305-Good One

Q1. A company is migrating a customer-facing e-commerce platform to Azure. Requirements: global users | HTTP/HTTPS routing | WAF | instant regional failover | minimal operational complexity. Which service should be the primary global entry point? A. Azure Traffic Manager | B. Azure Front Door | C. Azure Application Gateway in each region | D. Azure Load Balancer

Correct choice: B

Q2. A company hosts an internal regional line-of-business web application in Azure. Requirements: Layer 7 routing | WAF | no global distribution. Which service best fits? A. Azure Front Door | B. Azure Traffic Manager | C. Azure Application Gateway | D. Azure Load Balancer

Correct choice: C

Q3. An Azure Storage account must not be reachable from the public internet. Access must come only from approved virtual networks, and the design should minimize custom network appliances. What should you use? A. Service Endpoints | B. Private Endpoints | C. VPN Gateway | D. Azure Firewall

Correct choice: B

Q4. Azure VMs in a subnet need secure access to Azure SQL Database over the Azure backbone with the least configuration overhead. Public network access can remain enabled. Which should you use? A. Private Endpoint | B. Service Endpoint | C. ExpressRoute | D. VPN Gateway

Correct choice: B

Q5. A company must connect on-premises to Azure for mission-critical workloads with predictable latency, high throughput, and private connectivity. Budget matters, but reliability is the top priority. Which should you recommend? A. VPN Gateway | B. VNet Peering | C. ExpressRoute | D. Private Endpoint

Correct choice: C

Q6. Two Azure virtual networks in the same tenant must exchange traffic with low latency without traversing the public internet. Which should you recommend? A. VNet Peering | B. ExpressRoute | C. Private Endpoint | D. Site-to-Site VPN

Correct choice: A

Q7. Administrators need just-in-time role elevation, automatic expiration of privileged access, approval workflows, and audit history. Which solution best fits? A. Azure RBAC | B. Microsoft Entra PIM | C. Azure Policy | D. Conditional Access

Correct choice: B

Q8. Developers need permissions to manage resources only in one resource group and nowhere else. The company wants least privilege. What should you use? A. Azure Policy | B. Azure RBAC scoped to the resource group | C. Management Groups | D. Azure Blueprints

Correct choice: B

Q9. The platform team must prevent deployment of unapproved VM SKUs across many subscriptions and enforce a required tagging standard. What should you use first? A. Azure RBAC | B. Azure Policy | C. Azure Advisor | D. Azure Monitor

Correct choice: B

Q10. A company needs to deploy repeatable landing zones that include policy assignments, role assignments, and ARM/Bicep resources across multiple subscriptions. Which option is the best fit? A. Azure Load Balancer | B. Azure Blueprints-style landing zone pattern | C. Azure Advisor | D. Service Endpoints

Correct choice: B

Q11. A company needs to copy data nightly from on-prem SQL Server and a SaaS application into Azure Data Lake Storage, with light transformation and reusable scheduling. Which service should orchestrate this? A. Azure Functions | B. Azure Data Factory | C. Azure Synapse dedicated SQL pool | D. Azure SQL Database

Correct choice: B

Q12. A company wants one analytics platform that can query data with SQL, process large-scale data with Spark, integrate pipelines, and reduce the number of services to manage. Which should you choose? A. Azure Data Factory + Azure SQL Database | B. Azure Data Lake + Azure Databricks | C. Azure Synapse Analytics | D. Azure Cosmos DB

Correct choice: C

Q13. A data engineering team needs advanced Spark notebooks, complex data engineering workflows, and fine-grained control over Apache Spark processing. What should you recommend? A. Azure SQL Database | B. Azure Databricks | C. Azure Functions | D. Azure App Service

Correct choice: B

Q14. A company needs a storage platform for petabytes of raw structured, semi-structured, and unstructured data at the lowest possible cost, with analytics run only occasionally. Which should you recommend? A. Azure Data Lake Storage | B. Azure SQL Database | C. Azure Cosmos DB | D. Azure App Service

Correct choice: A

Q15. A company needs a globally distributed NoSQL database with low-latency reads and writes, multi-region replication, and flexible consistency options. Which service fits best? A. Azure SQL Database | B. Azure Cosmos DB | C. Azure Data Lake Storage | D. Azure Synapse Analytics

