak, and recovery operating costs

Total operating cost includes normal, peak, and recovery operation and supporting services and labor. Adding one VM omits dependencies; recovery costs are part of planning; a discount alone does not describe value or total cost. Source guide: PDF page(s) 7.

This item is flagged for content review.

16. A retail application reports healthy VM CPU, but customers cannot complete checkout because a database dependency is unavailable. Which monitoring design best detects customer impact?

Monitoring and logging

A.Monitor checkout availability, error rate, latency, and dependency failures.
B.Alert only when VM CPU exceeds 90 percent.
C.Treat Azure Status as proof that checkout is functioning.
D.Use subscription activity logs as the sole checkout health signal.

✓ Correct answer

Monitor checkout availability, error rate, latency, and dependency failures.

Customer-journey and dependency signals reveal the failed outcome and its cause. CPU can remain low during a dependency outage. Activity logs describe management events rather than the whole transaction. Azure Status reports the global platform and cannot prove application health. Source: AZ-305 Study Guide.pdf, PDF page(s) 8.

This item is flagged for content review.

17. An operations team needs Windows event logs from Azure VMs and audit records from Key Vault. Which collection combination should it recommend?

Monitoring and logging

A.AMA on every VM, with no Key Vault diagnostic settings.
B.AMA with associated DCRs for VM events, and Key Vault diagnostic settings for audit logs.
C.Key Vault diagnostic settings for both VM guest events and vault audit logs.
D.A Log Analytics workspace with no additional collection configuration.

✓ Correct answer

AMA with associated DCRs for VM events, and Key Vault diagnostic settings for audit logs.

AMA and DCR associations collect supported guest events, while resource diagnostic settings collect Key Vault audits. An agent does not configure a vault's diagnostic logs; a vault setting does not collect guest events. Creating the destination alone does not initiate either collection path. Source: AZ-305 Study Guide.pdf, PDF page(s) 8.

This item is flagged for content review.

18. A request crosses a frontend, two APIs, and a database. The team needs to identify which dependency adds 800 ms to individual transactions. What should it recommend?

Monitoring and logging

A.An activity-log export without application instrumentation.
B.Only hourly average CPU metrics from each host.
C.A resource lock on each API deployment.
D.Application instrumentation with distributed tracing and propagated correlation context.

✓ Correct answer

Application instrumentation with distributed tracing and propagated correlation context.

Distributed traces connect the individual request to dependency spans and their durations. Host CPU averages cannot attribute one transaction's latency. Locks control supported management operations. Activity logs record management events and do not replace request instrumentation. Source: AZ-305 Study Guide.pdf, PDF page(s) 8.

This item is flagged for content review.

19. A company must continuously deliver Azure resource logs to an existing external SIEM. Which diagnostic destination best matches the requirement?

Monitoring and logging

A.An Azure Monitor workspace containing Prometheus metrics.
B.An action group that emails every resource operation.
C.Event Hubs with appropriately configured consumers.
D.A DCR association without a stream destination.

✓ Correct answer

Event Hubs with appropriately configured consumers.

Event Hubs is the diagnostic streaming destination for external consumers such as a SIEM. A Prometheus workspace is a metrics store. A DCR association does not itself configure resource-log streaming. Action groups respond to alert conditions rather than providing a general continuous resource-log export. Source: AZ-305 Study Guide.pdf, PDF page(s) 9.

This item is flagged for content review.

20. Auditors require an immutable evidence archive, while operators need KQL investigations on the same resource logs. Which two destinations should the design use? Select 2 answers.

Monitoring and logging

A.Only Resource Health.
B.Only an Azure Monitor workspace for Prometheus.
C.Azure Storage with an appropriate immutable retention policy.
D.Log Analytics workspace.
E.Only an action group webhook.

✓ Correct answers

Azure Storage with an appropriate immutable retention policy.
Log Analytics workspace.

Log Analytics provides interactive log queries; immutable Storage supplies an independently protected archive. Webhooks are alert-response endpoints, a Prometheus workspace stores metrics, and Resource Health reports resource health. None of those three replaces the required audit archive or KQL log destination. Source: AZ-305 Study Guide.pdf, PDF page(s) 9.

This item is flagged for content review.

21. A regional resource in West Europe exports diagnostics to Storage in North Europe and a Log Analytics workspace in North Europe. What change addresses the destination-region requirement?

Monitoring and logging

A.Move the resource into a North Europe resource group without relocating it.
B.Use a Storage destination in West Europe; the workspace can remain in North Europe.
C.Move both destinations to West Europe because every diagnostic destination must match.
D.Keep Storage in North Europe and add a private endpoint.

✓ Correct answer

Use a Storage destination in West Europe; the workspace can remain in North Europe.

Storage and Event Hubs diagnostic destinations must match the region of a regional monitored resource. Log Analytics has no equivalent destination-region restriction. A private endpoint does not waive this requirement, and a resource group's metadata location does not relocate its contained resource. Source: AZ-305 Study Guide.pdf, PDF page(s) 9.

This item is flagged for content review.

22. A resource must send its logs to two separate Log Analytics workspaces and one Storage account. Which design meets diagnostic-setting destination limits?

Monitoring and logging

A.Use multiple diagnostic settings so each setting has at most one workspace destination.
B.Create six diagnostic settings, one for each log category.
C.Put both workspaces in a single diagnostic setting.
D.Create a DCE to remove the per-setting workspace limit.

✓ Correct answer

Use multiple diagnostic settings so each setting has at most one workspace destination.

One diagnostic setting supports one destination of each type, so two workspace destinations need separate settings. A resource supports up to five settings, making six invalid. A DCE is connectivity for supported DCR paths and does not alter diagnostic-setting destination limits. Source: AZ-305 Study Guide.pdf, PDF page(s) 9.

This item is flagged for content review.

23. Diagnostic export to a firewall-protected Event Hubs namespace is failing. The design already has a private endpoint and valid streaming permissions. Which action addresses the documented export route?

Monitoring and logging

A.Associate the namespace with the VM's DCR.
B.Move the namespace to another region to bypass its firewall.
C.Assume the existing private endpoint makes export traverse the customer's network.
D.Enable the trusted Microsoft services firewall bypass required for diagnostic export.

✓ Correct answer

Enable the trusted Microsoft services firewall bypass required for diagnostic export.

The documented diagnostic export path requires the trusted Microsoft services bypass for firewall-protected Event Hubs. A private endpoint alone does not redirect this path. A VM DCR is a separate collection mechanism. A different region does not solve the firewall condition and can violate regional destination rules. Source: AZ-305 Study Guide.pdf, PDF page(s) 9.

This item is flagged for content review.

24. Platform and workload teams use separate subscriptions, but the platform team owns the central log destination. Which two facts should guide diagnostic routing? Select 2 answers.

Monitoring and logging

A.A destination must always share the monitored resource's subscription.
B.For regional resources, Storage and Event Hubs destinations must satisfy the same-region rule.
C.Any private endpoint removes diagnostic destination restrictions.
D.A workspace must always share the monitored resource's region.
E.Cross-subscription destinations are possible with appropriate permissions.

✓ Correct answers

For regional resources, Storage and Event Hubs destinations must satisfy the same-region rule.
Cross-subscription destinations are possible with appropriate permissions.

Cross-subscription routing is supported when the configuring identity has relevant permissions. Regional Storage and Event Hubs restrictions still apply. A shared subscription is not mandatory, Log Analytics lacks that region restriction, and a private endpoint does not remove export requirements. Source: AZ-305 Study Guide.pdf, PDF page(s) 9.

This item is flagged for content review.

25. An enterprise has supported Windows servers in Azure and on premises. It wants centrally managed Windows event collection. Which architecture should it choose?

Monitoring and logging

A.The retired MMA agent as the standard for every new server.
B.Only Application Insights instrumentation in business applications.
C.AMA and DCR associations for Azure VMs, with Azure Arc and the AMA extension for supported external servers.
D.Diagnostic settings on each resource group as a substitute for guest event collection.

✓ Correct answer

AMA and DCR associations for Azure VMs, with Azure Arc and the AMA extension for supported external servers.

AMA uses reusable DCR-based collection; Arc represents supported external servers and enables agent deployment. MMA is retired and is unsuitable for a new design. Resource-group diagnostic settings do not substitute for guest collection. Application instrumentation measures the application and does not collect all required Windows events. Source: AZ-305 Study Guide.pdf, PDF page(s) 10.

This item is flagged for content review.

26. Two VM fleets must collect different OS logs and send sensitive security events to a restricted destination. Which two design choices are appropriate? Select 2 answers.

Monitoring and logging

A.Create a DCE for every VM because it defines collection policy.
B.Validate only the existence of the workspace.
C.Give every VM an identical rule regardless of requirements.
D.Separate DCRs where OS, sensitivity, or destination requirements differ.
E.Reuse DCRs across machines with matching collection needs.

✓ Correct answers

Separate DCRs where OS, sensitivity, or destination requirements differ.
Reuse DCRs across machines with matching collection needs.

Reuse makes matching collection consistent, and separate rules preserve meaningful collection or security boundaries. A universal rule ignores different requirements. A DCE provides connectivity rather than collection policy. Validation should generate representative events and confirm destination arrival, rather than check only resource existence. Source: AZ-305 Study Guide.pdf, PDF page(s) 10.

This item is flagged for content review.

27. A monitoring diagram adds a DCE to every public AMA deployment and claims it also controls Key Vault diagnostic export. What correction should the architect make?

Monitoring and logging

A.Replace collection rules with DCEs so endpoint configuration also defines Windows event selection.
B.Keep a DCE for every public AMA VM because private endpoints are mandatory for all guest logs.
C.Use a DCE to apply one collection policy to AMA, Key Vault diagnostic settings, and Application Insights.
D.Use DCEs where the supported source or private collection scenario requires them.

✓ Correct answer

Use DCEs where the supported source or private collection scenario requires them.

A DCE provides configuration and ingestion endpoints for relevant scenarios and is not universally required. A DCR defines collection policy. Diagnostic settings and application instrumentation are distinct paths, so the claim that a VM DCE controls Key Vault export must also be removed. Source: AZ-305 Study Guide.pdf, PDF page(s) 10.

This item is flagged for content review.

28. Debug events contain unnecessary personal identifiers and dominate ingestion cost. What should be recommended before dropping those events through a supported DCR transformation?

Monitoring and logging

A.Agree on required investigation and audit evidence, then filter or remove unnecessary fields before ingestion.
B.Drop all events during high-volume incidents using a hard cap.
C.Disable all application and resource diagnostics because the DCR covers them.
D.Assume filtered events can later be recovered from the same collection path.

✓ Correct answer

Agree on required investigation and audit evidence, then filter or remove unnecessary fields before ingestion.

Supported transformations reduce volume and exposure, but discarded data cannot be recovered from that collection path. Requirements must therefore be agreed first. A hard cap can remove incident evidence, and DCR collection does not replace separate application instrumentation or resource diagnostic settings. Source: AZ-305 Study Guide.pdf, PDF page(s) 10.

This item is flagged for content review.

29. Twenty subscriptions in one tenant share operations ownership, residency requirements, and investigation access. The team needs correlated queries at low administrative overhead. What should it recommend?

Monitoring and logging

A.Create one workspace per subscription because cross-subscription collection is unsupported.
B.Create one workspace per VM for maximum correlation.
C.Start with a centralized workspace and add boundaries only for justified requirements.
D.Copy every record into separate operations and security workspaces without evaluating cost.

✓ Correct answer

Start with a centralized workspace and add boundaries only for justified requirements.

A shared workspace simplifies correlation and administration when boundaries align. Subscription count alone does not require separate workspaces. Per-VM workspaces fragment queries. Unconditional duplication can double ingestion and should be justified against isolation, access, and Sentinel requirements. Source: AZ-305 Study Guide.pdf, PDF page(s) 10.

This item is flagged for content review.

30. A central workspace would place two legally separate tenant datasets under the same ownership and residency arrangement, contrary to their requirements. What should the architect recommend?

Monitoring and logging

A.One workspace per resource group to avoid evaluating the tenant requirements.
B.Separate workspace boundaries aligned to actual tenant, residency, and access requirements.
C.One central workspace regardless of the documented legal and access boundaries.
D.Use tags to hide one tenant's rows from the other.

✓ Correct answer

Separate workspace boundaries aligned to actual tenant, residency, and access requirements.

Real tenant, residency, or access boundaries justify separate workspaces despite centralization benefits. A mandatory single workspace would ignore those requirements. Per-resource-group separation is arbitrary, and tags are metadata rather than a log authorization boundary. Source: AZ-305 Study Guide.pdf, PDF page(s) 10.

This item is flagged for content review.

31. A team proposes the Basic table plan for security data that requires Azure Monitor Insights and resource-context investigation. Which recommendation meets those features?

Monitoring and logging

A.Use Analytics for data requiring Insights and resource-context queries.
B.Use Auxiliary with extended retention and assume the longer retention enables Insights.
C.Use Basic with a 30-day window and assume Insights remains available for the same data.
D.Keep Basic and enable workspace resource-context access without checking plan restrictions.

✓ Correct answer

Use Analytics for data requiring Insights and resource-context queries.

Analytics supports the requested operational features. Basic supports Simple Log Alerts but lacks Insights and resource-context queries; Auxiliary also lacks Insights and direct alerts. Retention duration and workspace access configuration do not add missing table-plan capabilities. Source: AZ-305 Study Guide.pdf, PDF page(s) 10-11.

This item is flagged for content review.

32. A workspace contains customer-impacting errors and high-volume diagnostics queried only during incidents. Which design best balances features and cost?

Monitoring and logging

A.Move critical errors to Auxiliary while keeping full Insights and direct alerts.
B.Set one universal table plan at workspace level.
C.Choose Basic for every table because query scanning is free.
D.Keep critical errors in Analytics and select an economical supported plan for verbose tables.

✓ Correct answer

Keep critical errors in Analytics and select an economical supported plan for verbose tables.

Plans are selected per supported table, letting critical signals retain Analytics features while infrequent diagnostics use another plan. There is no single workspace-wide plan switch for all records. Auxiliary lacks direct alert and Insights support, and Basic/Auxiliary query scanning incurs charges. Source: AZ-305 Study Guide.pdf, PDF page(s) 10-11.

This item is flagged for content review.

33. Analysts need immediate queries on six months of critical Analytics data and seven years of audit retention. Which two decisions fit the requirement? Select 2 answers.

Monitoring and logging

A.Configure suitable Analytics retention for the interactive period.
B.Assume retaining seven years is unsupported because the maximum is two years.
C.Configure total retention for the longer evidence period.
D.Set Basic's direct-query window to seven years.
E.Assume total retention automatically makes every plan immediately interactive.

✓ Correct answers

Configure suitable Analytics retention for the interactive period.
Configure total retention for the longer evidence period.

Analytics retention and total retention serve different access periods, and both can be configured to meet these durations within documented limits. Total retention does not grant every plan identical interactive features. Basic directly queries 30 days, while total retention can extend to 12 years rather than only two. Source: AZ-305 Study Guide.pdf, PDF page(s) 11.

This item is flagged for content review.

34. An investigation needs Basic-plan records from eight months ago that remain within total retention. What approach should be recommended?

Monitoring and logging

A.Create a new diagnostic export today and use it to obtain the eight-month-old workspace records.
B.Treat the 30-day direct-query window as the total retention period and declare the evidence lost.
C.Retrieve the retained records with a supported search job and investigate its Analytics results.
D.Extend Basic's ordinary query window to eight months and use the same direct query.

✓ Correct answer

Retrieve the retained records with a supported search job and investigate its Analytics results.

Search jobs can retrieve retained Basic data beyond its 30-day direct-query window and create Analytics results asynchronously. The direct window does not equal total retention and cannot simply be extended to eight months as Basic's regular query window. A new resource diagnostic setting exports supported source telemetry; it does not retrieve historical workspace data. Source: AZ-305 Study Guide.pdf, PDF page(s) 11.

This item is flagged for content review.

35. A verbose diagnostic table uses Basic and is displayed on a dashboard refreshed every minute. Ingestion is cheap, but the total bill is high. What should the architect evaluate first?

Monitoring and logging

A.Compare only ingestion price because workbook queries are included without scanning charges.
B.Evaluate query scanning and refresh frequency along with ingestion and retention.
C.Keep the same refresh rate and move the table to Auxiliary because every query is free there.
D.Choose a workspace ingestion commitment tier without examining how frequently Basic data is queried.

✓ Correct answer

Evaluate query scanning and refresh frequency along with ingestion and retention.

Basic and Auxiliary charge for queries, so frequent scanning can dominate economics. Evaluate access frequency, scanned volume, retention, and plan features. An ingestion commitment tier does not itself explain or eliminate query-scanning costs. Auxiliary queries are not free merely because ingestion is cheaper. Source: AZ-305 Study Guide.pdf, PDF page(s) 11.

This item is flagged for content review.

36. During an incident, telemetry spikes and a daily ingestion cap stops collecting logs. Which design improvement best preserves incident evidence while controlling cost?

Monitoring and logging

A.Disable all monitoring during high-error periods.
B.Reduce unnecessary source volume and use supported transformations with agreed evidence requirements.
C.Assume the workspace will reconstruct discarded logs later.
D.Lower the cap further to make the incident cheaper.

✓ Correct answer

Reduce unnecessary source volume and use supported transformations with agreed evidence requirements.

Controlling unnecessary sources and transforming supported streams can reduce cost while preserving essential signals. A lower cap or disabling monitoring worsens the evidence gap. Logs discarded or never ingested through that path cannot be reconstructed from the workspace. Source: AZ-305 Study Guide.pdf, PDF page(s) 11.

This item is flagged for content review.

37. A microservices team uses sampling to reduce Application Insights volume. Which two actions keep that decision aligned with observability requirements? Select 2 answers.

Monitoring and logging

A.Store passwords in traces to compensate for missing samples.
B.Preserve request correlation across services.
C.Replace all dependency traces with management activity logs.
D.Evaluate the effect of sampling on forensic detail.
E.Assume sampling changes only the invoice and never investigation coverage.

✓ Correct answers

Preserve request correlation across services.
Evaluate the effect of sampling on forensic detail.

Correlation enables a transaction to be followed across services, and sampling must be evaluated against diagnostic evidence needs. Sampling affects available detail. Activity logs are management records rather than request spans, and secrets should not be included in telemetry. Source: AZ-305 Study Guide.pdf, PDF page(s) 11.

This item is flagged for content review.

38. A saved KQL query using requests and timestamp works in Application Insights but fails in a Log Analytics workspace. What should be recommended?

Monitoring and logging

A.Use the actual workspace tables and fields, such as AppRequests and TimeGenerated.
B.Retain requests unchanged and alter only letter casing because context never changes table names.
C.Reinstall AMA because the same table names must exist in every query context.
D.Remove the time filter because workspace queries cannot restrict time.

✓ Correct answer

Use the actual workspace tables and fields, such as AppRequests and TimeGenerated.

Application Insights and workspace query contexts can expose different schemas, so adapt both table and field names as required and retain a useful time restriction. Agent reinstallation does not fix schema mismatch. Case changes alone do not address a different table, and workspace queries support time filtering. Source: AZ-305 Study Guide.pdf, PDF page(s) 11.

This item is flagged for content review.

39. An AKS platform requires container logs and managed Prometheus metrics. Which two stores are appropriate? Select 2 answers.

Monitoring and logging

A.An Application Insights resource as the sole Kubernetes inventory and Prometheus storage destination.
B.A single Log Analytics workspace as the managed Prometheus metrics store.
C.An Event Hubs stream as a replacement for both required managed telemetry stores.
D.Log Analytics workspace for supported Container Insights logs, events, and inventory.
E.Azure Monitor workspace for managed Prometheus metrics.

✓ Correct answers

Log Analytics workspace for supported Container Insights logs, events, and inventory.
Azure Monitor workspace for managed Prometheus metrics.

Container Insights logs use Log Analytics, while managed Prometheus uses the distinct Azure Monitor workspace. A Log Analytics workspace does not replace that managed metrics store. Application Insights supplies application observability rather than both specified platform stores, and Event Hubs is a stream destination rather than either managed investigation store. Source: AZ-305 Study Guide.pdf, PDF page(s) 12.

This item is flagged for content review.

40. AKS cluster metrics are normal, but requests between application services intermittently fail. Which addition best explains the failing transaction path?

Monitoring and logging

A.Increase cluster CPU chart resolution while collecting no application request or dependency spans.
B.Use only managed Prometheus cluster metrics and assume they describe the complete transaction.
C.Add distributed tracing with correlation across application requests and dependencies.
D.Export only cluster management events and use them to infer each application call's result.

✓ Correct answer

Add distributed tracing with correlation across application requests and dependencies.

Application tracing connects service requests and dependencies, exposing failures beyond cluster-level metrics. CPU resolution and management events do not establish each application's transaction path. Managed Prometheus cluster metrics are useful but cannot replace tracing for this requirement. Source: AZ-305 Study Guide.pdf, PDF page(s) 12.

This item is flagged for content review.

41. An operations team must alert on sustained queue-depth growth using a supported numeric metric. Which alert type is the best starting choice?

Monitoring and logging

A.Activity-log alert for resource deletion.
B.A policy exemption for the queue.
C.A lifecycle workflow triggered by employee departure.
D.Metric alert with an appropriate threshold, evaluation interval, and dimensions.

✓ Correct answer

Metric alert with an appropriate threshold, evaluation interval, and dimensions.

Metric alerts evaluate numeric time-series signals, with supported thresholds and dimensions. Resource-deletion alerts detect different management events. Policy exemptions and employee lifecycle workflows do not monitor sustained queue-depth behavior. Source: AZ-305 Study Guide.pdf, PDF page(s) 12.

This item is flagged for content review.

42. A team wants an alert when a query finds repeated failed requests across several records and wants the same response channel reused by other alerts. Which two components should it choose? Select 2 answers.

Monitoring and logging

A.Only an activity-log alert regardless of the application query.
B.A suitable log alert rule.
C.A reusable action group.
D.A DCE as the response automation definition.
E.Only a resource lock to evaluate the query.

✓ Correct answers

A suitable log alert rule.
A reusable action group.

The log alert evaluates the required record pattern or aggregation; the action group supplies reusable notification or automation destinations. Activity-log alerts address supported management events. DCEs are collection endpoints and locks govern supported management operations rather than query evaluation or response routing. Source: AZ-305 Study Guide.pdf, PDF page(s) 12.

This item is flagged for content review.

43. A company needs notifications about Azure provider incidents and planned maintenance affecting its subscribed services and regions. What should it recommend?

Monitoring and logging

A.Only application exception logs.
B.Azure Service Health alerts with a tested response destination.
C.Only Azure Status's global public page.
D.Only individual Resource Health views.

✓ Correct answer

Azure Service Health alerts with a tested response destination.

Service Health provides personalized provider incidents, maintenance, and advisories for relevant services and regions. Azure Status is the public global view; Resource Health focuses on individual resources. Application exceptions help diagnose the workload but do not replace provider maintenance notifications. Source: AZ-305 Study Guide.pdf, PDF page(s) 12.

This item is flagged for content review.

44. An alert repeatedly fires, but responders cannot access the escalation instructions when the application is down. What is the best operational recommendation?

Monitoring and logging

A.Host escalation instructions only inside the application that the alert is monitoring.
B.Increase alert frequency while preserving the same unavailable response instructions.
C.Test escalation and delivery, define an owner, and keep response instructions accessible during outages.
D.Validate detection in a test environment but omit production delivery and responder-access checks.

✓ Correct answer

Test escalation and delivery, define an owner, and keep response instructions accessible during outages.

Actionable monitoring needs a responsible owner and a usable, tested response path, including accessible runbooks during failures. More frequent detection does not fix escalation. Testing only condition evaluation omits delivery and responder access, and the failed application cannot be the sole host of required response instructions. Source: AZ-305 Study Guide.pdf, PDF page(s) 12.

This item is flagged for content review.

45. A platform team wants to detect significant management changes to a critical resource and notify its on-call team. Which combination best fits the requirement?

Monitoring and logging

A.A Basic-plan table selected without collecting management events.
B.A metric alert on CPU as the sole configuration-change detector.
C.Application sampling as the management audit source.
D.An activity-log alert for the supported management event and an action group.

✓ Correct answer

An activity-log alert for the supported management event and an action group.

Activity-log alerts detect supported management events, and action groups route their response. CPU does not reliably identify configuration changes; application sampling controls application telemetry rather than management auditing. A table plan determines storage and query capabilities but does not collect or detect an event on its own. Source: AZ-305 Study Guide.pdf, PDF page(s) 8, 12.

This item is flagged for content review.

46. An organization wants existing synchronized employees to sign in to cloud applications even if the on-premises site is offline. It accepts synchronization delay for account changes. Which authentication approach best fits?

Identity and access

A.Use password hash synchronization for cloud validation.
B.Use federation with the only AD FS validation service at the on-premises site.
C.Use PTA with every agent and domain controller at the on-premises site as the only validation path.
D.Use Cloud Sync without selecting a cloud authentication method or preparing an outage procedure.

✓ Correct answer

Use password hash synchronization for cloud validation.

PHS validates synchronized derived hashes in the cloud without a per-sign-in local request. The proposed PTA and AD FS designs still depend on the unavailable site. Cloud Sync provisions directory information; selecting its synchronization architecture alone does not establish an outage-resilient authentication method. Source: AZ-305 Study Guide.pdf, PDF page(s) 13-14.

This item is flagged for content review.

47. A company uses PHS and disables an employee in on-premises AD during a synchronization outage. Which security expectation should the architect document?

Identity and access

A.PHS checks current on-premises disabled state for each cloud sign-in even during the outage.
B.Account-state changes may wait for synchronization; address the cloud identity in the response.
C.Disabling an on-premises user immediately removes the user's cloud identity without synchronization.
D.Because PHS is enabled, an on-premises disable automatically revokes every existing cloud session.

✓ Correct answer

Account-state changes may wait for synchronization; address the cloud identity in the response.

PHS validates in the cloud, and relevant account-state changes depend on synchronization. It does not query current AD state for each sign-in or immediately remove the cloud identity without synchronization. Incident response must also consider cloud accounts and sessions rather than assume that all tokens are instantly revoked. Source: AZ-305 Study Guide.pdf, PDF page(s) 14.

This item is flagged for content review.

48. An organization requires cloud sign-in to validate current AD account policies through on-premises infrastructure and can operate resilient agents and domain controllers. Which authentication method is the best fit?

Identity and access

A.Use pass-through authentication.
B.Use PHS and rely on synchronization rather than on-premises validation for every sign-in.
C.Use a cloud-only identity with no link to the organization's AD account policies.
D.Select Cloud Sync alone and treat directory provisioning as the credential-validation method.

✓ Correct answer

Use pass-through authentication.

PTA validates passwords through outbound-connected agents against AD DS. PHS validates cloud information, and a cloud-only identity does not directly validate the specified AD policies. Cloud Sync handles provisioning rather than being the password-validation selection itself. Source: AZ-305 Study Guide.pdf, PDF page(s) 13-14.

This item is flagged for content review.

49. A PTA design uses one validation agent and assumes PHS backup activates automatically when that agent fails. Which two corrections should be made? Select 2 answers.

Identity and access

A.Keep one PTA agent because every sign-in is validated entirely by Entra ID.
B.Deploy resilient PTA agents; Microsoft recommends three.
C.Add local PTA agents but omit domain-controller and outbound-connectivity availability planning.
D.Plan and test the manual switch to prepared PHS backup.
E.Assume merely enabling PHS guarantees automatic fallback when the PTA agent fails.

✓ Correct answers

Deploy resilient PTA agents; Microsoft recommends three.
Plan and test the manual switch to prepared PHS backup.

PTA requires resilient agents and reachable domain controllers; three agents are recommended. PHS backup can be enabled, but switching to it is a planned manual change. One agent is still a dependency, and adding agents alone does not eliminate shared domain-controller or network failure. Source: AZ-305 Study Guide.pdf, PDF page(s) 14.

This item is flagged for content review.

50. A company has AD DS and assumes it must deploy AD FS for Microsoft Entra sign-in. Native cloud authentication already satisfies its requirements. What should the architect recommend?

Identity and access

A.Assume directory synchronization alone forces all credential validation through AD FS.
B.Require federation for every SAML application without evaluating Entra's supported application integration.
C.Deploy AD FS solely because an AD DS forest already exists.
D.Prefer cloud authentication when it meets the requirements.

✓ Correct answer

Prefer cloud authentication when it meets the requirements.

An existing AD DS forest does not require federation. Cloud authentication can reduce validation-path infrastructure when native capabilities meet the requirement. Application protocol support must be assessed rather than assuming every SAML app requires AD FS, and synchronization does not force federation. Source: AZ-305 Study Guide.pdf, PDF page(s) 14.

This item is flagged for content review.

51. A federation deployment is being moved to cloud authentication. Which two design practices reduce migration and recovery risk? Select 2 answers.

Identity and access

A.Move every user at once without validating application compatibility.
B.Delete federation certificates before testing any migrated users.
C.Preconfigure and test the emergency authentication alternative and dependency recovery.
D.Assume authentication infrastructure has no availability requirements.
E.Use staged rollout for suitable groups and validate their sign-in behavior.

✓ Correct answers

Preconfigure and test the emergency authentication alternative and dependency recovery.
Use staged rollout for suitable groups and validate their sign-in behavior.

Staged rollout permits incremental validation, and prepared emergency alternatives make recovery concrete. Premature certificate deletion can break remaining federation. Authentication dependencies and certificate expiry affect availability, and an untested universal cutover can expose compatibility problems. Source: AZ-305 Study Guide.pdf, PDF page(s) 14.

This item is flagged for content review.

52. A company wants to require stronger sign-in assurance for administrators based on application, device state, and location. Which solution should it recommend?

Identity and access

A.Grant only narrower Azure resource roles and omit all device/location sign-in conditions.
B.Deploy PIM eligibility alone and assume it enforces every targeted application's device and location requirements.
C.Use Conditional Access with appropriate controls and staged rollout.
D.Apply an Azure allowed-locations policy and assume it evaluates the administrator's sign-in location.

✓ Correct answer

Use Conditional Access with appropriate controls and staged rollout.

Conditional Access evaluates supported sign-in signals and applies the required authentication conditions. Azure resource roles authorize operations, and allowed-locations Policy governs resource deployment rather than the user's sign-in location. PIM reduces standing privilege but does not replace targeted sign-in conditions. Source: AZ-305 Study Guide.pdf, PDF page(s) 14.

This item is flagged for content review.

53. A proposed Conditional Access policy allows any MFA method but the requirement specifically calls for phishing-resistant administrator sign-in. What should be recommended?

Identity and access

A.Assume every MFA method offers identical phishing resistance.
B.Grant a narrower resource role and omit sign-in controls.
C.Use an appropriate authentication strength and supported phishing-resistant methods, with tested recovery.
D.Use report-only permanently as the enforcement mechanism.

✓ Correct answer

Use an appropriate authentication strength and supported phishing-resistant methods, with tested recovery.

Method strength matters, so select supported methods meeting the stated assurance and plan recovery. MFA methods differ in phishing resistance. Narrow authorization does not satisfy the authentication requirement, and report-only measures impact without enforcing the access condition. Source: AZ-305 Study Guide.pdf, PDF page(s) 14.

This item is flagged for content review.

54. A team is introducing a restrictive Conditional Access baseline. Which two actions should it include? Select 2 answers.

Identity and access

A.Skip feature-specific licensing checks for risk-based policies.
B.Maintain tested emergency administrator access.
C.Assess policy impact in report-only and roll out in stages where appropriate.
D.Assume Conditional Access grants the app's data permissions.
E.Block every emergency account without a recovery plan.

✓ Correct answers

Maintain tested emergency administrator access.
Assess policy impact in report-only and roll out in stages where appropriate.

Report-only and staged rollout identify unintended blocking, while tested emergency access supports recovery. Conditional Access does not grant application data permissions. Unrecoverable lockout is unsuitable, and licensing varies by feature, with additional requirements for risk-based controls. Source: AZ-305 Study Guide.pdf, PDF page(s) 14.

This item is flagged for content review.

55. An enterprise compares Connect Sync with Cloud Sync for several forests and device requirements. What should guide the recommendation?

Identity and access

A.Evaluate current synchronization capabilities separately from authentication.
B.Assume Connect Sync and Cloud Sync support identical forests, devices, attributes, and writeback needs.
C.Choose Cloud Sync and assume that choice automatically selects federation for every cloud sign-in.
D.Choose solely by agent footprint and defer all device, forest, writeback, and availability requirements.

✓ Correct answer

Evaluate current synchronization capabilities separately from authentication.

The synchronization architectures and evolving capabilities should be compared against the actual requirements. Provisioning is separate from credential validation, so Cloud Sync does not automatically choose federation. Agent footprint matters but cannot substitute for required feature and availability support. Source: AZ-305 Study Guide.pdf, PDF page(s) 13.

This item is flagged for content review.

56. A multitenant application design needs to distinguish its definition from its representation inside a tenant. Which mapping is correct?

Identity and access

A.The service principal is the application's Azure subscription, and its registration is an individual access token.
B.The service principal is the global app definition, and the application registration is always a human user.
C.The application registration and every service principal must be the same object with one cross-tenant instance.
D.The application registration defines the app, and a service principal represents it in a tenant.

✓ Correct answer

The application registration defines the app, and a service principal represents it in a tenant.

The application registration defines identity and configuration, while service principals provide tenant-specific application representations. Registrations are not necessarily human users, and the two concepts are not one universal cross-tenant object. Neither is a subscription or an individual access token. Source: AZ-305 Study Guide.pdf, PDF page(s) 13.

This item is flagged for content review.

57. A supplier's staff need approved access to employee collaboration resources using their existing organization identities. What should be recommended?

Identity and access

A.Use a customer external tenant for the supplier, without integrating its access to the existing workforce resources.
B.Use workforce-tenant B2B collaboration with governed partner access.
C.Create and maintain separate employee-style passwords for every supplier user despite the existing identity requirement.
D.Invite guests and assume invitation alone grants all application access indefinitely.

✓ Correct answer

Use workforce-tenant B2B collaboration with governed partner access.

B2B collaboration suits partner access to workforce resources with existing external identities. A customer tenant addresses a different primary population and is not by itself integration to the workforce resources. Separate passwords conflict with the stated preference, and invitations still need authorization and lifecycle controls. Source: AZ-305 Study Guide.pdf, PDF page(s) 14-15.

This item is flagged for content review.

58. A public retail application needs customer registration and sign-in separated from employee resources. Which identity architecture is the best fit?

Identity and access

A.Create employee-style accounts in the workforce directory and treat employee access policies as the complete consumer experience.
B.Use External ID customer identity in an external tenant.
C.Invite every retail customer as a workforce guest and use employee collaboration onboarding as the customer journey.
D.Use only application service-principal identities to sign in customers without an individual customer identity design.

✓ Correct answer

Use External ID customer identity in an external tenant.

An external tenant provides an appropriate customer sign-up/sign-in experience separated from employee resources. Workforce guest or employee accounts address other populations and do not fit the stated tenant separation. Service principals represent workloads, not a complete end-customer identity architecture. Source: AZ-305 Study Guide.pdf, PDF page(s) 14-15.

This item is flagged for content review.

