AZ 305 Sample Questions with Answers and Explanations

AZ 305 sample questions

Az 305 sample questions: answer after options.

Q1

A public sector agency must retain its Azure activity log and resource diagnostic logs for seven years to meet a state archival law. The total volume is estimated at 500 GB over the retention period. The agency does not need to query, alert on, or analyze the logs during that time. You need to recommend the lowest-cost logging solution. What should you recommend?

• A. Send logs to Azure Event Hubs and have a downstream service archive them to cold storage.
• B. Export the logs to a Log Analytics workspace and configure total retention for seven years.
• C. Enable Microsoft Sentinel and stream the diagnostic logs into its workspace with seven-year retention.
• D. Export the logs to an Azure Blob Storage account and apply a time-based retention policy.

Answer: D

The Blob Storage option is correct because the stated constraint is that the logs only need to be kept, not queried, alerted on, or analyzed. Blob storage with a time-based retention policy provides WORM protection for the seven-year period and is less expensive than ingesting and retaining the data in a telemetry platform. The Log Analytics workspace option is the strongest distractor: it is a legitimate log destination and can support long retention, but it adds ingestion and retention costs for query features the agency does not need. General rule: choose a storage archive for long-term compliance, and reserve Log Analytics or Microsoft Sentinel for workloads that actually require interactive analysis, alerting, or security incident investigation.

Q2

A regulated financial services firm is migrating a SQL Server 2019 database from an on-premises datacenter to Azure. Compliance requires a disaster-recovery copy in a different Azure region that must not lose an acknowledged transaction during a failover. The migration must minimize operational overhead without relaxing this requirement. What should you recommend as the migration target?

• A. Deploy SQL Server on Azure VMs with a synchronous-commit Always On Availability Group.
• B. Deploy SQL Server on Azure VMs with an asynchronous-commit Always On Availability Group for disaster recovery.
• C. Create an Azure SQL Database and use active geo-replication to a secondary region.
• D. Create an Azure SQL Database and use a failover group to a secondary region.

Answer: A

The deployed-on-Azure-VMs option is correct because a synchronous-commit Always On Availability Group replicates transactions to the secondary before the primary acknowledges them, so no acknowledged transaction is lost during failover. The strongest distractor is the Azure SQL Database failover-group option: it provides automatic failover and a transparent endpoint, but failover groups are built on active geo-replication, which is asynchronous, so an acknowledged transaction can be lost. Active geo-replication alone and an asynchronous-commit replica have the same limitation. The rule is: when the business requirement is zero data loss, asynchronous PaaS replication or an asynchronous-commit replica cannot be used; choose a solution that supports synchronous-commit replication, commonly SQL Server on Azure VMs with Always On Availability Groups.

Q3

An industrial IoT platform at a factory has 500 vibration sensors on an isolated OT network. The sensors use Modbus TCP and send data to an on-premises gateway, and they cannot be re-flashed. The WAN link from the factory is capped, so streaming raw telemetry to Azure is not viable. Live dashboards in Azure must show filtered machine metrics within seconds. You need to migrate ingestion and monitoring to Azure IoT Hub without changing sensor wiring, addresses, or the gateway's physical placement. What should you recommend?

• A. Keep the current on-premises Modbus gateway and use IoT Hub file upload to send compressed raw telemetry batches to Azure Storage, then run Stream Analytics for monitoring.
• B. Install Azure IoT Edge on the existing on-premises gateway, keep the sensors on Modbus TCP, and filter and aggregate telemetry locally before sending only metrics to IoT Hub.
• C. Run a Modbus-to-MQTT protocol bridge in an Azure VM in a VNet and connect the factory OT network over a site-to-site VPN; the VM forwards raw telemetry to IoT Hub.
• D. Register the sensors with Azure IoT Hub Device Provisioning Service and update their firmware so they send MQTT over TLS directly to IoT Hub instead of using the on-premises gateway.

Answer: B

The capped WAN link is the controlling constraint: the solution must reduce the data before it leaves the factory. The Azure IoT Edge-on-the-existing-gateway option does this by terminating Modbus TCP on the OT network and applying filtering and aggregation at the edge, so only metrics are sent to IoT Hub. The strongest distractor, the Azure VM protocol bridge behind a VPN, is a plausible IaaS migration but it pulls every raw telemetry message across the WAN before any reduction happens, which fails the capped-link requirement. The Device Provisioning Service/firmware option fails the explicit no-reflash constraint, and the batch file-upload option fails the live-dashboard requirement. General rule: when an IoT migration includes an on-premises protocol constraint and a bandwidth ceiling, keep protocol translation and data reduction at the edge rather than in a cloud-only gateway.