Correct choice: B

Q16. A finance app requires relational storage, ACID transactions, and high availability within a region, but not global write distribution. Which service is best? A. Azure Cosmos DB | B. Azure SQL Database | C. Azure Data Lake Storage | D. Azure Event Hubs

Correct choice: B

Q17. A streaming analytics solution must ingest millions of telemetry events per hour from devices and retain them only long enough for downstream processing. Which service is the best ingestion entry point? A. Azure API Management | B. Azure Event Hubs | C. Azure SQL Managed Instance | D. Azure Backup

Correct choice: B

Q18. An application must react to product image uploads by resizing the image and updating metadata. The solution should be event-driven, autoscale, and minimize management. Which compute option is best? A. Virtual Machine Scale Sets | B. Azure Functions | C. Azure Kubernetes Service | D. Azure Databricks

Correct choice: B

Q19. A company needs to deploy a standard customer web application with autoscaling, built-in deployment slots, and minimal server management. No container orchestration or OS access is required. Which service fits best? A. Azure Kubernetes Service | B. Azure Virtual Machines | C. Azure App Service | D. Azure Batch

Correct choice: C

Q20. A company must run containerized microservices and needs full control over orchestration, rolling upgrades, and horizontal scaling. Which service should be recommended? A. Azure Functions | B. Azure Kubernetes Service | C. Azure App Service | D. Azure Logic Apps

Correct choice: B

Q21. A legacy application requires full OS-level customization, custom drivers, and scaling based on demand. Which Azure compute option is the best fit? A. Azure App Service | B. Azure Virtual Machine Scale Sets | C. Azure Functions | D. Azure Container Apps

Correct choice: B

Q22. A mission-critical set of Azure VMs must stay available if an entire datacenter in one region fails. Cross-region failover is not required. What should you use? A. Azure Site Recovery | B. Availability Zones | C. Azure Backup | D. Geo-redundant storage

Correct choice: B

Q23. A business-critical application running on Azure VMs must automatically fail over to another region during a regional outage with minimal data loss. Which service best fits? A. Azure Backup | B. Azure Site Recovery | C. Azure Monitor | D. Azure Load Balancer

Correct choice: B

Q24. The requirement is to recover accidentally deleted files and retain backup copies for seven years for compliance. No application failover is needed. Which should you choose? A. Azure Site Recovery | B. Azure Backup | C. Traffic Manager | D. VNet Peering

Correct choice: B

Q25. A solution must monitor metrics and logs across multiple subscriptions, support KQL queries, and trigger alerts from telemetry. Which should you recommend? A. Azure Advisor | B. Azure Monitor with Log Analytics | C. Azure Policy | D. Microsoft Entra PIM

Correct choice: B

Q26. An architect needs a service that identifies underutilized resources, recommends cost optimizations, and highlights resiliency and security improvements. Which service should be used? A. Azure Advisor | B. Azure Monitor | C. Azure Policy | D. Azure Automation

Correct choice: A

Q27. A global application must route users to the lowest-latency endpoint using DNS only. WAF and Layer 7 routing are not required. Which service best fits? A. Azure Front Door | B. Azure Traffic Manager | C. Azure Application Gateway | D. Azure Bastion

Correct choice: B

Q28. A company needs highly available Layer 4 load balancing across a pool of Azure VMs inside one region. Which service is most appropriate? A. Azure Application Gateway | B. Azure Front Door | C. Azure Load Balancer | D. Azure Traffic Manager

Correct choice: C

Q29. A company uses Microsoft Entra ID and wants to require MFA only when users sign in from untrusted locations or unsupported devices. Which feature should you recommend? A. Azure RBAC | B. Conditional Access | C. Azure Policy | D. Azure Lighthouse

Correct choice: B

Q30. An enterprise uses many subscriptions grouped by environment and business unit. Leadership wants centralized governance boundaries and inherited policy assignment at the highest level. Which Azure construct should be used? A. Resource Groups | B. Management Groups | C. Availability Sets | D. Proximity Placement Groups