59. A supported compute resource is frequently replaced, but its workload identity and preprovisioned target permissions must remain stable. Which solution should be recommended?

Identity and access

A.Use a deployment service principal with a long-lived client secret rather than the available managed-identity lifecycle.
B.Create a system-assigned identity on each replacement and assume its principal stays unchanged.
C.Use a user-assigned managed identity with suitable target permissions.
D.Share one user-assigned identity across every environment without reviewing the resulting combined privileges.

✓ Correct answer

Use a user-assigned managed identity with suitable target permissions.

User-assigned identity is a separate resource and can retain its principal across compute replacement or exist before compute. System-assigned identities share compute lifecycle. A long-lived secret adds credential management unnecessarily, and unreviewed identity sharing combines effective privileges across workloads. Source: AZ-305 Study Guide.pdf, PDF page(s) 15.

This item is flagged for content review.

60. A simple supported App Service should have an identity tied to its own lifecycle and avoid stored client secrets. Which recommendation best fits?

Identity and access

A.Enable system-assigned identity and grant the target's required permissions.
B.Store a long-lived application client secret in the app configuration and rotate it manually.
C.Enable managed identity and assume the target data roles are granted automatically.
D.Deploy a user-assigned identity shared with unrelated production workloads without a reuse requirement.

✓ Correct answer

Enable system-assigned identity and grant the target's required permissions.

System-assigned identity fits this resource's lifecycle and avoids application-owned secrets, but target authorization remains necessary. Unnecessary identity sharing can combine privileges, while a stored client secret adds credential-management burden. Managed identity enablement alone does not grant target access. Source: AZ-305 Study Guide.pdf, PDF page(s) 15.

This item is flagged for content review.

61. An external deployment pipeline supports OpenID Connect and must access Azure without storing a long-lived client secret. Which two controls should its identity design include? Select 2 answers.

Identity and access

A.Store a reusable human password as the federation token.
B.Configure workload identity federation with matching issuer, subject, and audience trust.
C.Accept any external subject from any issuer.
D.Grant narrowly scoped target permissions to the workload's Entra identity.
E.Assume token exchange grants subscription Owner automatically.

✓ Correct answers

Configure workload identity federation with matching issuer, subject, and audience trust.
Grant narrowly scoped target permissions to the workload's Entra identity.

Federation exchanges a matching trusted external token, while authorization remains a separate least-privilege grant. Unrestricted issuer or subject trust broadens impersonation opportunities. Human passwords are not a substitute for the configured token trust, and exchange does not automatically grant Owner. Source: AZ-305 Study Guide.pdf, PDF page(s) 15.

This item is flagged for content review.

62. A user has Azure Reader on a storage account and can see its settings but cannot read blobs. Which recommendation meets read-only blob access?

Identity and access

A.Require stronger MFA while retaining only the existing management Reader permission.
B.Add a second management Reader assignment and rely on additive RBAC to supply blob reads.
C.Grant Contributor so the user can retrieve account keys instead of using least-privilege data reads.
D.Grant an appropriate blob data-read role at the smallest suitable scope.

✓ Correct answer

Grant an appropriate blob data-read role at the smallest suitable scope.

A role such as Storage Blob Data Reader grants the required data operation. Repeating management Reader adds no blob permission. Contributor may permit broader management or indirect data access but is excessive for this read-only requirement. MFA improves sign-in assurance rather than granting blob rights. Source: AZ-305 Study Guide.pdf, PDF page(s) 15-16.

This item is flagged for content review.

63. A team needs to manage Azure resources but must not receive standard permission to grant Azure role assignments. Which built-in role best matches that broad management requirement?

Identity and access

A.Global Administrator as a direct substitute for subscription Contributor.
B.Reader.
C.Contributor.
D.Owner.

✓ Correct answer

Contributor.

Contributor manages resources without the standard role-assignment capability; Owner includes access management. Reader lacks resource-management privileges. Global Administrator governs the Entra directory and is not an interchangeable Azure resource role. Evaluate indirect data-access pathways separately. Source: AZ-305 Study Guide.pdf, PDF page(s) 15.

This item is flagged for content review.

64. A developer receives a narrowly scoped read-only role on one resource group but also belongs to a group with subscription Contributor. What is the effective-access implication?

Identity and access

A.The subscription role is ignored because it came through group membership.
B.The broader applicable Contributor grant remains; the narrow assignment does not cancel it.
C.The resource-group role automatically denies writes in every assignment.
D.The most recent narrow role replaces all inherited roles.

✓ Correct answer

The broader applicable Contributor grant remains; the narrow assignment does not cancel it.

RBAC combines applicable direct, group, and inherited assignments. A narrow role adds a grant rather than replacing a broader one. Assignment recency does not select a single winning role, and group grants participate in effective access. Source: AZ-305 Study Guide.pdf, PDF page(s) 15-16.

This item is flagged for content review.

65. A custom role excludes an operation with NotActions, but another applicable role grants that operation. What should the architect conclude?

Identity and access

A.NotActions limits its own role grant and does not explicitly deny the other grant.
B.The permission depends only on which role name sorts first.
C.Custom roles always override built-in roles.
D.NotActions is a universal deny across every role assignment.

✓ Correct answer

NotActions limits its own role grant and does not explicitly deny the other grant.

NotActions subtracts from the permissions of that role definition, while another applicable role can still grant the operation. It is not a universal denial. Custom roles have no blanket precedence over built-ins, and role-name order is irrelevant to authorization. Source: AZ-305 Study Guide.pdf, PDF page(s) 16.

This item is flagged for content review.

66. A blob reader has a condition restricting reads by blob index tag, plus an unconditional broader data-read assignment. What must be changed to enforce the intended restriction?

Identity and access

A.Assume the conditional assignment overrides every unconditional assignment.
B.Add management Reader, which explicitly denies broad data reads.
C.Replace the condition with an informational cost-center tag on the subscription.
D.Review and remove or constrain the broader grant as well as configuring the supported condition.

✓ Correct answer

Review and remove or constrain the broader grant as well as configuring the supported condition.

Conditions refine their own supported role assignments; an unconditional grant may still authorize access. Enforce the intent through the complete effective-access set. Cost-center tags alone are metadata, and Reader is an additive management grant rather than an explicit data denial. Source: AZ-305 Study Guide.pdf, PDF page(s) 16.

This item is flagged for content review.

67. An App Service managed identity must retrieve one Key Vault secret. Which two design steps are necessary? Select 2 answers.

Identity and access

A.Assume identity enablement removes Key Vault firewall requirements.
B.Grant subscription Owner merely to obtain a token.
C.Ensure token audience, network access, and DNS allow the call.
D.Store the secret in an application resource tag instead.
E.Grant an appropriate Key Vault data permission at a suitable scope.

✓ Correct answers

Ensure token audience, network access, and DNS allow the call.
Grant an appropriate Key Vault data permission at a suitable scope.

Managed identity provides authentication, but the vault must authorize the operation and the service must be reachable with the correct token audience. Owner is excessive for one secret, identity does not bypass network policy, and tags are unsuitable plaintext secret storage. Source: AZ-305 Study Guide.pdf, PDF page(s) 15.

This item is flagged for content review.

68. A storage administrator must manage configuration while separation from data readers is required. Which two access pathways should the architect evaluate? Select 2 answers.

Identity and access

A.Assume no management permission can ever affect service data access.
B.Review only the narrowest visible role and ignore inherited or group assignments.
C.Evaluate management permissions that retrieve account keys or change access configuration.
D.Treat a ReadOnly resource lock as the complete data-plane authorization policy.
E.Evaluate applicable explicit data permissions.

✓ Correct answers

Evaluate management permissions that retrieve account keys or change access configuration.
Evaluate applicable explicit data permissions.

Separation requires checking explicit data operations and indirect management pathways. Effective access includes applicable group and inherited assignments. Some management permissions enable data access through keys or configuration, and management locks do not replace service data authorization. Source: AZ-305 Study Guide.pdf, PDF page(s) 16.

This item is flagged for content review.

69. A directory administrator is asked to manage one Azure subscription and assumes Global Administrator already supplies the same rights as subscription Owner. What should be recommended?

Identity and access

A.Create a management-group tag naming the administrator.
B.Grant every workload an Entra directory administrator role.
C.Evaluate and assign the required Azure resource role at the correct scope separately from the directory role.
D.Assume the two role names are equivalent.

✓ Correct answer

Evaluate and assign the required Azure resource role at the correct scope separately from the directory role.

Directory administration and Azure resource authorization target different systems and require separate role decisions. Global Administrator is not automatically interchangeable with subscription Owner. Workload directory-admin grants are excessive, and tags do not authorize administration. Source: AZ-305 Study Guide.pdf, PDF page(s) 13.

This item is flagged for content review.

70. An AD-dependent application is moved to Azure and requires domain join, LDAP, Group Policy, and Kerberos without customer-managed domain controllers. What is the best fit?

Identity and access

A.Use Entra Domain Services after validating legacy requirements.
B.Use self-managed AD DS controllers while treating their operation as fully managed by Azure.
C.Use application proxy as the replacement domain service for domain join and Group Policy.
D.Use Entra ID alone as a direct LDAP and Kerberos domain-controller endpoint.

✓ Correct answer

Use Entra Domain Services after validating legacy requirements.

Entra Domain Services provides the listed managed legacy capabilities for supported workloads. Entra ID alone is not a direct LDAP/Kerberos domain service. Self-managed domain controllers retain customer operational responsibilities, and application proxy publishes supported web applications rather than supplying domain join or Group Policy. Source: AZ-305 Study Guide.pdf, PDF page(s) 16.

This item is flagged for content review.

71. Remote employees need MFA-protected access to an internal Windows-authenticated web application without opening inbound publishing ports. Which two components should be recommended? Select 2 answers.

Identity and access

A.An Azure Reader role as the web app's Kerberos authorization.
B.Removal of all application ACLs because preauthentication grants app access.
C.Application proxy with Entra preauthentication and outbound-connected private network connectors.
D.Correct Kerberos constrained delegation, SPNs, identity mapping, and app permissions.
E.Application proxy as a VPN for every internal protocol.

✓ Correct answers

Application proxy with Entra preauthentication and outbound-connected private network connectors.
Correct Kerberos constrained delegation, SPNs, identity mapping, and app permissions.

Application proxy provides the web publishing/preauthentication path, and configured KCD enables integrated Windows SSO for the permitted service. It is not general VPN connectivity. Azure Reader does not supply Kerberos application authorization, and internal app permissions remain necessary. Source: AZ-305 Study Guide.pdf, PDF page(s) 16.

This item is flagged for content review.

72. Supported Entra-joined Windows devices use Windows Hello for Business and need SSO to on-premises AD resources. Which architecture should be evaluated?

Identity and access

A.Use Entra Domain Services as a mandatory replacement for all existing on-premises domain controllers.
B.Evaluate cloud Kerberos trust and its connectivity and device/domain prerequisites.
C.Use application proxy as the general network path for every AD file-share protocol.
D.Assume an Entra token eliminates all domain-controller and service-ticket requirements for existing AD resources.

✓ Correct answer

Evaluate cloud Kerberos trust and its connectivity and device/domain prerequisites.

Cloud Kerberos trust fits the supported passwordless-client SSO scenario while on-premises domain controllers still issue service tickets and control authorization. Connectivity remains necessary. Application proxy is supported web publishing, and Entra Domain Services is a different managed legacy-domain scenario rather than a mandatory replacement. Source: AZ-305 Study Guide.pdf, PDF page(s) 16.

This item is flagged for content review.

73. A user signs in successfully to Entra ID but is denied access to a traditional AD-authorized on-premises file share. Which aspect should be reviewed?

Identity and access

A.Repeat the successful Entra sign-in and assume authentication automatically adds the required AD group membership.
B.Deploy application proxy and assume it provides general SMB authorization for the share.
C.Grant subscription Owner and assume that role overrides the on-premises share's ACLs.
D.Review AD authentication, group/ACL authorization, DNS, and domain-controller connectivity.

✓ Correct answer

Review AD authentication, group/ACL authorization, DNS, and domain-controller connectivity.

Traditional file-share access requires the supported AD authentication and group/ACL authorization path along with connectivity and DNS. Subscription roles do not override share ACLs, and successful sign-in does not automatically add access groups. Application proxy publishes supported web apps rather than supplying general SMB authorization. Source: AZ-305 Study Guide.pdf, PDF page(s) 16.

This item is flagged for content review.

74. An application must store a third-party API credential and retrieve its value when calling the provider. Which Key Vault object is the best fit?

Identity and access

A.Store it in Managed HSM as though the service supported general secret objects.
B.Store the API credential as a Key Vault secret.
C.Store only a certificate object even though the provider requires an arbitrary API credential value.
D.Store it as a Key Vault key and use a sign operation to retrieve the password value.

✓ Correct answer

Store the API credential as a Key Vault secret.

A secret stores a retrievable sensitive API credential. A cryptographic key performs supported operations rather than serving as arbitrary password-value storage. A certificate object manages X.509 material, and Managed HSM supports keys rather than general secret objects. Source: AZ-305 Study Guide.pdf, PDF page(s) 16-17.

This item is flagged for content review.

75. A regulator requires dedicated single-tenant HSM-backed cryptographic key custody, and general secret storage is handled separately. Which service should be evaluated?

Identity and access

A.Evaluate Azure Key Vault Managed HSM.
B.Use a certificate object in a shared vault and assume that object creates a dedicated HSM boundary.
C.Use Key Vault Standard and treat software-protected keys as the required dedicated HSM custody.
D.Use Key Vault Premium and assume its HSM tenancy is identical to dedicated Managed HSM.

✓ Correct answer

Evaluate Azure Key Vault Managed HSM.

Managed HSM is the dedicated single-tenant key service using documented FIPS 140-3 Level 3 validated HSMs. Premium vault HSM keys are a different offering and do not establish identical dedicated tenancy. Standard software keys and a certificate object do not supply the required dedicated HSM custody. Source: AZ-305 Study Guide.pdf, PDF page(s) 17.

This item is flagged for content review.

76. A company wants separate vault administrators and applications that only retrieve secrets. Which authorization approach is recommended?

Identity and access

A.Use only Contributor and assume it always supplies secret-read data rights.
B.Share one administrator's credentials with all applications.
C.Give every application subscription Owner.
D.Azure RBAC with appropriate management and narrowly scoped vault data roles.

✓ Correct answer

Azure RBAC with appropriate management and narrowly scoped vault data roles.

Azure RBAC supports separation through distinct management and data roles, such as Key Vault Secrets User for suitable secret retrieval. Owner and shared administrator credentials are excessive. Contributor is a management role and is not a universal guarantee of secret retrieval; indirect escalation paths must also be controlled. Source: AZ-305 Study Guide.pdf, PDF page(s) 17.

This item is flagged for content review.

77. An encrypted workload must resist permanent loss of its customer-managed key after accidental deletion. Which two vault controls should be included? Select 2 answers.

Identity and access

A.A management lock treated as a substitute for key recovery.
B.Only a resource tag declaring the key recoverable.
C.Soft delete for recoverability within retention.
D.A plan to purge every deleted key immediately.
E.Purge protection to prevent early permanent deletion.

✓ Correct answers

Soft delete for recoverability within retention.
Purge protection to prevent early permanent deletion.

Soft delete retains recoverable objects, and purge protection blocks permanent deletion before the retention period ends. Tags do not provide recovery. Immediate purge undermines the requirement, and management locks do not replace object recovery controls or the availability of required key versions. Source: AZ-305 Study Guide.pdf, PDF page(s) 17.

This item is flagged for content review.

78. A key rotation policy creates a new key version, but some encrypted data still needs an older version. What should be recommended?

Identity and access

A.Assume a new version re-encrypts all external data without consumer involvement.
B.Immediately disable every old version after the new version is created.
C.Verify consumer adoption and retain required old versions until decryption and recovery needs permit retirement.
D.Export the private key into a plaintext resource tag for recovery.

✓ Correct answer

Verify consumer adoption and retain required old versions until decryption and recovery needs permit retirement.

Rotation must coordinate consumer version adoption and preservation of keys required by existing data or recovery. Creating a version does not automatically re-encrypt every external dataset. Immediate disablement can make data unavailable, and plaintext tags are unsuitable for private key material. Source: AZ-305 Study Guide.pdf, PDF page(s) 17.

This item is flagged for content review.

79. A database password is stored in Key Vault. A job writes a new secret version but does not change the database password or refresh the application. Why does rotation fail?

Identity and access

A.Key Vault secret values are used only for cryptographic sign operations.
B.Secret rotation must coordinate the external credential change and consumer refresh.
C.Switching to Managed HSM will store the password and update every database automatically.
D.Every new secret version automatically changes the password in every external system.

✓ Correct answer

Secret rotation must coordinate the external credential change and consumer refresh.

A secret version is a stored value, so a rotation workflow must also change the external password and update consumers in a safe sequence. It does not automatically change external systems. Secrets differ from cryptographic keys, and Managed HSM is not general password storage or universal database rotation. Source: AZ-305 Study Guide.pdf, PDF page(s) 17.

This item is flagged for content review.

80. A service depends on a Key Vault-managed X.509 certificate. The vault renews the certificate, but the service continues presenting the old one. What should be recommended?

Identity and access

A.Replace the certificate with a cost-center tag.
B.Disable audit logs so renewal uses fewer resources.
C.Coordinate renewal with supported consuming-service refresh and verify the transition.
D.Assume renewal forces every consumer to reload immediately.

✓ Correct answer

Coordinate renewal with supported consuming-service refresh and verify the transition.

Certificate lifecycle includes consuming-service adoption as well as vault renewal, so verify refresh and transition behavior. Renewal does not guarantee universal immediate reload. Tags do not supply certificate material, and removing audits does not solve adoption or provide visibility into expiry. Source: AZ-305 Study Guide.pdf, PDF page(s) 17.

This item is flagged for content review.

81. A team deploys new Key Vaults using API version 2026-02-01 and must supply application data access consistently. Which assumption matches the documented default?

Identity and access

A.Selecting RBAC as the default automatically gives every enabled managed identity secret-read access.
B.New vaults under that API version always default to legacy access policies.
C.Using that API version automatically converts every previously created vault to RBAC.
D.New vaults default to RBAC; assign suitable vault data roles explicitly.

✓ Correct answer

New vaults default to RBAC; assign suitable vault data roles explicitly.

From API version 2026-02-01, newly created vaults default to Azure RBAC. This does not automatically convert every existing vault or grant all managed identities data access. Explicit suitable role assignments and deployment-model checks remain necessary. Source: AZ-305 Study Guide.pdf, PDF page(s) 17.

This item is flagged for content review.

82. A platform team must apply one policy baseline across several subscriptions in the same Entra tenant. Which boundary is the best fit?

Governance and compliance

A.Use a management group containing the relevant subscriptions.
B.Put the subscriptions inside one resource group and assign the initiative at that resource group.
C.Use the central Log Analytics workspace as the parent scope of all workload subscriptions.
D.Assign the baseline only to the platform subscription and assume it inherits to sibling subscriptions.

✓ Correct answer

Use a management group containing the relevant subscriptions.

Management groups provide governance scopes above subscriptions, allowing applicable policy and roles to inherit. Resource groups contain resources rather than subscriptions. An assignment on one subscription does not inherit to siblings, and a workspace is a telemetry container rather than a governance parent. Source: AZ-305 Study Guide.pdf, PDF page(s) 18.

This item is flagged for content review.

83. An enterprise proposes a management-group tree that mirrors every reporting manager and has nine non-root management-group levels. Which recommendation is appropriate?

Governance and compliance

A.Keep the nine-level tree and move subscriptions to its leaves without reducing management-group depth.
B.Keep nine levels because the directory's reporting hierarchy overrides management-group depth limits.
C.Use durable policy boundaries and stay within the supported six non-root management-group levels.
D.Replace the common policy baseline with manually maintained department tags rather than evaluating governance needs.

✓ Correct answer

Use durable policy boundaries and stay within the supported six non-root management-group levels.

The supported depth is six management-group levels excluding root and subscription, and durable policy needs should drive a understandable hierarchy. Organizational reporting lines and placement of leaf subscriptions do not override the limit. Tags do not replace inherited evaluated policy. Source: AZ-305 Study Guide.pdf, PDF page(s) 18.

This item is flagged for content review.

84. Two production and sandbox subscriptions share a parent management group. An administrator has Owner inherited from that parent. Which isolation issue must the architect address?

Governance and compliance

A.The inherited privilege reaches applicable descendants, so subscription separation alone does not isolate that administrator.
B.Separate subscriptions automatically cancel all parent-scope roles.
C.Moving each subscription to a different resource group removes inheritance.
D.A sandbox tag makes the inherited role read-only.

✓ Correct answer

The inherited privilege reaches applicable descendants, so subscription separation alone does not isolate that administrator.

Applicable parent assignments inherit, so restrict broad scope and role grants to enforce the desired production boundary. Separate subscriptions do not cancel inherited roles. Tags do not modify authorization, and subscriptions do not belong inside resource groups. Source: AZ-305 Study Guide.pdf, PDF page(s) 18.

This item is flagged for content review.

85. A company is separating workloads into subscriptions. Which two requirements provide concrete reasons for subscription boundaries? Select 2 answers.

Governance and compliance

A.A requirement to nest subscriptions within a workload resource group.
B.Geographic placement alone, with no regional governance need, as an automatic management-group requirement.
C.The assumption that subscriptions automatically block inherited privilege without reviewing parent-scope access.
D.Distinct operating ownership, environment, or regulatory administration.
E.Independent billing or quota and scale requirements.

✓ Correct answers

Distinct operating ownership, environment, or regulatory administration.
Independent billing or quota and scale requirements.

Subscriptions provide concrete administrative, billing, quota, environment, and governance boundaries. Geography alone need not define a management-group boundary. Separation does not eliminate inherited privilege, and resource groups cannot contain subscriptions. Source: AZ-305 Study Guide.pdf, PDF page(s) 18.

This item is flagged for content review.

86. A deployment pipeline routinely deletes temporary application environments, but the database must remain for years under a separate owner. Which resource-group design best fits?

Governance and compliance

A.Nest a database resource group inside the disposable resource group.
B.Place persistent database resources separately from disposable resources according to lifecycle and permissions.
C.Assume deleting a resource group only removes its metadata and leaves all resources.
D.Place everything together so deletion of the temporary group removes the database too.

✓ Correct answer

Place persistent database resources separately from disposable resources according to lifecycle and permissions.

Lifecycle and ownership grouping lets temporary deletion avoid long-lived data resources. Deleting a resource group initiates deletion of contained resources. Groups cannot nest, and group deletion is not merely metadata deletion. Source: AZ-305 Study Guide.pdf, PDF page(s) 19.

This item is flagged for content review.

87. An application uses resources in West Europe and North Europe. The team wants one resource group because ownership and lifecycle align. Which two facts support the design? Select 2 answers.

Governance and compliance

A.Resource groups can nest to represent each region.
B.Its own location stores group metadata rather than forcing every resource into that region.
C.A resource can ordinarily belong to several resource groups simultaneously.
D.A resource group may contain resources in different regions.
E.Every resource group must contain resources in only its metadata region.

✓ Correct answers

Its own location stores group metadata rather than forcing every resource into that region.
A resource group may contain resources in different regions.

Resource-group location concerns metadata, and resources can be deployed in multiple regions within the same group. Ordinary resource-group-scoped resources belong to one group at a time; groups cannot nest. Regional service requirements still apply independently of this grouping choice. Source: AZ-305 Study Guide.pdf, PDF page(s) 19.

This item is flagged for content review.

88. Finance requires every supported workload resource to carry the same approved cost-center tag as its resource group. Existing resource tags are missing. What should be recommended?

Governance and compliance

A.Use tags as the resource's authorization boundary.
B.Put cost-center tags only on the management group.
C.Assume resource-group tags automatically inherit.
D.Use an appropriate modify policy and remediation for existing supported resources.

✓ Correct answer

Use an appropriate modify policy and remediation for existing supported resources.

Tags do not automatically inherit; suitable modify policies can copy approved parent values, with required remediation for existing resources. Management groups do not support tags. Tags support reporting and automation but do not grant or restrict resource access themselves. Source: AZ-305 Study Guide.pdf, PDF page(s) 19.

This item is flagged for content review.

89. An organization standardizes tags for reporting and automation. Which two practices should it adopt? Select 2 answers.

Governance and compliance

A.Use stable application identifiers and owner groups with approved tag values.
B.Treat compliant=true as proof that all required controls have been evaluated and satisfied.
C.Exclude secrets/personal data and standardize key/value casing.
D.Use an individual employee's temporary name as the sole long-term application ownership record.
E.Assume differently cased tag values always merge into one cost-reporting value.

✓ Correct answers

Use stable application identifiers and owner groups with approved tag values.
Exclude secrets/personal data and standardize key/value casing.

Stable identifiers and accountable groups improve ownership continuity. Tags are plaintext, so keep secrets/personal data out and standardize casing because values are case-sensitive. Temporary individual names become stale, a compliance claim is not evaluated evidence, and inconsistent value casing can fragment reporting. Source: AZ-305 Study Guide.pdf, PDF page(s) 19.

This item is flagged for content review.

90. A developer has Contributor on a resource group but a deployment to a prohibited region is rejected. Which explanation best fits the governance model?

Governance and compliance

A.An audit policy always blocks deployment.
B.Contributor automatically bypasses every Azure Policy assignment.
C.The cost-center tag is the only permission checked at deployment.
D.Azure RBAC permits management operations, while an applicable deny policy constrains the deployment.

✓ Correct answer

Azure RBAC permits management operations, while an applicable deny policy constrains the deployment.

RBAC and Policy answer different questions: permission to perform the operation and applicable configuration constraints. Contributor does not bypass a deny policy. Audit records noncompliance without blocking, and a cost-center tag alone is not the complete authorization or compliance mechanism. Source: AZ-305 Study Guide.pdf, PDF page(s) 19.

This item is flagged for content review.

91. A security team wants to discover noncompliant configurations before blocking new deployments. Which policy effect is the best starting point?

Governance and compliance

A.Deny.
B.Modify as a guarantee that every resource is only observed.
C.Audit.
D.DeployIfNotExists as a universal nonrepairing observation mode.

✓ Correct answer

Audit.

Audit reports noncompliance without blocking or repairing. Deny blocks violating operations. DeployIfNotExists can deploy supported related configuration, and modify changes supported properties; neither is a universal observation-only substitute. Source: AZ-305 Study Guide.pdf, PDF page(s) 19.

This item is flagged for content review.

92. A policy baseline must create supported diagnostic settings for new resources and remediate existing resources missing those settings. Which two requirements belong in the design? Select 2 answers.

Governance and compliance

A.A suitable DeployIfNotExists assignment with a managed identity holding required roles.
B.Only a compliance scan, assuming every finding is repaired automatically.
C.A remediation task for existing noncompliant resources.
D.An audit effect with no deployment mechanism.
E.A narrow identity with none of the permissions required to create settings.

✓ Correct answers

A suitable DeployIfNotExists assignment with a managed identity holding required roles.
A remediation task for existing noncompliant resources.

DeployIfNotExists can create related configuration using the assignment identity, and existing findings need remediation tasks. A compliance scan reports state rather than automatically repairing every existing resource. Audit does not deploy, and remediation needs the actual permissions to create the settings. Source: AZ-305 Study Guide.pdf, PDF page(s) 19-20.

This item is flagged for content review.

93. A modify policy is updated to make additional supported changes, but remediation fails with authorization errors. What should the architect review first?

Governance and compliance

A.Review only the compliance-report reader's role because that user's identity always performs remediation.
B.Review the assignment managed identity's roles against the updated remediation actions.
C.Assume changing a policy definition automatically adds every new role needed by its assignment identity.
D.Switch to an audit effect and treat detection alone as completion of the required property changes.

✓ Correct answer

Review the assignment managed identity's roles against the updated remediation actions.

The assignment identity performs supported remediation and needs roles for the new actions; definition changes do not automatically update its permissions. The report reader is not necessarily the remediation principal. Audit identifies noncompliance but does not perform the required property changes. Source: AZ-305 Study Guide.pdf, PDF page(s) 20.

This item is flagged for content review.

94. A legacy workload needs an approved, time-limited exception to one assigned policy while retaining an auditable reason and owner. What should be recommended?

Governance and compliance

A.A documented policy exemption with justification, ownership, and expiry.
B.Deleting the initiative definition for every workload.
C.A resource lock that automatically makes the policy compliant.
D.An untracked scope exclusion for all policies forever.

✓ Correct answer

A documented policy exemption with justification, ownership, and expiry.

An exemption records an accepted exception against an assignment and can preserve its governance context with expiry. An exclusion removes scope from evaluation and the proposed broad untracked exclusion loses accountability. Locks do not prove policy compliance, and deleting the common baseline is excessive. Source: AZ-305 Study Guide.pdf, PDF page(s) 20.

This item is flagged for content review.

95. A security standard requires supported guest-OS settings to be audited on Azure VMs and external servers. Which solution best fits?

Governance and compliance

A.Evaluate only Defender for Cloud's general recommendations without configuring the required guest package and assignments.
B.Treat AMA's collection of selected guest logs as a complete guest-configuration enforcement mechanism.
C.Check only ARM properties such as VM region and size to prove internal OS baseline compliance.
D.Use Machine Configuration with required guest extension/identity or Arc setup.

✓ Correct answer

Use Machine Configuration with required guest extension/identity or Arc setup.

Machine Configuration evaluates or applies supported guest settings using its prerequisites and packages. ARM region/size does not prove OS configuration. General posture findings do not remove required guest-package/assignment planning, and log collection through AMA is a separate telemetry mechanism rather than universal guest-configuration enforcement. Source: AZ-305 Study Guide.pdf, PDF page(s) 20.

This item is flagged for content review.

96. An organization needs cloud security posture recommendations and regulatory control mappings, plus security-event correlation and incident response. Which two service roles match? Select 2 answers.

Governance and compliance

A.Sentinel for connected event correlation, incidents, and response.
B.Azure Policy alone as a replacement for every security-event incident-investigation workflow.
C.Azure Monitor alone as automatic legal certification of every regulatory obligation.
D.Defender for Cloud for posture assessments and supported compliance views.
E.Access reviews as the primary correlation engine for arbitrary workload threat events.

✓ Correct answers

Sentinel for connected event correlation, incidents, and response.
Defender for Cloud for posture assessments and supported compliance views.

Defender for Cloud supplies posture and supported compliance assessments, while Sentinel supplies security-event correlation and incident workflows. Azure Monitor supports observability rather than legal certification. Policy evaluates supported resource controls and does not replace all incident investigation; access reviews recertify identity access rather than function as a general SIEM. Source: AZ-305 Study Guide.pdf, PDF page(s) 20.

This item is flagged for content review.

97. As of October 20, 2026, an architect is choosing tools for a new reusable governance deployment. What should be recommended?

Governance and compliance

A.Current infrastructure as code using deployment stacks and template specs where appropriate.
B.Only manual portal deployment because retirement makes templates unsupported.
C.A plan relying on new blueprint definitions created after July 31, 2026.
D.Azure Blueprints because it is the preferred new long-term governance platform.

✓ Correct answer

Current infrastructure as code using deployment stacks and template specs where appropriate.

Blueprints is already in phased retirement; current guidance recommends deployment stacks and template specs for relevant lifecycle and reusable-template needs. New blueprint definitions and versions ceased July 31, 2026. Retirement does not make supported infrastructure-as-code templates unavailable. Source: AZ-305 Study Guide.pdf, PDF page(s) 20.

This item is flagged for content review.

98. A team migrates Azure Blueprints before final retirement on January 31, 2027. Which two outcomes must it plan for? Select 2 answers.

Governance and compliance

A.Export blueprint definitions, versions, and assignments needed for future reference before deletion.
B.Assume every previously deployed workload is deleted with its blueprint.
C.Assume blueprint locks remain indefinitely after the service retires.
D.Delay all migration because new definitions remain supported through January 31.
E.Replace required governance protection because blueprint locks stop enforcing while workload resources remain.

✓ Correct answers

Export blueprint definitions, versions, and assignments needed for future reference before deletion.
Replace required governance protection because blueprint locks stop enforcing while workload resources remain.

Unexported blueprint metadata is deleted at final retirement and blueprint locks stop functioning, while resources created through blueprints remain. Therefore preserve needed definitions and replace required protection. Workloads are not automatically deleted, locks do not remain indefinitely, and definition creation already ceased during the phased schedule. Source: AZ-305 Study Guide.pdf, PDF page(s) 20.

This item is flagged for content review.

99. HR is the employee source of truth, and the organization needs consistent joiner, mover, and leaver handling across supported applications. Which recommendation best fits?

Governance and compliance

A.Keep former employees enabled to preserve every existing assignment.
B.Synchronize directory objects and assume that alone decides whether every application permission is justified.
C.Use reliable lifecycle attributes, supported workflows and provisioning, and governance rules for initial, changed, and removed access.
D.Treat a resource-group hierarchy as the employee provisioning engine.

✓ Correct answer

Use reliable lifecycle attributes, supported workflows and provisioning, and governance rules for initial, changed, and removed access.

Lifecycle design needs authoritative attributes, automated supported tasks/provisioning, and decisions about access through role changes and departure. Synchronization aligns directories but does not replace governance. Retaining obsolete enabled access conflicts with the leaver process, and resource groups are Azure resource containers. Source: AZ-305 Study Guide.pdf, PDF page(s) 20-21.

This item is flagged for content review.

100. Administrators should obtain elevated Azure permissions only when necessary, with time-limited activation and configured approval/MFA. What should be recommended?

Governance and compliance

A.Require Conditional Access MFA but leave the same permanent active privileged roles in place.
B.Use PIM eligibility with appropriate activation controls.
C.Keep all administrators permanently active as Owner and periodically review the standing assignments.
D.Grant an expiring access package while assuming it supplies all supported PIM role-activation controls.

✓ Correct answer

Use PIM eligibility with appropriate activation controls.

PIM eligibility and configured activation controls reduce standing privileged duration. Permanent Owner remains standing privilege even with reviews or MFA. Access packages govern approved access bundles and policies rather than replacing all PIM activation mechanics. Source: AZ-305 Study Guide.pdf, PDF page(s) 21.

This item is flagged for content review.

101. A user activates an eligible subscription Owner assignment through PIM for one hour. Which risk remains during that hour?

Governance and compliance

A.MFA makes every privileged action compliant with all resource policies.
B.PIM automatically converts Owner into read-only access.
C.The active role still grants its full permissions at the assigned scope, so role and scope must be appropriate.
D.Eligibility review is unnecessary because an activation expires.

✓ Correct answer

The active role still grants its full permissions at the assigned scope, so role and scope must be appropriate.

PIM reduces duration of privilege, not the active role's permission set. Scope, role selection, monitoring, and eligibility reviews still matter. MFA improves sign-in assurance but does not make all actions compliant or remove applicable policy constraints. Source: AZ-305 Study Guide.pdf, PDF page(s) 21.

This item is flagged for content review.

102. Partner project staff need sponsor-approved access to a bundle of groups and applications for 90 days with recurring review. Which capability is the best fit?

Governance and compliance

A.Create permanent manual group assignments and rely on the sponsor to remember future removals.
B.Use only a recurring access review and omit the initial package request, approval, and expiry process.
C.Use only PIM activation for one administrative Azure role despite the requested multi-resource project bundle.
D.Use an entitlement-management package with approval, expiry, and reviews.

