Practice Test #3

Simulate the real exam experience with 50 questions and a 100-minute time limit. Practice with AI-verified answers and detailed explanations.

50Questions100Minutes700/1000Passing Score

Browse Practice Questions

AI-Powered

Triple AI-Verified Answers & Explanations

Every answer is cross-verified by 3 leading AI models to ensure maximum accuracy. Get detailed per-option explanations and in-depth question analysis.

GPT Pro

Claude Opus

Gemini Pro

Per-option explanations

In-depth question analysis

3-model consensus accuracy

Practice Questions

Question 1

(Select 3)

You are designing a large Azure environment that will contain many subscriptions. You plan to use Azure Policy as part of a governance solution. To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Want to practice all questions on the go?

Download Cloud Pass — includes practice tests, progress tracking & more.

Other Practice Tests

Start Practicing Now

Download Cloud Pass and start practicing all Microsoft AZ-305 exam questions.

Want to practice all questions on the go?

Get the app

Download Cloud Pass — includes practice tests, progress tracking & more.

Question 2

You are designing an application that will be hosted in Azure. The application will host video files that range from 50 MB to 12 GB. The application will use certificate-based authentication and will be available to users on the internet. You need to recommend a storage option for the video files. The solution must provide the fastest read performance and must minimize storage costs. What should you recommend?

Question Analysis

Core concept: This question tests choosing the right Azure storage service for large unstructured objects (video files) with internet access, strong authentication, high read performance, and low cost. For AZ-305, this maps to selecting the appropriate data platform and access pattern (object storage vs file shares vs database). Why the answer is correct: Azure Blob Storage is the primary Azure service for storing and serving large binary objects (50 MB to 12 GB) efficiently. It provides the best cost/performance fit for internet-facing content delivery scenarios because it is optimized for high-throughput reads, supports tiering to minimize cost, and integrates cleanly with secure access mechanisms. For “fastest read performance,” Blob Storage can be paired with Azure CDN or Front Door for edge caching and acceleration, which is the typical architecture for global video delivery. For “minimize storage costs,” Blob supports Hot/Cool/Archive access tiers and lifecycle management rules to automatically move older/less-accessed videos to cheaper tiers. Key features and best practices: - Performance: Blob Storage supports high throughput and large object sizes; using Premium Block Blob can further increase performance for demanding workloads, while Standard is usually most cost-effective. - Cost optimization: Use lifecycle policies to transition blobs from Hot to Cool/Archive based on last access/modified time; consider reserved capacity for predictable storage. - Secure internet access: Use Azure AD integration where applicable, SAS tokens, stored access policies, and/or private endpoints (for internal access). For certificate-based authentication, a common pattern is to authenticate users/app via certificates to an identity provider or API, then issue short-lived SAS for blob reads. - Well-Architected alignment: Cost Optimization (tiering, lifecycle), Performance Efficiency (CDN/Front Door caching), Security (least privilege via SAS/AAD, encryption at rest). Common misconceptions: Azure Files can look attractive because it’s “file storage,” but it’s SMB/NFS-oriented and typically not the best/cheapest for large-scale internet content distribution. ADLS Gen2 is built on Blob but is optimized for analytics and hierarchical namespace scenarios, not primarily for serving public video content. SQL Database is not suitable for large video binaries. Exam tips: For large media files served to internet users, default to Azure Blob Storage (often with CDN/Front Door). Use access tiers and lifecycle management for cost control, and use SAS/AAD patterns for secure access rather than exposing storage keys.

Question 3

(Select 2)

You have an Azure subscription that contains an Azure Blob Storage account named store1. You have an on-premises file server named Server1 that runs Windows Server 2016. Server1 stores 500 GB of company files. You need to store a copy of the company files from Server1 in store1. Which two possible Azure services achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Question 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements: ✑ Provide access to the full .NET framework. ✑ Provide redundancy if an Azure region fails. ✑ Grant administrators access to the operating system to install custom application dependencies. Solution: You deploy an Azure virtual machine scale set that uses autoscaling. Does this meet the goal?

Question Analysis

Core concept: This question tests Azure governance controls for regional compliance using Azure Policy. The requirement is to deploy App Service instances only to specific Azure regions, and ensure the resources for the App Service instances reside in the same region. Why the answer is correct: Recommending an Azure Policy initiative that enforces the location of resource groups does NOT meet the goal. Resource group location is metadata for the resource group container and does not control or guarantee the locations of resources deployed into that resource group. You can create a resource group in one region (e.g., West Europe) and deploy resources into another region (e.g., North Europe). Therefore, enforcing resource group location does not enforce App Service (or App Service plan) region, nor does it ensure all related resources are co-located. Key features / correct approach: To meet the regulatory requirement, you should enforce allowed locations at the resource level using built-in Azure Policy definitions such as: - “Allowed locations” (subscription or management group scope) to restrict which regions resources can be created in. - Resource-type specific location policies (e.g., for Microsoft.Web/serverfarms and Microsoft.Web/sites) if you need more granular control. Additionally, to ensure App Service resources are in the same region, remember that an App Service app’s region is determined by its App Service plan. Enforce the plan’s location and/or deny creation of apps not matching the plan’s region (often handled operationally and via policy targeting the plan and app types). For Azure SQL Database, enforce its allowed locations separately (Microsoft.Sql/servers). This aligns with Azure Well-Architected Framework governance and compliance practices (Policy-as-code, preventative controls). Common misconceptions: A frequent misunderstanding is assuming resource group location dictates resource location. It does not. Another misconception is thinking a single policy on resource groups will automatically co-locate dependent resources; co-location requires policies applied to the actual resource types (and sometimes deployment templates/initiatives that coordinate multiple resources). Exam tips: For AZ-305, distinguish between governance at the container level (resource groups) versus enforcement at the resource provider/type level. When a question says “deploy only to specific regions,” think “Allowed locations” (deny effect) at subscription/management group scope, not resource group location. Also remember App Service app location follows the App Service plan’s region.