Correct choice: B

Q31. A company stores archival legal data that is rarely retrieved, may tolerate hours of rehydration, and must minimize storage cost. Which blob tier should be chosen? A. Hot | B. Cool | C. Archive | D. Premium

Correct choice: C

Q32. A company needs to deploy an Azure web app in multiple regions and present a single global HTTPS endpoint with rapid regional failover, edge acceleration, and WAF. The application uses only HTTP/S. What should be the front-end service? A. Azure Front Door | B. Azure Traffic Manager | C. Azure Load Balancer | D. Azure VPN Gateway

Correct choice: A

Q33. An architect must choose between Azure Backup and Azure Site Recovery. The stated requirement is: restore an application to the last good data point after accidental corruption, but failover orchestration is explicitly out of scope. Which is best? A. Azure Backup | B. Azure Site Recovery | C. Availability Zones | D. Azure Front Door

Correct choice: A

Q34. A company wants to keep sensitive data in a storage account inaccessible from the public internet while allowing access only from a specific subnet. Later, an auditor asks whether the PaaS service still exposes a public endpoint. Which answer is true if Service Endpoints were used? A. No, Service Endpoints remove the public endpoint entirely | B. Yes, Service Endpoints still use the public endpoint, just restricted by subnet identity | C. No, Service Endpoints always create a private IP in the VNet | D. Yes, but traffic leaves the Microsoft backbone

Correct choice: B

Q35. A company needs an analytics design for semi-structured and unstructured data from many sources. Requirements: use SQL for BI teams | use Spark for data engineers | reduce operational complexity by favoring one integrated service where practical. Which option is best? A. Azure Synapse Analytics | B. Azure Databricks + Azure SQL Database | C. Azure Functions + Azure SQL Database | D. Azure App Service + Event Grid

Correct choice: A

Q36. A company runs a regional application behind a web application firewall and now plans a second region for disaster recovery. The company wants the simplest global HTTP/S routing layer while preserving the existing regional reverse proxies if needed. Which primary global service should be added? A. Azure Front Door | B. Azure Load Balancer | C. VNet Peering | D. Azure Bastion

Correct choice: A

Q1. A retail company is redesigning its public shopping site. Requirements: users in North America, Europe, and Asia must connect to the nearest entry point | HTTPS only | built-in WAF required | automatic regional failover required | solution must avoid managing separate reverse proxies in every region. Which service should be the primary global entry point? A. Azure Traffic Manager | B. Azure Front Door | C. Azure Application Gateway | D. Azure Load Balancer

Correct choice: B

Q2. A bank hosts an internal HR application in a single Azure region. Requirements: URL-based routing between multiple backend pools | TLS termination | WAF | no global routing requirement. Which service is the best fit? A. Azure Front Door | B. Azure Traffic Manager | C. Azure Application Gateway | D. Azure Load Balancer

Correct choice: C

Q3. A company must let application servers in one subnet access an Azure Storage account. Requirements: traffic should stay on the Azure backbone | public network access to the storage account may remain enabled | minimal setup is preferred. What should be used? A. Private Endpoint | B. Service Endpoint | C. VPN Gateway | D. ExpressRoute

Correct choice: B

Q4. A healthcare workload uses Azure SQL Database. Requirements: the database must not expose any public endpoint | only selected VNets may connect | the design should avoid custom NVA appliances. What should be implemented? A. Service Endpoint | B. Private Endpoint | C. Azure Firewall | D. Site-to-Site VPN

Correct choice: B

Q5. A manufacturer needs connectivity from on-premises datacenters to Azure. Requirements: private connection | predictable latency | high throughput | business states that production systems are mission critical even though cost should be considered. Which solution best meets the requirements? A. VPN Gateway | B. ExpressRoute | C. VNet Peering | D. Private Endpoint

Correct choice: B

Q6. Two Azure VNets in different subscriptions under the same tenant must exchange traffic. Requirements: low latency | traffic must stay on Microsoft network | no on-premises connectivity needed. What should be recommended? A. VNet Peering | B. ExpressRoute | C. VPN Gateway | D. Private Endpoint