Q4

A regulated financial services firm sends trade messages to Azure for real-time risk analytics. The stream peaks at 14 MB/s. Each order for a symbol must be processed in the order it occurred; messages for different symbols can be processed independently. No symbol exceeds 1 MB/s. The proposed design is a single Standard-tier Event Hubs namespace with 20 throughput units and one partition to guarantee global ordering. What should you recommend?

• A. Keep the single partition and raise throughput units to 40. This preserves global ordering and provides enough aggregate ingress.
• B. Create multiple partitions and use the symbol as the partition key. This preserves per-symbol order while spreading symbols across partitions.
• C. Enable Event Hubs Capture to land all events in Azure Data Lake Storage Gen2 and query with Synapse serverless SQL.
• D. Create multiple partitions and send without a partition key. This uses round-robin distribution to maximize throughput across the namespace.

Answer: B

Use multiple partitions, not one, because Event Hubs enforces a per-partition throughput ceiling. A Standard-tier partition is limited to 1 MB/s ingress, so even a namespace with 40 throughput units cannot push 14 MB/s through a single partition. Partitioning by symbol lets Event Hubs route all messages for a symbol to the same partition, preserving per-symbol order, while different symbols can use different partitions and collectively exceed a single partition's cap. The strongest distractor is the option that raises throughput units to 40: it correctly recognizes that aggregate throughput units can cover 14 MB/s, but it misses the ceiling that applies to each partition. The general rule: for ordered event streams, size the partition count for both the ordering key and per-partition throughput, because aggregate capacity does not remove per-partition limits.

Q5

A healthcare provider runs production workloads in Azure and keeps its security operations center on premises. The existing SIEM cannot be replaced and accepts messages only from a designated Azure Event Hubs namespace. A compliance rule requires Azure platform logs to reach the SIEM within two minutes and forbids persisting them in a Log Analytics workspace first. You need to recommend the log routing. What should you recommend?

• A. Use diagnostic settings to write the platform logs to an Azure storage account and have the on-premises SIEM ingest new blobs from that account.
• B. Create diagnostic settings that stream each Azure resource's platform logs directly to the existing Event Hubs namespace that the on-premises SIEM consumes.
• C. Use diagnostic settings to send the platform logs to a Log Analytics workspace; the on-premises SIEM queries that workspace through the Log Analytics API.
• D. Send the platform logs to a Log Analytics workspace, then create a data export rule that streams them to the Event Hubs namespace.

Answer: B

The direct-to-Event Hubs option is correct because diagnostic settings are the native Azure path for streaming platform logs to Event Hubs, and the SIEM can only consume from that designated Event Hubs namespace. The strongest distractor is the Log Analytics workspace plus data export option: it is attractive because the logs still reach Event Hubs, but it stores the logs in Log Analytics before delivery, which the compliance rule forbids and which the direct route avoids. The general rule is that when Azure platform logs must be sent to an external or on-premises SIEM, stream them directly to Event Hubs with diagnostic settings; do not insert Log Analytics unless the solution requires cloud analytics and compliance permits the extra copy.

Q6

Contoso Airlines runs an internet-facing reservation web farm in Azure. A frequent-flyer partner uses a desktop client that pins the origin TLS certificate; any decryption and re-encryption by an intermediary breaks the client. You are adding a front-end network tier and must preserve end-to-end TLS while still providing availability for the web farm. Which solution should you recommend?

• A. Use Azure Front Door with a WAF policy and the web farm configured as an HTTPS origin.
• B. Use a Standard Azure Load Balancer with a public IP and layer-4 rules to the web servers.
• C. Use Azure Application Gateway v2 with WAF, upload the reservation site's certificate, and set the backend as HTTPS.
• D. Run Azure Firewall Premium inline with TLS inspection enabled and alert on certificates the backend does not trust.

Answer: B

This is correct because the stated constraint is that no intermediary may decrypt and re-encrypt the HTTPS flow. A Standard Azure Load Balancer operates at layer 4 and forwards TCP segments intact, so the original TLS session and pinned certificate remain unmodified. Azure Application Gateway and Azure Front Door both terminate client TLS at the front end and open a new TLS connection to the origin, so each fails the no-re-encryption constraint. Azure Firewall Premium with TLS inspection also decrypts and re-encrypts traffic. The strongest distractor is the Application Gateway option: it is the default layer-7 choice for an HTTPS web farm, but its TLS-offload behavior makes it incompatible. Rule: when the requirement is preservation of end-to-end TLS, use a layer-4 pass-through device; only use layer-7 reverse proxies or TLS inspection when your architecture tolerates two TLS sessions.