Question 5

Your company has 300 virtual machines hosted in a VMware environment. The virtual machines vary in size and have various utilization levels. You plan to move all the virtual machines to Azure. You need to recommend how many and what size Azure virtual machines will be required to move the current workloads to Azure. The solution must minimize administrative effort. What should you use to make the recommendation?

Question 6

DRAG DROP - Your company has an existing web app that runs on Azure virtual machines. You need to ensure that the app is protected from SQL injection attempts and uses a layer-7 load balancer. The solution must minimize disruptions to the code of the app. What should you recommend? To answer, drag the appropriate services to the correct targets. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

Part 1:

Azure service: ______

Part 2:

Feature: ______

Question 7

HOTSPOT - You have an on-premises database that you plan to migrate to Azure. You need to design the database architecture to meet the following requirements: ✑ Support scaling up and down. ✑ Support geo-redundant backups. ✑ Support a database of up to 75 TB. ✑ Be optimized for online transaction processing (OLTP). What should you include in the design? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Part 1:

Service: ______

Part 2:

Service tier: ______

Question 8

What should you include in the identity management strategy to support the planned changes?

Question Analysis

Core concept: This question tests hybrid identity design when extending on-premises Active Directory Domain Services (AD DS) to Azure. In AZ-305, a common requirement is ensuring authentication/authorization remains available with low latency for workloads moved to Azure, while maintaining proper forest/domain boundaries and minimizing risk. This aligns with the Azure Well-Architected Framework pillars of Reliability (resilient identity), Security (least privilege and boundary control), and Operational Excellence (clear identity architecture). Why the answer is correct: Deploying domain controllers for the rd.fabrikam.com forest to Azure virtual networks (Option D) supports planned changes where new R&D workloads/projects are expected to run in Azure and rely on the R&D forest for authentication. Placing at least two domain controllers in Azure (in separate Availability Zones or Availability Sets where supported) provides local authentication, reduces dependency on WAN/VPN/ExpressRoute for every Kerberos/LDAP request, and improves resiliency if on-prem connectivity is degraded. It also preserves the separation between corp and R&D by keeping authentication within the correct forest boundary. Key features and best practices: - Deploy a minimum of two DCs per domain/forest in Azure for high availability; use separate fault domains/Update domains (Availability Sets) or Zones. - Use Azure DNS carefully: either host AD-integrated DNS on the DCs and point VNets to those DC IPs, or integrate with Azure DNS Private Resolver if needed for hybrid name resolution. - Ensure secure connectivity (ExpressRoute preferred for predictable latency; VPN acceptable) and configure AD Sites and Services to optimize replication and logon traffic. - Harden DCs (NSGs, JIT/JEA where applicable, restricted management, backup strategy) and monitor with Azure Monitor/Log Analytics. Common misconceptions: Option A (corp DCs in Azure) can be valid if corp workloads move to Azure, but it doesn’t directly address R&D identity needs if R&D is a separate forest. Option B (move all corp DCs) is risky and rarely required; it can introduce outages and complicate recovery. Option C (new Azure AD tenant) is typically incorrect because Azure AD is not a drop-in replacement for AD DS (Kerberos/LDAP/Group Policy) and creating a separate tenant increases governance and collaboration complexity unless there is a strong isolation requirement. Exam tips: - If workloads require traditional AD DS (Kerberos/LDAP/GPO), think “deploy DCs close to the workloads,” not “create a new Azure AD tenant.” - Respect forest/domain boundaries: deploy DCs for the domain/forest that will authenticate the workloads. - Avoid “move all DCs” answers unless the scenario explicitly mandates full cloud-only AD DS hosting and addresses connectivity, DR, and operational impacts.

Question 9

You need to design a highly available Azure SQL database that meets the following requirements: ✑ Failover between replicas of the database must occur without any data loss. ✑ The database must remain available in the event of a zone outage. ✑ Costs must be minimized. Which deployment option should you use?

Question 10

HOTSPOT - You are planning an Azure Storage solution for sensitive data. The data will be accessed daily. The dataset is less than 10 GB. You need to recommend a storage solution that meets the following requirements: ✑ All the data written to storage must be retained for five years. ✑ Once the data is written, the data can only be read. Modifications and deletion must be prevented. ✑ After five years, the data can be deleted, but never modified. ✑ Data access charges must be minimized. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Part 1:

Storage account type: ______

Part 2:

Configuration to prevent modifications and deletions: ______

Practice Test #3

Triple AI-Verified Answers & Explanations

Practice Questions

Other Practice Tests

Practice Test #1

Practice Test #2

Practice Test #4

Start Practicing Now