Correct choice: A

Q7. A company wants administrators to activate privileged roles only when needed. Requirements: approval workflow | time-bound elevation | audit trail | automatic removal after the task. Which feature should be used? A. Azure RBAC | B. Microsoft Entra PIM | C. Conditional Access | D. Azure Policy

Correct choice: B

Q8. A security team wants to block creation of resources in unapproved regions and require a specific cost-center tag on all new resources across many subscriptions. Which service should enforce the rule? A. Azure RBAC | B. Azure Policy | C. Azure Advisor | D. Management Groups

Correct choice: B

Q9. A development team needs Contributor access only within a single resource group for one project environment. The company wants least privilege and no access anywhere else. What should be used? A. Azure RBAC assignment at resource-group scope | B. Azure Policy assignment at subscription scope | C. Management Group assignment | D. Conditional Access

Correct choice: A

Q10. A company uses multiple subscriptions for prod, test, and dev. Executives want governance inherited from a hierarchy above subscriptions so policies and access can be centrally organized. Which Azure construct should be used? A. Resource Groups | B. Management Groups | C. Availability Sets | D. Proximity Placement Groups

Correct choice: B

Q11. A cloud operations team wants recommendations about underutilized resources, cost reduction opportunities, resiliency improvements, and security suggestions. Which service should be used? A. Azure Monitor | B. Azure Advisor | C. Azure Policy | D. Log Analytics

Correct choice: B

Q12. A platform team needs centralized telemetry for several subscriptions. Requirements: collect platform metrics and logs | run KQL queries | build alerts based on conditions | minimize service sprawl. Which solution best fits? A. Azure Policy | B. Azure Monitor with Log Analytics | C. Microsoft Entra PIM | D. Azure Blueprints

Correct choice: B

Q13. A company must ingest data every night from on-prem SQL Server, Oracle, and a SaaS CRM. Requirements: scheduling | reusable connectors | light transformations | no need for advanced analytics in the orchestrator. Which service should perform the orchestration? A. Azure Functions | B. Azure Data Factory | C. Azure Synapse dedicated SQL pool | D. Azure App Service

Correct choice: B

Q14. A data platform must support BI analysts who use SQL and data engineers who use Spark. Requirements: integrated pipelines | fewer services to manage | combination of structured and unstructured data. Which service should be the primary analytics platform? A. Azure Databricks plus Azure Data Lake Storage | B. Azure Synapse Analytics | C. Azure SQL Database | D. Azure Cosmos DB

Correct choice: B

Q15. A research team needs collaborative notebooks, advanced Spark configuration, and complex data engineering workflows with fine-grained Spark controls. What should be recommended? A. Azure SQL Database | B. Azure Databricks | C. Azure Functions | D. Azure Application Gateway

Correct choice: B

Q16. A company needs to store petabytes of raw data from web logs, documents, sensor data, and images. Requirements: very low storage cost | analytics run only on demand | raw files must be preserved. Which storage service is the best fit? A. Azure Data Lake Storage | B. Azure SQL Database | C. Azure Cosmos DB | D. Azure Managed Disks

Correct choice: A

Q17. An e-commerce platform needs a database for product catalogs and shopping sessions. Requirements: global distribution | low-latency reads and writes worldwide | automatic multi-region replication | flexible consistency. Which service best fits? A. Azure SQL Database | B. Azure Cosmos DB | C. Azure Files | D. Azure Data Lake Storage

Correct choice: B

Q18. A financial transaction system needs ACID transactions, relational schema, and T-SQL compatibility. Requirements: managed platform | high availability within a region | no need for global multi-master writes. Which should be used? A. Azure Cosmos DB | B. Azure SQL Database | C. Azure Blob Storage | D. Azure Event Hubs

Correct choice: B

Q19. A solutions architect must recommend a blob tier for compliance data. Requirements: files are rarely accessed | retention is measured in years | the lowest possible storage cost matters more than retrieval time. Which tier should be selected? A. Hot | B. Cool | C. Archive | D. Premium

Correct choice: C

Q20. A company streams millions of telemetry messages per hour from field devices. Requirements: highly scalable ingestion | temporary buffering before downstream processing | event streaming semantics. Which service should be the ingress point? A. Azure Event Hubs | B. Azure Service Bus queues | C. Azure SQL Database | D. Azure Backup

