Free AZ-305 practice test: 30 questions with answers

Policy assigned at a management group is inherited by all child subscriptions, including new ones, which enforces consistency at scale. Manual per-subscription assignments drift, manual tags are not enforced, and spreadsheets do not enforce anything.

PIM provides just-in-time elevation with approvals, time limits, audit and access reviews across Azure and Entra roles. Permanent Owner rights, shared accounts and broad global admin rights create standing privilege and weak accountability.

A deny policy blocks the creation of resources that violate the rule regardless of role, which enforces the requirement. Reminders, tags and non-inherited rules do not prevent deployment.

The Activity Log records control-plane operations, and routing it to Log Analytics allows alerting and retention. Guest OS logs do not capture management operations, Advisor gives recommendations, and the pricing page is not an audit record.

Per-identity RBAC grants access narrowly, and diagnostic logs provide an audit trail of each access. Configuration files expose secrets, administrator roles are excessive, and shared keys cannot be audited per application.

ExpressRoute provides private, high-bandwidth connectivity with service-level commitments, and redundant circuits improve availability. A single VPN tunnel has lower bandwidth and availability, public internet paths are not private, and Bastion provides administrative access.

App Service provides deployment slots for testing and swapping releases, along with autoscale rules. A manually deployed VM, Batch and Lab Services do not provide this web hosting model.

AKS with the cluster autoscaler adds and removes nodes as workloads demand, which suits microservices. A single container instance, virtual desktops and blob storage do not orchestrate scalable container platforms.

Global routing sends users to the nearest healthy backend, and deploying close to users reduces round-trip time. Routing everything through one region, disabling caching and a single regional IP all increase latency for distant users.

Azure Monitor collects metrics and logs, Log Analytics stores and queries them centrally, and alert rules notify teams. Cost management, lab services and the pricing calculator are not monitoring platforms.

Premium SSD v2 and Ultra Disks provide high IOPS and low latency for demanding database workloads. HDDs are slow, archive tiers are for rarely accessed blobs, and Cool file tiers are not VM data disks.

Azure Files provides managed SMB file shares that many virtual machines can mount. Table and queue storage are not file shares, and archive blobs are not accessed as SMB shares.

Cosmos DB supports multi-region writes with low latency across regions. A single-region SQL database, a single-region table service and Azure Files do not meet the multi-write global requirement.

Immutable storage with a time-based retention policy prevents modification or deletion for the retention period, which meets compliance needs. Shared drives, short-lived snapshots and public containers do not provide that guarantee.

The archive tier has the lowest storage cost for rarely accessed data, with rehydration needed before reading. Hot and premium tiers cost more for storage, and the cool tier is designed for less frequent access than daily reads.

Internal load balancers and private addresses keep the application off the internet, and ExpressRoute or VPN provide the private path from on-premises. Public load balancers, public VMs and email access expose or fail to serve the application.

A hub with Azure Firewall and user-defined routes forces spoke traffic through the firewall for inspection. Direct peering without a firewall, public IPs and separate tenants do not provide central inspection.

A CDN or Front Door caches content at edge locations, which reduces origin egress and speeds delivery. Office copies, disabled caching and couriers do not improve delivery for users at scale.

Private DNS zones resolve private names inside Azure, and forwarding from on-premises DNS makes those names available to on-premises clients. Public records for private IPs, hosts files and IP-only access do not scale or secure private resolution.

Network security groups with application security groups let rules target groups of VMs by role, which simplifies management. Public IPs, disabled filtering and shared passwords do not control traffic between roles.

An active-passive design with failover groups or Site Recovery can restore service in a secondary region within a short recovery time. Single-region deployments, tape restores and same-region backups cannot meet a fast regional failover target.

Auto-failover groups provide automatic failover to a secondary region and a stable listener endpoint for applications. Same-zone replicas, local backups and CSV exports do not provide regional failover with one endpoint.

Availability zones are separate datacentres within a region, and zone-redundant resources continue when one zone fails. Availability sets protect against hardware faults within a datacentre, a single VM has no redundancy, and manual failover causes downtime.

Zone redundancy protects against datacentre failures within a region, and geo-replication or failover groups protect against regional failures. Same-region-only backups, no backups and disabled backups all leave the workload exposed.

The recovery point objective is the maximum acceptable data loss, so frequent backups or replication are needed to meet 15 minutes. Weekly or three-day backups and no backup cannot meet this objective.

Spot VMs offer large discounts for interruptible workloads, and scale sets can manage capacity. Dedicated hosts running constantly, fixed on-demand VMs and reservations for a few hours of use all cost more than necessary for this pattern.

A scale set with a custom image supports the required OS and drivers and scales out with autoscale rules. Functions do not run the legacy stack, a single VM cannot scale out, and containers cannot run the required drivers.

Azure Batch schedules parallel and high-performance jobs across pools of nodes, which suits simulations. Bastion provides access, Front Door routes web traffic, and Monitor workbooks visualize data.

Functions on consumption-style plans scale to zero and bill per execution, which suits event-driven image processing. Fixed App Service plans, always-on VMs and dedicated hosts cost money while idle.

Platform services remove OS patching from the customer when full OS control is not required. Manually patched VMs, colocation servers and office hardware leave patching to the company.