✓ Correct answer

Use an entitlement-management package with approval, expiry, and reviews.

Access packages combine supported resources with request, approval, expiry, and review policies. Permanent manual grants omit enforced lifecycle requirements. A single privileged-role activation does not supply the project bundle, and a review alone does not implement the complete approved request and expiry design. Source: AZ-305 Study Guide.pdf, PDF page(s) 21.

This item is flagged for content review.

103. An access package must ultimately allow a partner to use an Azure resource. The resource already authorizes a security group. What should the architect recommend?

Governance and compliance

A.Assume every Azure permission is directly packaged as a standalone entitlement object.
B.Package supported group membership and verify that the group's actual resource authorization grants the required access.
C.Ignore resource roles because package approval automatically grants every resource operation.
D.Use expiry only on the partner's email address and retain all resource grants.

✓ Correct answer

Package supported group membership and verify that the group's actual resource authorization grants the required access.

Supported group membership can provide the indirect authorization path to a resource already using that group, but its role and effective access must be verified. Access packages do not directly package every possible Azure permission or automatically override resource authorization. Expiry must apply to actual access. Source: AZ-305 Study Guide.pdf, PDF page(s) 21.

This item is flagged for content review.

104. A recurring access review denies a guest's group membership, but the guest retains access through another group. Which two actions complete the governance design? Select 2 answers.

Governance and compliance

A.Configure and verify application of review removal decisions.
B.Review alternate group, direct, and inherited grants that preserve effective access.
C.Assume completing any review universally removes all permissions.
D.Replace review results with a tag saying guest=removed.
E.Disable all future reviews because one alternate grant exists.

✓ Correct answers

Configure and verify application of review removal decisions.
Review alternate group, direct, and inherited grants that preserve effective access.

Access reviews need decisions applied to their defined scope, and separate grants can still authorize access. Verify effective access after removal. A review is not a universal permission purge, a tag does not revoke authorization, and alternate grants call for improved review scope rather than abandonment. Source: AZ-305 Study Guide.pdf, PDF page(s) 21.

This item is flagged for content review.

105. An organization assumes Entra ID P2 includes every advanced identity-governance capability and designs lifecycle automation without checking licensing. What should be recommended?

Governance and compliance

A.Check the required Governance or Suite licensing and workflow support.
B.Assume P2 universally covers every advanced governance capability without feature-specific checks.
C.Treat an Azure resource role assignment as the entitlement to every Entra Governance feature.
D.Assume licensing alone ensures reliable HR attributes and complete lifecycle automation.

✓ Correct answer

Check the required Governance or Suite licensing and workflow support.

P2 includes some established capabilities, while advanced features can require relevant Governance or Suite licensing. Actual feature support and workflow prerequisites must be checked. Licensing does not ensure trustworthy lifecycle attributes, and an Azure resource role is not an Entra Governance license. Source: AZ-305 Study Guide.pdf, PDF page(s) 21.

This item is flagged for content review.

106. A new order service uses one contained SQL database and requires no instance-level features. The team wants minimum engine and OS administration. Which initial service best fits?

Relational data

A.SQL Server on Azure VMs
B.Azure Database for PostgreSQL flexible server
C.Azure Cosmos DB for NoSQL
D.Azure SQL Database

✓ Correct answer

Azure SQL Database

SQL Database supplies the required managed SQL database. A VM adds unwanted OS/engine administration. Cosmos uses a different data/transaction model. PostgreSQL changes the required engine. Source guide: PDF page 22-23.

This item is flagged for content review.

107. A SQL Server migration depends on SQL Agent jobs and supported cross-database queries. OS customization is unnecessary. Which service should be assessed first?

Relational data

A.Azure SQL Managed Instance
B.SQL Server on Azure VMs solely because the source is a VM
C.Azure SQL Database as a single database
D.Azure Table storage

✓ Correct answer

Azure SQL Managed Instance

Managed Instance targets high instance compatibility and these supported dependencies without guest OS management. A single SQL Database has different instance capabilities. Table is not a SQL engine. Retaining a VM without a compatibility need adds operational responsibility. Source guide: PDF page 22-23.

This item is flagged for content review.

108. A vendor's SQL application must install a proprietary native component on the database host OS and retain a specific SQL Server version. Which design satisfies those requirements?

Relational data

A.Azure Database for PostgreSQL flexible server
B.SQL Server on an Azure VM
C.Azure SQL Database Hyperscale
D.Azure SQL Managed Instance

✓ Correct answer

SQL Server on an Azure VM

SQL on a VM provides host OS and engine-version control. Managed Instance and SQL Database do not grant OS administration; Hyperscale changes storage architecture, not that control. PostgreSQL changes the engine. Source guide: PDF page 22-23.

This item is flagged for content review.

109. An application requires PostgreSQL-specific supported extensions and the team wants managed backups and patching. What should the architect recommend?

Relational data

A.Azure SQL Database because SQL syntax guarantees PostgreSQL extension compatibility
B.SQL Server on an Azure VM because guest access supplies PostgreSQL extensions to SQL Server
C.Azure Database for PostgreSQL flexible server after checking versions and extension support
D.Cosmos DB for NoSQL because JSON support guarantees relational compatibility

✓ Correct answer

Azure Database for PostgreSQL flexible server after checking versions and extension support

Flexible server preserves PostgreSQL with supported extensions and managed operations. SQL syntax does not make Azure SQL or SQL Server PostgreSQL-compatible. Cosmos JSON support does not supply the required engine. Source guide: PDF page 23.

This item is flagged for content review.

110. A team confuses Azure SQL pricing and deployment terms. Which two mappings are correct? Select 2 answers.

Relational data

A.DTU and vCore are purchasing models
B.Hyperscale is the name of the DTU purchasing model
C.Business Critical is a serverless pause policy
D.Provisioned and serverless are compute choices

✓ Correct answers

DTU and vCore are purchasing models
Provisioned and serverless are compute choices

DTU/vCore express resource purchasing; provisioned/serverless describe compute behavior. Hyperscale is a SQL Database service tier, and Business Critical is a service tier rather than a pause policy. Source guide: PDF page 23.

This item is flagged for content review.

111. A continuously busy transactional database needs predictable capacity and ordinary storage latency at balanced cost. Which starting configuration best matches?

Relational data

A.Hyperscale chosen solely for very large storage when the workload is small and capacity is predictable
B.Azure SQL Database serverless with aggressive pause as the primary saving assumption
C.Business Critical solely because every workload needs local SSD
D.Azure SQL Database General Purpose with provisioned compute

✓ Correct answer

Azure SQL Database General Purpose with provisioned compute

General Purpose provisioned compute fits sustained ordinary transactional load. Continuous demand defeats pause-based savings. Business Critical's low-latency architecture and Hyperscale's large-scale storage are not justified by the stated requirements; compare total cost and features before using them. Source guide: PDF page 23.

This item is flagged for content review.

112. A SQL transactional application has measured storage I/O latency problems and needs eligible read-only replica offload. Cost is secondary. Which tier is the strongest starting point?

Relational data

A.DTU Basic
B.Azure SQL Database Business Critical
C.General Purpose serverless with a low compute maximum, assuming pause behavior supplies a low-latency reporting replica
D.General Purpose solely because adding memory always removes storage latency

✓ Correct answer

Azure SQL Database Business Critical

Business Critical uses local SSD and multiple replicas with supported read scale. Basic targets a different performance class. General Purpose remote storage and extra memory do not automatically resolve measured latency. Serverless pause/compute settings do not create the Business Critical read-scale architecture. Source guide: PDF page 23.

This item is flagged for content review.

113. A SQL Database will grow well beyond conventional small-database sizes and needs distributed storage and several read replicas. Which recommendations are valid? Select 2 answers.

Relational data

A.Assume Hyperscale auto-pause is generally available for every production configuration
B.Assess the supported provisioned, serverless, or elastic-pool Hyperscale configuration rather than relying on old exclusions
C.Choose Managed Instance Hyperscale because every Azure SQL product has it
D.Evaluate Hyperscale and its supported database size/replica configuration

✓ Correct answers

Assess the supported provisioned, serverless, or elastic-pool Hyperscale configuration rather than relying on old exclusions
Evaluate Hyperscale and its supported database size/replica configuration

Hyperscale offers distributed storage and supported deployment choices; exact limits/configuration still matter. Managed Instance does not inherit Hyperscale. The guide qualifies Hyperscale auto-pause as preview, so it is not an unconditional GA assumption. Source guide: PDF page 23-24.

This item is flagged for content review.

114. An intermittent development SQL workload can tolerate resume delay, but must minimize idle compute. Which design considerations are correct? Select 2 answers.

Relational data

A.Assume autoscaling automatically guarantees no billed idle compute
B.Evaluate serverless with suitable minimum/maximum compute and eligible auto-pause
C.Expect an open connection pool never to affect pausing
D.Budget storage costs even while compute is paused

✓ Correct answers

Evaluate serverless with suitable minimum/maximum compute and eligible auto-pause
Budget storage costs even while compute is paused

Serverless and eligible pause can fit intermittent use, but storage remains billed. Open sessions can prevent pause. Autoscaling changes online capacity and does not by itself eliminate idle compute charges. Source guide: PDF page 23-24.

This item is flagged for content review.

115. A serverless SQL database has almost no user CPU activity but never pauses. It has active geo-replication and persistent open sessions. What best explains the behavior?

Relational data

A.Geo-replication always pauses both replicas together without restriction
B.The vCore purchasing model disables every autoscaling capability
C.Both the geographic replication feature and open sessions can prevent auto-pause
D.Auto-pause must occur whenever CPU is near zero, so the platform is necessarily faulty

✓ Correct answer

Both the geographic replication feature and open sessions can prevent auto-pause

Auto-pause has feature and session conditions, so inactivity alone is insufficient. Geo-replication is listed as preventing pause, not forcing synchronized pause. The vCore model does not categorically disable autoscaling. Source guide: PDF page 24.

This item is flagged for content review.

116. A production service requires an always-ready response and only generally available dependencies. A proposal depends on Hyperscale serverless auto-pause. What should change?

Relational data

A.Choose compute/readiness behavior that meets the latency requirement and avoid depending on preview Hyperscale auto-pause
B.Enable long-term retention to guarantee Hyperscale will pause faster
C.Accept the proposal because serverless guarantees zero resume delay
D.Move to Managed Instance Hyperscale and retain identical pause settings

✓ Correct answer

Choose compute/readiness behavior that meets the latency requirement and avoid depending on preview Hyperscale auto-pause

Auto-pause introduces resume latency and Hyperscale pause is qualified as preview. Serverless does not guarantee zero resume delay; LTR can prevent pausing. Managed Instance does not offer an interchangeable Hyperscale tier. Source guide: PDF page 24.

This item is flagged for content review.

117. A SQL workload is slow while CPU is moderate. Traces show long transactions holding locks and blocked sessions. What is the best first response?

Relational data

A.Move the database into an elastic pool to eliminate transaction isolation
B.Reduce lock contention and tune the transactions/query plans
C.Double vCores without investigating locks
D.Add a readable geo-secondary to make primary lock waits disappear

✓ Correct answer

Reduce lock contention and tune the transactions/query plans

The measured bottleneck is contention, so shorten/tune the blocking work. Extra cores do not release locks. Read replicas do not resolve primary write contention. Pooling resources preserves database behavior and isolation. Source guide: PDF page 24.

This item is flagged for content review.

118. Forty tenant SQL databases have independent brief peaks and must remain separate. Which two design actions are appropriate? Select 2 answers.

Relational data

A.Configure per-database limits alongside the shared pool budget
B.Promise every tenant its individual maximum at the same time regardless of total pool size
C.Evaluate an elastic pool sized for overlapping aggregate demand
D.Merge all databases because an elastic pool requires one shared schema

✓ Correct answers

Configure per-database limits alongside the shared pool budget
Evaluate an elastic pool sized for overlapping aggregate demand

An elastic pool shares capacity while keeping databases separate; limits constrain noisy tenants. It neither merges schemas nor makes aggregate capacity unlimited, so simultaneous maximum demand needs sufficient total resources. Source guide: PDF page 24-25.

This item is flagged for content review.

119. Every tenant in an elastic pool now runs a large batch at 09:00. Why can they all throttle despite acceptable individual database limits?

Relational data

A.Their overlapping total demand exceeds the pool's resource budget
B.Per-database limits eliminate all shared-resource contention
C.The pool automatically reserves each database's maximum so total demand is irrelevant
D.Elastic pools replicate writes to every tenant database

✓ Correct answer

Their overlapping total demand exceeds the pool's resource budget

Pool and per-database constraints both apply. Individual headroom does not supply aggregate budget. Pooling does not replicate tenant writes, and limits do not guarantee contention-free simultaneous peaks. Source guide: PDF page 24.

This item is flagged for content review.

120. Reporting reads consume primary capacity. Writes already fit, and reports can tolerate supported replica consistency. Which actions address the read load? Select 2 answers.

Relational data

A.Use eligible read-only replica routing for reports
B.Expect the read replica to execute half the primary's incoming writes automatically
C.Assume adding any replica changes all existing read connections without client configuration
D.Verify the reports' freshness requirements against replica behavior

✓ Correct answers

Use eligible read-only replica routing for reports
Verify the reports' freshness requirements against replica behavior

Read scale requires supported routing and consistency-aware clients. It offloads reads rather than increasing primary write capacity. Existing connections are not universally rerouted merely by adding a replica. Source guide: PDF page 24.

This item is flagged for content review.

121. A write-heavy SaaS workload has reached practical single-database limits. Tenant-scoped transactions dominate and cross-tenant queries are rare. Which design best supports further write scaling?

Relational data

A.Put all tenants in an elastic pool and assume it multiplies one database's write throughput indefinitely
B.Add read-only replicas and send writes to them unchanged
C.Cache every write without persisting it
D.Shard tenants across databases using an access-aligned key and plan cross-shard operations

✓ Correct answer

Shard tenants across databases using an access-aligned key and plan cross-shard operations

Sharding distributes write ownership across databases but requires query/transaction design. Read-only replicas do not accept ordinary primary writes. Pooling shares resources and does not make one database unlimited. A cache is not durable write ownership. Source guide: PDF page 24.

This item is flagged for content review.

122. A team scales an Azure SQL database and expects every active connection to remain uninterrupted. What should the application design include?

Relational data

A.No retries because online scaling guarantees every connection survives
B.Treat every retry as a new order without idempotency
C.Bounded reconnect/retry behavior for possible brief interruptions
D.Unbounded immediate retries across all clients

✓ Correct answer

Bounded reconnect/retry behavior for possible brief interruptions

Online scaling can still cause reconnects/brief interruptions, so safe bounded retries are necessary. Unlimited synchronized retries can overload recovery. Repeating business effects without idempotency can create duplicates. Source guide: PDF page 24.

This item is flagged for content review.

123. A security design uses TDE and claims database administrators can never query sensitive column values. Which correction is appropriate?

Relational data

A.TDE blocks every authorized SELECT on encrypted files
B.A private endpoint guarantees that any database administrator sees only ciphertext
C.TDE encrypts data at rest; evaluate Always Encrypted and separate client-side key control for the administrator-confidentiality requirement
D.Dynamic masking is a cryptographic replacement for TDE and client-side encryption

✓ Correct answer

TDE encrypts data at rest; evaluate Always Encrypted and separate client-side key control for the administrator-confidentiality requirement

TDE protects stored files/logs/backups, while Always Encrypted can protect eligible values from database-side access with separate keys. Masking changes presentation and is not encryption. Network location does not prevent authorized queries. Source guide: PDF page 24-25.

This item is flagged for content review.

124. A company moves SQL TDE to customer-managed keys. Which two operational requirements are essential? Select 2 answers.

Relational data

A.Treat a private endpoint as a replacement for key permissions
B.Preserve access to key versions needed by current data and restores
C.Delete all previous key versions immediately after rotation
D.Test key rotation, permissions, and key-store recovery dependencies

✓ Correct answers

Preserve access to key versions needed by current data and restores
Test key rotation, permissions, and key-store recovery dependencies

Required key versions and accessibility are recovery dependencies. Deleting required prior keys can prevent access/restoration. Private connectivity does not grant cryptographic key permissions. Source guide: PDF page 24.

This item is flagged for content review.

125. An application has an Azure role allowing SQL resource management but SELECT fails. What should be inspected?

Relational data

A.The application's authenticated database principal and data roles/permissions
B.Only the management-plane Contributor assignment, assuming it grants every SQL data permission
C.Whether TDE must be disabled for managed identities
D.Only IP firewall rules, assuming network access authorizes SELECT

✓ Correct answer

The application's authenticated database principal and data roles/permissions

Management-plane rights differ from database data authorization; inspect identity mapping and database roles. A Contributor assignment alone does not supply every SQL data permission, and firewall reachability does not authorize SELECT. TDE and managed identity can coexist. Source guide: PDF page 24.

This item is flagged for content review.

126. A private SQL endpoint is reachable by IP, but the application cannot connect using the intended name and has no database data permissions. Which fixes are required? Select 2 answers.

Relational data

A.Configure appropriate DNS and application network routing
B.Remove authentication because traffic is private
C.Increase the SQL tier to grant SELECT automatically
D.Authenticate the application and grant least-privilege database permissions

✓ Correct answers

Configure appropriate DNS and application network routing
Authenticate the application and grant least-privilege database permissions

Private access still requires correct DNS/routes and principal authorization. Private networking is not an authentication bypass. A more expensive tier does not grant database permissions. Source guide: PDF page 24.

This item is flagged for content review.

127. A multi-tenant shared SQL database must restrict each authenticated tenant to its own rows. Which capability directly matches?

Relational data

A.Dynamic masking of the tenant ID alone
B.TDE alone
C.Long-term backup retention
D.Row-level security with suitable predicates and identity context

✓ Correct answer

Row-level security with suitable predicates and identity context

Row-level security filters authorized rows. TDE addresses at-rest confidentiality, masking changes presentation, and LTR stores history; none of these alone enforce tenant row access. Source guide: PDF page 25.

This item is flagged for content review.

128. A regulated SQL application needs investigation records of access plus modified sensitive values hidden from selected routine users. Which mechanisms match those distinct needs?

Relational data

A.Always Encrypted alone as a complete access-audit and user-display policy
B.Auditing for investigative access/change records and dynamic masking for selected users' displayed values
C.TDE alone for both access records and user-specific display
D.PITR backups used instead of access auditing and display controls

✓ Correct answer

Auditing for investigative access/change records and dynamic masking for selected users' displayed values

Auditing records activity and dynamic masking changes selected users' displayed values without becoming encryption. TDE addresses data at rest; Always Encrypted protects eligible client-encrypted values; PITR restores past database state. Those mechanisms do not by themselves supply the requested audit trail plus display policy. Source guide: PDF page 25.

This item is flagged for content review.

129. A Basic Azure SQL Database must recover a mistakenly deleted row from twenty days ago. No other retained copy exists. What design gap prevents the proposed native PITR approach?

Relational data

A.Geo-replication automatically retains each historical row for thirty-five days
B.Every SQL Database tier has an unconditional ten-year PITR timeline
C.Basic short-term retention is limited to one through seven days, so the desired point exceeds that window
D.TDE prevents all restores older than twenty-four hours

✓ Correct answer

Basic short-term retention is limited to one through seven days, so the desired point exceeds that window

The guide limits Basic PITR retention to one-seven days. TDE does not impose the stated age limit. Geo-replication copies current changes, and ten-year LTR is selected backups rather than a ten-year PITR timeline. Source guide: PDF page 25.

This item is flagged for content review.

130. A SQL failover-group secondary contains a mistaken delete performed an hour earlier. Which recovery action should be evaluated?

Relational data

A.Rotate the TDE key to reconstruct the deleted records
B.Restore a retained backup/PITR point from before the delete and validate/reconnect the application
C.Force failover because replication always excludes accidental deletes
D.Add a read-scale replica to recover prior versions automatically

✓ Correct answer

Restore a retained backup/PITR point from before the delete and validate/reconnect the application

A pre-error retained point can recover good data. Geo/current read replicas can carry the delete and do not supply history. Key rotation changes cryptographic control rather than recreating records. Source guide: PDF page 25.

This item is flagged for content review.

131. A PostgreSQL production database is continuously CPU-intensive and also needs supported local HA. Which starting plan is most suitable?

Relational data

A.General Purpose or Memory Optimized flexible server sized to demand, with supported HA
B.Treat a cross-region asynchronous read replica as automatic zero-data-loss local HA
C.Burstable solely because CPU credits never run out
D.Use the synchronous HA standby as the main reporting endpoint

✓ Correct answer

General Purpose or Memory Optimized flexible server sized to demand, with supported HA

General Purpose/Memory Optimized suit sustained production demand and supported HA. Burstable CPU credits can constrain continuous usage. HA standby is not normal read scale; cross-region asynchronous replicas have different promotion/data-loss semantics. Source guide: PDF page 25.

This item is flagged for content review.

132. An image website accesses millions of independent media files using HTTP object operations. No shared filesystem is required. Which storage service is the best starting point?

Object, file, and NoSQL data

A.Azure managed disks attached to every web worker
B.Azure Table storage for the image bytes
C.Azure Files solely for SMB semantics
D.Azure Blob Storage

✓ Correct answer

Azure Blob Storage

Blob provides the required object API and media lifecycle/security features. Files adds unneeded file-share semantics; per-worker disks complicate independent shared object access. Table is a key/attribute store rather than a media-object service. Source guide: PDF page 26.

This item is flagged for content review.

133. A legacy application opens shared paths through SMB and cannot be redesigned. Which recommendation matches its access semantics?

Object, file, and NoSQL data

A.Replace the share with ordinary Blob URLs and assume applications need no changes
B.Store file content as Cosmos partition-key values
C.Use a compatible Azure Files share and validate identity, performance, and backup support
D.Place all shared documents on ephemeral OS disks

✓ Correct answer

Use a compatible Azure Files share and validate identity, performance, and backup support

Azure Files supports compatible shared-file protocols. Blob API access differs from SMB. Ephemeral disks are disposable, and Cosmos partition keys organize records rather than presenting a shared filesystem. Source guide: PDF page 26.

This item is flagged for content review.

134. A database VM disk supports more throughput than measured, but the VM has reached its documented aggregate storage throughput limit. What should the architect evaluate first?

Object, file, and NoSQL data

A.Only a faster disk, because VM throughput limits never constrain disk traffic
B.The VM's I/O limits and an appropriately sized VM/storage combination
C.More storage capacity without reviewing IOPS or throughput
D.Azure Blob archive to reduce disk read latency

✓ Correct answer

The VM's I/O limits and an appropriately sized VM/storage combination

Effective I/O is constrained by both disk and VM. A disk upgrade cannot bypass the VM cap. Archive is offline object storage, and capacity alone does not establish needed performance. Source guide: PDF page 27.

This item is flagged for content review.

135. A team needs durable business records to survive VM replacement. Which two choices are appropriate? Select 2 answers.

Object, file, and NoSQL data

A.Protect the records with supported backup/recovery
B.Use an ephemeral OS disk as the only copy because the VM can be recreated
C.Use a temporary VM disk because its name says disk
D.Store records on suitable durable managed disks or a resilient data service

✓ Correct answers

Protect the records with supported backup/recovery
Store records on suitable durable managed disks or a resilient data service

Durable storage plus recovery protects records. Temporary and ephemeral disks are intended for disposable/recreatable data, and recreating a VM does not recreate missing business records. Source guide: PDF page 27.

This item is flagged for content review.

136. A hybrid file estate needs fast access to frequently used files on Windows Server while retaining a managed Azure cloud share. Which service fits?

Object, file, and NoSQL data

A.Azure Backup file protection alone as an interactive synchronized cache
B.A direct Azure Files cloud share with no local caching layer
C.Blob lifecycle management alone for local Windows hot-file caching
D.Azure File Sync with supported endpoints and cloud tiering

✓ Correct answer

Azure File Sync with supported endpoints and cloud tiering

File Sync synchronizes supported Windows endpoints with Azure Files and can retain hot files locally. A direct cloud share does not supply the requested local tiering/cache layer. Blob lifecycle tiers objects rather than synchronizing the Windows file cache; backup retains recovery points rather than acting as an interactive synchronized cache. Source guide: PDF page 26-27.

This item is flagged for content review.

137. File Sync has propagated an accidental deletion to every endpoint. Which design component addresses this incident?

Object, file, and NoSQL data

A.Independent retained snapshots or supported backups from before the deletion
B.More local cache capacity
C.Moving the cloud share from hot to cold Blob tier
D.Additional synchronized endpoints only

✓ Correct answer

Independent retained snapshots or supported backups from before the deletion

Independent historical recovery points can restore a pre-delete state. Extra synchronized copies can carry the same delete, cache capacity preserves no history by itself, and Blob tier changes do not describe Azure Files recovery. Source guide: PDF page 27.

This item is flagged for content review.

138. Analytics jobs write temporary output and then rename large directory trees to commit results. They need path ACLs. Which storage option is appropriate?

Object, file, and NoSQL data

A.Azure Table storage because RowKey is a filesystem path
B.Flat Blob namespace solely because slashes give identical atomic directory semantics
C.ADLS with hierarchical namespace, after checking feature compatibility
D.Managed disks on disposable workers as the only persistent lake

✓ Correct answer

ADLS with hierarchical namespace, after checking feature compatibility

HNS supplies real directories and path ACLs suited to analytics. Slashes in flat object names are not equivalent. Table keys are not a directory API; worker disks alone are not a resilient shared analytics lake. Source guide: PDF page 27.

This item is flagged for content review.

139. A lake account is being upgraded to hierarchical namespace. The current recovery design depends on ordinary block-blob PITR. What must happen before relying on the new design?

Object, file, and NoSQL data

A.Replace the incompatible PITR assumption with a supported recovery mechanism and validate the compatibility matrix
B.Assume HNS enables every flat-namespace recovery feature automatically
C.Disable all backups because real directories prevent corruption
D.Use directory rename as a substitute for a pre-error recovery point

✓ Correct answer

Replace the incompatible PITR assumption with a supported recovery mechanism and validate the compatibility matrix

Ordinary block-blob PITR does not support HNS, so recovery must be redesigned/verified. HNS is not corruption prevention, and namespace renaming does not preserve an independent good historical state. Source guide: PDF page 27.

This item is flagged for content review.

140. An analyst has Storage Blob Data Reader on an entire ADLS account. A directory ACL omits that analyst, but reads still succeed. Why?

Object, file, and NoSQL data

A.The Reader management role and Blob Data Reader role always mean identical data permissions
B.A sufficient data RBAC grant is evaluated before ACLs and cannot be narrowed by that ACL
C.HNS disables Microsoft Entra authorization
D.Every ACL automatically overrides every data-role grant, so the observed success is impossible

✓ Correct answer

A sufficient data RBAC grant is evaluated before ACLs and cannot be narrowed by that ACL

An ACL cannot remove access already sufficiently granted by data RBAC. HNS supports Entra/roles/ACLs, and management/data roles differ. Narrow the broad data-role scope if path isolation is required. Source guide: PDF page 27.

This item is flagged for content review.

141. A service should access only one lake directory through Entra identity. Which two controls should be included? Select 2 answers.

Object, file, and NoSQL data

A.Required directory execute/traversal permissions along the path
B.Account-wide Blob Data Reader followed by an ACL deny to narrow that grant
C.Narrowly scoped data-role grants or appropriate ACL authorization
D.A subscription management role as sufficient permission to read every file

✓ Correct answers

Required directory execute/traversal permissions along the path
Narrowly scoped data-role grants or appropriate ACL authorization

Least-privilege data grants and required path traversal allow intended operations. A broad sufficient role cannot be narrowed by ACLs. Management-plane access does not automatically authorize file reads. Source guide: PDF page 27.

This item is flagged for content review.

142. A document set is read rarely, but users require immediate retrieval. Objects stay at least six months. Which tier class should be evaluated first?

Object, file, and NoSQL data

A.Archive with a five-minute guaranteed rehydration assumption
B.LRS because redundancy names specify access-frequency pricing tiers
C.Archive because every tier guarantees immediate normal reads
D.An online tier such as cool or cold based on actual retrieval and transaction cost

✓ Correct answer

An online tier such as cool or cold based on actual retrieval and transaction cost

Cool/cold remain online and can fit infrequent immediate reads. Archive requires rehydration with variable completion. LRS is redundancy, not an access tier. Source guide: PDF page 27-28.

This item is flagged for content review.

143. A legal archive is almost never retrieved, allows delayed access, and retains files for years. Which two considerations support Blob archive? Select 2 answers.

Object, file, and NoSQL data

A.Rehydration delay is acceptable before normal reads
B.The application requires every object to be immediately readable in five minutes
C.Long retention reduces early-deletion charging exposure
D.ZRS is mandatory for the same archived objects under the documented tier matrix

✓ Correct answers

Rehydration delay is acceptable before normal reads
Long retention reduces early-deletion charging exposure

Delayed retrieval and long retention fit archive. A guaranteed immediate five-minute requirement does not. The guide states archive supports LRS/GRS/RA-GRS rather than ZRS/GZRS/RA-GZRS. Source guide: PDF page 27-28.

This item is flagged for content review.

144. A team deletes a cool-tier Blob after ten days in a general-purpose-v2 account. What should its cost estimate consider?

Object, file, and NoSQL data

A.Cool is offline and always requires rehydration before deletion
B.Deletion is technically forbidden for thirty days in all cases
C.Every Blob tier has the same 180-day minimum duration
D.Possible prorated early-deletion charges for the thirty-day minimum duration

✓ Correct answer

Possible prorated early-deletion charges for the thirty-day minimum duration

Minimum duration is a charging rule rather than an immutable deletion ban. Cool ordinarily has thirty days, not the archive 180 days, and remains online. Source guide: PDF page 27-28.

This item is flagged for content review.

145. Objects are frequently downloaded despite being stored in cold tier. Monthly spending rises. What is the best next step?

Object, file, and NoSQL data

A.Compare total storage, retrieval, and transaction cost against a hotter tier
B.Ignore retrieval charges because cold data is online
C.Choose archive solely because its per-GB storage price is lower
D.Tune lifecycle to move objects colder sooner without measuring their read frequency

✓ Correct answer

Compare total storage, retrieval, and transaction cost against a hotter tier

Total cost includes access charges as well as stored bytes. Archive adds offline retrieval and can worsen this access pattern. Online status does not eliminate retrieval/transaction pricing, and moving frequently read objects colder sooner can increase their total access cost. Source guide: PDF page 27-28.

This item is flagged for content review.

146. A retention policy must move inactive objects and eventually delete expired versions automatically, but no immediate deadline is required. Which mechanism fits?

Object, file, and NoSQL data

A.Versioning enabled without any policy to age out expired objects
B.A lifecycle rule used as a guaranteed real-time workflow callback
C.Blob lifecycle management with scoped supported rules and retention constraints
D.Manual tier changes with no scheduled or policy-driven version-expiration process

✓ Correct answer

Blob lifecycle management with scoped supported rules and retention constraints

Lifecycle asynchronously tiers/deletes eligible objects by supported rules. It is not a guaranteed immediate callback. Manual-only changes do not supply the requested automation, and versioning retains versions without itself defining their business expiration/tiering policy. Source guide: PDF page 28.

This item is flagged for content review.

147. A lifecycle deletion rule is valid, but a protected legal-record object remains. What is the likely intended cause?

Object, file, and NoSQL data

A.Lifecycle always deletes objects despite locked retention
B.An applicable immutability policy or legal hold prevents deletion
C.ZRS supplies an undeletable historical version for every write
D.Changing a Blob name always removes all legal holds

✓ Correct answer

An applicable immutability policy or legal hold prevents deletion

Protection constraints can override attempted lifecycle deletion. ZRS copies current state rather than creating undeletable history, and renaming does not universally remove retention. Legal constraints must be incorporated in policy design. Source guide: PDF page 28-30.

This item is flagged for content review.

148. A storage account must tolerate a primary-region zone failure and keep a geographic copy; supported secondary Blob reads before failover are also required. Which option best matches?

Object, file, and NoSQL data

A.GRS without read-access support
B.ZRS without geographic replication
C.RA-GZRS
D.LRS

✓ Correct answer

RA-GZRS

RA-GZRS combines primary ZRS, asynchronous geographic copies, and supported secondary reads. LRS lacks zone/geographic separation; ZRS lacks a region copy; plain GRS lacks primary zone redundancy and pre-failover read-access behavior. Source guide: PDF page 28-29.

This item is flagged for content review.

149. A Blob application reads a geographic secondary during a primary outage. Which two behaviors must its design handle? Select 2 answers.

Object, file, and NoSQL data

A.The normal secondary endpoint serves supported reads rather than acting as an independent writable primary
B.Selecting RA redundancy automatically recovers web compute, DNS, identity, and secrets
C.Secondary reads always see every primary acknowledgement immediately
D.The secondary can lag or lack a recently written object

✓ Correct answers

The normal secondary endpoint serves supported reads rather than acting as an independent writable primary
The secondary can lag or lack a recently written object

Geographic replication is asynchronous and read-access variants expose supported reads. They neither provide immediate freshest writes nor fail over every application dependency. Source guide: PDF page 29.

This item is flagged for content review.

150. One workload requires archive; another requires primary-region ZRS. Both were proposed for one storage account. What is the strongest correction?

Object, file, and NoSQL data

A.Set separate redundancy on two containers in the same account
B.Use compatible separate accounts because archive does not support ZRS and account services share redundancy
C.Replace the archive requirement with a readable Files secondary without assessing protocols
D.Enable archive and ZRS together because every Blob tier supports every redundancy mode

✓ Correct answer

Use compatible separate accounts because archive does not support ZRS and account services share redundancy

Archive's support excludes ZRS, and redundancy is shared at account level, so separate compatible accounts address differing needs. Containers do not independently override redundancy; Files semantics are a separate design. Source guide: PDF page 28-29.

This item is flagged for content review.

151. A proposal says every GRS account, including Azure Files, guarantees no more than fifteen minutes of data loss because Geo Priority Replication exists. Which correction is accurate?

Object, file, and NoSQL data

A.Its block-blob SLA automatically applies to all Azure Files share configurations
B.Ordinary GRS is synchronous across regions and guarantees zero loss
C.The capability makes the geographic secondary a second writable primary
D.Its specific opt-in SLA covers eligible block-blob Last Sync Time lag of fifteen minutes or less for 99% of the month, subject to exclusions; it is not universal zero loss

✓ Correct answer

Its specific opt-in SLA covers eligible block-blob Last Sync Time lag of fifteen minutes or less for 99% of the month, subject to exclusions; it is not universal zero loss

Geo Priority Replication has explicit scope, enablement, and exclusions and remains asynchronous. GRS does not become synchronous or writable-active-active, and the stated block-blob SLA is not a universal Files promise. Source guide: PDF page 29.

This item is flagged for content review.

152. An attacker with valid storage read authorization downloads plaintext despite service-side encryption. What explains this?