Correct choice: A

Q21. A line-of-business application must execute code whenever new files land in Blob Storage. Requirements: event-driven | automatic scaling | minimal operational management. Which compute service is the best fit? A. Azure Virtual Machine Scale Sets | B. Azure Functions | C. Azure Kubernetes Service | D. Azure Batch

Correct choice: B

Q22. A company is deploying a straightforward customer web application. Requirements: autoscaling | deployment slots | integrated authentication options | no need for OS-level access or container orchestration. Which service should be used? A. Azure Kubernetes Service | B. Azure Virtual Machines | C. Azure App Service | D. Azure Databricks

Correct choice: C

Q23. A software company is standardizing containerized microservices. Requirements: Kubernetes orchestration | rolling upgrades | pod scaling | support for service meshes in the future. Which Azure service best fits? A. Azure Functions | B. Azure Kubernetes Service | C. Azure App Service | D. Azure Logic Apps

Correct choice: B

Q24. A legacy application requires custom drivers and full control over the Windows OS. Requirements: scale out automatically across identical instances during peak periods. Which compute option should be selected? A. Azure App Service | B. Azure Virtual Machine Scale Sets | C. Azure Functions | D. Azure Container Apps

Correct choice: B

Q25. A manufacturing ERP system runs on Azure VMs in one region. Requirements: survive a datacenter failure within that region | application should remain available | no cross-region DR requirement. Which design feature addresses the requirement most directly? A. Azure Site Recovery | B. Availability Zones | C. Azure Backup | D. Traffic Manager

Correct choice: B

Q26. A critical three-tier application runs on Azure VMs. Requirements: regional disaster recovery | orchestrated failover to a paired region | minimal data loss | recovery of full workloads, not just files. Which service should be recommended? A. Azure Backup | B. Azure Site Recovery | C. Availability Sets | D. Geo-zone-redundant storage

Correct choice: B

Q27. A company must protect against accidental deletion and logical corruption of files. Requirements: restore to a previous point in time | keep copies for seven years | failover is not needed. Which service best fits? A. Azure Site Recovery | B. Azure Backup | C. Azure Front Door | D. VNet Peering

Correct choice: B

Q28. A company plans a global web application with origins in three regions. Requirements: WAF | edge acceleration | near-instant failover | single anycast entry point | HTTP/S only. Which service should front the application? A. Azure Traffic Manager | B. Azure Front Door | C. Azure Application Gateway | D. Azure Load Balancer

Correct choice: B

Q29. A company wants clients to reach the nearest endpoint using DNS responses only. Requirements: global distribution | health-probe-based failover | no WAF needed | no Layer 7 proxying needed. Which service is the most appropriate? A. Azure Front Door | B. Azure Traffic Manager | C. Azure Application Gateway | D. Azure Load Balancer

Correct choice: B

Q30. An architect must design highly available TCP traffic distribution across a set of Azure VMs in one region. Requirements: Layer 4 load balancing only | private and public endpoints may be used. What should be recommended? A. Azure Load Balancer | B. Azure Application Gateway | C. Azure Front Door | D. Azure Traffic Manager

Correct choice: A

Q31. Users sign in from managed laptops and personal devices. Requirements: require MFA only when the sign-in is from risky conditions such as untrusted locations or unsupported devices. Which feature best meets the requirement? A. Azure RBAC | B. Conditional Access | C. Azure Policy | D. Management Groups

Correct choice: B

Q32. A platform architect needs a repeatable environment deployment model that includes policy assignments, role assignments, and infrastructure artifacts for many subscriptions. Which exam answer is the best fit? A. Azure Blueprints-style landing zone pattern | B. Azure Monitor | C. Azure Firewall | D. Conditional Access

Correct choice: A

Q33. A public API is deployed to two Azure regions. Existing regional architecture already uses Application Gateway for path-based routing and WAF in each region. Management now wants the simplest global HTTP/S layer to direct users across regions. What should be added? A. Azure Front Door | B. Azure Load Balancer | C. Azure Route Server | D. ExpressRoute

