AZ-305 Practice Questions

1. Connecting without Prompt (SSO)

To enable users to sign in to an application using their Azure Active Directory (Azure AD) accounts, the application must first be registered in an Azure AD tenant. This app registration process creates an identity configuration for your application, allowing it to integrate with Azure AD.

For users on Azure AD-joined Windows devices, this registration enables a Single Sign-On (SSO) experience. When a user signs into their device, they receive a Primary Refresh Token (PRT). This token is then used to silently acquire access tokens for other Azure AD-registered applications, like App1, without requiring the user to re-enter their credentials.

An Azure AD managed identity is incorrect as it provides an identity for applications to authenticate to other Azure services, not for user sign-in. Azure AD Application Proxy is used for publishing on-premises applications, which is not the case here.

2. Access from Company-Owned Computers

A conditional access policy is the specific Azure AD tool designed to enforce access rules based on various conditions, or "signals." To meet the requirement of allowing access only from company-owned computers, an administrator would create a Conditional Access policy that applies to App1. This policy would be configured with a "grant control" that requires the user's device to be Hybrid Azure AD joined or marked as compliant. Since the company computers are Azure AD joined, this policy effectively restricts access to only those managed devices.

The other options are incorrect as they serve different purposes:

• Administrative units scope administrative permissions.
• Azure Application Gateway is a load balancer.
• Azure Blueprints and Azure Policy are used for governing Azure resources, not for controlling user access to applications based on device state.

Microsoft Learn | Microsoft identity platform documentation. "Quickstart: Register an application with the Microsoft identity platform." This document states, "To delegate Identity and Access Management functions to Azure Active Directory (Azure AD), an application must be registered with an Azure AD tenant."

Microsoft Learn | Azure Active Directory documentation. "What is a Primary Refresh Token?" It explains, "A Primary Refresh Token (PRT) is a key artifact of Azure AD authentication... It allows single sign-on (SSO) across the applications used on that device." This SSO capability is contingent on the application being registered in Azure AD.

Microsoft Learn | Azure Active Directory documentation. "What is Conditional Access?". The documentation defines it as follows: "Conditional Access is the tool used by Azure Active Directory to bring signals together, to make decisions, and enforce organizational policies."

Microsoft Learn | Azure Active Directory documentation. "Conditional Access: Grant." This source details the access controls available in a policy, including "Require Hybrid Azure AD joined device," which is a control used to ensure access is from a corporate-managed computer.

To ensure governance is consistent across all subscriptions while minimizing administrative effort, both the blueprint definition and its assignment should be made at the highest possible level in the management group hierarchy.

1. Blueprint Definition: Defining the blueprint at the root management group makes it available to all child management groups and subscriptions within the hierarchy. This creates a single, reusable source of truth, satisfying the need for consistency and minimizing the number of definitions to just one.
2. Blueprint Assignment: Assigning the blueprint at the root management group applies it to all nested management groups and subscriptions. This single assignment ensures that all current and future subscriptions under the root inherit the same governance controls, meeting the requirement to minimize assignments.

This approach is the most efficient method for applying a consistent baseline configuration across the entire Azure environment as described.

Microsoft Azure Documentation, "What is Azure Blueprints?":

Section: "Blueprint definition"

Content: "You can save your blueprint definition in a management group or subscription. If you save it to a management group, it can be assigned to any child subscription of that management group. This feature allows you to only have to define the blueprint once and reuse it for control and consistency at scale." This supports defining the blueprint at the highest level (the root management group) for maximum reuse and consistency.

Microsoft Azure Documentation, "Understand the lifecycle of an Azure Blueprint":

Section: "Blueprint assignment"

Content: "A blueprint can be assigned to a management group or subscription." It further explains that assignments are inherited by resources within the assigned scope. Assigning to the root management group is the most efficient way to ensure all subscriptions inherit the blueprint's configuration, thereby minimizing the number of individual assignments.

Azure Migrate is the purpose-built service for discovering, assessing, and migrating on-premises workloads to Azure. The "Azure Migrate: Discovery and assessment" tool specifically addresses the scenario by deploying an appliance in the VMware environment to discover VMs and collect performance data. Based on this data, it provides recommendations for the appropriate number and size (SKU) of Azure VMs required to support the workloads. This automated process of discovery and assessment directly fulfills the requirement while minimizing administrative effort, as it avoids manual inventory and performance analysis.