Object, file, and NoSQL data

A.Encryption at rest protects stored data, while authorization still allows permitted readers to receive plaintext
B.A private endpoint alone prevents every authorized client from exporting data
C.At-rest encryption should always reject every authorized read
D.Customer-managed keys replace all identity and data-permission controls

✓ Correct answer

Encryption at rest protects stored data, while authorization still allows permitted readers to receive plaintext

At-rest encryption protects stored media rather than denying authorized reads. Customer-managed keys do not replace identity/data permissions. A private endpoint limits the network path but does not prohibit a permitted client from reading or exporting data. Source guide: PDF page 29.

This item is flagged for content review.

153. An external client needs temporary read access to one Blob and the organization prefers Entra-based delegation over sharing account keys. Which design fits?

Object, file, and NoSQL data

A.A least-privilege short-lived user delegation SAS using a key obtained with Entra credentials
B.A service SAS that is claimed to be Entra-signed without an account key
C.An account key emailed to the client for all containers
D.A management Contributor role as a public unauthenticated Blob URL

✓ Correct answer

A least-privilege short-lived user delegation SAS using a key obtained with Entra credentials

User delegation SAS offers supported Entra-derived signing with scoped bearer access. Account keys grant broad sensitive capability; service SAS uses an account key. Management Contributor is not an anonymous object access token. Source guide: PDF page 29.

This item is flagged for content review.

154. A vendor receives SAS access for a short upload. Which two choices reduce exposure? Select 2 answers.

Object, file, and NoSQL data

A.Assume a leaked SAS is harmless because clients must know the account key too
B.Grant only required resource/operation scope and a short validity interval
C.Protect the token as a bearer credential and plan supported revocation
D.Use a stored access policy as a universal control for every SAS type

✓ Correct answers

Grant only required resource/operation scope and a short validity interval
Protect the token as a bearer credential and plan supported revocation

A SAS bearer can act within its grants, so constrain/protect it and plan revocation. Possession of the account key is not required for token use. Stored policies apply only to eligible service SAS, not all types. Source guide: PDF page 29.

This item is flagged for content review.

155. A flat-namespace Blob estate needs pre-overwrite history and undo for eligible block blobs. Which two capabilities support this recovery design? Select 2 answers.

Object, file, and NoSQL data

A.Only TDE-key rotation after a bad overwrite
B.Eligible PITR using versioning, soft delete, and change feed
C.GRS alone as a guaranteed historical restore timeline
D.Blob versioning and soft delete with suitable retention

✓ Correct answers

Eligible PITR using versioning, soft delete, and change feed
Blob versioning and soft delete with suitable retention

Versions/soft delete and supported PITR preserve usable historical states. Replication can propagate an overwrite; encryption-key rotation does not reconstruct old values. Source guide: PDF page 29.

This item is flagged for content review.

156. A team says container soft delete alone recovers all deleted blobs and all old overwrites. Which correction matches the protection scopes?

Object, file, and NoSQL data

A.Container soft delete is the same operation as whole storage-account backup
B.A readable geographic copy always preserves pre-overwrite content
C.Every HNS overwrite automatically has a version because container delete is enabled
D.Container soft delete targets container deletion; combine appropriate object-level soft delete/versioning and supported restore for object history

✓ Correct answer

Container soft delete targets container deletion; combine appropriate object-level soft delete/versioning and supported restore for object history

Protection mechanisms have distinct scopes. Container deletion protection is not an unlimited object/version or storage-account recovery system. HNS overwrite and replica history assumptions are unsupported. Source guide: PDF page 29.

This item is flagged for content review.

157. Records must resist deletion or modification for a regulatory retention period. The team will test write behavior before locking. Which control directly fits?

Object, file, and NoSQL data

A.Blob versioning alone without a locked retention or legal-hold policy
B.Immutable Blob storage with a supported time-based retention policy or legal hold
C.Blob soft delete alone as an immutable prohibition on all writes and deletes
D.Archive access tier alone as WORM enforcement

✓ Correct answer

Immutable Blob storage with a supported time-based retention policy or legal hold

Immutability enforces eligible WORM retention. Soft delete offers an undo window rather than prohibiting every modification. Archive is an access tier, while versioning retains supported previous versions without itself creating the requested immutable retention boundary. Source guide: PDF page 29-30.

This item is flagged for content review.

158. A global product catalog stores JSON with varying attributes and needs low-latency regional reads with customer read-your-own-write behavior. Which starting architecture fits?

Object, file, and NoSQL data

A.Blob archive for all operational documents with immediate reads
B.Azure Files with row-level SQL constraints
C.Cosmos DB for NoSQL with an access-aligned distributed key, appropriate regions, and session handling
D.Azure Table storage assumed to provide every Cosmos regional and consistency feature

✓ Correct answer

Cosmos DB for NoSQL with an access-aligned distributed key, appropriate regions, and session handling

Cosmos NoSQL fits the document/operational/regional pattern, with session tokens for session guarantees. Files and archive do not satisfy those query semantics. Table does not inherit the entire Cosmos feature matrix. Source guide: PDF page 30-31.

This item is flagged for content review.

159. A Cosmos container uses country as the key, and one country generates nearly all writes. Account-wide throughput has spare capacity but requests throttle. What change should be evaluated?

Object, file, and NoSQL data

A.Only increasing global RU/s and assuming every hot key becomes unlimited
B.Adding unrelated partition-key values that never receive requests
C.Switching to archive to add Cosmos write partitions
D.A higher-cardinality access-aligned partition strategy that spreads that country's traffic, with data movement if needed

✓ Correct answer

A higher-cardinality access-aligned partition strategy that spreads that country's traffic, with data movement if needed

A hot key can remain limited despite global spare throughput. A redesigned key distributes actual demand, usually requiring migration. Unused keys do not move hot traffic, and Blob archive does not change Cosmos partitioning. Source guide: PDF page 30-31.

This item is flagged for content review.

160. Tenant-scoped queries are common, but a single large tenant will exceed a conventional 20-GB single-level logical partition. Which design should be evaluated?

Object, file, and NoSQL data

A.Assume any new physical partition automatically makes one conventional logical partition unlimited
B.Supported hierarchical partition keys that distribute the tenant across lower-level key values while enabling tenant-prefix queries
C.A constant key for every tenant because logical partitions have no size limit
D.A random key without checking the resulting query cost

✓ Correct answer

Supported hierarchical partition keys that distribute the tenant across lower-level key values while enabling tenant-prefix queries

Hierarchical keys can distribute a tenant prefix across full key values under documented limits. Constant/hot keys retain limits; random keys can force expensive scans. Physical scaling does not remove a conventional logical partition's limits. Source guide: PDF page 30.

This item is flagged for content review.

161. A workflow must atomically change several Cosmos NoSQL records. Which two design points matter? Select 2 answers.

Object, file, and NoSQL data

A.Choose multi-region writes as a substitute for transaction scope
B.Place required transactional records in the same supported logical partition
C.Choose the partition key for business correctness as well as balanced access
D.Assume an ordinary transactional batch spans arbitrary partition keys

✓ Correct answers

Place required transactional records in the same supported logical partition
Choose the partition key for business correctness as well as balanced access

Ordinary NoSQL transactions are logical-partition scoped, so key design affects invariants. Multi-write regional topology does not extend arbitrary cross-partition atomicity. Source guide: PDF page 30-31.

This item is flagged for content review.

162. A Cosmos workload performs 150 operations per second at 4 RUs each plus 50 indexed writes per second at 12 RUs each. Ignoring headroom, what throughput demand should be planned?

Object, file, and NoSQL data

A.800 RU/s
B.200 RU/s
C.1,200 RU/s
D.600 RU/s

✓ Correct answer

1,200 RU/s

150 × 4 = 600 and 50 × 12 = 600, totaling 1,200 RU/s before headroom. 200 counts requests without operation cost; 600 includes only one workload; 800 incorrectly prices all 200 operations as 4-RU reads. Source guide: PDF page 30.

This item is flagged for content review.

163. An intermittent Cosmos application must run in two Azure regions. Which purchasing-design conclusion is correct?

Object, file, and NoSQL data

A.Evaluate supported provisioned or autoscale throughput because serverless accounts are single-region
B.Choose serverless because consumed-RU billing enables all regional configurations
C.Choose manual RU/s to eliminate every hot partition automatically
D.Choose a vCore MongoDB offering and assume identical NoSQL RU/consistency limits

✓ Correct answer

Evaluate supported provisioned or autoscale throughput because serverless accounts are single-region

The stated serverless single-region restriction excludes that choice for two regions. Manual capacity does not repair skew, and vCore MongoDB is a different offering whose model must be checked. Source guide: PDF page 30-31.

This item is flagged for content review.

164. Customers update a profile and must immediately read their own change, while unrelated clients may see older values temporarily. Which two choices support the requirement? Select 2 answers.

Object, file, and NoSQL data

A.Preserve/share the relevant session token correctly across involved client instances
B.Strong consistency combined with multiple write regions
C.Session consistency
D.Eventual consistency alone as an unconditional read-your-write guarantee

✓ Correct answers

Preserve/share the relevant session token correctly across involved client instances
Session consistency

Session consistency provides documented session guarantees with correct tokens. Eventual has no such unconditional guarantee, while multi-write strong is unsupported and stronger than the stated unrelated-reader need. Source guide: PDF page 31.

This item is flagged for content review.

165. A distributed application permits bounded freshness lag, rather than requiring the latest value, but must express the lag as versions or time. Which Cosmos consistency level fits?

Object, file, and NoSQL data

A.Eventual
B.Session without shared token context
C.Bounded staleness
D.Consistent prefix

✓ Correct answer

Bounded staleness

Bounded staleness states explicit version/time bounds. Eventual supplies convergence without a fixed freshness bound; consistent prefix addresses ordering; session addresses client-session guarantees rather than the required universal freshness bound. Source guide: PDF page 31.

This item is flagged for content review.

166. A company copies source files into a lake and calls the analytical project complete. Reports still lack validated facts and consistent definitions. What should be designed next?

Integration and analytics

A.A second raw lake replica without changing the analytical pipeline
B.Transformation, quality checks, curated serving models, orchestration, and report consumption
C.More raw storage capacity without defining transformations or business models
D.A Purview catalog entry that automatically transforms all source fields

✓ Correct answer

Transformation, quality checks, curated serving models, orchestration, and report consumption

Ingestion/storage alone does not create validated analytical models. More capacity or another raw copy does not define business transformations or quality checks. Purview cataloging tracks/discovers data rather than executing the missing pipeline. Source guide: PDF page 32-34.

This item is flagged for content review.

167. Large historical aggregation reports slow down short customer transactions in the production SQL system. Which architecture addresses the contention?

Integration and analytics

A.Run every historical report more frequently on the same primary
B.Catalog report queries without separating their execution from customer transactions
C.Increase primary capacity without considering independent analytical scaling or workload contention
D.Prepare a separate analytical store with independent capacity and a freshness-appropriate ingestion process

✓ Correct answer

Prepare a separate analytical store with independent capacity and a freshness-appropriate ingestion process

Separating OLAP capacity and data layout isolates large scans from OLTP while freshness drives integration. More scans worsen contention. Larger primary capacity may help temporarily but does not provide independent analytical workload isolation; cataloging does not change where expensive queries run. Source guide: PDF page 32.

This item is flagged for content review.

168. A destination must not receive unnecessary sensitive fields. Source transformations are feasible before loading and latency is acceptable. Which integration pattern best matches?

Integration and analytics

A.ETL that removes or transforms the sensitive fields before final loading
B.Full-copy replication with no transformation because all SQL data is safe
C.Purview classification alone as automatic field removal
D.ELT that first exposes every sensitive raw field to unrestricted destination users

✓ Correct answer

ETL that removes or transforms the sensitive fields before final loading

ETL transforms before final destination load and can reduce sensitive exposure. An unrestricted raw ELT landing conflicts with the stated policy. Copying and classification do not themselves remove fields or enforce the intended transformation. Source guide: PDF page 32.

This item is flagged for content review.

169. Transformation rules are expected to change and the team needs reprocessing without repeatedly extracting historical source data. Which two design choices fit? Select 2 answers.

Integration and analytics

A.Land governed raw data before transformation using an ELT-style pattern
B.Retain replayable source detail according to security and retention requirements
C.Grant everyone access to raw quarantine files because they are not curated
D.Delete source detail immediately after every curated output succeeds

✓ Correct answers

Land governed raw data before transformation using an ELT-style pattern
Retain replayable source detail according to security and retention requirements

ELT/raw retention enables replay while security/retention governs cost/exposure. Immediate deletion removes reprocessing input. Raw and quarantine records can contain sensitive data and need access control. Source guide: PDF page 32-33.

This item is flagged for content review.

170. A timestamp-watermark pipeline uses modification time but misses deleted rows and some equal-timestamp updates. What is the best next step?

Integration and analytics

A.Increase destination compute and leave change detection unchanged
B.Replace the watermark with an untracked wall clock and skip checkpoints
C.Design correct watermark boundaries and deletion handling or use supported CDC, then reconcile business totals
D.Use only pipeline activity success as proof every source change arrived

✓ Correct answer

Design correct watermark boundaries and deletion handling or use supported CDC, then reconcile business totals

The fault is incomplete change capture. Robust boundaries/deletion handling or supported CDC addresses it; reconciliation proves effects. Faster destination compute and activity success do not correct missing changes, and losing tracked progress worsens recovery. Source guide: PDF page 32.

This item is flagged for content review.

171. A copy job is retried after half of a batch was committed. Orders appear twice. Which two changes directly address safe recovery? Select 2 answers.

Integration and analytics

A.Use idempotent destination processing keyed to the intended business event
B.Disable validation because the activity eventually reports success
C.Retain checkpoints or tracked progress for resume/replay
D.Assume retry delivery means exactly-once business effects

✓ Correct answers

Use idempotent destination processing keyed to the intended business event
Retain checkpoints or tracked progress for resume/replay

Tracked progress and idempotent writes support recovery without repeated business effects. Success flags do not reconcile results, and retries can duplicate delivery/effects unless the end-to-end design prevents them. Source guide: PDF page 32-34.

This item is flagged for content review.

172. A finance copy activity reports success, yet destination totals differ from the source. Which validation should be required?

Integration and analytics

A.Check only the activity's success flag
B.Increase raw-file retention and assume totals automatically match
C.Compare only copy duration and network throughput, without checking result values
D.Reconcile row counts and business totals, including expected inserts, updates, and deletes

✓ Correct answer

Reconcile row counts and business totals, including expected inserts, updates, and deletes

Reconciliation tests substantive correctness beyond transport completion. Success flags, faster copy/network metrics, and retention do not prove that the correct records and financial totals were produced. Source guide: PDF page 32.

This item is flagged for content review.

173. An analytical lake must expose traceable quality boundaries and preserve source detail. Which layer mapping is appropriate?

Integration and analytics

A.Refined/silver replaces every requirement for source retention and access control
B.Raw/bronze preserves source; refined/silver cleans and standardizes; curated/gold serves business-ready data
C.Curated/gold is an unrestricted quarantine for malformed records
D.Raw/bronze automatically contains only approved business aggregates

✓ Correct answer

Raw/bronze preserves source; refined/silver cleans and standardizes; curated/gold serves business-ready data

The layers distinguish source retention, cleansing, and serving. Raw is not automatically curated, quarantine needs protection, and refined output does not eliminate replay/security requirements. Source guide: PDF page 33.

This item is flagged for content review.

174. Data Factory must nightly copy data from a private on-premises SQL Server reachable only inside the company network. Which two components should be planned? Select 2 answers.

Integration and analytics

A.Azure-SSIS runtime merely because the source database is SQL Server, even though no SSIS package exists
B.A supported self-hosted integration runtime with source network access
C.Only a cloud linked-service password, because credentials create the network route
D.A linked service with correct credentials plus routes, firewall, and DNS reachability

✓ Correct answers

A supported self-hosted integration runtime with source network access
A linked service with correct credentials plus routes, firewall, and DNS reachability

Self-hosted runtime reaches supported private sources; connection credentials and network reachability both matter. Authentication cannot create routes, and Azure-SSIS is for supported existing SSIS package execution rather than every SQL source. Source guide: PDF page 33.

This item is flagged for content review.

175. Existing supported SSIS packages should run in Azure with minimal package redesign. Which Data Factory runtime should be evaluated?

Integration and analytics

A.Azure-SSIS Integration Runtime
B.Only an Azure managed copy runtime because it executes every SSIS package unchanged
C.Azure SQL elastic pool as an SSIS execution service
D.A self-hosted runtime solely because it is the only Azure SSIS option

✓ Correct answer

Azure-SSIS Integration Runtime

Azure-SSIS IR is the supported SSIS execution option. Managed cloud copy runtime and self-hosted connectivity are different runtime purposes. SQL resource pooling is not package execution. Source guide: PDF page 33.

This item is flagged for content review.

176. An on-premises ingestion path relies on one self-hosted runtime machine, which fails during maintenance. Which improvement best addresses that runtime failure boundary?

Integration and analytics

A.Rely on a manual restart of the single node instead of testing an available second runtime node
B.Increase destination capacity but keep the failed single execution node as the only runtime
C.Add linked services without adding execution nodes
D.Deploy and monitor multiple supported self-hosted runtime nodes, protecting credentials and checking throughput

✓ Correct answer

Deploy and monitor multiple supported self-hosted runtime nodes, protecting credentials and checking throughput

Supported multiple nodes improve runtime availability/capacity. Connection definitions and destination capacity do not replace a failed execution machine. Manual-only restart of the same node leaves the single-node maintenance failure boundary. Source guide: PDF page 33.

This item is flagged for content review.

177. A team thinks Data Factory is the warehouse that stores all historical business facts. Which clarification is correct?

Integration and analytics

A.An integration runtime is the long-term report-retention database
B.Every dataset definition stores a full warehouse copy inside Data Factory
C.Data Factory orchestrates integration; separately choose the durable data store and analytical serving engine
D.A linked service automatically supplies relational warehouse tables

✓ Correct answer

Data Factory orchestrates integration; separately choose the durable data store and analytical serving engine

Pipelines/runtimes integrate data; datasets identify it and linked services describe connections. None of those definitions automatically creates the historical warehouse. Source guide: PDF page 33.

This item is flagged for content review.

178. A team needs an integrated Azure analytics environment with SQL, Spark, and pipelines, plus allocated distributed warehouse capacity. Which service/configuration fits?

Integration and analytics

A.Azure Synapse Analytics with a suitable dedicated SQL pool
B.Synapse serverless SQL assumed to have every dedicated warehouse capability
C.Azure SQL Database alone assumed to supply the integrated SQL/Spark/pipeline environment
D.Data Factory Copy Activity alone as the allocated distributed warehouse serving engine

✓ Correct answer

Azure Synapse Analytics with a suitable dedicated SQL pool

Synapse dedicated SQL pools supply allocated distributed warehouse processing within the broader SQL/Spark/pipeline platform. Serverless has different capabilities/cost. SQL Database alone does not provide that integrated environment, and Copy Activity moves data rather than supplies the warehouse serving engine. Source guide: PDF page 33-34.

This item is flagged for content review.

179. Analysts occasionally query eligible lake files and want data-scanning cost rather than permanently allocated warehouse compute. Which two choices should be evaluated? Select 2 answers.

Integration and analytics

A.Columnar formats and filter-aligned file partitioning to reduce scanned data
B.A dedicated pool solely because it always bills only bytes scanned
C.Unpartitioned row-oriented files as the guaranteed cheapest scan layout
D.Synapse serverless SQL if its capabilities meet the queries

✓ Correct answers

Columnar formats and filter-aligned file partitioning to reduce scanned data
Synapse serverless SQL if its capabilities meet the queries

Serverless SQL and efficient file layouts can fit occasional eligible queries. Dedicated capacity bills differently; unpartitioned row-oriented scans may process more data and are not guaranteed cheapest. Source guide: PDF page 34.

This item is flagged for content review.

180. A dedicated Synapse pool has expensive cross-node data movement during joins. What should the architect inspect before only increasing capacity?

Integration and analytics

A.Only ingestion schedule changes, assuming they fix every cross-node join
B.Table distribution, data movement, indexing, and query design
C.Only adding warehouse capacity, without examining distributed joins
D.Only the number of cataloged tables without inspecting data placement

✓ Correct answer

Table distribution, data movement, indexing, and query design

Distributed warehouse performance depends on table placement, movement, indexing, and queries. Catalog counts do not reveal the bottleneck. Capacity can help but may preserve inefficient data movement, and changing ingestion schedule does not automatically fix distributed join execution. Source guide: PDF page 34.

This item is flagged for content review.

181. Data engineers need a Spark ecosystem for scalable transformation, streaming, lakehouse tables, and data science. Which service is the strongest starting point?

Integration and analytics

A.Synapse dedicated SQL pool alone, without Spark or a separate engineering engine
B.Data Factory Copy Activity alone without a transformation engine
C.Azure Data Explorer chosen solely as a substitute for the required Spark engineering ecosystem
D.Azure Databricks

✓ Correct answer

Azure Databricks

Databricks supplies the requested Spark/lakehouse engineering environment. A dedicated SQL pool alone is a warehouse SQL engine; ADX focuses on KQL event exploration rather than supplying the stated Spark ecosystem. Copy Activity moves data and does not replace the required transformation/engineering engine. Source guide: PDF page 33.

This item is flagged for content review.

182. An organization wants integrated SaaS analytics around OneLake and Power BI. Which recommendation includes the necessary design caveat?

Integration and analytics

A.Assume every Fabric Data Factory feature is identical to Azure Data Factory
B.Choose Fabric and assume it automatically migrates all Azure data services unchanged
C.Evaluate Microsoft Fabric, including capacity, tenant governance, identity, residency, and workload support
D.Use OneLake as proof that no transformation or quality design is needed

✓ Correct answer

Evaluate Microsoft Fabric, including capacity, tenant governance, identity, residency, and workload support

Fabric's integrated model fits but capacity/governance and compatibility still matter. Integration does not eliminate migration, data-quality, or platform feature differences. Source guide: PDF page 33-34.

This item is flagged for content review.

183. A telemetry team needs fast interactive exploration and aggregation of high-volume time-series events with KQL. Which platform is the strongest starting point?

Integration and analytics

A.Azure Data Explorer
B.Azure SQL Managed Instance selected solely for instance compatibility without checking telemetry analysis requirements
C.Azure Stream Analytics alone as the long-term interactive KQL serving store
D.Synapse dedicated SQL pool chosen without evaluating KQL event-exploration needs

✓ Correct answer

Azure Data Explorer

ADX targets interactive telemetry/log/time-series analytics using KQL. SQL instance compatibility and warehouse capacity alone do not match the stated KQL exploration requirement. Stream Analytics processes supported streams, but is not itself the durable interactive KQL event-serving store. Source guide: PDF page 34.

This item is flagged for content review.

184. A manufacturer needs daily reconciled finance reports and a machine-failure dashboard updated within seconds. Which design is most appropriate?

Integration and analytics

A.Purview cataloging as a replacement for both ingestion paths
B.Separate freshness-appropriate batch and event-streaming paths, with governed raw replay and validated curated outputs
C.Only nightly copying for both because reports and telemetry have identical freshness needs
D.Only a fast broker feed as the financial system of record without validation

✓ Correct answer

Separate freshness-appropriate batch and event-streaming paths, with governed raw replay and validated curated outputs

Different freshness/correctness requirements justify batch finance and streaming telemetry, each with validation/serving. Nightly processing misses seconds freshness; broker arrival alone does not validate finance; a catalog is not ingestion. Source guide: PDF page 34-35.

This item is flagged for content review.

185. A streaming dashboard counts events per non-overlapping five-minute period using event time. Devices can send late or duplicate events. Which two choices are needed? Select 2 answers.

Integration and analytics

A.Define five-minute tumbling windows and a late-arrival policy
B.Use suitable checkpoints and idempotent output/event handling
C.Use sliding windows while claiming each event belongs to exactly one non-overlapping interval
D.Promise end-to-end exactly-once effects solely because one component has strong delivery semantics

✓ Correct answers

Define five-minute tumbling windows and a late-arrival policy
Use suitable checkpoints and idempotent output/event handling

Tumbling windows form non-overlapping intervals; late events and replay need explicit correctness policies. Sliding windows are moving intervals. Strong component delivery does not by itself prevent all downstream duplicate business effects. Source guide: PDF page 34.

This item is flagged for content review.

186. A data catalog must show sensitive-field classification and trace changed source columns into reports. Which recommendation fits while preserving access control?

Integration and analytics

A.Purview catalog membership automatically authorizes every source query
B.Lake file ACLs alone as the source-to-report lineage and classification system
C.Pipeline execution logs alone without data classification, glossary, or catalog lineage
D.Microsoft Purview for discovery/classification/lineage, with source and analytical permissions configured separately

✓ Correct answer

Microsoft Purview for discovery/classification/lineage, with source and analytical permissions configured separately

Purview supports governance/discovery/classification/lineage, while underlying authorization remains separate. Membership is not universal data permission. Execution logs and file ACLs are useful operational/security controls but do not alone provide the requested governed classification and source-to-report lineage. Source guide: PDF page 34.

This item is flagged for content review.

187. A pipeline can authenticate to an Azure data source, but access is blocked by its private-network configuration. What best addresses the failure?

Integration and analytics

A.Select supported runtime/private connectivity options and verify routes, DNS, and firewall reachability
B.Increase warehouse compute even though the connection cannot reach the source
C.Rotate valid credentials repeatedly because authentication necessarily creates private routes
D.Disable pipeline checkpoints because they control all firewall traffic

✓ Correct answer

Select supported runtime/private connectivity options and verify routes, DNS, and firewall reachability

Network execution/connectivity must fit the source. Credentials establish identity rather than routes; warehouse capacity and checkpoints do not solve source reachability. Source guide: PDF page 33.

This item is flagged for content review.

188. A service fails at 14:00. The last usable recovery point is 13:52, and customers can complete transactions again at 14:41. What are its realized recovery metrics?

Backup and disaster recovery

A.Forty-one-minute data gap and eight-minute recovery duration
B.Eight-minute data gap and forty-one-minute recovery duration
C.Zero data gap because a recovery point exists
D.Fifty-two-minute data gap and fourteen-hour recovery duration

✓ Correct answer

Eight-minute data gap and forty-one-minute recovery duration

Data gap is incident minus usable point: eight minutes. Recovery duration is restored business service minus incident: forty-one minutes. Reversing the metrics confuses RPO/RTO; the clock minute itself is not an interval, and a point's existence does not imply zero loss. Source guide: PDF page 36.

This item is flagged for content review.

189. A payments system has a five-minute RPO. Its only protection is one successful backup each hour. Which conclusion is accurate?

Backup and disaster recovery

A.RPO only measures VM startup duration
B.The schedule always meets it because restores start within five minutes
C.The schedule alone cannot meet the five-minute objective because almost an hour of changes can be lost
D.One retained hourly point guarantees every transaction exists on a secondary

✓ Correct answer

The schedule alone cannot meet the five-minute objective because almost an hour of changes can be lost

Worst-case usable-point age can approach an hour, exceeding the five-minute data-loss objective. Restore start/VM startup relates to recovery time, not data gap, and an hourly point cannot contain all later writes. Source guide: PDF page 36.

This item is flagged for content review.

190. A recovery drill boots VMs in twelve minutes, then database replay takes eighteen minutes and identity/DNS/validation takes fifteen more. The business RTO is thirty minutes. What is the correct assessment?

Backup and disaster recovery

A.The RTO is twelve minutes minus eighteen minutes
B.The RTO is met because only VM boot counts
C.The sequential forty-five-minute recovery exceeds the RTO despite fast VM boot
D.The RPO is forty-five minutes because each dependency contributes downtime

✓ Correct answer

The sequential forty-five-minute recovery exceeds the RTO despite fast VM boot

For the stated sequential process, 12+18+15=45 minutes to business recovery. RTO includes dependencies and validation. These elapsed recovery steps do not establish a data-loss gap, and subtracting required work is invalid. Source guide: PDF page 36.

This item is flagged for content review.

191. An administrator can delete production data and existing backups under one identity. The design must reduce destructive compromise risk. Which two controls should be assessed? Select 2 answers.

Backup and disaster recovery

A.Give the same identity unrestricted control of Resource Guard and the vault
B.Retained recovery points protected with supported immutability and least-privilege backup administration
C.Rely only on more backup administrators sharing the same unrestricted credentials
D.Resource Guard multiuser authorization controlled independently from the vault administrator

✓ Correct answers

Retained recovery points protected with supported immutability and least-privilege backup administration
Resource Guard multiuser authorization controlled independently from the vault administrator

Protected retained points and independent critical-operation authorization reduce a single identity's destructive reach. Shared unrestricted guard/vault ownership collapses separation, and more administrators using the same powerful credential do not create an independent permission boundary. Source guide: PDF page 36-37.

This item is flagged for content review.

192. A supported Recovery Services vault uses geo-redundant backup storage. A proposal assumes every workload can be restored immediately in any secondary region. What should be checked?

Backup and disaster recovery

A.Only whether the vault is GRS, assuming that guarantees every workload's immediate regional restore
B.Only the restore target's resource-group location, assuming any location is permitted
C.Only whether the primary VM backup job succeeded, without testing secondary restore support
D.Workload-specific Cross Region Restore support, actual region behavior, and configured vault settings

✓ Correct answer

Workload-specific Cross Region Restore support, actual region behavior, and configured vault settings

Vault/workload support and configured regional restore capabilities determine accessibility. GRS alone does not supply universal immediate arbitrary-region restore. Primary job success or choosing a resource-group location does not prove support for the desired secondary-region operation. Source guide: PDF page 37.

This item is flagged for content review.

193. A vault soft-delete policy retains deleted backup data for fourteen days. The team expects it to protect against an unnoticed deletion discovered a year later. What is the design gap?

Backup and disaster recovery

A.A storage redundancy change extends every soft-delete window to a year
B.Detection and recovery must occur within the retention window; choose suitable retention and complementary protected points
C.Resource Guard automatically reconstructs expired recovery points
D.Soft delete guarantees a permanent undeletable history regardless of its configured window

✓ Correct answer

Detection and recovery must occur within the retention window; choose suitable retention and complementary protected points

Soft delete is a time-limited undo mechanism and needs monitoring. It is not permanent immutability; Resource Guard authorizes critical operations rather than recreating expired points, and redundancy does not change this policy window. Source guide: PDF page 37.

This item is flagged for content review.

194. An Azure VM must be restorable as a whole machine or for selected disks/files, with retained historical points. Which primary protection should be planned?

Backup and disaster recovery

A.Supported Azure Backup VM protection with the required scope and consistency
B.MARS assumed to protect every Azure VM configuration identically
C.A Backup vault selected without checking whether it supports this VM workload
D.Site Recovery replication as the only history for every accidental deletion

✓ Correct answer

Supported Azure Backup VM protection with the required scope and consistency

Azure Backup VM protection targets retained supported VM/disk/file recovery and requires scope/consistency validation. Replication alone is not historical recovery. MARS is not a universal VM backup replacement, and vault support must be checked. Source guide: PDF page 36-38.

This item is flagged for content review.

195. A write-intensive application cannot rely on the recovery behavior of a sudden power-off snapshot. Which recovery-point type should be preferred where supported?

Backup and disaster recovery

A.Crash-consistent points assumed always identical to application-consistent points
B.Application-consistent points coordinating the application's recoverable state
C.An OS-only image that excludes all data disks
D.A VM placement change that automatically validates database writes

✓ Correct answer

Application-consistent points coordinating the application's recoverable state

Application consistency coordinates eligible state. Crash consistency may need application log replay and is not equivalent. Excluding business disks omits data; placement is fault isolation rather than validation of recovery state. Source guide: PDF page 37-38.

This item is flagged for content review.

196. A stateless web OS is rebuilt with infrastructure as code, but orders are stored on an unprotected data disk. Which two changes are needed? Select 2 answers.

Backup and disaster recovery

A.Keep the data disk temporary because configuration is version-controlled
B.Assume redeploying the OS automatically recreates all customer orders
C.Retain a supported recovery mechanism for irreplaceable order data
D.Inventory/protect external state and dependencies needed to restore the business service

✓ Correct answers

Retain a supported recovery mechanism for irreplaceable order data
Inventory/protect external state and dependencies needed to restore the business service

IaC rebuilds configuration/compute, while business data and dependencies need independent protection. Versioned configuration does not recreate missing records, and temporary storage is unsuitable for the sole durable order copy. Source guide: PDF page 38.

This item is flagged for content review.

197. On-premises Windows files need supported cloud backup, while another hybrid server needs broader application-aware protection. Which tool mapping should be evaluated?

Backup and disaster recovery

A.Azure SQL PITR as a file-agent replacement on both machines
B.Azure File Sync alone as an independent historical backup of every application
C.MARS for eligible Windows files/folders and MABS or DPM for the broader supported workload
D.MARS for every Linux application and all whole-server recovery cases

✓ Correct answer

MARS for eligible Windows files/folders and MABS or DPM for the broader supported workload

MARS has eligible Windows file/folder scope; MABS/DPM cover broader supported workloads with their own operation requirements. SQL PITR protects SQL PaaS data, and synchronization alone does not preserve all application history. Source guide: PDF page 37-38.

This item is flagged for content review.

198. A Kubernetes team backs up only worker VM OS images. It must reconstruct its application after state loss. Which two additional scopes should be assessed? Select 2 answers.

Backup and disaster recovery

A.Only load-balancer health probes because they archive all persistent data
B.Only node count because images contain every Kubernetes resource automatically
C.External secrets, databases, and state dependencies
D.Cluster/application resources and supported persistent volumes

✓ Correct answers

External secrets, databases, and state dependencies
Cluster/application resources and supported persistent volumes

Application resources/persistent volumes plus external state are needed. Worker OS images do not automatically contain the full application definition/history, and probes determine health rather than retain data. Source guide: PDF page 38.

This item is flagged for content review.

199. A physical Linux server is replicated to Azure with a supported Site Recovery configuration. Management assumes failback returns directly to its original physical hardware. What should the runbook state?

Backup and disaster recovery

A.The documented physical-source failback target is a supported VMware VM, with the correct source-specific procedure
B.Use any generic VM-source failback runbook without checking physical-source support
C.Failback universally restores the original physical hardware unchanged
D.Treat a successful Azure VM boot as proof that the original physical failback target is supported

✓ Correct answer

The documented physical-source failback target is a supported VMware VM, with the correct source-specific procedure

Physical-source failback has the documented VMware target restriction. Source platforms have distinct flows, so a generic VM-source procedure cannot be assumed applicable. Successful boot in Azure does not prove support for returning to original physical hardware. Source guide: PDF page 38.

This item is flagged for content review.

200. A SQL Database user deletes important rows. Regional replicas contain the same deletion. Which mechanism directly supports recovering the earlier state?

Backup and disaster recovery

A.Disabling TDE to generate a historical row timeline
B.A forced failover that is guaranteed to exclude logical deletes
C.Restoring an arbitrary guest OS image of the SQL PaaS service
D.Native PITR to a retained pre-delete point, followed by validation and reconnection

✓ Correct answer

Native PITR to a retained pre-delete point, followed by validation and reconnection

PITR uses retained native SQL backups to recover an earlier/new database. Current replicas can contain the delete. SQL PaaS is not a guest VM backup target, and TDE does not generate deleted rows. Source guide: PDF page 38-39.

This item is flagged for content review.

201. A SQL Database must retain selected full backups for seven years for compliance. Its operational PITR window is thirty-five days. Which recommendation meets the distinct retention need?