Q7

An airline sends engine telemetry logs to an Azure Event Hubs namespace. Load testing shows throttling errors despite total ingress being below the namespace's throughput-unit capacity. The logs use the route code as the partition key, and one route accounts for most of the traffic. What should the company do?

• A. Change the partition key so writes are spread across partitions.
• B. Increase the Event Hubs throughput units assigned to the namespace.
• C. Create a new event hub with more partitions and migrate producers.
• D. Add a second Event Hubs namespace for the high-volume route.

Answer: A

The correct action is to change the partition key so writes are spread across partitions. The scenario says total ingress is below the namespace's aggregate throughput-unit capacity, so adding throughput units would not address the actual limit: all logs for the busy route share one partition key, which routes them to the same Event Hubs partition, and a single partition has its own ingestion ceiling. The strongest distractor is the throughput-units option because it is the natural answer to generic Event Hubs throttling, but it treats a namespace-level aggregate limit as the problem when the data points to a partition-level ceiling. The rule that generalises: when an Event Hubs pipeline throttles, first determine whether the limit is aggregate namespace capacity or a single-partition/partition-key hot spot; if it is the latter, fix key distribution, not total capacity.

Q8

Contoso Logistics runs a driver portal that already authenticates users against Contoso's Microsoft Entra ID. The portal must be opened to 4,000 independent owner-operators whose own companies use Microsoft Entra ID. Contoso requires MFA for every sign-in, cannot change the portal's authentication code, and will not create local identities. What should Contoso recommend?

• A. Create a Microsoft Entra B2C tenant with a user flow and switch the portal's OpenID Connect registration to B2C.
• B. Create cloud-only accounts for the owner-operators and use Microsoft Entra Domain Services to authenticate them to the portal.
• C. Federate each owner-operator company to Contoso by using an Active Directory Federation Services farm for portal authentication.
• D. Configure Microsoft Entra B2B collaboration, invite each owner-operator as a guest, and enforce MFA with Conditional Access.

Answer: D

This is correct because the portal already trusts Contoso's Microsoft Entra ID and the binding constraint is no code change. Microsoft Entra B2B collaboration extends that existing tenant to include the owner-operators as guests, so the portal code does not change, and Conditional Access can require MFA for those external users. The strongest distractor is the Microsoft Entra B2C option: B2C is also a real external-identity solution and can provide MFA, but it requires registering the portal against a separate B2C tenant and changing its OpenID Connect configuration, which violates the no-code-change constraint. The rule that generalises is: when an existing app already uses Microsoft Entra ID, add external users with B2B collaboration; choose B2C only when you can modify the application to use a dedicated customer identity platform.

Q9

Contoso Game Studios runs its multiplayer backend on Azure VMs, with player data stored in SQL Server on Azure VMs. The studio requires an RPO of four hours and an RTO of eight hours for this data. A new publisher contract mandates that player-data backups be tamper-proof for one year: no user, including a compromised administrator, may alter, overwrite, or delete backup data after it is written. What should you implement to meet these requirements?

• A. Deploy Azure Site Recovery to a paired Azure region for the VMs and SQL Server Always On availability groups for the databases.
• B. Back up to a Recovery Services vault using geo-redundant storage and enable cross-region restore to a paired Azure region.
• C. Enable backup immutability on the Recovery Services vault, then protect the VMs and SQL Server databases with Azure Backup.
• D. Back up to a Recovery Services vault using zone-redundant storage and enable soft delete to protect backup data from accidental deletion.

Answer: C

This is correct because Azure Backup's immutable vault makes recovery points non-deletable and unchangeable for the configured immutability period, and it protects both Azure VMs and SQL Server on Azure VMs. The geo-redundant backup with cross-region restore option is the strongest distractor: it is a solid disaster-recovery configuration, but geo redundancy only addresses regional loss and does not stop an administrator from deleting or altering backup copies. The soft-delete option also fails because soft delete is an accidental-deletion safeguard that a compromised administrator can disable. General rule: if a compliance requirement says backups must be tamper-proof or immutable for a defined period, choose an immutable vault or immutable storage; geo-redundancy, soft delete, and replication are complementary but not substitutes.

More: objectives · practice test · study plan

Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.