A. Azure Cost Management: This service is used to monitor, control, and optimize the costs of resources that are already running in Azure, not for pre-migration assessment of on-premises workloads.

B. Azure Pricing calculator: This is a tool for manually estimating costs. It requires you to already know the specific Azure VM sizes and quantities you plan to use; it does not assess your current environment to provide these recommendations.

D. Azure Advisor: This service provides recommendations to optimize existing Azure deployments for reliability, security, performance, and cost. It does not assess on-premises environments for migration planning.

1. Azure Migrate Documentation: "About Azure Migrate". Microsoft Learn. "Azure Migrate provides a centralized hub to assess and migrate on-premises servers

infrastructure

applications

and data to Azure. The hub provides Azure Migrate tools for assessment and migration

as well as third-party independent software vendor (ISV) offerings."

2. Azure Migrate Documentation: "Assessment overview for VMware VMs". Microsoft Learn. "An Azure VM assessment in the Azure Migrate: Discovery and assessment tool helps you to evaluate on-premises VMware VMs for migration to Azure... The assessment provides Azure sizing recommendations for on-premises VMs." This section explicitly details performance-based sizing which is key to the question.

3. Azure Advisor Documentation: "Introduction to Azure Advisor". Microsoft Learn. "Advisor is a personalized cloud consultant that helps you follow best practices to optimize your Azure deployments." This confirms its scope is limited to existing Azure resources.

4. Azure Cost Management Documentation: "What is Cost Management + Billing?". Microsoft Learn. This document outlines the capabilities for analyzing

managing

and optimizing Azure costs

which presumes the existence of Azure resources.

The proposed solution is incorrect because enforcing the location of a resource group does not enforce the location of the resources created within it. A resource can be deployed to a different region than its parent resource group. The resource group's location only specifies where the metadata for that group is stored. To meet the regulatory requirement of restricting App Service instance locations, an Azure Policy must be applied directly to the App Service resource type (Microsoft.Web/sites) to restrict its location property to the list of approved Azure regions. This ensures direct compliance, whereas the proposed solution creates a compliance gap.

A (Yes): This is incorrect. A resource's location is independent of its resource group's location. Therefore, a policy restricting the resource group's location does not guarantee that the App Service instances within it will be in an approved region.

1. Microsoft Learn

Azure Resource Manager documentation

"What is a resource group?": Under the "Resources" section

it states

"The location of the resource group can be different than the location of the resources. [...] The resource group stores metadata about the resources. When you specify a location for the resource group

you're specifying where that metadata is stored." This confirms that resource and resource group locations are independent.

2. Microsoft Learn

Azure Policy documentation

"Tutorial: Create and manage policies to enforce compliance": In the "Apply a policy" section

it describes the "Allowed locations" policy. The documentation explains

"This policy definition enables you to restrict the locations your organization can specify when deploying resources." This policy should be assigned and scoped to the App Service resource type to meet the requirement directly.

3. Microsoft Learn

Azure Policy built-in definitions

"Allowed locations": The policy definition ("policyRule": { "if": { "not": { "field": "location"

"in": "[parameters('listOfAllowedLocations')]" } }

"then": { "effect": "deny" } }) demonstrates that the policy acts on the location field of a resource

not its resource group. To be effective for this scenario

it must be applied to the Microsoft.Web/sites resource type.

The Data Migration Assistant (DMA) is the correct tool for migrating an on-premises SQL Server database to an Azure SQL Database. DMA is designed to detect compatibility issues and feature parity problems between source and target, and it can perform the migration of the schema, data, and uncontained objects.

The Azure Cosmos DB Data Migration Tool is the appropriate choice for migrating a specific table from SQL Server to an Azure Cosmos DB account. This tool is purpose-built to import data from various sources, including relational databases like SQL Server, into Azure Cosmos DB. It efficiently handles the data transformation from a tabular format to the document model used by the Cosmos DB SQL API.

AzCopy is incorrect as it's a command-line utility for copying blobs or files to or from Azure Storage accounts. Data Management Gateway is a legacy name for the Self-hosted Integration Runtime, which is a component of Azure Data Factory used for data integration, not a standalone migration tool.