Backup and disaster recovery

A.Rely on a read-only replica as immutable backup history
B.Configure supported long-term retention in addition to short-term PITR
C.Use a failover group as a seven-year historical backup store
D.Increase PITR to seven years because all short-term windows permit it

✓ Correct answer

Configure supported long-term retention in addition to short-term PITR

LTR supports selected backups up to ten years, separate from short-term PITR. Current replicas/failover groups maintain current state rather than years of independent historical backups, and ordinary PITR does not span seven years. Source guide: PDF page 38.

This item is flagged for content review.

202. SQL Server on an Azure VM needs selected-time recovery with no more than fifteen minutes of lost updates under the backup design. Which two measures should be planned? Select 2 answers.

Backup and disaster recovery

A.Only a weekly OS-disk snapshot without database logs
B.Use read-scale replica routing as proof every historical restore time exists
C.Frequent successful log backups and a valid restorable log chain matching the required RPO
D.Supported workload-aware full/differential/log backups or a correctly operated native SQL plan

✓ Correct answers

Frequent successful log backups and a valid restorable log chain matching the required RPO
Supported workload-aware full/differential/log backups or a correctly operated native SQL plan

Baseline/differential/log chains enable workload-aware selected-time restore; frequent successful logs support the intended gap. An OS snapshot excludes the precise chain, and routing reports to replicas provides no historical timeline. Source guide: PDF page 38-39.

This item is flagged for content review.

203. A SQL native backup plan has a full baseline, a later differential, and several transaction logs. One required log segment is missing. What is the correct recovery consideration?

Backup and disaster recovery

A.Only the newest VM snapshot proves every selected-time database restore is possible
B.Differential backups contain every change since the last log regardless of baseline
C.Any later log can always be applied directly to an empty database
D.Restore precision depends on a valid applicable baseline/differential/log chain; a missing required segment can limit the target time

✓ Correct answer

Restore precision depends on a valid applicable baseline/differential/log chain; a missing required segment can limit the target time

A valid chain determines reachable points. Logs require the proper database chain rather than an empty baseline; a differential relates to its full baseline. VM snapshots are different from proving SQL log continuity. Source guide: PDF page 39.

This item is flagged for content review.

204. A Cosmos account has excellent multiregion availability, but the team must undo accidental document deletion from an earlier retained time. Which two actions support this? Select 2 answers.

Backup and disaster recovery

A.Check the latest restorable timestamp and whether the intended restore is account-level or selected data
B.Evaluate continuous backup/PITR under the selected retention tier and API support
C.Assume adding regions creates a historical version for every deleted document forever
D.Copy SQL Database Basic retention limits directly to Cosmos

✓ Correct answers

Check the latest restorable timestamp and whether the intended restore is account-level or selected data
Evaluate continuous backup/PITR under the selected retention tier and API support

Cosmos continuous backup has specific retention, API, and restore scope/timestamp details. Regional current-state copies are not a permanent history, and SQL product limits cannot be transferred without verification. Source guide: PDF page 39.

This item is flagged for content review.

205. An Azure SQL service needs a faster regional recovery path than restoring a full geographically replicated backup. Some potential recent-write loss is acceptable during forced failover. Which design should be evaluated?

Backup and disaster recovery

A.Geo-restore assumed always instantaneous with zero data gap
B.MARS file backup as the native SQL Database failover engine
C.A supported ready geographic database secondary or failover group alongside retained backups
D.TDE alone as a ready database in another region

✓ Correct answer

A supported ready geographic database secondary or failover group alongside retained backups

A ready secondary can reduce activation work compared with geo-restore, while asynchronous forced failover can lose recent writes and backups preserve history. TDE and MARS do not supply SQL PaaS regional replication. Source guide: PDF page 38-39.

This item is flagged for content review.

206. A PostgreSQL flexible server must recover from regional loss. Which two options should be assessed under current support? Select 2 answers.

Backup and disaster recovery

A.A supported cross-region read replica with a tested promotion/connection plan
B.SQL Managed Instance Hyperscale as an identical PostgreSQL backup tier
C.Geo-redundant native backups and their restore characteristics
D.The local synchronous HA standby assumed to reside automatically in another region

✓ Correct answers

A supported cross-region read replica with a tested promotion/connection plan
Geo-redundant native backups and their restore characteristics

Supported geo backups and cross-region replicas provide distinct regional RPO/RTO options. Local HA is a different failure boundary, and SQL product tiers do not supply PostgreSQL compatibility. Source guide: PDF page 39.

This item is flagged for content review.

207. Eligible block blobs need a protected recovery copy that survives deletion of the entire source storage account. Which approach fits?

Backup and disaster recovery

A.Vaulted Blob backup into a Backup vault with a supported policy and configuration
B.GRS alone as an independent protected history immune to every account deletion
C.Operational source-account Blob PITR alone
D.Additional versions stored only inside the account being deleted

✓ Correct answer

Vaulted Blob backup into a Backup vault with a supported policy and configuration

Vaulted backup retains eligible offsite protected data. Operational PITR and source-only versions reside in the source account; redundancy is not independent historical protection against every destructive account event. Source guide: PDF page 39.

This item is flagged for content review.

208. An existing supported operational Blob backup policy offers local point-in-time recovery. What is true about where the protected data resides?

Backup and disaster recovery

A.It automatically protects every deleted storage account without a separate retained copy
B.Its operational label guarantees every byte is stored in an isolated Backup vault
C.It uses source-account capabilities and does not transfer the backup data into vault storage
D.It supplies identical ordinary block-blob PITR for all HNS accounts

✓ Correct answer

It uses source-account capabilities and does not transfer the backup data into vault storage

Operational protection relies on source-account PITR/versioning/soft-delete/change-feed, so it is not an isolated vaulted copy. Account deletion and HNS compatibility need distinct protection checks. This item concerns an existing policy, avoiding assumptions about current new-policy creation options. Source guide: PDF page 37-39.

This item is flagged for content review.

209. A Blob recovery plan covers eligible flat-namespace block blobs but is being reused for an HNS analytics lake without assessment. Which two checks are essential? Select 2 answers.

Backup and disaster recovery

A.Verify namespace/account/blob-type/tier support for the selected backup or restore method
B.Treat path ACLs as retained copies of overwritten file contents
C.Design a supported alternative where ordinary block-blob PITR is unavailable for HNS
D.Assume every operational and vaulted method has identical support

✓ Correct answers

Verify namespace/account/blob-type/tier support for the selected backup or restore method
Design a supported alternative where ordinary block-blob PITR is unavailable for HNS

Backup compatibility varies and ordinary block-blob PITR excludes HNS. Operational/vaulted methods are not identical, and ACLs control access rather than retain historical data. Source guide: PDF page 39.

This item is flagged for content review.

210. An Azure Files application needs recovery from accidental overwrites and zone failure. Which design combines appropriate mechanisms?

Backup and disaster recovery

A.ZRS alone as a timeline of every overwritten version
B.Supported snapshots/backup for earlier good files plus supported ZRS for zone resilience
C.Blob archive as a drop-in SMB high-availability mechanism
D.File Sync alone because synchronized bad changes are independent backups

✓ Correct answer

Supported snapshots/backup for earlier good files plus supported ZRS for zone resilience

History and fault-boundary resilience solve distinct incidents. ZRS and synchronization can copy bad current state; archive is offline object storage rather than equivalent SMB recovery. Source guide: PDF page 39.

This item is flagged for content review.

211. A regional Azure Files recovery proposal uses SSD shares with GRS and expects normal read access to a secondary share before failover. What is the appropriate correction?

Backup and disaster recovery

A.Use RA-GRS to make any Azure Files secondary normally readable
B.Accept it because every share supports every storage redundancy
C.Add a second File Sync endpoint and assume SSD geo-redundancy is now enabled
D.Choose a supported regional design because SSD shares do not support GRS/GZRS and Files secondary-read behavior differs from Blob

✓ Correct answer

Choose a supported regional design because SSD shares do not support GRS/GZRS and Files secondary-read behavior differs from Blob

The proposal combines unsupported SSD geo-redundancy and Files readable-secondary assumptions. RA naming does not create secondary Files access, and an endpoint does not alter the share redundancy support matrix. Source guide: PDF page 39.

This item is flagged for content review.

212. An eligible geo-redundant HDD Files share must fail over after the primary is unavailable. Which two runbook expectations are valid? Select 2 answers.

Backup and disaster recovery

A.Asynchronous replication can leave a data gap during unplanned failover
B.A readable Blob secondary means the Files share never needs its supported failover procedure
C.All recent acknowledged writes are guaranteed replicated synchronously across regions
D.Client sessions may need reconnection and the recovered application path must be validated

✓ Correct answers

Asynchronous replication can leave a data gap during unplanned failover
Client sessions may need reconnection and the recovered application path must be validated

Geographic replication can lag, and clients/application dependencies need supported recovery/reconnection. It is not synchronous zero-loss replication; Blob read-access semantics do not remove Files-specific failover behavior. Source guide: PDF page 39-42.

This item is flagged for content review.

213. A hybrid three-tier service will use Site Recovery. Replication is healthy but target DNS, identity, and network rules are missing. Which recovery-plan approach is appropriate?

Backup and disaster recovery

A.Prepare dependencies, recover database before dependent tiers, validate service, and use an isolated test failover to measure business RTO
B.Assume disk replication recreates every external permission and secret automatically
C.Fail over into the production network during every drill to create duplicate writers
D.Start every tier simultaneously and declare recovery when the first VM powers on

✓ Correct answer

Prepare dependencies, recover database before dependent tiers, validate service, and use an isolated test failover to measure business RTO

Prepared dependencies and ordered startup/validation make the service usable; isolated drills test this without interfering with production. Boot alone is insufficient, duplicate production writers are unsafe, and disk copies do not reconstruct all external state. Source guide: PDF page 38-39.

This item is flagged for content review.

214. A VM application must tolerate a full availability-zone outage within one region. Which starting architecture directly addresses that fault boundary?

High availability

A.Supported instances across zones with healthy routing, resilient state, and surviving capacity
B.One zonal VM with three redundant disks and no application replica
C.A region-pair selection assumed to deploy redundant workers automatically
D.Two VMs in one availability set assumed to span separate regions

✓ Correct answer

Supported instances across zones with healthy routing, resilient state, and surviving capacity

Deliberate zone spread and end-to-end dependencies address a zone failure. Sets distribute local fault/update domains rather than supplying a regional/zone-spanning application guarantee. Disk copies do not supply a replacement worker, and pairing deploys no app topology. Source guide: PDF page 40.

This item is flagged for content review.

215. Three zones each normally process up to 400 requests per second. Required load is 1,000 requests per second and one zone can fail. No scale-up occurs during the outage. What does the design lack?

High availability

A.Only a backup retention increase, because capacity is unrelated to HA
B.A smaller health-probe interval that automatically doubles worker capacity
C.At least 200 requests per second of additional surviving capacity across the remaining zones
D.Nothing, because three zones guarantee all workload capacity after any failure

✓ Correct answer

At least 200 requests per second of additional surviving capacity across the remaining zones

Two surviving zones offer 800 requests/s, below the required 1,000 by 200. Zone count alone does not prove capacity. Backup retention and probes do not supply the missing processing resources. Source guide: PDF page 40.

This item is flagged for content review.

216. VM Scale Set workers can be replaced, but user sessions are stored only in each worker's local memory. Which two design choices improve service continuity? Select 2 answers.

High availability

A.Route requests to healthy workers using a suitable frontend and probes
B.Treat additional worker count as a replacement for state durability
C.Externalize or deliberately replicate state in a resilient service
D.Assume the scale set automatically reconstructs every lost in-memory session

✓ Correct answers

Route requests to healthy workers using a suitable frontend and probes
Externalize or deliberately replicate state in a resilient service

Resilient state and healthy routing enable replacement workers to serve correctly. A scale set does not reconstruct arbitrary memory; extra stateless capacity alone does not retain sessions. Source guide: PDF page 40.

This item is flagged for content review.

217. A team selected an App Service region with zones but never enabled zone redundancy or verified plan support. Which recommendation is appropriate?

High availability

A.Assume every resource in a zoned region is already zone-redundant
B.Enable backups only and treat a restore as an already running redundant instance
C.Scale up one zonal instance and assume additional cores provide zone isolation
D.Verify supported plan/region, enable zone redundancy, and size enough instances/surviving capacity

✓ Correct answer

Verify supported plan/region, enable zone redundancy, and size enough instances/surviving capacity

Zone resilience is configuration-specific and requires sufficient surviving capacity. Region capability does not automatically enable it; more cores on one zonal instance do not create zone isolation. Backup restores support recovery but are not an already serving redundant worker. Source guide: PDF page 40.

This item is flagged for content review.

218. An AKS application runs one pod on one node despite a resilient managed control plane. Which two changes address workload availability? Select 2 answers.

High availability

A.Rely only on control-plane resilience to recreate an immediately available second application instance
B.Configure useful health probes and plan resilient storage and capacity
C.Run suitable application replicas with deliberate supported node/zone placement
D.Use a pod disruption budget as a guarantee against every involuntary zone outage

✓ Correct answers

Configure useful health probes and plan resilient storage and capacity
Run suitable application replicas with deliberate supported node/zone placement

Replica placement, probes, storage, and capacity protect the workload. Managed control-plane availability does not make one pod redundant, and PDBs primarily govern eligible voluntary disruption rather than preventing infrastructure loss. Source guide: PDF page 40-41.

This item is flagged for content review.

219. During database failover, every web worker immediately retries indefinitely and clients create duplicate orders. Which behavior should be designed?

High availability

A.Unbounded synchronized retries to guarantee the fastest recovery
B.Bounded retries with exponential backoff/timeouts and idempotent order handling
C.Suppress all failures forever without a timeout or user-service metric
D.Treat each retried order as a new business transaction

✓ Correct answer

Bounded retries with exponential backoff/timeouts and idempotent order handling

Bounded backoff reduces overload while idempotency prevents repeated business effects. Unlimited synchronized retry can congest recovery; new-transaction retries duplicate orders, and hiding failures indefinitely prevents bounded service behavior. Source guide: PDF page 41.

This item is flagged for content review.

220. A simplified model requires both a web component available 99.9% and a database available 99.95%. Assume independent measured availability for this exercise. Which statement is valid?

High availability

A.The serial estimate is approximately 99.85%; real correlations and contractual SLA definitions limit the model
B.Multiply the values and treat the result as a contractual promise without examining definitions
C.Add the percentages to promise 199.85% application availability
D.Use the higher percentage as a guaranteed contractual application SLA

✓ Correct answer

The serial estimate is approximately 99.85%; real correlations and contractual SLA definitions limit the model

0.999×0.9995=0.9985005, about 99.85%. Required serial dependencies reduce the independent modeled availability. Addition and choosing the higher value are invalid; mathematical estimates alone do not create contractual guarantees. Source guide: PDF page 42.

This item is flagged for content review.

221. A SQL Database tier includes managed local availability, but the workload must survive a zone outage. Which two points should be verified? Select 2 answers.

High availability

A.Every configuration is zone-redundant merely because local HA is managed
B.A native backup restore is identical to a ready HA replica with no restore delay
C.The selected tier, region, hardware, and replica configuration support zone redundancy
D.Zone redundancy is actually enabled and the application's connectivity/retry behavior fits failover

✓ Correct answers

The selected tier, region, hardware, and replica configuration support zone redundancy
Zone redundancy is actually enabled and the application's connectivity/retry behavior fits failover

Managed local HA and supported enabled zone resilience are distinct. A backup restore requires recovery work, and local HA does not imply every tier/configuration is zone-redundant. Source guide: PDF page 41.

This item is flagged for content review.

222. A Managed Instance design relies on Next-gen General Purpose zone redundancy with no feature-status or underlying storage check. What should be corrected?

High availability

A.Choose SQL Database Hyperscale as a Managed Instance tier without compatibility assessment
B.Treat a read-only reporting endpoint as proof every regional dependency is protected
C.Assume all Managed Instance General Purpose generations have identical generally available zone support
D.Check its preview status and documented dependency on supported Elastic SAN ZRS availability before relying on the configuration

✓ Correct answer

Check its preview status and documented dependency on supported Elastic SAN ZRS availability before relying on the configuration

The guide specifically qualifies Next-gen General Purpose zone redundancy as preview with underlying support conditions. Product tiers/generations differ, and reporting access does not establish zone/regional protection for all dependencies. Source guide: PDF page 41.

This item is flagged for content review.

223. Two SQL Server VMs are placed in an availability set, but no database replication or failover topology is configured. Which design work remains?

High availability

A.Only read routing because current replicas already exist automatically
B.Configure a supported availability group or failover-cluster design with quorum, listener connectivity, synchronization, and testing
C.Only a scale-set autoscale rule because it copies SQL transactions
D.Nothing because an availability set automatically configures SQL data replication

✓ Correct answer

Configure a supported availability group or failover-cluster design with quorum, listener connectivity, synchronization, and testing

VM placement reduces certain infrastructure risks but does not create SQL HA topology. Availability groups/clusters and associated coordination/connectivity must be configured; scaling/routing alone does not replicate the database. Source guide: PDF page 41.

This item is flagged for content review.

224. A relational service needs no loss of committed transactions for covered local failovers and also a remote DR copy. Which two design statements are accurate? Select 2 answers.

High availability

A.A VM availability set alone ensures transaction-level synchronous replication
B.An asynchronous remote replica can support regional recovery with a potential recent-write data gap
C.Supported synchronous local replication can protect committed writes during covered failovers at coordination/latency cost
D.Every remote asynchronous replica guarantees zero data loss during forced failover

✓ Correct answers

An asynchronous remote replica can support regional recovery with a potential recent-write data gap
Supported synchronous local replication can protect committed writes during covered failovers at coordination/latency cost

Synchronous covered-local and asynchronous regional mechanisms have distinct guarantees. Geographic async writes can lag, and VM placement does not itself implement transaction replication. Source guide: PDF page 41.

This item is flagged for content review.

225. A PostgreSQL production server uses same-zone HA. It must now survive a whole zone outage. Which change should be evaluated?

High availability

A.Increase same-zone standby count while preserving the same zone failure boundary
B.Treat a PITR backup as automatic instantaneous zone failover
C.Supported zone-redundant HA separating primary and synchronous standby across zones
D.Use the HA standby as a normal report endpoint to create zone separation

✓ Correct answer

Supported zone-redundant HA separating primary and synchronous standby across zones

Cross-zone supported HA separates the relevant infrastructure boundary. More same-zone copies do not isolate the zone; standby reporting is not its role; backup restore is different from ready automatic HA. Source guide: PDF page 41.

This item is flagged for content review.

226. A PostgreSQL team routes reports to its synchronous HA standby and claims a cross-region replica is the same mechanism. What is the correct distinction?

High availability

A.Read replicas add synchronous primary write capacity automatically
B.HA standby serves supported synchronous availability; read replicas serve asynchronous eligible read scale and regional promotion needs its own plan
C.Both are always readable primary endpoints with identical automatic failover
D.The local HA standby guarantees regional recovery because it is warm

✓ Correct answer

HA standby serves supported synchronous availability; read replicas serve asynchronous eligible read scale and regional promotion needs its own plan

The HA standby is not the ordinary reporting replica, while asynchronous replicas have their own consistency/promotion behavior. Neither changes write capacity as described, and local HA does not automatically span a region outage. Source guide: PDF page 41.

This item is flagged for content review.

227. An SQL regional failover can be planned while both primary and secondary are healthy, or forced after the primary is unreachable. Which statement should the runbook reflect?

High availability

A.A supported planned failover can synchronize before switching; forced asynchronous failover may lose recent committed writes
B.Both methods universally guarantee no recent data loss because replication exists
C.Client retry behavior is unnecessary whenever the chosen method preserves committed data
D.Forced failover reconstructs deleted historical rows automatically

✓ Correct answer

A supported planned failover can synchronize before switching; forced asynchronous failover may lose recent committed writes

Synchronizing a planned transition differs from forcing an available async secondary when source changes may be missing. Neither operation inherently recovers pre-delete history. Connections can be interrupted even when committed writes survive. Source guide: PDF page 25,41.

This item is flagged for content review.

228. A Blob service must survive a primary-zone outage and also retain a geographic current copy. Which configuration directly combines those storage boundaries?

High availability

A.LRS because three local copies span every region
B.A legal hold alone because it deploys a second region
C.Supported GZRS, with separate application regional routing/recovery
D.ZRS alone because every ZRS account has a geographic secondary

✓ Correct answer

Supported GZRS, with separate application regional routing/recovery

GZRS combines primary zone redundancy and asynchronous geographic replication. Application failover remains separate. LRS lacks geographic/zone spread, ZRS lacks a regional copy, and legal retention does not deploy replicas. Source guide: PDF page 41.

This item is flagged for content review.

229. A Blob application can read from an RA-GZRS secondary but also needs writes after a region outage. Which two points belong in its design? Select 2 answers.

High availability

A.Compute, endpoint/routing, identity, secrets, and supported data failover must be recovered together
B.RA-GZRS automatically turns every client connection into active-active writes
C.Normal secondary read access can expose older data and is not an independent writable primary
D.Secondary read access removes all need for historical backup protection

✓ Correct answers

Compute, endpoint/routing, identity, secrets, and supported data failover must be recovered together
Normal secondary read access can expose older data and is not an independent writable primary

RA secondary access is supported read-only with async lag, and end-to-end recovery includes every dependency. It does not create independent multiwriter behavior or historical backup retention. Source guide: PDF page 41.

This item is flagged for content review.

230. An Azure Files application must tolerate a zone outage and survive interrupted file sessions. What should be included?

High availability

A.RA-GRS assumed to provide a normal readable Files secondary share
B.LRS only, relying on client retries to replace zone copies
C.A storage key rotation as a guarantee no file session is ever interrupted
D.A compatible ZRS share plus reconnect behavior and sufficient surviving application/share performance

✓ Correct answer

A compatible ZRS share plus reconnect behavior and sufficient surviving application/share performance

Supported ZRS covers the zone boundary while clients/performance support real service continuity. Retries cannot add missing copies, Files secondary access differs from Blob, and key rotation does not guarantee session continuity. Source guide: PDF page 41-42.

This item is flagged for content review.

231. An HDD Azure Files share needs supported regional failover, while a proposed SSD share must use the same GRS design. Which conclusion is correct?

High availability

A.GRS/GZRS support is identical for every HDD and SSD share
B.Any read-access account option makes the SSD share geographically replicated
C.Evaluate supported geo-redundant HDD failover and a different compatible regional recovery design for SSD
D.File Sync removes every share-protocol and redundancy restriction

✓ Correct answer

Evaluate supported geo-redundant HDD failover and a different compatible regional recovery design for SSD

The guide separates supported HDD geo-failover from SSD lack of GRS/GZRS. Read-access naming and File Sync do not override share support restrictions. Source guide: PDF page 41-42.

This item is flagged for content review.

232. A Cosmos account must accept low-latency writes in multiple regions while concurrently updated records obey explicit business rules. Which two design actions are required? Select 2 answers.

High availability

A.Use strong consistency with multiple write regions without qualification
B.Select serverless because all serverless Cosmos accounts are multiregion
C.Verify per-region zone redundancy and SDK preferred-region/failover configuration
D.Choose supported multi-write topology/consistency and conflict-resolution behavior

✓ Correct answers

Verify per-region zone redundancy and SDK preferred-region/failover configuration
Choose supported multi-write topology/consistency and conflict-resolution behavior

Multi-write requires supported consistency/conflict handling and coordinated regional/SDK resilience. Strong is incompatible with multiple write regions and serverless is single-region under the documented model. Source guide: PDF page 42.

This item is flagged for content review.

233. Two Cosmos regions concurrently update the same account balance. A proposal uses last-write-wins and claims both financial changes are merged. What should change?

High availability

A.Accept the proposal because last-write-wins sums all concurrent balances
B.Add read-only regions and assume transaction scope becomes global
C.Use eventual consistency as a replacement for accounting conflict rules
D.Define supported business conflict/ownership logic because last-write-wins can discard one update instead of merging accounting effects

✓ Correct answer

Define supported business conflict/ownership logic because last-write-wins can discard one update instead of merging accounting effects

LWW selects a winning update; it is not an accounting merge. Business invariants require appropriate conflict/serialization/idempotency design. Read consistency and replica count do not supply missing merge semantics or arbitrary global transactions. Source guide: PDF page 31,42.

This item is flagged for content review.

234. A geographically distributed system can tolerate older reads but needs the documented ordering of a write sequence rather than a strict latest-value guarantee. Which Cosmos level should be evaluated?

High availability

A.Eventual claimed to guarantee a fixed freshness window and ordered observations
B.Consistent prefix under its documented semantics
C.Bounded staleness described as permission to reorder writes arbitrarily
D.Strong because every ordering requirement demands global latest-value reads

✓ Correct answer

Consistent prefix under its documented semantics

Consistent prefix addresses ordering without guaranteeing newest data. Strong supplies stricter latest-value behavior than requested. Eventual does not supply a fixed freshness bound, and bounded staleness is a bound rather than a license to reorder arbitrarily. Source guide: PDF page 31,42.

This item is flagged for content review.

235. An architecture uses a designated Azure region pair and claims application regional failover is automatic. Which two decisions still need explicit design? Select 2 answers.

High availability

A.Supported per-dependency replication/failover, data-residency destinations, and traffic routing
B.Assume pairing deploys and starts every secondary application component
C.Choose active-passive or active-active behavior with capacity and write/consistency implications
D.Assume all Azure regions have identical paired-region behavior

✓ Correct answers

Supported per-dependency replication/failover, data-residency destinations, and traffic routing
Choose active-passive or active-active behavior with capacity and write/consistency implications

Region pairing is service-specific and not universal application DR. Topology, capacity, destinations, and routing remain architectural choices. It neither deploys every dependency nor applies identically to all regions. Source guide: PDF page 42.

This item is flagged for content review.

236. A manufacturer must run an unchanged vendor application that installs a Windows service and requires local administrator access. Which compute choice best satisfies the constraint?

Compute design

A.Azure Virtual Machines
B.Azure Container Apps
C.Azure App Service
D.Azure Functions Flex Consumption

✓ Correct answer

Azure Virtual Machines

Virtual Machines provide guest OS administrator control and compatibility for the unchanged service. Flex Consumption abstracts the guest OS, Container Apps expects supported container packaging, and App Service supplies managed web hosting rather than an unrestricted Windows server. Source guide: PDF page(s) 43.

This item is flagged for content review.

237. A company has an unchanged payroll Windows service, a supported HTTP API, and thousands of independent nightly rendering jobs. Which approach is most appropriate?

Compute design

A.Host every component in Functions solely to obtain demand-based billing
B.Select a compute host separately for each component's execution and control requirements
C.Use one large VM because shared hardware always improves availability
D.Use AKS for all components because containers eliminate operating responsibilities

✓ Correct answer

Select a compute host separately for each component's execution and control requirements

Component-level design can combine a VM, managed web hosting, and Batch or suitable event compute. Functions cannot automatically satisfy arbitrary guest service requirements; one large VM concentrates failure and does not inherently improve availability; AKS does not remove workload or cluster operations and is not justified solely by packaging. Source guide: PDF page(s) 43, 48.

This item is flagged for content review.

238. A database performs small random reads. Its data disk supports 20,000 IOPS, but the VM aggregate limit is 8,000 IOPS. What should the architect investigate first?

Compute design

A.Increase disk IOPS to 40,000 while retaining the same VM
B.Move the database to the temporary disk for durability
C.Select a VM size with sufficient aggregate I/O capacity and validate the complete disk path
D.Use disk throughput in MB/s as the only sizing measure

✓ Correct answer

Select a VM size with sufficient aggregate I/O capacity and validate the complete disk path

The VM's aggregate IOPS cap can limit the disk path, so VM and disk sizing must be evaluated together. More disk IOPS cannot remove that VM cap, temporary storage is not durable business storage, and MB/s alone does not characterize small random I/O demand. Source guide: PDF page(s) 44.

This item is flagged for content review.

239. A stateless image-processing VM can be rebuilt completely from a controlled image. It needs fast reimaging and keeps results in Blob Storage. Which OS disk design fits?

Compute design

A.A supported ephemeral OS disk
B.A Premium SSD v2 OS disk
C.An Ultra Disk OS disk
D.The temporary disk as the only permanent output store

✓ Correct answer

A supported ephemeral OS disk

An ephemeral OS disk fits replaceable stateless instances whose state is external. Ultra Disk and Premium SSD v2 are data-disk options, not OS disks; storing the only output on temporary local storage contradicts durability. Source guide: PDF page(s) 44-45.

This item is flagged for content review.

240. A team requires data-disk capacity, IOPS, and throughput to be independently configured for a supported VM and region. Which disk is the strongest initial candidate?

Compute design

A.The VM temporary disk
B.Standard HDD OS disk
C.Ephemeral OS disk
D.Premium SSD v2

✓ Correct answer

Premium SSD v2

Premium SSD v2 permits independent capacity and performance configuration for supported data disks. Standard HDD does not meet that tunable-performance requirement, while ephemeral OS and temporary disks are local replaceable storage rather than this managed data-disk design. Source guide: PDF page(s) 45.

This item is flagged for content review.

241. An architect is validating a demanding transaction workload's disk configuration. Which two checks are necessary? Select 2 answers.

Compute design

A.Place recovery-critical data on temporary local storage
B.Treat IOPS and MB/s as interchangeable capacity measurements
C.Verify both the selected disk's limits and the VM's aggregate storage limits
D.Verify the data-disk type is supported for the selected VM, region, and zone
E.Assume all Premium disk variants can host an OS disk

✓ Correct answers

Verify both the selected disk's limits and the VM's aggregate storage limits
Verify the data-disk type is supported for the selected VM, region, and zone

Disk performance must fit both device and VM limits, and advanced disk availability has VM and location constraints. Premium SSD v2 cannot be assumed to support OS use; IOPS measures operation rate rather than transfer rate; temporary local storage is unsuitable for recovery-critical data. Source guide: PDF page(s) 44-45.

This item is flagged for content review.

242. Operators repeatedly hand-edit production VMs, and replacements behave differently. Which design most directly reduces this drift?

Compute design

A.Keep each VM's manual installation process undocumented
B.Build versioned images and distribute approved versions through Azure Compute Gallery
C.Use a mutable latest image tag while leaving manual edits outside source control
D.Rebuild replacements from whichever operator's local instructions are available

✓ Correct answer

Build versioned images and distribute approved versions through Azure Compute Gallery

A versioned image pipeline and Compute Gallery preserve approved configuration. Undocumented edits remain unrepeatable, a mutable image does not capture production's manual drift, and unversioned local instructions can create inconsistent replacements. Source guide: PDF page(s) 44.

This item is flagged for content review.

243. A worker fleet has low CPU but a growing work queue because each task spends time waiting on external I/O. Which autoscale signal best represents unmet demand?

Compute design

A.Queue depth or work items per worker, with downstream-aware concurrency limits
B.CPU utilization alone with no backlog monitoring
C.The worker instance count alone, regardless of pending work
D.Completed-task count alone, excluding pending work and age

✓ Correct answer

Queue depth or work items per worker, with downstream-aware concurrency limits

Queue depth measures unmet demand when workers are I/O-bound. CPU can miss this bottleneck, instance count describes allocation rather than backlog, and completed-task count alone can hide accumulating work. Scaling must still protect downstream capacity. Source guide: PDF page(s) 45.

This item is flagged for content review.

244. A VM scale set rapidly alternates between adding and removing workers. Which two adjustments address the instability? Select 2 answers.

Compute design

A.Remove the maximum count so every burst creates unlimited instances
B.Use appropriate metric aggregation windows and autoscale cooldowns
C.Set realistic minimum and maximum instance counts and validate threshold behavior
D.Scale in immediately whenever one worker has a brief low-CPU sample
E.Store all worker progress only in instance memory

✓ Correct answers

Use appropriate metric aggregation windows and autoscale cooldowns
Set realistic minimum and maximum instance counts and validate threshold behavior

Aggregation, cooldowns, and sensible bounds reduce reaction to transient samples and control capacity. Unbounded scaling risks cost and dependency overload, immediate scale-in encourages oscillation, and memory-only progress threatens durability rather than fixing control behavior. Source guide: PDF page(s) 45.

This item is flagged for content review.

245. A fleet needs standard Azure VM APIs, individual VM control, autoscaling, and supported Azure Backup integration. Which orchestration mode is the strongest candidate?

Compute design

A.Uniform orchestration because its child instances are always ordinary standalone VM resources
B.Flexible orchestration with autoscale ruled out by definition
C.An availability set because it automatically performs metric autoscale
D.Flexible VM scale-set orchestration

✓ Correct answer

Flexible VM scale-set orchestration

Flexible manages standard VMs and currently supports autoscale and standard VM integrations. Uniform uses scale-set child APIs and has different integration support; availability sets are placement constructs without metric autoscale; claiming Flexible cannot autoscale is outdated. Source guide: PDF page(s) 45.

This item is flagged for content review.

246. A team needs a large group of similar machines managed with a common VM profile and scale-set instance APIs. Which option most closely matches?

Compute design

A.A single availability set with automatic app-level load balancing
B.A single large VM with vertically scaled CPU
C.Uniform VM scale-set orchestration
D.Uncoordinated standalone VMs without a common scale-set profile

✓ Correct answer

Uniform VM scale-set orchestration

Uniform coordinates common-profile machines through scale-set APIs. Availability sets supply placement rather than fleet management and automatic app balancing, one large VM is not the fleet, and uncoordinated VMs lack the common profile. Source guide: PDF page(s) 45.

This item is flagged for content review.

247. Three equal-capacity zones each currently handle one third of application load. The application must sustain full load after one zone fails. Which design requirement follows?

Compute design

A.Provision headroom so surviving zones can absorb the failed zone's load
B.Treat three-zone placement as sufficient capacity regardless of utilization
C.Place all application data on each VM's temporary disk
D.Use scale-set placement as automatic cross-region replication

✓ Correct answer

Provision headroom so surviving zones can absorb the failed zone's load

Zone placement must be combined with enough healthy surviving compute and dependency capacity. Three zones alone do not create headroom, temporary disks are not a replicated durable data design, and a regional scale set does not add cross-region replication. Source guide: PDF page(s) 45.

This item is flagged for content review.

248. A DR deployment must have permission to allocate a supported SKU and assurance that hardware is secured in its target zone. Which two mechanisms address these separate needs? Select 2 answers.

Compute design

A.Verify regional and VM-family vCPU quota
B.Buy only a Reserved VM Instance discount
C.Create a successful supported on-demand capacity reservation
D.Assume a quota increase allocates physical machines
E.Use Spot VMs as an uninterrupted capacity guarantee

✓ Correct answers

Verify regional and VM-family vCPU quota
Create a successful supported on-demand capacity reservation

Quota supplies allocation permission and a successful capacity reservation secures supported physical capacity. Reserved VM Instances primarily discount billing, Spot can be evicted, and quota increases do not manufacture or reserve hardware. Source guide: PDF page(s) 45.

This item is flagged for content review.

249. A team buys a one-year Reserved VM Instance and expects guaranteed VM availability in a specific zone. What should the architect explain?