Correct choice: A

Q34. A workload stores sensitive application data in a Storage account. Security states that no public endpoint must exist for the data plane. Later, an auditor asks what would be true if Service Endpoints were used instead. Which statement would be correct? A. Service Endpoints create a private IP for the storage account in the VNet | B. Service Endpoints remove the public endpoint entirely | C. Service Endpoints still use the public endpoint but restrict access by subnet identity | D. Service Endpoints force traffic to leave the Microsoft backbone

Correct choice: C

Q35. A startup wants to keep a customer-facing site highly available within one region. Requirements: protect from a single VM host failure | no need for datacenter-level isolation | lowest design complexity. Which option is most appropriate? A. Availability Sets | B. Azure Site Recovery | C. ExpressRoute | D. Traffic Manager

Correct choice: A

Q36. Analysts need to query files stored in a data lake only when reports are generated. Requirements: avoid paying for always-on compute | preserve raw files | keep storage and compute loosely coupled. Which design best fits? A. Azure Synapse dedicated SQL pool over SQL tables only | B. Azure Data Lake Storage with serverless/on-demand analytics | C. Azure App Service with local disk | D. Azure Cache for Redis

Correct choice: B

Q37. A company runs SaaS integration workloads that connect APIs, transform messages lightly, and trigger workflows. Requirements: event-driven orchestration with many connectors and minimal custom code. Which service is the best fit? A. Azure Logic Apps | B. Azure Virtual Machines | C. Azure Kubernetes Service | D. Azure Load Balancer

Correct choice: A

Q38. An architect is deciding between Azure Backup and Azure Site Recovery for a SQL-based application. Requirement document emphasizes application failover during regional outage, boot order sequencing, and testing recovery plans. Which service should be chosen? A. Azure Backup | B. Azure Site Recovery | C. Azure Data Lake Storage | D. Azure Advisor

Correct choice: B

Q39. A company needs a secure connection from Azure App Service to Azure Storage. Requirement states: block all public access to the storage account and keep traffic private over Microsoft network. Which option best satisfies the requirement? A. Service Endpoint | B. Private Endpoint | C. Azure Bastion | D. VNet Peering

Correct choice: B

Q40. A data architecture must ingest from many sources, keep raw data cheaply, and support both BI users and data engineers. Requirement specifically says to reduce operational complexity by using the fewest analytics services practical. Which recommendation best fits? A. Azure Databricks plus Azure SQL Database | B. Azure Synapse Analytics as the primary analytics platform | C. Azure Functions plus Azure Files | D. Azure Application Gateway plus Cosmos DB

Correct choice: B

Q41. A company builds a partner integration solution. Requirements: queued, durable messaging between decoupled business systems | support for ordered message processing and transactions in messaging workflows. Which service best fits? A. Azure Event Hubs | B. Azure Service Bus | C. Azure Front Door | D. Azure DNS

Correct choice: B

Q42. A company wants to reduce the blast radius of administrative mistakes. Requirements: separate subscriptions for dev, test, and prod | centralized policies at a higher scope | independent billing boundaries. Which design choice supports the requirement best? A. Multiple resource groups in one subscription | B. Separate subscriptions organized by Management Groups | C. Separate VNets in one subscription | D. Multiple App Service plans in one subscription

Correct choice: B

Q43. A web workload must provide private access from on-premises users to an Azure web app hosted behind a regional reverse proxy. Requirements: Layer 7 inspection at the regional entry point | private front-end access only. Which service should be used at the regional edge? A. Azure Application Gateway | B. Azure Front Door | C. Azure Traffic Manager | D. Azure Load Balancer

Correct choice: A

Q44. A company needs to store business documents for branch offices using SMB and standard file share semantics. Users and legacy apps expect mounted file shares rather than object storage. Which Azure storage service is the best fit? A. Azure Blob Storage | B. Azure Files | C. Azure Data Lake Storage | D. Azure Queue Storage

Correct choice: B

Q45. A company is selecting a DR design for a database tier. Requirements: read access to a secondary region for reporting and regional redundancy for the storage layer, but not full VM/app failover orchestration. Which data redundancy option best matches the requirement? A. LRS | B. ZRS | C. GRS | D. RA-GRS

Correct choice: D