Compute design

A.The purchase prevents Spot eviction
B.The purchase increases every VM-family quota
C.A Reserved VM Instance guarantees all VM sizes in every zone
D.The purchase provides a billing discount; a separate supported capacity reservation is needed to secure capacity

✓ Correct answer

The purchase provides a billing discount; a separate supported capacity reservation is needed to secure capacity

A Reserved VM Instance is a price commitment rather than a hardware guarantee. It neither guarantees arbitrary SKUs nor changes all quotas, and it does not change Spot's eviction model. A capacity reservation addresses the separate capacity requirement. Source guide: PDF page(s) 45.

This item is flagged for content review.

250. Two web apps share one App Service plan. A staging load test slows production, and each app needs independent scaling. What should change?

Compute design

A.Add another deployment slot to the same plan and assume isolated CPU
B.Move the independently scaled workload to a separate App Service plan
C.Use per-app worker limits as guaranteed dedicated workers and independent plan autoscaling
D.Stop the staging app only during billing evaluation and assume plan charges stop

✓ Correct answer

Move the independently scaled workload to a separate App Service plan

Separate plans provide independent worker and scaling boundaries. Slots share plan compute, stopping an app generally does not stop plan charges, and per-app limits do not convert shared capacity into dedicated independent plans. Source guide: PDF page(s) 46.

This item is flagged for content review.

251. A staging deployment should be warmed before release, while its staging database connection string must stay in staging after a swap. Which feature meets the configuration requirement?

Compute design

A.Store the connection string only in a swapped application package
B.Assume every configuration setting is automatically slot-sticky
C.Mark the connection string as a slot setting
D.Use deployment slots as cross-region backup replicas

✓ Correct answer

Mark the connection string as a slot setting

Slot settings retain environment-specific values with their intended slot. Embedding the value in swapped content can move it to production, not every setting is automatically sticky, and deployment slots are live endpoints on shared regional plan capacity rather than cross-region recovery. Source guide: PDF page(s) 46.

This item is flagged for content review.

252. A supported Premium App Service plan uses zone redundancy and two workers. Per-app scaling limits the business app to one worker. What must the architect verify?

Compute design

A.Every app automatically runs a hot replica in every zone
B.Zone redundancy includes automatic database geo-replication
C.Exactly three plan instances are universally required regardless of current infrastructure
D.The app's actual placement and ability to run on surviving workers; plan redundancy does not prove a second hot app replica

✓ Correct answer

The app's actual placement and ability to run on surviving workers; plan redundancy does not prove a second hot app replica

The worker limit can prevent simultaneous hot application replicas even when plan workers are distributed. Plan zones do not guarantee every app's placement, the universal exactly-three rule is outdated, and compute placement does not geo-replicate databases. Source guide: PDF page(s) 46.

This item is flagged for content review.

253. A public App Service API must reach a private database, and a separate requirement now makes API ingress private. Which two controls address the directions? Select 2 answers.

Compute design

A.Attach a NAT Gateway and assume it rejects every API caller
B.Treat outbound VNet integration alone as private ingress
C.Use supported private endpoints or appropriate access restrictions to control inbound API access
D.Use VNet integration for outbound access to the private database
E.Replace the database identity permissions with a private route

✓ Correct answers

Use supported private endpoints or appropriate access restrictions to control inbound API access
Use VNet integration for outbound access to the private database

Outbound VNet integration and inbound private endpoints or restrictions solve distinct network directions. Integration alone does not privatize the web endpoint, NAT supplies outbound translation rather than API ingress policy, and network reachability does not replace database authorization. Source guide: PDF page(s) 46.

This item is flagged for content review.

254. A containerized API needs event scaling and versioned traffic shifts, but the team does not require Kubernetes APIs or custom controllers. Which host best fits?

Compute design

A.Azure Container Apps
B.Azure Container Registry as the execution platform
C.An availability set
D.AKS solely because the app is containerized

✓ Correct answer

Azure Container Apps

Container Apps supplies revisions and event scaling while abstracting cluster operations. AKS may work but adds control and responsibility not required here; Container Registry stores artifacts; an availability set provides VM placement rather than managed container release and scaling. Source guide: PDF page(s) 46-47.

This item is flagged for content review.

255. A container platform must run custom Kubernetes controllers and use Kubernetes APIs directly. Which host is appropriate?

Compute design

A.Azure Container Instances because container groups are a Kubernetes control plane
B.Azure Container Apps because it exposes full cluster APIs
C.Azure Kubernetes Service
D.Azure App Service because deployment slots are Kubernetes controllers

✓ Correct answer

Azure Kubernetes Service

AKS exposes Kubernetes control and ecosystem integration. Container Apps abstracts the underlying cluster, Container Instances offers container groups without a full Kubernetes platform, and App Service slots do not implement custom cluster controllers. Source guide: PDF page(s) 46-47.

This item is flagged for content review.

256. An operations script needs a short-lived container plus a sidecar sharing its lifecycle and network, without a rollout controller. Which service is a strong initial choice?

Compute design

A.AKS solely for this one-off group despite no Kubernetes requirements
B.Azure Container Instances
C.App Service slots used as an isolated container-group task scheduler
D.Azure Container Registry alone

✓ Correct answer

Azure Container Instances

Container Instances fits a simple short-lived group with shared lifecycle and networking. Registry does not execute images, AKS adds cluster operations unjustified by this simple requirement, and web slots are release endpoints rather than isolated group task scheduling. Source guide: PDF page(s) 47.

This item is flagged for content review.

257. AKS increases pod replicas under load, but additional pods remain Pending because no nodes have room for their requests. Which two changes address the situation? Select 2 answers.

Compute design

A.Configure appropriate cluster autoscaling and available node capacity
B.Increase the deployment replica count indefinitely without adding schedulable capacity
C.Validate pod resource requests and limits against node capacity
D.Assume the managed control plane provides unlimited worker compute
E.Replace readiness probes with more permissive NSG rules

✓ Correct answers

Configure appropriate cluster autoscaling and available node capacity
Validate pod resource requests and limits against node capacity

Cluster autoscaling adds supported node capacity and sensible resource requests enable scheduling. More replicas alone cannot create nodes, NSG rules do not solve resource scheduling, and a managed control plane does not supply unlimited worker capacity. Source guide: PDF page(s) 46.

This item is flagged for content review.

258. An AKS application loses availability during rolling maintenance because it has one replica and no disruption controls. Which two measures most directly improve survivability? Select 2 answers.

Compute design

A.Run multiple healthy replicas with suitable topology spread
B.Use appropriate disruption budgets and readiness checks with sufficient replacement capacity
C.Keep all durable state only on one pod's local filesystem
D.Increase image tag mutability so nodes always pull an unreviewed latest build
E.Assume Kubernetes control-plane management protects every individual pod

✓ Correct answers

Run multiple healthy replicas with suitable topology spread
Use appropriate disruption budgets and readiness checks with sufficient replacement capacity

Replica diversity and controlled disruption with readiness and capacity improve maintenance tolerance. Local-only state can lose data, a managed control plane cannot protect a single pod from all failures, and mutable unreviewed images undermine release control. Source guide: PDF page(s) 46.

This item is flagged for content review.

259. Security finds a vulnerable library inside a deployed container image. Which lifecycle response is most appropriate?

Compute design

A.Rebuild and scan a corrected version, then deploy a controlled image digest or version
B.Grant every host anonymous access to private images
C.Treat Container Registry storage as proof that the image is secure
D.Patch each running container manually and retain the vulnerable source image

✓ Correct answer

Rebuild and scan a corrected version, then deploy a controlled image digest or version

A corrected, scanned, controlled image gives reproducible replacement of vulnerable code. In-place patches disappear on recreation and leave the source vulnerable, registry storage is not a security guarantee, and anonymous access weakens image protection rather than fixing dependencies. Source guide: PDF page(s) 46.

This item is flagged for content review.

260. A Container Apps API scales to zero overnight, but first-request startup delay violates its latency target. Which setting should be considered?

Compute design

A.A longer HTTP timeout while every revision still scales to zero
B.More traffic weight assigned to an inactive revision with zero instances
C.A longer revision termination grace period without keeping a replica running
D.A positive minimum replica count

✓ Correct answer

A positive minimum replica count

Minimum replicas maintain running capacity. Traffic weighting without a warm instance does not guarantee startup latency, termination grace concerns stopping instances, and a longer HTTP timeout tolerates delay rather than meeting the latency target. Source guide: PDF page(s) 46-47.

This item is flagged for content review.

261. A new variable-demand code workload needs serverless scaling and outbound VNet access. The runtime is supported on Flex Consumption. Which plan is a strong starting choice?

Compute design

A.A Dedicated plan solely because it automatically bills zero while idle
B.Legacy Consumption on the assumption that all plans have identical networking
C.Flex Consumption
D.Premium on the assumption that its minimum provisioned cost is zero

✓ Correct answer

Flex Consumption

Flex provides event-driven scale and outbound VNet integration for supported code workloads. Legacy Consumption has different limits, Dedicated allocates plan capacity, and Premium maintains a minimum provisioned cost. Plans must be selected by actual networking, latency, and billing needs. Source guide: PDF page(s) 47.

This item is flagged for content review.

262. A Functions workload requires supported custom Linux containers, private networking, and prewarmed capacity. Among the listed Functions plans, which is the strongest match?

Compute design

A.Legacy Consumption with unlimited synchronous request duration assumed
B.Premium
C.Free App Service with every Premium feature assumed
D.Flex Consumption with arbitrary custom container support assumed

✓ Correct answer

Premium

Premium supports prewarmed event-driven capacity and appropriate private networking and custom Linux containers. The Flex option incorrectly assumes arbitrary custom containers, legacy Consumption does not eliminate networking or HTTP duration limits, and a Free plan does not provide Premium capabilities. Source guide: PDF page(s) 47.

This item is flagged for content review.

263. A team hosts Functions in a Dedicated App Service plan and needs reliable continuous non-HTTP trigger processing. Which plan setting should it review?

Compute design

A.Always On
B.A longer HTTP execution timeout used as a non-HTTP host keep-alive
C.CPU autoscale alone while allowing the host to idle
D.A deployment-slot swap without continuous host configuration

✓ Correct answer

Always On

Always On keeps the dedicated host active when continuous triggers require it. CPU autoscale does not itself prevent host idle, execution duration controls invocations rather than host keep-alive, and slots promote releases rather than ensure continuous host operation. Source guide: PDF page(s) 47.

This item is flagged for content review.

264. A report takes twelve minutes. The client needs an immediate acknowledgement and later status, and the report must survive host replacement. Which two design choices fit? Select 2 answers.

Compute design

A.Switch to legacy Consumption and assume unlimited uninterrupted execution
B.Keep the original HTTP request open because a 30-minute execution setting removes all response limits
C.Keep report progress only in one function's memory
D.Return an accepted response with a status location
E.Queue the work or use a durable workflow with external progress state

✓ Correct answers

Return an accepted response with a status location
Queue the work or use a durable workflow with external progress state

Accepted/status semantics and queued or durable processing separate the request lifetime from long work and persist progress. A longer function execution setting does not remove the documented HTTP response limit, host memory is not durable, and legacy Consumption has a maximum execution duration rather than unlimited uninterrupted runtime. Source guide: PDF page(s) 47-48.

This item is flagged for content review.

265. A Durable Functions orchestrator makes a direct nondeterministic external API call during replay. Which change is most appropriate?

Compute design

A.Disable retries and assume history no longer replays
B.Move the external call into an activity and keep orchestration deterministic
C.Move every workflow record into process memory
D.Replace the call with a different random API inside the orchestrator

✓ Correct answer

Move the external call into an activity and keep orchestration deterministic

Activities are the appropriate place for external and nondeterministic work while deterministic orchestration replays recorded history. Process memory loses durability, disabling retries does not erase replay requirements, and changing to another random API preserves the same nondeterminism. Source guide: PDF page(s) 47.

This item is flagged for content review.

266. An approval process must wait days for a human response without holding an ordinary execution thread open. Which approach fits?

Compute design

A.An in-process cache used as the sole approval record
B.A legacy Consumption invocation sleeping until approval
C.A durable workflow waiting for an external approval event with persisted progress
D.A single synchronous HTTP request held for several days

✓ Correct answer

A durable workflow waiting for an external approval event with persisted progress

Durable orchestration can persist state and wait for external events without one continuous ordinary execution. Synchronous requests and sleeping legacy invocations exceed their lifetime constraints, while an in-process cache is not a durable approval record. Source guide: PDF page(s) 47.

This item is flagged for content review.

267. A Durable Functions activity charges a payment, then its response is lost and the activity retries. Which mechanism prevents a second charge most directly?

Compute design

A.A longer function timeout alone
B.Deterministic orchestrator code alone
C.A more expensive Functions plan alone
D.A stable payment idempotency key enforced by the payment operation

✓ Correct answer

A stable payment idempotency key enforced by the payment operation

Payment-side idempotency links retries to one intended business effect. Deterministic orchestration is necessary for replay but does not make external side effects exactly once; longer timeouts and larger plans do not close the response-loss duplication window. Source guide: PDF page(s) 47.

This item is flagged for content review.

268. An architect configures unbounded execution on a supported Premium Functions plan. Which two statements remain true? Select 2 answers.

Compute design

A.Legacy Consumption automatically gains the same configured maximum
B.Long user-facing HTTP work still needs to account for the documented 230-second response limit
C.Platform maintenance and scale-in can still impose documented interruption or grace-period behavior
D.Every HTTP request can remain open for the full workflow duration
E.Unbounded configuration guarantees an uninterrupted process forever

✓ Correct answers

Long user-facing HTTP work still needs to account for the documented 230-second response limit
Platform maintenance and scale-in can still impose documented interruption or grace-period behavior

Execution configuration does not remove host-lifecycle behavior or the HTTP path's response limit. Unbounded is not an uninterrupted-process guarantee, HTTP lifetime is distinct from workflow lifetime, and legacy Consumption retains different timeout limits. Source guide: PDF page(s) 47-48.

This item is flagged for content review.

269. A studio needs to schedule 40,000 independent render commands on a managed pool of compute nodes, stage inputs, and persist outputs. Which service is the strongest candidate?

Compute design

A.Azure Batch
B.One Container Instances group without external fleet orchestration
C.App Service web hosting alone without job scheduling
D.One legacy Consumption Function invocation executing all commands synchronously

✓ Correct answer

Azure Batch

Batch provides pools and parallel job/task scheduling. One legacy Consumption invocation has a limited lifetime and is not a fleet scheduler, web hosting alone lacks Batch scheduling, and one uncoordinated group does not schedule the parallel task fleet. Source guide: PDF page(s) 48.

This item is flagged for content review.

270. New Batch nodes need a controlled software preparation step before tasks run. Which Batch concept should be used?

Compute design

A.Only a job release task after completion
B.An autoscale formula that changes count but installs no software
C.A task dependency graph with no preparation action
D.A pool start task or controlled image/application package

✓ Correct answer

A pool start task or controlled image/application package

Start tasks and controlled images/packages prepare nodes. Job release runs after work, dependencies order tasks without supplying missing software, and autoscale changes capacity rather than installation. Source guide: PDF page(s) 48.

This item is flagged for content review.

271. A simulation has checkpointed retryable tasks, but a fixed deadline needs a reliable completion baseline. Which two decisions fit? Select 2 answers.

Compute design

A.Persist checkpoints and results in durable shared storage
B.Use dedicated nodes for baseline completion capacity and Spot nodes for additional retryable throughput
C.Use only Spot nodes and treat eviction as impossible after a reservation discount
D.Skip Batch and VM quotas because pool autoscale bypasses allocation limits
E.Keep checkpoints only on a node's temporary disk

✓ Correct answers

Persist checkpoints and results in durable shared storage
Use dedicated nodes for baseline completion capacity and Spot nodes for additional retryable throughput

A mixed pool combines reliable dedicated capacity with cheaper interruption-tolerant throughput, and external checkpoints support recovery. Spot can still be evicted, temporary-only checkpoints can disappear, and account or VM quotas can constrain pool growth. Source guide: PDF page(s) 48.

This item is flagged for content review.

272. An HPC team must preserve its existing scheduler and highly customized cluster topology while Azure provisions and scales nodes. Which direction fits?

Compute design

A.App Service deployment slots as MPI node allocation
B.Azure CycleCloud with the team operating its scheduler
C.Azure Batch on the assumption that it preserves every external scheduler unchanged
D.Azure Container Registry as a scheduler

✓ Correct answer

Azure CycleCloud with the team operating its scheduler

CycleCloud is intended for customized HPC infrastructure with a customer-operated scheduler. Batch has its own pool/job/task model and does not automatically preserve every external scheduler; a registry and web slots do not allocate the required HPC scheduler topology. Source guide: PDF page(s) 48.

This item is flagged for content review.

273. A research application uses tightly coupled MPI work across several nodes. Which Batch capability should be evaluated?

Compute design

A.A dependency graph waiting for separate single-node tasks to finish
B.Pool autoscale alone with ordinary single-node commands
C.Multi-instance tasks with compatible node, network, and coordination requirements
D.Independent single-node tasks without cross-node coordination

✓ Correct answer

Multi-instance tasks with compatible node, network, and coordination requirements

Multi-instance tasks coordinate supported tightly coupled MPI execution. Uncoordinated tasks, capacity autoscale alone, and completion dependencies between separate single-node commands do not supply simultaneous distributed execution and communication. Source guide: PDF page(s) 48.

This item is flagged for content review.

274. Each accepted order must be processed once logically by the fulfillment worker fleet, with work retained while workers are offline. Which messaging topology fits the competing-worker requirement?

Application architecture

A.A Service Bus queue with competing Peek Lock consumers
B.A separate topic subscription for every fulfillment worker so every worker creates a shipment
C.An Event Hubs consumer group for every worker so every worker replays each order
D.A synchronous call to every worker before accepting the order

✓ Correct answer

A Service Bus queue with competing Peek Lock consumers

A queue distributes one logical work stream among competing receivers and retains pending work. Separate subscriptions or independent Event Hubs groups give each worker a copy rather than dividing fulfillment, while synchronous calls couple acceptance to every worker's availability. Processing still needs idempotency for redelivery. Source guide: PDF page(s) 49-50.

This item is flagged for content review.

275. Billing, fulfillment, and analytics each need an independent copy of every OrderPlaced message, including after temporary outages. Which architecture fits?

Application architecture

A.One Service Bus queue with one competing consumer per department
B.One Queue Storage queue with all departments competing
C.A Service Bus topic with a subscription for each department
D.One Service Bus session that assigns each message to a random department

✓ Correct answer

A Service Bus topic with a subscription for each department

Topic subscriptions maintain independent copies and processing progress for each department. Competing consumers on one queue divide messages, so each department would miss orders; sessions manage related-message order and ownership rather than creating independent department copies. Source guide: PDF page(s) 50.

This item is flagged for content review.

276. A Service Bus worker must remove a message only after successful processing and allow another attempt after a crash. Which receive mode fits?

Application architecture

A.Peek Lock followed by Complete before the database operation
B.Peek Lock followed by Complete after success
C.Receive and Delete before processing
D.Receive and Delete followed by an assumed broker rollback of SQL

✓ Correct answer

Peek Lock followed by Complete after success

Peek Lock preserves recoverability until the receiver completes the message. Receive and Delete removes at receipt, completing early can lose work on a later failure, and broker reception does not provide automatic rollback of external SQL writes. Source guide: PDF page(s) 50.

This item is flagged for content review.

277. A worker inserts an order, then crashes before completing its Service Bus message. Duplicate detection is enabled on the queue. Which change closes the remaining duplicate-order risk?

Application architecture

A.Assume message completion and the SQL insert already form a distributed transaction
B.Increase only the send-side duplicate-detection window
C.Use a new MessageId for each receive attempt
D.Enforce a stable business order ID with a database uniqueness constraint or transactional processed-message record

✓ Correct answer

Enforce a stable business order ID with a database uniqueness constraint or transactional processed-message record

Database-enforced business idempotency handles redelivery after a successful write and lost completion. Broker duplicate detection primarily suppresses duplicate sends within its window, a new ID does not recognize the existing effect, and arbitrary SQL plus message completion is not automatically one distributed transaction. Source guide: PDF page(s) 50.

This item is flagged for content review.

278. An account system requires ordered updates per account and independence between accounts. It must also avoid duplicate effects after redelivery. Which two measures fit? Select 2 answers.

Application architecture

A.Put all accounts into one session to maximize independent parallelism
B.Treat duplicate detection as guaranteed exactly-once external execution
C.Enforce idempotency using stable business identifiers
D.Use Receive and Delete to recover automatically after consumer crashes
E.Assign related messages the same account-scoped SessionId

✓ Correct answers

Enforce idempotency using stable business identifiers
Assign related messages the same account-scoped SessionId

Account-scoped sessions provide the required local ordering, and idempotency protects repeated business processing. One global session serializes unrelated accounts, duplicate detection does not guarantee external execution exactly once, and Receive and Delete loses the message before processing recovery is assured. Source guide: PDF page(s) 50-51.

This item is flagged for content review.

279. A delivery worker cannot process a malformed address and has exceeded allowed retries. What should the recovery design include?

Application architecture

A.Dead-letter the message, alert an owner, and provide controlled inspection and correction or replay
B.Delete every failed message immediately to preserve a zero queue count
C.Assume a dead-letter queue automatically repairs the address and fulfills the order
D.Retry forever with no alert because durable messaging guarantees eventual success

✓ Correct answer

Dead-letter the message, alert an owner, and provide controlled inspection and correction or replay

Dead-lettering retains failure evidence for a managed business recovery process. Endless retries waste capacity, immediate untracked deletion loses work, and the dead-letter queue does not repair invalid business data automatically. Source guide: PDF page(s) 51.

This item is flagged for content review.

280. A worker receives a valid message whose prerequisite record has not arrived. It needs to retrieve that same message later. Which mechanism is the best fit?

Application architecture

A.Receive and Delete with an assumption that the broker can restore the deleted message
B.Service Bus message deferral with retained retrieval information
C.An Event Hubs checkpoint advanced beyond the message
D.Service Bus scheduling of an entirely new message as the only possible approach

✓ Correct answer

Service Bus message deferral with retained retrieval information

Deferral retains a received message for later retrieval once prerequisites exist. Scheduling controls initial availability and is a distinct mechanism, Receive and Delete does not retain recoverable work, and advancing a stream checkpoint is not deferred Service Bus message retrieval. Source guide: PDF page(s) 51.

This item is flagged for content review.

281. An order database commits successfully, but a network outage prevents publication of its fulfillment message. Which pattern most directly prevents this lost-publication gap?

Application architecture

A.Wrap any SQL write inside a Service Bus transaction and assume distributed atomicity
B.Use a longer message TTL without recording pending publication
C.Commit the order and an outgoing-message record together, then dispatch the record reliably
D.Send the message first and assume the later SQL insert cannot fail

✓ Correct answer

Commit the order and an outgoing-message record together, then dispatch the record reliably

A transactional outbox atomically records business state and publication intent in the database, enabling later retries. Sending first can publish an order that never commits, broker transactions do not automatically include arbitrary SQL, and TTL does not preserve missing publication intent. Source guide: PDF page(s) 51.

This item is flagged for content review.

282. A simple Queue Storage worker repeatedly receives an invalid large-content work item. Which two design changes fit the service model? Select 2 answers.

Application architecture

A.Store large content in Blob Storage and queue a secure reference
B.Ignore encoding overhead when sizing messages
C.Assume Queue Storage has the same built-in dead-letter architecture as Service Bus
D.Enable Service Bus sessions directly on the Storage queue
E.Use dequeue count to move persistent failures into an application-managed poison queue

✓ Correct answers

Store large content in Blob Storage and queue a secure reference
Use dequeue count to move persistent failures into an application-managed poison queue

Poison handling and claim-check references fit Queue Storage's simpler model and payload limits. Storage queues do not expose Service Bus sessions or identical dead-letter infrastructure; encoding overhead can reduce the effective payload budget. Source guide: PDF page(s) 51-52.

This item is flagged for content review.

283. A new blob upload should trigger independent validation and indexing handlers. The handlers need the object's location rather than its complete contents. Which service is the strongest candidate?

Application architecture

A.Azure Event Hubs solely to obtain guaranteed global event order
B.Azure API Management as a durable notification broker
C.Azure App Configuration
D.Azure Event Grid

✓ Correct answer

Azure Event Grid

Event Grid routes discrete change notifications to interested handlers, using references to source objects. Event Hubs targets retained high-volume streams and does not guarantee global order, APIM mediates API calls rather than durable event publication, and App Configuration manages settings. Source guide: PDF page(s) 49, 51.

This item is flagged for content review.

284. An Event Grid handler sometimes receives the same event twice and may receive later events first. Which two application measures are appropriate? Select 2 answers.

Application architecture

A.Assume changing retry duration creates strict publication order
B.Design state transitions to tolerate or reconcile out-of-order arrival
C.Acknowledge receipt before safely accepting any work
D.Use stable event IDs or business versions for idempotent processing
E.Put the full multi-gigabyte object into every event

✓ Correct answers

Design state transitions to tolerate or reconcile out-of-order arrival
Use stable event IDs or business versions for idempotent processing

Stable identifiers and order-aware state handling address at-least-once and non-guaranteed ordering. Retry duration does not create global order, early acknowledgment can lose work, and large objects should be referenced rather than embedded. Source guide: PDF page(s) 51.

This item is flagged for content review.

285. A consumer team must retrieve Event Grid events on demand and explicitly acknowledge or release them. Which current capability should be considered?

Application architecture

A.Event Grid push delivery with a consumer checkpoint assumed to control every webhook
B.APIM subscription keys as pull-message locks
C.Traffic Manager weighted DNS routing
D.Event Grid namespace pull delivery

✓ Correct answer

Event Grid namespace pull delivery

Event Grid namespaces support a pull model with receive and settlement operations. Ordinary push delivery is not the requested consumer-driven pull semantics, APIM keys identify subscriptions rather than event locks, and DNS routing does not consume events. Source guide: PDF page(s) 51.

This item is flagged for content review.

286. One million devices emit telemetry that real-time detection and historical analytics must read independently and replay after restart. Which two design elements fit? Select 2 answers.

Application architecture

A.Commit checkpoints before storing processing results
B.Use Event Grid delivery as an unlimited retained log
C.Assign independent applications separate consumer groups and checkpoint after durable processing
D.Use Event Hubs for retained partitioned telemetry
E.Use one Service Bus queue with all applications competing to ensure each gets every event

✓ Correct answers

Assign independent applications separate consumer groups and checkpoint after durable processing
Use Event Hubs for retained partitioned telemetry

Event Hubs supplies retained stream partitions and independent consumption views; checkpoints after durable work allow safe restart. Competing queue consumers divide messages, early checkpointing can skip unprocessed events, and Event Grid notifications are not an unlimited retained replay log. Source guide: PDF page(s) 51.

This item is flagged for content review.

287. An Event Hubs application has four useful partitions and forty consumers in one group, but throughput does not improve. What should the architect investigate?

Application architecture

A.Partition concurrency and uneven key distribution before adding more consumers
B.Whether Event Hubs automatically creates a new partition for every worker
C.Whether all groups share exactly one global checkpoint by definition
D.The number of APIM developer portal users

✓ Correct answer

Partition concurrency and uneven key distribution before adding more consumers

Partition ownership and hot keys constrain useful parallelism; extra consumers cannot automatically create partition capacity. Portal users are unrelated, independent groups do not share one global checkpoint by definition, and workers do not each cause an automatic partition. Source guide: PDF page(s) 51.

This item is flagged for content review.

288. A telemetry consumer records its checkpoint before committing the results to its database, then crashes. What is the principal risk?

Application architecture

A.The partition key automatically recreates missing database results
B.The checkpoint guarantees database rollback across services
C.Restart skips events that were marked complete but never durably processed
D.Event Hubs deletes all other consumer groups

✓ Correct answer

Restart skips events that were marked complete but never durably processed

An advanced checkpoint can cause restart to move beyond lost results. It is a recorded reading position rather than a distributed database transaction, does not delete independent consumer groups, and partition grouping does not rebuild uncommitted business results. Source guide: PDF page(s) 51.

This item is flagged for content review.

289. A team wants automatic copies of streamed telemetry in supported Blob or Data Lake storage for later batch analysis while retaining live processing. Which Event Hubs capability fits?

Application architecture

A.Service Bus duplicate detection
B.Capture, with separate monitoring of live consumer lag
C.App Configuration snapshots
D.Capture as a guarantee of transactional processing in every analytics database

✓ Correct answer

Capture, with separate monitoring of live consumer lag

Capture writes the stream to supported storage for archival and batch use, while live lag still needs monitoring. It does not make external analytics transactional; duplicate detection manages repeated broker sends and configuration snapshots store settings rather than telemetry. Source guide: PDF page(s) 51.

This item is flagged for content review.

290. Several APIs need one published contract, token validation, transformations, throttling, and a developer portal. Which service is the strongest fit?

Application architecture

A.Azure Front Door alone
B.Azure API Management
C.App Service deployment slots alone
D.Application Gateway v2 alone

✓ Correct answer

Azure API Management

APIM combines API publication, gateway policies, usage controls, and a developer portal. Front Door focuses on global web delivery, Application Gateway on regional HTTP routing and WAF, and slots on release staging; none alone supplies the requested API management capability set. Source guide: PDF page(s) 52.

This item is flagged for content review.

291. A gateway receives an unexpired Entra token issued for a different API. Which two checks are necessary before granting sensitive access? Select 2 answers.

Application architecture

A.Treat the APIM subscription key as the complete user identity
B.Remove backend authentication because token signature is valid
C.Validate required permissions or claims in addition to expiry
D.Validate the intended audience and trusted issuer
E.Accept any token signed by Entra regardless of audience

✓ Correct answers

Validate required permissions or claims in addition to expiry
Validate the intended audience and trusted issuer

Token validation must establish its intended API, issuer, lifetime, and authorization claims. A valid signature alone does not grant a different audience, subscription keys do not fully authenticate a sensitive user, and backend access remains protected. Source guide: PDF page(s) 52.

This item is flagged for content review.

292. An APIM gateway must call a supported Azure backend without long-lived embedded credentials. Which mechanism should it use?

Application architecture

A.Managed identity with appropriate backend authorization
B.A service tag as the backend user identity
C.A subscription key reused as every backend's Entra password
D.A public IP address as proof of application authorization

✓ Correct answer

Managed identity with appropriate backend authorization

A managed identity obtains supported backend credentials without embedded passwords and still needs permissions. Subscription keys do not become universal Entra passwords, service tags represent network prefixes, and public IP reachability is not identity authorization. Source guide: PDF page(s) 52.

This item is flagged for content review.

293. A production APIM gateway can remain public, but must call private VNet backends. Which listed tier and capability is an appropriate direction?

Application architecture

A.Premium v2 chosen solely because it guarantees all classic multiregion features
B.Consumption internal cache used as a private network tunnel
C.Standard v2 outbound VNet integration
D.Developer classic chosen for its guaranteed production SLA

✓ Correct answer

Standard v2 outbound VNet integration

Standard v2 outbound integration addresses private backend reachability while gateway ingress remains public. Developer lacks the production SLA, a cache is not a private tunnel, and Premium v2's name does not imply classic feature parity. Source guide: PDF page(s) 52.

This item is flagged for content review.

294. A hybrid architecture requires APIM's supported self-hosted gateway and built-in multiregion deployment. Which tier should be evaluated against the current matrix?

Application architecture

A.Developer classic as the supported built-in multiregion production tier
B.Standard v2 solely because outbound VNet integration means multiregion deployment
C.Premium v2 on the assumption that every classic feature is inherited
D.Premium classic

✓ Correct answer

Premium classic

Premium classic is the supported candidate for these classic capabilities. Premium v2 does not automatically include them, Developer is a non-production-SLA test tier rather than this multiregion production option, and private backend integration is distinct from multiregion deployment. Source guide: PDF page(s) 52.

This item is flagged for content review.

295. An API must limit short bursts to protect a backend and cap each customer's monthly usage allowance. Which two policy concepts fit? Select 2 answers.

Application architecture

A.DNS geographic routing
B.Longer-window usage quota
C.Short-window rate limiting
D.A longer Functions execution timeout
E.A mutable container image tag

✓ Correct answers

Longer-window usage quota
Short-window rate limiting

Rate limiting controls burst frequency and quota expresses longer usage allowance. Execution timeout controls processing lifetime, geographic DNS selects endpoints, and image tags select deployments rather than enforcing API consumption limits. Source guide: PDF page(s) 52.

This item is flagged for content review.

296. A team selects APIM Consumption and needs response caching. Which assumption must be corrected?

Application architecture

A.Consumption has no built-in internal cache; evaluate supported external caching
B.Changing API quotas creates an internal response cache
C.Configuring the developer portal implicitly enables internal Consumption response caching
D.Consumption automatically includes every classic cache behavior

✓ Correct answer

Consumption has no built-in internal cache; evaluate supported external caching

Consumption lacks built-in internal caching. Cache capabilities differ by tier, quotas govern usage rather than creating cache infrastructure, and a portal does not enable an unsupported gateway cache. Source guide: PDF page(s) 52-53.

This item is flagged for content review.

297. An application misses its catalog key in a distributed cache. It uses cache-aside. What should happen next?

Application architecture

A.Treat the miss as proof that the database row does not exist
B.Write a blank cached value permanently without reading the source
C.Move the authoritative database into process memory
D.Read the authoritative database, then cache the result with a suitable TTL

✓ Correct answer

Read the authoritative database, then cache the result with a suitable TTL

Cache-aside loads from the source on a miss and caches reusable data. A miss only describes cache state, a permanent blank can hide valid source data, and process memory is not a suitable durable authoritative replacement. Source guide: PDF page(s) 53.

This item is flagged for content review.

298. After a product price update, different application instances continue serving the old cached price beyond the allowed freshness window. Which change addresses this directly?

Application architecture

A.Treat an in-process cache on each instance as automatically synchronized
B.Invalidate or update affected distributed-cache entries after the database change
C.Add more web instances without changing invalidation
D.Increase cache TTL further

✓ Correct answer

Invalidate or update affected distributed-cache entries after the database change

Cache invalidation or update aligns the reusable copy with authoritative changes. More instances can create more stale local copies, a longer TTL extends staleness, and in-process caches are not automatically shared or synchronized. Source guide: PDF page(s) 53.

This item is flagged for content review.

299. APIM caches an authenticated user's account response using only the URL as a key. Another tenant receives that response. Which two measures address the design fault? Select 2 answers.

Application architecture

A.Cache only responses safe for the intended reuse scope and preserve authorization
B.Use a longer TTL to increase the chance of correct reuse
C.Vary cache keys by the relevant identity and tenant context
D.Treat all responses at one URL as interchangeable regardless of caller
E.Replace TLS with a service tag

✓ Correct answers

Cache only responses safe for the intended reuse scope and preserve authorization
Vary cache keys by the relevant identity and tenant context

Keys must include security-sensitive variation and only safely reusable data should be cached. Longer TTL prolongs disclosure, a network prefix tag does not supply confidentiality or identity, and identical URLs can produce different authorized data. Source guide: PDF page(s) 53.

This item is flagged for content review.

300. A new app requires a managed low-latency Redis-compatible distributed cache and wants to avoid retiring service dependencies. Which service should be evaluated first?

Application architecture

A.Azure Cache for Redis Basic with no migration plan
B.Azure Cache for Redis Enterprise as a new indefinite-lifetime service
C.Azure Managed Redis
D.App Configuration as a high-throughput Redis replacement

✓ Correct answer

Azure Managed Redis

Managed Redis is the current managed Redis direction. The legacy Basic and Enterprise families have announced retirement and creation restrictions that require migration planning, while App Configuration manages settings rather than serving as Redis-compatible data caching. Source guide: PDF page(s) 53.

This item is flagged for content review.

301. As of October 20, 2026, a qualifying existing tenant says Azure Cache for Redis Basic creation is universally blocked from October 1, 2026. What should the architect explain?

Application architecture

A.Every existing Basic cache was deleted on October 1, 2026
B.All tenant and cloud creation restrictions were removed permanently
C.Enterprise and Basic retire on the same day in 2027
D.The planned existing-customer block was removed in July 2026; evaluate Managed Redis and the actual tenant eligibility and retirement timeline

✓ Correct answer

The planned existing-customer block was removed in July 2026; evaluate Managed Redis and the actual tenant eligibility and retirement timeline

Current guidance removed the planned block for qualifying existing Basic/Standard/Premium customers while retaining tier-specific retirement and new-customer/cloud rules. It did not delete every cache in October 2026, Enterprise and Basic have different dates, and eligibility restrictions are not universally absent. Source guide: PDF page(s) 53.

This item is flagged for content review.

302. A cache restart causes thousands of simultaneous misses and overloads the database. Which two mitigations best address this failure mode? Select 2 answers.

Application architecture

A.Bound fallback concurrency to the database's sustainable capacity
B.Increase web replicas until every miss is a separate database request
C.Retain every value indefinitely without considering freshness or recovery of an empty cache
D.Allow unlimited parallel fallback queries because the cache is unavailable
E.Coalesce requests or stagger expiries and prewarm useful data

✓ Correct answers

Bound fallback concurrency to the database's sustainable capacity
Coalesce requests or stagger expiries and prewarm useful data

Coalescing, staggered expiry, prewarming, and bounded fallback limit a miss storm. Unlimited fallback and more independent requests increase pressure; indefinite retention ignores freshness and does not restore missing cache data after restart. Source guide: PDF page(s) 53.

This item is flagged for content review.

303. An application needs centrally managed settings and controlled feature enablement without redeploying code each time. Which service is the strongest fit?

Application architecture

A.Configuration JSON files baked independently into each container image
B.Azure App Configuration with providers and feature flags
C.Environment variables copied independently into each deployment package
D.Azure Key Vault used as the only general feature-management store

✓ Correct answer

Azure App Configuration with providers and feature flags

App Configuration centralizes settings and feature flags with supported refresh. Key Vault primarily protects secrets; independent deployment copies and image-baked files need releases and coordination rather than providing centralized code-independent enablement. Source guide: PDF page(s) 53.

This item is flagged for content review.

304. A release needs a named immutable set of selected App Configuration keys and labels for consistent rollback. Which feature fits?

Application architecture

A.A Service Bus delivery lock
B.An APIM subscription key
C.An App Configuration snapshot
D.A continually edited mutable key with no version record

✓ Correct answer

An App Configuration snapshot

A snapshot is an immutable selected configuration set suitable for repeatable release configuration. An unversioned mutable key cannot preserve the set, APIM subscription keys govern API subscription access, and a delivery lock controls message reception. Source guide: PDF page(s) 53.

This item is flagged for content review.

305. An app reads App Configuration successfully but cannot resolve its Key Vault secret reference. Which two facts should the architect verify? Select 2 answers.

Application architecture

A.The app can reach and resolve the Key Vault endpoint through the intended network path
B.A config reference stores the plaintext secret and therefore never needs Key Vault access
C.App Configuration read permission automatically grants secret read permission
D.The app identity has appropriate secret retrieval authorization in Key Vault
E.Feature flags are a substitute for Key Vault authorization

✓ Correct answers

The app can reach and resolve the Key Vault endpoint through the intended network path
The app identity has appropriate secret retrieval authorization in Key Vault

Secret references require both authorized Key Vault retrieval and a working network/DNS path. Configuration permissions are separate, feature flags do not authorize secrets, and a reference is not automatically an embedded plaintext value. Source guide: PDF page(s) 53.

This item is flagged for content review.

306. A team disables an admin feature flag and assumes users cannot call the corresponding API directly. What else is required?

Application architecture

A.Server-side authentication and authorization for the admin API
B.Moving the flag into an immutable snapshot as the sole permission check
C.Only hiding the navigation link
D.Only restricting who may edit the feature flag

✓ Correct answer

Server-side authentication and authorization for the admin API

Server authorization protects direct endpoint calls. Hiding navigation only affects presentation, flag-editor rights govern configuration modification rather than endpoint use, and a snapshot preserves values without granting caller permissions. Source guide: PDF page(s) 53.

This item is flagged for content review.

307. A team needs Azure-native reusable declarative modules that compile to ARM templates. Which tool matches?

Application architecture

A.An imperative Azure CLI script creating resources sequentially
B.Manual Azure portal deployment steps
C.Bicep
D.Terraform on the assumption that its state compiles to ARM templates

✓ Correct answer

Bicep

Bicep is the Azure-native declarative language compiling to ARM templates. Terraform uses provider/state semantics, while sequential CLI commands and manual portal steps are not the requested declarative module language. Source guide: PDF page(s) 54.

This item is flagged for content review.

308. Two engineers deploy shared Terraform-managed infrastructure. Their local state files diverge and may contain secrets. Which design change fits?

Application architecture

A.Replace state locking with a shorter DNS TTL
B.Use a secured shared remote state backend with locking
C.Commit plaintext state with credentials to a public repository
D.Give each engineer an independent uncoordinated state file for the same resources

✓ Correct answer

Use a secured shared remote state backend with locking

Secured shared state and locking coordinate resource tracking and protect sensitive content. Public plaintext state exposes secrets, divergent local state permits conflicting changes, and DNS TTL does not serialize infrastructure operations. Source guide: PDF page(s) 54.

This item is flagged for content review.

309. A release pipeline must avoid long-lived Azure secrets and make production artifacts traceable. Which two practices fit? Select 2 answers.

Application architecture

A.Store a permanent administrator password in every pipeline variable group
B.Treat a successful ARM deployment as the only user-path health check
C.Rebuild from an unpinned branch separately in each environment
D.Use supported workload identity federation or managed identity for deployment authentication
E.Build once and promote the same immutable artifact through validated environments

✓ Correct answers

Use supported workload identity federation or managed identity for deployment authentication
Build once and promote the same immutable artifact through validated environments

Federated or managed identity reduces embedded credentials, and one immutable artifact preserves release identity. Rebuilding creates unverified differences, permanent admin credentials increase exposure, and infrastructure success does not prove application behavior. Source guide: PDF page(s) 54.

This item is flagged for content review.

310. A new API release should initially serve 5% of requests while its behavior is measured, then expand gradually. Which release pattern fits?

Application architecture

A.Blue-green deployment with an immediate unobserved switch of all users
B.A rolling deployment with no health checks or remaining capacity
C.A slot swap assumed to reverse every database change
D.Canary deployment using supported traffic-shift mechanisms

✓ Correct answer

Canary deployment using supported traffic-shift mechanisms

Canary deliberately exposes a small traffic share and expands on health evidence. The stated all-at-once blue-green switch does not provide the requested initial percentage, unsafe rolling replacement ignores readiness and capacity, and swaps cannot undo arbitrary database changes. Source guide: PDF page(s) 54.

This item is flagged for content review.

311. An API rollout supports rapid routing rollback, but a database migration removes columns still used by the old version. What is the best corrective design?

Application architecture

A.Use expand-and-contract schema evolution so both application versions remain compatible during rollout
B.Increase API rate limits to prevent schema incompatibility
C.Treat blue-green duplicate capacity as a guarantee of schema reversibility
D.Assume switching traffic back recreates deleted columns and data

✓ Correct answer

Use expand-and-contract schema evolution so both application versions remain compatible during rollout

Expand-and-contract retains compatible schema until the old version is retired. Traffic rollback does not restore removed data, duplicate environments do not make their shared schema reversible, and rate controls do not repair incompatible contracts. Source guide: PDF page(s) 54.

This item is flagged for content review.

312. Two VNets use 10.20.0.0/16 and must communicate through ordinary VNet peering. What must be addressed first?

Network design

A.Enable gateway transit and assume it permits ordinary overlapping peering
B.Buy more ExpressRoute bandwidth to remove the address conflict
C.Add a broader default UDR and leave the overlap unchanged
D.Resolve the overlapping address spaces through an appropriate readdressing design

✓ Correct answer

Resolve the overlapping address spaces through an appropriate readdressing design

Ordinary VNet peering requires nonoverlapping address spaces. Gateway transit and broader routes do not remove conflicting destinations, and circuit bandwidth affects throughput rather than address ambiguity. Source guide: PDF page(s) 55.

This item is flagged for content review.

313. Spoke A and spoke B are each peered with a hub, but they have no direct peering or configured forwarding path. Why can A not automatically reach B?

Network design

A.Gateway transit automatically provides spoke-to-spoke communication but DNS never does
B.VNet peering is nontransitive; add direct peering or deliberately configured hub routing and forwarding
C.Global peering is the only way any two same-region spokes can communicate
D.Every VNet peering blocks private IP traffic by definition

✓ Correct answer

VNet peering is nontransitive; add direct peering or deliberately configured hub routing and forwarding

Two hub peerings do not create automatic transit between spokes. Peering does carry supported private IP traffic, gateway transit is a separate shared-gateway feature, and same-region spokes can use direct peering or routed hub transit without requiring global peering. Source guide: PDF page(s) 55.

This item is flagged for content review.

314. A spoke should use the hub's supported VPN gateway rather than deploy its own. Which design should be configured?

Network design

A.Configure only a UDR toward the hub while omitting remote-gateway peering settings
B.Deploy a separate VPN gateway in every spoke
C.Compatible hub gateway-transit and spoke remote-gateway peering settings
D.Configure only a DNS-zone link and leave gateway sharing unchanged

✓ Correct answer

Compatible hub gateway-transit and spoke remote-gateway peering settings

Sharing the hub gateway requires compatible gateway-transit and remote-gateway settings. Separate spoke gateways contradict the sharing requirement, DNS links do not establish packet transit, and UDRs alone do not replace the required peering configuration. Source guide: PDF page(s) 55.

This item is flagged for content review.

315. An enterprise connects hundreds of branches and several Azure regions and wants managed virtual hubs and centralized routing. Which service should be evaluated?

Network design

A.Azure Virtual WAN with deliberate route propagation and segmentation
B.NAT Gateway used as a global private WAN
C.Traffic Manager used as a private branch tunnel
D.A flat set of ordinary peerings assumed to provide universal automatic transit

✓ Correct answer

Azure Virtual WAN with deliberate route propagation and segmentation

Virtual WAN provides managed hubs and supported branch/VNet connections, while routing policies still determine reachability. Ordinary peering is nontransitive, Traffic Manager answers DNS, and NAT Gateway supplies subnet egress rather than private global WAN tunnels. Source guide: PDF page(s) 55-56.

This item is flagged for content review.

316. Private Azure VMs must call a third-party internet API from predictable public source addresses. Unsolicited inbound access is not required. Which service best fits?

Network design

A.Azure Bastion as an application egress translator
B.Azure NAT Gateway associated with their subnet
C.An internal Load Balancer without an explicit egress method
D.Implicit default outbound access as a guaranteed fixed public source address

✓ Correct answer

Azure NAT Gateway associated with their subnet

NAT supplies controlled public egress addresses. An internal load balancer alone does not establish explicit egress, Bastion serves administrative access, and implicit default addresses are not guaranteed predictable customer-controlled sources. Source guide: PDF page(s) 55.

This item is flagged for content review.

317. A subnet has NAT Gateway attached and a 0.0.0.0/0 UDR with a firewall virtual-appliance next hop. The external API sees the firewall path's egress address. What explains this?

Network design

A.NAT Gateway automatically overrides every UDR but the API resolves stale DNS
B.Private subnets forbid all explicitly configured internet egress
C.The selected UDR steers traffic to the firewall; NAT Gateway attachment does not override the route
D.A NAT association automatically deletes previously configured firewall UDRs

✓ Correct answer

The selected UDR steers traffic to the firewall; NAT Gateway attachment does not override the route

The selected route directs traffic to the firewall; NAT attachment neither overrides nor automatically removes that UDR. Stale DNS does not make NAT replace the route, and private subnets can use supported explicit egress. Source guide: PDF page(s) 55-57.

This item is flagged for content review.

318. A newly created VNet uses an API version released after March 31, 2026. Private VMs have no explicit egress and cannot retrieve public updates. What is the appropriate design response?

Network design

A.Assume every existing VNet in the tenant also lost outbound access automatically
B.Create a Basic Load Balancer as the current recommended replacement
C.Add only an inbound HTTP allow rule to restore outbound SNAT
D.Configure a supported explicit outbound method because new subnets default to private

✓ Correct answer

Configure a supported explicit outbound method because new subnets default to private

The API-dependent new-VNet default requires explicit outbound connectivity for private VMs. Existing VNets are not automatically converted, an inbound allow rule does not supply egress translation or routing, and Basic Load Balancer is retired. Source guide: PDF page(s) 56.

This item is flagged for content review.

319. A team transitions an existing subnet from implicit VM outbound access to an explicit design. Which two steps should it include? Select 2 answers.

Network design

A.Assume marking the subnet private creates a NAT Gateway automatically
B.Configure only a DNS forwarding rule and ignore packet egress
C.Assume earlier API versions and all existing VNets were universally converted on March 31, 2026
D.Plan required stop and deallocate actions to clear existing default outbound assignment when making the subnet private
E.Configure an appropriate NAT, firewall/NVA, Standard Load Balancer outbound, or assigned-public-IP method

✓ Correct answers

Plan required stop and deallocate actions to clear existing default outbound assignment when making the subnet private
Configure an appropriate NAT, firewall/NVA, Standard Load Balancer outbound, or assigned-public-IP method

Explicit connectivity establishes the outbound path, and deallocation can be required to clear previous NIC-level default assignments. The private flag does not create NAT, the change is not universal existing-network conversion, and DNS forwarding cannot replace egress. Source guide: PDF page(s) 56.

This item is flagged for content review.

320. An API client opens a new TCP connection for every request and sees intermittent outbound failures during bursts. NAT Gateway is in use. What should be investigated?

Network design

A.SNAT port pressure and connection reuse, along with actual egress capacity
B.Only health probes, assuming their success proves unlimited egress concurrency
C.Only inbound NSG allow rules, assuming every outbound timeout is an ingress failure
D.Only DNS TTL, assuming longer caching creates translation ports

✓ Correct answer

SNAT port pressure and connection reuse, along with actual egress capacity

Connection churn and concurrency can exhaust translation capacity, so reuse and measured port pressure matter. Inbound permissions alone do not characterize SNAT, DNS caching does not allocate ports, and probes cannot prove unlimited connection capacity. Source guide: PDF page(s) 55-56.

This item is flagged for content review.

321. A branch office requires an encrypted tunnel over the internet from its network to an Azure VNet. Which connectivity type fits?

Network design

A.ExpressRoute private peering without additional encryption
B.Point-to-site VPN for one individual client
C.Traffic Manager performance routing
D.Site-to-site VPN Gateway

✓ Correct answer

Site-to-site VPN Gateway

Site-to-site VPN provides the network-to-network IPsec/IKE tunnel. Point-to-site targets individual clients, ExpressRoute is private connectivity rather than this internet tunnel and is not automatically end-to-end encrypted, and Traffic Manager performs DNS endpoint selection. Source guide: PDF page(s) 56.

This item is flagged for content review.

322. A remote engineer needs private Azure access from one laptop rather than a tunnel for an entire branch network. Which connectivity type fits?

Network design

A.ExpressRoute Global Reach as a laptop VPN client
B.Point-to-site VPN with a supported protocol and authentication combination
C.Site-to-site VPN requiring a branch VPN appliance as the only possible method
D.A NAT Gateway inbound administration listener

✓ Correct answer

Point-to-site VPN with a supported protocol and authentication combination

Point-to-site connects individual supported clients with appropriate authentication. A site-to-site appliance is a different network-to-network model, Global Reach connects circuits rather than laptop VPN clients, and NAT Gateway does not provide unsolicited inbound administration. Source guide: PDF page(s) 56.

This item is flagged for content review.

323. A VPN deployment defines an on-premises device and advertised remote CIDR ranges. Which Azure resource represents this information?

Network design

A.GatewaySubnet itself as the remote VPN device record
B.A VNet peering resource as the remote VPN appliance definition
C.Local network gateway
D.Virtual network gateway as the on-premises device definition

✓ Correct answer

Local network gateway

Local network gateway represents remote VPN device information and prefixes. Virtual network gateway terminates Azure's tunnel, GatewaySubnet supplies its local address space, and peering connects VNets rather than defining a remote appliance. Source guide: PDF page(s) 56.

This item is flagged for content review.

324. A regulated workload uses ExpressRoute but requires end-to-end confidentiality for application traffic. Which two statements guide the design? Select 2 answers.

Network design

A.ExpressRoute private connectivity is not end-to-end encrypted by default
B.Use BGP route announcements as payload encryption
C.Use application TLS or a supported IPsec-over-ExpressRoute design according to the required scope
D.Treat ExpressRoute Direct MACsec as encryption of the entire application journey
E.Assume redundant circuits encrypt every application packet automatically

✓ Correct answers

ExpressRoute private connectivity is not end-to-end encrypted by default
Use application TLS or a supported IPsec-over-ExpressRoute design according to the required scope

Private transport and encryption are separate requirements. TLS and supported IPsec can protect the required traffic scope; redundant connections improve availability without encrypting payloads, MACsec covers the supported physical-link segment, and BGP exchanges routes rather than encrypting application content. Source guide: PDF page(s) 56-57.

This item is flagged for content review.

325. An enterprise must exchange routes between on-premises networks and Azure VNet private addresses through ExpressRoute. Which peering is appropriate?

Network design

A.ExpressRoute private peering
B.Microsoft peering solely because every Azure resource uses a public address
C.A DNS zone link used as BGP route exchange
D.VNet peering used as the provider circuit

✓ Correct answer

ExpressRoute private peering

Private peering is intended for on-premises-to-Azure VNet routing. Microsoft peering reaches supported Microsoft public services under requirements, VNet peering is not the provider circuit, and DNS links do not exchange BGP prefixes. Source guide: PDF page(s) 56.

This item is flagged for content review.

326. An ExpressRoute design must tolerate a provider-path or peering-location outage. Which two areas should be included in its resilience review? Select 2 answers.

Network design

A.Ignore return routes because BGP encrypts the application
B.Gateway design, route coverage, and tested surviving connection capacity
C.Assume one circuit's redundant connections eliminate every customer and provider failure
D.Count a public web health check as a complete private hybrid failover test
E.Customer devices, provider paths, and diverse circuits or peering locations where required

✓ Correct answers

Gateway design, route coverage, and tested surviving connection capacity
Customer devices, provider paths, and diverse circuits or peering locations where required

Resilience spans the full physical and logical path, including devices, circuits, locations, gateways, routes, and surviving capacity. Circuit redundancy alone does not remove correlated upstream failures, one public check does not validate hybrid paths, and BGP does not eliminate routing or provide encryption. Source guide: PDF page(s) 56-57.

This item is flagged for content review.

327. An eligible ExpressRoute workload needs a lower-overhead data path. The team proposes FastPath and removing the gateway entirely. What should the architect explain?

Network design

A.FastPath removes both data-path and control-plane gateway requirements
B.FastPath is a replacement for every Private Link DNS record
C.FastPath can bypass the gateway for eligible data traffic, but the gateway remains required for route exchange
D.FastPath guarantees every provider and Direct destination path is supported identically

✓ Correct answer

FastPath can bypass the gateway for eligible data traffic, but the gateway remains required for route exchange

FastPath optimizes supported data paths while retaining the gateway's route exchange role. It does not eliminate gateway control requirements or DNS, and eligibility differs by circuit and destination features. Source guide: PDF page(s) 57.

This item is flagged for content review.

328. Two on-premises datacenters have supported ExpressRoute circuits and want to communicate through Microsoft's backbone. Which feature fits?

Network design

A.VNet peering as a direct link between the two external circuits
B.ExpressRoute Global Reach
C.Front Door Private Link as general non-HTTP datacenter transit
D.NAT Gateway as a circuit-to-circuit private bridge

✓ Correct answer

ExpressRoute Global Reach

Global Reach links supported circuits for on-premises site communication. VNet peering joins virtual networks rather than the external circuits, Front Door handles supported HTTP origin connectivity, and NAT Gateway provides subnet public egress rather than circuit transit. Source guide: PDF page(s) 57.

This item is flagged for content review.

329. ExpressRoute fails and a backup VPN successfully establishes a tunnel, but the application misses its performance target. Which two checks are most relevant? Select 2 answers.

Network design

A.Test the actual application routes, DNS, and firewall policies over the backup path
B.Verify backup bandwidth can sustain the surviving production load
C.Add a second diagram line without changing route preference
D.Assume tunnel Connected status proves all application paths and capacity
E.Disable TLS because reachability requires plaintext

✓ Correct answers

Test the actual application routes, DNS, and firewall policies over the backup path
Verify backup bandwidth can sustain the surviving production load

Backup readiness includes usable capacity and complete application routing, DNS, and security behavior. Tunnel status alone does not validate those, a diagram does not establish a working path, and failover does not require removing application confidentiality. Source guide: PDF page(s) 57.

This item is flagged for content review.

330. A subnet has a 0.0.0.0/0 UDR to a firewall and an applicable 10.40.0.0/16 BGP route. Ignoring documented service-specific exceptions, which route ordinarily matches traffic to 10.40.8.9?

Network design

A.The internet route because private destinations never match BGP
B.Whichever route was created most recently
C.The UDR because route type always beats prefix length
D.The 10.40.0.0/16 route because it is more specific

✓ Correct answer

The 10.40.0.0/16 route because it is more specific

Longest matching prefix ordinarily comes before equal-prefix route-type precedence, so the /16 is more specific than /0. UDR priority is not a universal override of more specific routes, private prefixes can be learned by BGP, and creation order is not the selection rule. Source guide: PDF page(s) 57.

This item is flagged for content review.

331. A subnet has applicable UDR, BGP, and system routes for the same destination prefix. No service-specific exception applies. Which route ordinarily takes precedence?

Network design

A.The user-defined route
B.The system route because all default routes are immutable
C.The route with the highest numeric NSG priority
D.The BGP route because dynamic routes always beat UDRs

✓ Correct answer

The user-defined route

For equal applicable prefixes, ordinary precedence is UDR, BGP, then system. Dynamic routing is not universally first, system routes can often be overridden by supported UDRs, and NSG priority selects filtering rules rather than routes. Source guide: PDF page(s) 57.

This item is flagged for content review.

332. A team enables a Storage service endpoint but also expects a UDR to override the service-endpoint route and force the same traffic through an NVA. What must it account for?

Network design

A.Virtual network service-endpoint next-hop routes cannot be overridden by a UDR
B.NAT Gateway attachment converts the service endpoint into a private endpoint
C.A narrower UDR always overrides the service-endpoint route without exception
D.An NSG rule changes the route's next-hop type

✓ Correct answer

Virtual network service-endpoint next-hop routes cannot be overridden by a UDR

Service-endpoint next-hop routes are an important routing exception; the traffic path must be redesigned or assessed accordingly. Generic longest-prefix claims cannot erase that exception, NAT does not transform endpoints, and NSGs filter traffic without rewriting route types. Source guide: PDF page(s) 57.

This item is flagged for content review.

333. An architect sets a UDR next-hop type to Virtual network gateway and intends it to specify an ExpressRoute gateway. What should be corrected?

Network design

A.The next-hop type is supported for every gateway without restrictions
B.A private endpoint is required solely to allow an ExpressRoute gateway UDR target
C.That UDR next-hop type is supported for VPN gateways, not ExpressRoute gateways
D.Changing the NSG rule priority makes the next hop supported

✓ Correct answer

That UDR next-hop type is supported for VPN gateways, not ExpressRoute gateways

The documented Virtual network gateway UDR target is for VPN rather than ExpressRoute gateways. Support cannot be assumed across gateway types, adding a private endpoint does not change the UDR capability, and filtering priority cannot enable an unsupported route target. Source guide: PDF page(s) 57.

This item is flagged for content review.

334. A spoke UDR sends traffic to an NVA, but the appliance does not forward packets successfully. Which two configurations should be checked? Select 2 answers.

Network design

A.Whether a VM reservation discount is applied
B.Inspection policy and a coherent return path
C.Whether DNS labels contain the appliance vendor's name
D.Required Azure NIC and guest IP forwarding and routing
E.Only whether the route-table resource exists

✓ Correct answers

Inspection policy and a coherent return path
Required Azure NIC and guest IP forwarding and routing

A usable NVA path needs forwarding, actual routes, allowed policy, and return-path coherence. The route table's existence does not prove appliance behavior, DNS naming is not forwarding configuration, and billing discounts do not route packets. Source guide: PDF page(s) 57.

This item is flagged for content review.

335. Outbound packets traverse one stateful firewall path, while replies bypass it. The application intermittently fails despite permissive NSG rules. What is the best investigation?

Network design

A.Switch to a higher VM size as a guaranteed route correction
B.Inspect effective routes and packet flow to establish a coherent symmetric inspection path
C.Add broader NSG allow rules until asymmetric routing no longer matters
D.Increase DNS TTL to share firewall session state

✓ Correct answer

Inspect effective routes and packet flow to establish a coherent symmetric inspection path

Stateful inspection can fail when only one direction follows the expected session path. Effective routing and packet evidence identify the inconsistency; permissive filtering does not fix asymmetry, DNS TTL does not synchronize firewall state, and VM size does not deterministically correct routes. Source guide: PDF page(s) 57.

This item is flagged for content review.

336. A Storage account must be privately reachable and must reject public access. Which two configuration areas are required? Select 2 answers.

Network design

A.Assume private endpoint creation always disables every public endpoint
B.Create and approve appropriate private endpoint connections with working private DNS
C.Configure public network access and service firewall policy separately
D.Enable a service endpoint and assume it assigns a private IP to the resource
E.Replace all application permissions with the endpoint IP address

✓ Correct answers

Create and approve appropriate private endpoint connections with working private DNS
Configure public network access and service firewall policy separately

Private endpoints and DNS establish the private path; public exposure requires separate service settings. Private Link alone does not universally disable public access, network addresses do not authorize data access, and service endpoints retain public service addressing. Source guide: PDF page(s) 57-58.

This item is flagged for content review.

337. A Storage account's blob private endpoint works, but an application also requires Azure Files access. What should the architect assess?

Network design

A.Add an SMB NSG allow rule but leave the file endpoint and DNS unconfigured
B.Rename the blob endpoint NIC and assume its target changes to file
C.Assume one blob endpoint automatically covers every Storage subresource
D.Create the appropriate file subresource private endpoint and corresponding DNS configuration

✓ Correct answer

Create the appropriate file subresource private endpoint and corresponding DNS configuration

File and blob are separate supported endpoint targets with corresponding DNS. A blob endpoint does not cover every subresource, a filtering rule does not create missing Private Link connectivity, and renaming the NIC does not change its service target. Source guide: PDF page(s) 57-58.

This item is flagged for content review.

338. A team enables a service endpoint and adds its subnet to a service firewall. What addressing should it expect?

Network design

A.The service receives a private NIC address inside that subnet
B.The service still uses its public endpoint, with subnet identity available to supported service firewall controls
C.The service firewall replaces application data-plane authorization
D.Every on-premises client gains the same Private Link access automatically

✓ Correct answer

The service still uses its public endpoint, with subnet identity available to supported service firewall controls

Service endpoints extend supported subnet identity over the backbone without assigning the destination a private VNet NIC. Private endpoint addressing is a different model, on-premises private access is not automatically supplied, and valid application permissions remain required. Source guide: PDF page(s) 57-58.

This item is flagged for content review.

339. An on-premises application has VPN reachability to a Storage private endpoint but resolves the normal service name to a public address. Which two elements should be verified? Select 2 answers.

Network design

A.Correct private endpoint records and links in the intended Azure private DNS zone
B.Replace the application's hostname with a raw IP and disregard TLS matching
C.On-premises forwarding to a suitable reachable Private Resolver inbound endpoint or supported DNS forwarding path
D.Only the outbound Resolver endpoint, because inbound hybrid queries cannot use an inbound endpoint
E.Assume a connected VPN automatically changes all DNS responses

✓ Correct answers

Correct private endpoint records and links in the intended Azure private DNS zone
On-premises forwarding to a suitable reachable Private Resolver inbound endpoint or supported DNS forwarding path

Private records and zone access plus on-premises-to-Azure forwarding make the service name resolve to the endpoint IP. Outbound resolver endpoints handle the opposite selected-query direction, direct IP can break TLS and SDK expectations, and VPN reachability does not automatically configure DNS. Source guide: PDF page(s) 58.

This item is flagged for content review.

340. An application reaches a private endpoint by IP but fails certificate hostname validation. Which design best preserves normal TLS and SDK behavior?

Network design

A.Disable certificate validation permanently
B.Treat NSG allow rules as certificate validation
C.Publish the private IP as a public certificate name without changing application design
D.Use the normal service hostname and correct private DNS resolution

✓ Correct answer

Use the normal service hostname and correct private DNS resolution

Normal hostnames retain the certificate identity and SDK contract while DNS maps to the private endpoint. Disabling validation weakens confidentiality assurance, an arbitrary IP does not automatically match the certificate, and NSGs cannot validate TLS hostnames. Source guide: PDF page(s) 58.

This item is flagged for content review.

341. Azure workloads must resolve selected on-premises names using on-premises DNS. Which Private Resolver direction fits?

Network design

A.Outbound endpoint with an appropriate forwarding ruleset
B.Create an empty private zone shadowing the on-premises domain without forwarding
C.Inbound endpoint alone with no outbound forwarding rules
D.Link only an Azure private zone and assume it forwards every on-premises query

✓ Correct answer

Outbound endpoint with an appropriate forwarding ruleset

Outbound endpoints and rulesets forward selected Azure queries externally. Inbound endpoints serve incoming queries, zone links expose records rather than forwarding all queries, and an empty shadow zone cannot resolve on-premises records. Source guide: PDF page(s) 58.

This item is flagged for content review.

342. A private endpoint resolves correctly from the hub but to a public address from a spoke. Packet routing between them is already valid. What should be checked first?

Network design

A.Assume every private endpoint automatically publishes private answers to every VNet
B.Increase ExpressRoute bandwidth while leaving DNS unchanged
C.Private-zone links and DNS forwarding or resolver configuration for the spoke
D.Only NSG permissions, assuming working routing guarantees private name resolution

✓ Correct answer

Private-zone links and DNS forwarding or resolver configuration for the spoke

Zone visibility and resolver paths can differ between VNets even with working routing. Packet permissions and bandwidth do not correct DNS, and private endpoint creation does not universally link its records to every VNet. Source guide: PDF page(s) 58.

This item is flagged for content review.

343. An NSG has a matching deny at priority 100 and a matching allow at priority 200. What happens to a new flow?

Network design

A.The more permissive action always wins regardless of priority
B.The deny matches first because lower priority numbers are evaluated first
C.Both rules are merged because they match the same packet
D.The allow wins because a larger number means earlier evaluation

✓ Correct answer

The deny matches first because lower priority numbers are evaluated first

NSGs evaluate lower-numbered priorities first and apply the first match. Higher numbers are later, allow does not universally override deny, and matching rules are not merged. Source guide: PDF page(s) 58-59.

This item is flagged for content review.

344. A subnet NSG allows a flow, but the NIC NSG denies the same applicable flow. What is the result?

Network design

A.The subnet allow overrides every NIC rule
B.Only the NAT Gateway public address determines permission
C.The NIC NSG is ignored whenever a subnet NSG exists
D.The flow is blocked because applicable rules at both scopes must permit it

✓ Correct answer

The flow is blocked because applicable rules at both scopes must permit it

Both applicable NSGs participate in filtering, so a deny at either scope can block the flow. Neither general subnet precedence nor automatic NIC omission applies, and egress translation does not override NSG permissions. Source guide: PDF page(s) 59.

This item is flagged for content review.

345. Security wants NSG rules to refer to web-tier and application-tier NIC roles instead of individual IP lists. Which feature is appropriate?

Network design

A.A broad VirtualNetwork tag with no web/application role distinction
B.Subnet names treated as identities automatically used as NSG source groups
C.Application security groups
D.Service tags treated as arbitrary customer-defined NIC-role groups

✓ Correct answer

Application security groups

ASGs group selected NICs by role. Service tags are maintained prefix sets rather than arbitrary NIC membership, VirtualNetwork is broader than this role distinction, and subnet names do not automatically create application security groups. Source guide: PDF page(s) 59.

This item is flagged for content review.

346. A web workload needs regional HTTP attack filtering and centralized inspected egress for non-HTTP workloads. Which two controls fit their respective roles? Select 2 answers.

Network design

A.An NSG alone to inspect every HTTP request body
B.Azure Firewall or a suitable NVA for centralized network/application egress inspection
C.NAT Gateway as a full intrusion-detection firewall
D.A WAF on a supported HTTP frontend for application-layer web attacks
E.A WAF as a universal UDP inspection device

✓ Correct answers

Azure Firewall or a suitable NVA for centralized network/application egress inspection
A WAF on a supported HTTP frontend for application-layer web attacks

WAF inspects supported HTTP requests, while Firewall/NVA handles centralized network and application traffic policies. NSGs filter network attributes rather than HTTP bodies, NAT performs outbound translation rather than full inspection, and WAF does not provide universal UDP security. Source guide: PDF page(s) 59.

This item is flagged for content review.

347. Administrators need managed SSH and RDP access without assigning public IPs to each target VM. Which service should be considered?

Network design

A.Azure Bastion with an appropriate tier and access permissions
B.A public Load Balancer forwarding RDP/SSH directly to the VMs
C.NAT Gateway accepting unsolicited inbound administrative sessions
D.A private endpoint assumed to provide RDP/SSH for arbitrary VMs

✓ Correct answer

Azure Bastion with an appropriate tier and access permissions

Bastion supplies managed secure administrative access. Direct public port forwarding is a different exposed model, NAT is outbound-only, and Private Link connects supported service targets rather than universally administering arbitrary VMs. Source guide: PDF page(s) 59.

This item is flagged for content review.

348. An internet-facing workload needs protection from network flooding and separate HTTP injection filtering. Which distinction is correct?

Network design

A.WAF replaces every TCP/UDP DDoS protection requirement
B.DDoS protection validates every user's application permissions
C.DDoS protection addresses flooding, while WAF addresses application-layer HTTP patterns
D.NSG service tags automatically remove all malicious HTTP bodies

✓ Correct answer

DDoS protection addresses flooding, while WAF addresses application-layer HTTP patterns

The controls operate on different attack classes and should be selected by traffic and supported scope. WAF is not universal network flood protection, DDoS mitigation is not application authorization, and service tags do not inspect malicious bodies. Source guide: PDF page(s) 59.

This item is flagged for content review.

349. A private application uses a custom TCP protocol inside one region and needs distribution across healthy VM backends. No HTTP path routing is required. Which frontend fits?

Network design

A.Azure Front Door as a private arbitrary-TCP proxy
B.Internal Standard Azure Load Balancer
C.Traffic Manager as a regional in-path transport load balancer
D.Application Gateway v2 as a generic custom-TCP path router

✓ Correct answer

Internal Standard Azure Load Balancer

An internal Standard Load Balancer provides supported Layer 4 private distribution. Application Gateway and Front Door target HTTP/HTTPS application delivery, while Traffic Manager answers DNS rather than proxying regional transport flows. Source guide: PDF page(s) 59-60.

This item is flagged for content review.

350. A regional web app needs hostname and URL-path routing, TLS termination, and optional WAF within a VNet. Which service is the strongest candidate?

Network design

A.Application Gateway v2 in its dedicated subnet
B.Standard Load Balancer with an assumption of URL-path inspection
C.Traffic Manager with assumed TLS termination
D.NAT Gateway with inbound HTTP routing

✓ Correct answer

Application Gateway v2 in its dedicated subnet

Application Gateway v2 supplies regional Layer 7 routing, TLS termination, health probes, and WAF options. Standard Load Balancer is Layer 4, Traffic Manager does not terminate TLS, and NAT Gateway is an outbound translator. Source guide: PDF page(s) 59-60.

This item is flagged for content review.

351. A global HTTP application must use edge caching and managed WAF rules, connect to supported private origins, and prevent direct public origin bypass. Which two choices fit? Select 2 answers.

Network design

A.Keep every origin publicly unrestricted because edge WAF then protects all possible paths
B.Use Front Door Standard and assume managed WAF rules and Private Link match Premium
C.Restrict origins so callers cannot bypass the intended global entry policy
D.Use a supported Front Door Premium Private Link origin configuration
E.Use Traffic Manager as the HTTP caching proxy

✓ Correct answers

Restrict origins so callers cannot bypass the intended global entry policy
Use a supported Front Door Premium Private Link origin configuration

Front Door Premium supports private origin connectivity and managed WAF rules, while origin restriction preserves the intended security entry. Standard does not have these Premium capabilities, Traffic Manager does not proxy or cache HTTP, and unrestricted origins can bypass edge policy. Source guide: PDF page(s) 59-60.

This item is flagged for content review.

352. Traffic Manager changes its preferred endpoint after a health failure, but some clients keep using the old endpoint for a time. What should the failover design account for?

Network design

A.Traffic Manager's required TLS termination on every client connection
B.Immediate redirection of every existing packet by Traffic Manager
C.Automatic rollback of the backend database when DNS changes
D.DNS TTL/caching and existing connections because Traffic Manager selects endpoints through DNS

✓ Correct answer

DNS TTL/caching and existing connections because Traffic Manager selects endpoints through DNS

Traffic Manager's DNS answers are subject to caching and existing connections; health and TTL behavior influence observed convergence. It is not an in-path packet proxy, does not terminate TLS, and DNS routing does not roll back database state. Source guide: PDF page(s) 60.

This item is flagged for content review.

353. An application requires global TCP/UDP distribution to supported regional public Standard Load Balancers rather than an HTTP proxy. Which service should be evaluated?

Network design

A.Application Gateway v2 as a cross-region Layer 4 frontend
B.An internal regional Load Balancer assumed to become global automatically
C.Global Azure Load Balancer
D.Azure Front Door as an arbitrary TCP/UDP load balancer

✓ Correct answer

Global Azure Load Balancer

Global Load Balancer provides supported cross-region Layer 4 distribution over regional public Standard Load Balancers. Front Door and Application Gateway are HTTP application-delivery services, and an internal regional load balancer does not automatically gain a global public frontend. Source guide: PDF page(s) 59-60.

This item is flagged for content review.

354. A datacenter must close soon. A supported legacy application can run on Azure VMs with minimal changes, and redesign would exceed the deadline. Which initial strategy is most appropriate?

Migration design

A.Rebuild the application before any move
B.Replace the application with unrelated SaaS immediately
C.Retire the application despite active business dependency
D.Rehost now and assess modernization after stabilization

✓ Correct answer

Rehost now and assess modernization after stabilization

Rehosting preserves the application pattern with limited change and can fit the deadline. Rebuilding or unassessed replacement introduces larger changes; retirement is inappropriate while the application provides required value. Source guide: PDF page(s) 61.

This item is flagged for content review.

355. A web application uses a supported runtime. It can move to App Service after modest changes to configuration and file persistence, without changing its component structure. Which strategy describes this?

Migration design

A.Replatform
B.Rearchitect
C.Rebuild
D.Retain

✓ Correct answer

Replatform

Replatforming changes hosting with limited application changes. Rearchitecting changes structure, retaining keeps the current environment, and rebuilding creates a new application. Source guide: PDF page(s) 61.

This item is flagged for content review.

356. A monolithic application must be decomposed into independently scalable services. Which migration strategy best describes this structural change?

Migration design

A.Rehost
B.Rearchitect
C.Retain
D.Retire

✓ Correct answer

Rearchitect

Rearchitecting changes application structure. Rehosting preserves it, retaining leaves it in place, and retiring removes a workload after business and dependency checks. Source guide: PDF page(s) 61.

This item is flagged for content review.

357. An obsolete reporting service has no active users, but downstream dependencies and retention obligations are unknown. What should precede retirement?

Migration design

A.Replacing all reports with a queue before assessing use
B.Dependency and retention checks with business-owner acceptance
C.Changing its VM size to the largest supported SKU
D.Copying the server to every available region

✓ Correct answer

Dependency and retention checks with business-owner acceptance

Retirement requires evidence that removal is safe and obligations are satisfied. Regional copies, a larger VM, or an unrelated queue add work without establishing that decommissioning is appropriate. Source guide: PDF page(s) 61.

This item is flagged for content review.

358. Production cutover is scheduled while target DNS, RBAC, backup ownership, and diagnostic policies are still being negotiated. What should the architect recommend?

Migration design · Governance and compliance

A.Stabilize landing-zone readiness before production cutover
B.Replace unfinished role design with a shared permanent Owner credential for the app
C.Approve cutover using replication health without validating the target controls
D.Migrate first and defer DNS, access, and backup ownership until production stabilizes

✓ Correct answer

Stabilize landing-zone readiness before production cutover

Landing-zone prerequisites are part of production readiness. Replication alone proves neither secure access nor recoverability. Deferring essential controls or using shared permanent privilege undermines a controlled migration. Source guide: PDF page(s) 61.

This item is flagged for content review.

359. A server inventory has been imported into Azure Migrate. The team assumes the applications have now migrated. Which statement clarifies the result?

Migration design

A.Assessment results are equivalent to a completed production cutover
B.Inventory import installs all application dependencies on PaaS
C.Every inventoried VM automatically starts in the target subscription
D.Inventory import can support discovery but does not copy workloads

✓ Correct answer

Inventory import can support discovery but does not copy workloads

Discovery identifies assets; assessment evaluates readiness and sizing; migration copies or replicates them. Inventory does not start VMs, install a PaaS application, or complete cutover. Source guide: PDF page(s) 62.

This item is flagged for content review.

360. A web server, database, and file server communicate frequently. The proposed waves treat each as an unrelated asset. Which assessment evidence should guide regrouping?

Migration design

A.Alphabetical server names
B.A policy that every server must migrate in a separate month
C.Dependency analysis of application communication and ownership
D.Only the server purchase dates

✓ Correct answer

Dependency analysis of application communication and ownership

Dependency analysis reveals the working application unit and supports coherent wave grouping. Names and purchase dates do not define runtime dependencies; forced separation can leave a workload across an unsuitable network path. Source guide: PDF page(s) 62.

This item is flagged for content review.

361. An assessment collected data during a quiet weekend and recommends a much smaller target VM. The workload has month-end processing spikes. What should be done before approving the size?

Migration design

A.Approve the smallest recommendation using only the quiet weekend utilization average
B.Exclude the month-end job from the assessment so the recommendation remains unchanged
C.Collect peak-period data and review assessment confidence
D.Keep the weekend average and compensate solely with an optimistic growth assumption

✓ Correct answer

Collect peak-period data and review assessment confidence

Sizing must reflect representative business demand and adequate evidence. Quiet averages can hide peaks, aggressive downsizing is unsafe with low confidence, and omitting a real dependency makes the assessment incomplete. Source guide: PDF page(s) 62.

This item is flagged for content review.

362. A target assessment preserves allocated on-premises capacity rather than basing recommendations primarily on collected utilization. Which sizing approach is being used?

Migration design

A.As-on-premises sizing
B.Performance-based sizing
C.A completed migration rehearsal
D.Application transaction benchmarking

✓ Correct answer

As-on-premises sizing

As-on-premises sizing preserves allocation more directly. Performance-based sizing uses measured utilization; transaction benchmarking and rehearsal are distinct validation activities. Source guide: PDF page(s) 62.

This item is flagged for content review.

363. The migration inventory lists VMs and databases but omits application service accounts and scheduled jobs. Which two additions are most useful? Select two answers.

Migration design

A.Identity, certificate, and service-account dependencies
B.Only the original hardware vendor logo
C.A requirement to recreate every VM with the same public IP
D.Scheduled jobs, file paths, external APIs, and application owners
E.Only VM display colors in dashboards

✓ Correct answers

Identity, certificate, and service-account dependencies
Scheduled jobs, file paths, external APIs, and application owners

Identity and application dependencies are necessary to make the workload function after migration. Display details and logos do not establish readiness; identical public IPs are neither generally available nor a universal requirement. Source guide: PDF page(s) 62.

This item is flagged for content review.

364. Server replication is healthy, but the target has not been tested with its database, identity provider, or backup service. What conclusion is justified?

Migration design

A.The source may be deleted immediately to reduce overlap costs
B.Replication reduces final transfer volume but application readiness remains unproven
C.Application readiness is proven because disks are synchronized
D.The target requires no business validation once the VM boots

✓ Correct answer

Replication reduces final transfer volume but application readiness remains unproven

Replication is a transfer mechanism, not a complete readiness test. Dependency behavior, transactions, backups, and ownership still need validation. Booting alone is insufficient, and deletion must wait for acceptance and rollback conditions. Source guide: PDF page(s) 62.

This item is flagged for content review.

365. A migrated test copy contains a job that emails customers and updates a payment service. Which rehearsal design is most appropriate?

Migration design

A.Disable all identity tests so the application cannot sign in
B.Run the copy on the production network without changing dependencies
C.Skip rehearsal because replication is continuous
D.Use an isolated test network and prevent real external side effects

✓ Correct answer

Use an isolated test network and prevent real external side effects

Isolation must prevent duplicate writers and real emails or payments while permitting representative validation. Production connectivity risks side effects; omitting identity validation or all rehearsal leaves essential risks untested. Source guide: PDF page(s) 62.

This item is flagged for content review.

366. A stateful application is ready to cut over. Which two actions directly support a consistent switch? Select two answers.

Migration design

A.Start target dependencies in order and validate transactions before release
B.Delete source backups before business acceptance
C.Change DNS before any target identity or database is ready
D.Let source and target accept unrelated writes indefinitely
E.Quiesce source writes as required and synchronize final changes

✓ Correct answers

Start target dependencies in order and validate transactions before release
Quiesce source writes as required and synchronize final changes

Final synchronization and dependency-aware startup support a controlled switch. Uncoordinated dual writers can diverge; premature routing exposes unready services; deleting backups removes recovery options. Source guide: PDF page(s) 62-63.

This item is flagged for content review.

367. After cutover, the target accepts new orders. A performance issue triggers rollback. Why is restoring the old DNS record alone insufficient?

Migration design

A.The source may lack accepted target writes, so rollback requires data reconciliation
B.DNS can never be changed during a migration
C.Performance issues always require deletion of the target data
D.Every online migration provides automatic reverse replication

✓ Correct answer

The source may lack accepted target writes, so rollback requires data reconciliation

New target writes must be retained or reconciled before returning traffic to the source. DNS changes are possible but do not synchronize state; reverse replication is not universal; deleting data is not a valid blanket response. Source guide: PDF page(s) 63.

This item is flagged for content review.

368. A compatible web app is moving to managed hosting. It currently saves durable user uploads to a local VM disk and embeds secrets in configuration files. Which two changes support replatforming? Select two answers.

Migration design · Application architecture

A.Treat each scaled instance’s local filesystem as a shared durable store
B.Require all requests to return to the same disposable instance forever
C.Move durable uploads to a supported external state store
D.Externalize secrets and nonsecret configuration into appropriate services
E.Copy secrets into the new source-control repository

✓ Correct answers

Move durable uploads to a supported external state store
Externalize secrets and nonsecret configuration into appropriate services

External state and properly managed configuration reduce dependence on VM-local assumptions. Sticky routing does not make local data durable, source control is inappropriate for secrets, and instance filesystems are not automatically shared. Source guide: PDF page(s) 63.

This item is flagged for content review.

369. An enterprise has a justified need to preserve VMware tooling and the VMware operating environment during migration. Which destination should be evaluated alongside other supported choices?

Migration design

A.Azure VMs with application-by-application rehosting
B.Azure Kubernetes Service with application containerization
C.Azure App Service with application replatforming
D.Azure VMware Solution

✓ Correct answer

Azure VMware Solution

Azure VMware Solution is relevant when preserving the VMware environment and tooling is a justified constraint. Azure VM rehosting can move applications but does not preserve the same VMware operating environment. App Service replatforming and AKS containerization require application changes and are not a VMware environment destination. Source guide: PDF page(s) 63.

This item is flagged for content review.

370. A SQL application depends on server-level jobs, linked servers, and extensions. The team has chosen a transfer tool before assessing these features. What is the best next step?

Migration design · Relational data

A.Choose Azure SQL Database and assume all server-level SQL dependencies are supported
B.Discard server-level jobs and extensions before identifying the application dependencies
C.Assess compatibility, select a target, and then select tooling
D.Copy tables first and accept the move solely from matching source and target row counts

✓ Correct answer

Assess compatibility, select a target, and then select tooling

Target capabilities and operating requirements constrain the migration workflow. Azure SQL Database, Managed Instance, and SQL on VMs differ; table copies omit jobs and behavior; removal without assessment can break the application. Source guide: PDF page(s) 63.

This item is flagged for content review.

371. A plan specifies current Azure DMS online migration from SQL Server to Azure SQL Database. The business cannot accept the measured offline outage. Which correction is appropriate?

Migration design

A.Continue with DMS online mode because Managed Instance support implies SQL Database support
B.Reassess the target or another supported migration path
C.Rename the target to Managed Instance while retaining the same SQL Database service
D.Enable schema migration and treat that setting as a zero-downtime data-transfer feature

✓ Correct answer

Reassess the target or another supported migration path

Current DMS does not provide online migration to Azure SQL Database. A different supported approach or suitable target must be evaluated against requirements. Names do not change service capabilities, and schema preparation does not eliminate data synchronization or cutover. Source guide: PDF page(s) 63.

This item is flagged for content review.

372. A supported online database migration performs initial copy and ongoing synchronization while the source runs. What still needs to be budgeted?

Migration design

A.Automatic migration of all surrounding server objects
B.An assumption of zero cutover time in every supported scenario
C.Final synchronization and the application switch outage
D.Deletion of all source backups before the final change set

✓ Correct answer

Final synchronization and the application switch outage

Online reduces downtime but still needs a final consistent synchronization and switch. It does not guarantee zero outage, migrate every external object, or justify deleting recovery options. Source guide: PDF page(s) 63.

This item is flagged for content review.

373. A supported backup-based SQL migration uses DMS to a SQL VM. The source has a full backup but no continuing transaction-log backup process. What must the migration team prepare?

Migration design

A.A valid source backup and log chain with required access and final synchronization
B.A DNS record that substitutes for missing transaction logs
C.A larger target VM without any source backup work
D.Only a diagnostic setting because DMS creates all source backups

✓ Correct answer

A valid source backup and log chain with required access and final synchronization

DMS consumes prepared backups in supported backup-based workflows. The team must maintain the chain and access requirements. Diagnostic settings, DNS, and target sizing do not create source backups or replace the log chain. Source guide: PDF page(s) 63.

This item is flagged for content review.

374. The target Azure SQL Database lacks the source tables. A current supported offline DMS workflow is planned. Which statement is accurate?

Migration design

A.All server-level features will be recreated automatically with the schema
B.An empty target automatically proves the application is compatible
C.DMS never migrates schema in any SQL Database workflow
D.Supported missing schema can be migrated by the workflow, or prepared separately with supported tools

✓ Correct answer

Supported missing schema can be migrated by the workflow, or prepared separately with supported tools

Current DMS can handle supported missing schema; supported project tooling is another preparation path. The object support list and server dependencies still require review, and an empty database establishes no application compatibility. Source guide: PDF page(s) 63.

This item is flagged for content review.

375. Row counts match after SQL migration, but a batch process fails and query latency is much higher. Which validation should have accompanied row counts?

Migration design

A.Only a test that one administrator can open the Azure portal
B.Critical aggregates, identities, jobs, transactions, execution plans, and performance
C.Only a check that the target database name is unchanged
D.Only a screenshot of successful transfer status

✓ Correct answer

Critical aggregates, identities, jobs, transactions, execution plans, and performance

Migration validation must cover the application and surrounding behavior. Names, transfer screenshots, and portal access do not verify correctness, jobs, application authorization, or database performance. Source guide: PDF page(s) 63.

This item is flagged for content review.

376. An October 2026 migration runbook requires a retired Azure Data Studio desktop extension. What is the appropriate maintenance action?

Migration design

A.Replace the procedure with a supported current workflow and verify the source-target matrix
B.Assume all DMS database migrations are now unsupported
C.Convert the database to blobs solely to avoid changing the runbook
D.Keep it because a validated older runbook can never become stale

✓ Correct answer

Replace the procedure with a supported current workflow and verify the source-target matrix

Azure Data Studio retired February 28, 2026. Use supported replacements and current scenario guidance. Retirement of one tool does not invalidate every DMS scenario or justify an unrelated data-model change. Source guide: PDF page(s) 63.

This item is flagged for content review.

377. A file migration contains millions of tiny files. A size-divided-by-link-rate estimate fits the window, but a pilot runs much slower. Which factor should be investigated first?

Migration design

A.Only the advertised WAN bandwidth, without considering metadata operations
B.Only database CPU sizing, without examining the file enumeration or target operations
C.Enumeration and per-file operation-rate overhead
D.The target storage redundancy setting alone, without a per-file throughput pilot

✓ Correct answer

Enumeration and per-file operation-rate overhead

Enumeration, metadata work, and operations per second can limit many-small-file migrations. Advertised bandwidth alone ignores those effects. Database CPU sizing does not identify the file-copy bottleneck. Storage configuration may affect performance, but redundancy alone does not explain or measure per-file overhead. Source guide: PDF page(s) 64.

This item is flagged for content review.

378. A team needs managed projects, endpoints, repeatable migration jobs, and monitoring for a supported file source-target path. Which tool best fits?

Migration design

A.AzCopy scripts maintained separately for every share
B.Azure Storage Mover
C.Azure Data Box for a physical one-time bulk transfer
D.Azure File Sync as a permanent local-cache architecture

✓ Correct answer

Azure Storage Mover

Storage Mover supplies managed projects, endpoints, repeatable jobs, and monitoring for supported migration paths. AzCopy is useful for command-line copies but lacks that same managed project workflow. File Sync addresses an ongoing cache/tiering architecture, which is not requested. Data Box is for physical bulk transfer and is not the requested managed online job orchestration. Source guide: PDF page(s) 64.

This item is flagged for content review.

379. A Storage Mover design is based on old notes that list only NFS-to-Blob migration. What should determine the supported design?

Migration design

A.Only the file extensions, without checking source protocol or destination semantics
B.The original NFS-to-Blob notes, even if the supported product matrix has since changed
C.A general assumption that all SMB, NFS, and cloud-object protocol pairs now migrate
D.The current supported scenario matrix and fidelity requirements

✓ Correct answer

The current supported scenario matrix and fidelity requirements

The current scenario matrix, agent requirements, cloud availability, status, and fidelity guarantees govern implementation. A universal protocol-pair assumption is unsafe. File extensions do not establish protocol compatibility, and old notes can omit newer supported paths. Source guide: PDF page(s) 64.

This item is flagged for content review.

380. An administrator needs a controlled command-line copy on a supported Azure storage path. Managed project orchestration is not required. Which tool is most directly suited?

Migration design

A.AzCopy
B.Azure File Sync for permanent Windows caching
C.Azure Storage Mover managed project orchestration
D.Azure Data Box for offline physical shipment

✓ Correct answer

AzCopy

AzCopy most directly supplies the requested command-line copy on supported storage paths. Storage Mover addresses managed job orchestration rather than this command-line task. File Sync serves permanent Windows caching and tiering. Data Box serves physical bulk transfer rather than the requested online command-line copy. Source guide: PDF page(s) 64.

This item is flagged for content review.

381. An AzCopy pilot transfers all bytes successfully. The business also requires ACL and timestamp fidelity. What should happen before migration acceptance?

Migration design

A.Assume byte completion proves every ACL is unchanged
B.Replace all ACLs with the migration operator’s identity
C.Grant public anonymous access to bypass metadata checks
D.Verify supported preservation options and compare required metadata on the actual target

✓ Correct answer

Verify supported preservation options and compare required metadata on the actual target

Metadata preservation depends on source, target, and supported options. Successful byte copying alone does not establish permissions or timestamps; public access or blanket ACL replacement contradicts fidelity requirements. Source guide: PDF page(s) 64.

This item is flagged for content review.

382. A Windows file service needs to migrate to Azure Files while keeping a permanent local Windows Server cache with cloud tiering. Which component should be evaluated?

Migration design

A.AzCopy as the only ongoing cache and tiering service
B.Azure Storage Mover as the permanent Windows cache
C.Azure File Sync
D.Azure Data Box as the continuous local-cache layer

✓ Correct answer

Azure File Sync

File Sync fits an ongoing Windows Server cache with Azure Files and cloud tiering. AzCopy and Storage Mover can transfer data but do not supply that persistent caching service. Data Box is a bulk transfer device, not a continuous cache/tiering layer. Source guide: PDF page(s) 64.

This item is flagged for content review.

383. A large eligible dataset cannot be uploaded over the WAN within the migration window. The data continues to change. Which plan best fits?

Migration design

A.Data Box with no allowance for ordering, shipping, or ingestion
B.Data Box for the bulk load followed by validated delta synchronization and cutover
C.A DNS switch before any source data is transferred
D.A resource tag that automatically transfers source data

✓ Correct answer

Data Box for the bulk load followed by validated delta synchronization and cutover

Physical bulk transfer can address bandwidth limits, but logistics and subsequent changes still require a consistency plan. Ignoring device timing or using tags or premature DNS changes does not transfer a usable dataset. Source guide: PDF page(s) 64.

This item is flagged for content review.

384. A pilot measures effective throughput of 200 megabytes per second. Ignoring overhead only for this calculation, how long does transferring 2,000,000 megabytes take?

Migration design

A.1,000 seconds
B.100 seconds
C.10,000 seconds, about 2.78 hours
D.200,000 seconds, about 55.56 hours

✓ Correct answer

10,000 seconds, about 2.78 hours

2,000,000 MB / 200 MB/s = 10,000 s, approximately 2.78 hours. Other values use incorrect division. A production plan must additionally allow for retries, enumeration, changed data, and validation. Source guide: PDF page(s) 69.

This item is flagged for content review.

385. The target application has passed an initial smoke test. A manager wants to delete the source immediately. Which conditions should govern decommissioning?

Migration design

A.Only the desire to remove migration overlap cost
B.Business acceptance, retention obligations, backup validation, and rollback boundaries
C.Only the existence of a new target VM
D.Only the first successful HTTP response

✓ Correct answer

Business acceptance, retention obligations, backup validation, and rollback boundaries

Decommissioning requires agreed acceptance and recovery and retention conditions. A VM or one HTTP response does not establish those conditions; cost reduction must not bypass them. Source guide: PDF page(s) 64.

This item is flagged for content review.

386. A retailer has two healthy web instances but checkout fails during a zone outage because the order database is unavailable. What is the most useful design correction?

Integrated architecture scenarios · Relational data · High availability · Compute design

A.Review resilience, capacity, and probes across the checkout dependency path
B.Add frontend instances without changing the order database failure boundary
C.Use only a static frontend probe as evidence that the order transaction is available
D.Adopt the frontend SLA as the checkout objective without reviewing the data dependency

✓ Correct answer

Review resilience, capacity, and probes across the checkout dependency path

Availability depends on the complete journey, including the data tier and surviving capacity. Extra frontends do not fix a failed indispensable database; static probes can hide dependency failure; a component SLA is not the journey target. Source guide: PDF page(s) 65.

This item is flagged for content review.

387. A retailer uses an asynchronous SQL secondary for regional recovery. A forced failover occurs during heavy write load. Which two concerns require explicit testing? Select two answers.

Integrated architecture scenarios · Relational data · Backup and disaster recovery

A.Automatic restoration of accidentally deleted rows through replication
B.A guarantee that every acknowledged primary write exists at the secondary
C.Elimination of all failover authorization requirements
D.Application connection behavior and recovery-region capacity
E.Possible loss of recent unreplicated writes

✓ Correct answers

Application connection behavior and recovery-region capacity
Possible loss of recent unreplicated writes

Asynchronous lag can lose recent writes, and recovery must restore a working application with capacity and connectivity. Async replication does not guarantee zero loss or reverse propagated deletion, and failover authority remains necessary. Source guide: PDF page(s) 65.

This item is flagged for content review.

388. A retailer’s app resolves a Blob endpoint to a reachable private IP but receives authorization failures. The app uses a managed identity with no storage data role. What is missing?

Integrated architecture scenarios · Identity and access · Network design · Object, file, and NoSQL data

A.Only a management-plane role to configure the storage account
B.Microsoft Graph API permissions in place of Storage data authorization
C.A different private DNS alias without any change to the already working private route
D.Appropriate Blob data authorization for the managed identity

✓ Correct answer

Appropriate Blob data authorization for the managed identity

The managed identity needs appropriate Blob data authorization at the correct scope. Management-plane configuration rights are not an automatic Blob data-role grant. DNS and routing are already working in this scenario; changing an alias does not supply permissions. Microsoft Graph permissions authorize a different API, not access to the blobs. Source guide: PDF page(s) 65.

This item is flagged for content review.

389. A managed application has feature flags, unavoidable third-party credentials, and access to Azure data services. Which two choices best separate these needs? Select two answers.

Integrated architecture scenarios · Identity and access · Application architecture

A.Store secrets in the application image to avoid runtime permissions
B.Use a shared permanent Owner account as the application identity
C.App Configuration for nonsecret settings and feature flags
D.Key Vault for unavoidable secrets and managed identity where Azure access supports it
E.Put every credential into feature-flag descriptions

✓ Correct answers

App Configuration for nonsecret settings and feature flags
Key Vault for unavoidable secrets and managed identity where Azure access supports it

App Configuration suits nonsecret settings; Key Vault suits secrets; managed identity can eliminate supported stored Azure credentials. Flags, source images, and shared permanent high privilege are inappropriate secret or identity designs. Source guide: PDF page(s) 65.

This item is flagged for content review.

390. A manufacturer has two analytics teams that must independently replay a retained telemetry stream after short outages. Which design best fits?

Integrated architecture scenarios · Application architecture · Integration and analytics

A.Event Hubs with independent consumer groups and checkpoints
B.Event Grid notifications used as if they were an independently replayable retained log
C.One cache record overwritten by every measurement with no retained stream
D.One Service Bus competing-consumer queue shared by the two analytics teams

✓ Correct answer

Event Hubs with independent consumer groups and checkpoints

Event Hubs supplies a retained partitioned stream with independent consumer positions. One competing queue does not give both teams independent full streams, an overwritten cache loses history, and notification delivery is not the required retained-log design. Source guide: PDF page(s) 66.

This item is flagged for content review.

391. A telemetry platform also sends order-processing commands that require completion, dead-letter handling, and ordered processing per order. Which addition best fits this separate path?

Integrated architecture scenarios · Application architecture

A.Event Grid push notifications used as ordered transactional command completion
B.Queue Storage with an assumption of native broker sessions and dead-lettering
C.Event Hubs partition ordering and checkpoints used as business-queue settlement
D.Service Bus with suitable sessions and completion/dead-letter handling

✓ Correct answer

Service Bus with suitable sessions and completion/dead-letter handling

Service Bus offers the required business-messaging mechanisms, including sessions for related ordering and completion/dead-letter handling. Event Hubs ordering and checkpoints are stream-processing mechanisms rather than the required queue settlement model. Queue Storage requires application handling and does not supply the same native sessions/dead-letter features. Event Grid notifications do not provide the specified ordered transactional business queue. Source guide: PDF page(s) 66.

This item is flagged for content review.

392. A worker commits an order update to an external database and crashes before acknowledging the message. On retry, which protection prevents a duplicate business update?

Integrated architecture scenarios · Application architecture

A.Increase message retention without changing business update logic
B.Assume broker duplicate detection suppresses every consumer retry forever
C.Application idempotency or an appropriate transactional design around the side effect
D.Assume acknowledgement guarantees exactly-once effects before it occurs

✓ Correct answer

Application idempotency or an appropriate transactional design around the side effect

Redelivery after a crash can repeat the external side effect. Application idempotency or coordinated transaction design addresses that window. Acknowledgement is incomplete, broker deduplication is not a universal side-effect guarantee, and longer retention does not prevent duplicate updates. Source guide: PDF page(s) 66, 69.

This item is flagged for content review.

393. A hybrid workload has a database RPO tighter than its file-share RPO. A proposal uses identical disk-replication assumptions for every component. Which review is needed?

Integrated architecture scenarios · Backup and disaster recovery · Relational data

A.Remove retained backups because replicated disks are available
B.Assess each dependency’s latest consistent recovery point and supported protection mechanism
C.Use the least demanding file RPO for the whole system automatically
D.Measure only the time for the application VM to boot

✓ Correct answer

Assess each dependency’s latest consistent recovery point and supported protection mechanism

Dependency consistency and RPO can differ; database-native or another supported mechanism may be required. The looser target cannot automatically satisfy the tighter one, boot time is not service recovery, and replication does not replace retained recovery points. Source guide: PDF page(s) 66.

This item is flagged for content review.

394. A hybrid failover test starts the application before DNS, identity, and the database are ready. The VM boots, but no transaction succeeds. Which recovery-plan change is most important?

Integrated architecture scenarios · Backup and disaster recovery · Network design

A.Move routing first and investigate failed dependencies after release
B.Order prerequisites and database recovery before the app, then validate a business transaction
C.Use a static success page as proof of database consistency
D.Stop measuring recovery time once the VM is running

✓ Correct answer

Order prerequisites and database recovery before the app, then validate a business transaction

Recovery orchestration must restore dependency readiness and validate acceptable service. Boot time, a static page, and premature routing do not prove the user journey is recovered. Source guide: PDF page(s) 66.

This item is flagged for content review.

395. Quarterly recovery exercises must not interrupt production or accidentally charge real customers. Which two controls directly address this? Select two answers.

Integrated architecture scenarios · Backup and disaster recovery

A.Share live payment credentials with every test worker
B.Route all production traffic to the rehearsal before validation
C.Skip identity and authorization testing completely
D.Use an isolated test-failover network with suitable test dependencies
E.Prevent test jobs and writers from causing real business side effects

✓ Correct answers

Use an isolated test-failover network with suitable test dependencies
Prevent test jobs and writers from causing real business side effects

Isolation and controlled dependencies prevent interference while allowing useful testing. Premature production routing and live side effects defeat the requirement; omitting identity and authorization leaves recovery readiness unproven. Source guide: PDF page(s) 66.

This item is flagged for content review.

396. RTO is 60 minutes. Detection takes 10 minutes, decision 5, failover 15, routing 5, and business validation 10. Based only on these listed steps, what recovery budget remains?

Integrated architecture scenarios · Backup and disaster recovery

A.5 minutes
B.25 minutes
C.15 minutes
D.45 minutes

✓ Correct answer

15 minutes

The steps total 45 minutes, leaving 15 minutes of the 60-minute RTO. The other values confuse elapsed and remaining time or omit steps. Representative tests still need to validate dependencies and timings. Source guide: PDF page(s) 68.

This item is flagged for content review.

397. A system has RPO 15 minutes and usually replicates within 5 minutes. Which additional evidence is needed before claiming the RPO is met under disaster conditions?

Integrated architecture scenarios · Backup and disaster recovery

A.Only the count of deployed frontend instances
B.Only the duration of the DNS TTL
C.Only the average lag during a quiet day
D.Lag and usable consistent recovery points under representative load and failure conditions

✓ Correct answer

Lag and usable consistent recovery points under representative load and failure conditions

Typical lag is not a worst-case recovery guarantee. Validate replication under stress and the usable state across dependencies. A quiet average, frontend count, or DNS TTL cannot establish the data-loss target. Source guide: PDF page(s) 68.

This item is flagged for content review.

398. A VM API, PaaS database, and external SIEM need guest events, application traces, and platform resource logs. Which collection design covers all three signal types?

Integrated architecture scenarios · Monitoring and logging

A.Application instrumentation, AMA/DCRs, and diagnostic settings with suitable destinations
B.Only AMA on the VM for every platform resource and custom trace
C.Only database diagnostic settings for guest OS events and API exceptions
D.Only a new Log Analytics workspace with no collection settings

✓ Correct answer

Application instrumentation, AMA/DCRs, and diagnostic settings with suitable destinations

Instrumentation covers app traces, AMA/DCRs guest telemetry, and diagnostic settings supported platform categories. An agent cannot replace every PaaS diagnostic setting; database settings do not instrument a VM app; a workspace alone collects none of these required configured paths. Source guide: PDF page(s) 68.

This item is flagged for content review.

399. A spoke client resolves a private storage endpoint correctly, but an on-premises client still resolves the public address. Public access is disabled. Which change addresses the missing hybrid path?

Integrated architecture scenarios · Network design · Object, file, and NoSQL data

A.Re-enable anonymous public access as the only solution
B.Grant Contributor on the storage account without changing DNS
C.Change the spoke VM’s availability zone
D.Configure supported private DNS forwarding/resolution and verify routing from on premises

✓ Correct answer

Configure supported private DNS forwarding/resolution and verify routing from on premises

Hybrid clients need a supported DNS resolution path, such as Private Resolver or forwarding, and private network reachability. Contributor does not fix DNS resolution and does not automatically grant Blob data permissions; public anonymous access is not required; zone placement is irrelevant. Source guide: PDF page(s) 68.

This item is flagged for content review.

400. A datacenter-exit program has compatible VM workloads, web apps suitable for managed hosting, and obsolete systems. Which program decision best reflects the requirements?

Integrated architecture scenarios · Migration design

A.Copy every server unchanged even when it has no business value
B.Require every workload to rebuild before the exit date
C.Use rehost, replatform, and retire decisions per workload based on assessed value and constraints
D.Choose migration tools before identifying any target compatibility

✓ Correct answer

Use rehost, replatform, and retire decisions per workload based on assessed value and constraints

Workload-specific strategies meet differing requirements and deadlines. Universal rebuilding, indiscriminate copying, and tool-first planning ignore value, compatibility, and operational constraints. Source guide: PDF page(s) 67.

This item is flagged for content review.