Microsoft Docs: Overview of Data Migration Assistant. This document outlines the capabilities of DMA, stating, "Data Migration Assistant (DMA) helps you upgrade to a modern data platform by detecting compatibility issues that can impact database functionality in your new version of SQL Server or Azure SQL Database." It further specifies its use for migrating "an on-premises SQL Server instance to an Azure SQL Database."

Source: Microsoft Corporation. (2023). Overview of Data Migration Assistant. SQL Server Documentation. Retrieved from https://learn.microsoft.com/en-us/sql/dma/dma-overview

Microsoft Docs: Import data into Azure Cosmos DB for NoSQL with the desktop data migration tool. This guide details the usage of the Cosmos DB Data Migration tool. In the "Supported data sources" section, it explicitly lists Microsoft SQL Server as a source from which data can be imported into Azure Cosmos DB.

Source: Microsoft Corporation. (2024). Import data into Azure Cosmos DB for NoSQL with the desktop data migration tool. Azure Cosmos DB Documentation. Retrieved from https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/import-data

Statement 1: PA1 will only evaluate the resources in Sub2. (No) Azure Policy assignments are inherited by all child resources. Since policy PA1 is assigned to management group MG1, it applies to all subscriptions within MG1. According to the tables, MG1 contains both Sub2 and Sub4. Therefore, PA1 will evaluate the resources in both subscriptions, not only Sub2.

Statement 2: PA2 will evaluate all the virtual machines deployed to the East US region. (Yes) The question states that PA2 is modified to include a resource selector. Resource selectors filter the resources that a policy assignment evaluates. In this case, the selector narrows the evaluation to only virtual machines (Microsoft.Compute/virtualMachines) in the East US location. Assuming the policy is assigned at a scope that includes all subscriptions (like the Tenant Root Group), it will evaluate VM1, VM2, and VM3, as they all meet these criteria.

Statement 3: PA3 will evaluate VM3. (Yes) The modification to PA3 adds an exclusion for Sub1. An exclusion prevents the policy from being evaluated on the specified scope and its children. VM3 is in Sub3. Since the policy assignment is not excluded from Sub3, and assuming it has a broad assignment scope that includes MG2 (where Sub3 resides), the policy will evaluate VM3. The exclusion of Sub1 has no impact on the evaluation of resources in Sub3.

Azure Policy Scope: Microsoft Learn. (n.d.). Understand scope in Azure Policy. This document explains that policy assignments are inherited by child resources and management groups. Section "Inheritance" details how assignments flow down the hierarchy.

Azure Policy Exclusions: Microsoft Learn. (n.d.). Understand scope in Azure Policy. The "Exclusions" section clarifies that an excluded scope is not evaluated by a specific policy assignment.

Azure Policy Resource Selectors: Microsoft Learn. (n.d.). Scope in Azure Policy. The "Resource selectors (Preview)" section describes how this feature allows targeting specific resources within an assignment's scope based on properties like location and type.

To meet the requirements using modern, policy-based controls, you should use Azure AD Identity Protection to manage the MFA registration process. Identity Protection includes a specific MFA registration policy that can be targeted to require users to set up their MFA methods before it's enforced.

To enforce the use of MFA during sign-in, a Conditional Access policy (capolicy1) is the appropriate tool. Within this policy, the Grant control is configured to "Require multifactor authentication." This control specifically enforces the MFA challenge for users and applications that fall within the policy's scope, such as administrators accessing the Azure portal. Session controls apply after authentication, and a sign-in risk policy would only trigger for risky sign-ins, not all of them as required.

Microsoft Entra Documentation (formerly Azure AD): "Configure the Microsoft Entra multifactor authentication registration policy" states that "Microsoft Entra ID Protection helps you manage the roll-out of Microsoft Entra multifactor authentication registration by configuring a Conditional Access policy to require MFA registration..." This document confirms that the MFA registration policy is part of Identity Protection.

Microsoft Entra Documentation: "Conditional Access: Grant" explains the available controls within a policy. Under section "Grant controls", it lists "Require multifactor authentication" as the primary control to force users to perform MFA. This supports the selection of "Grant control" as the mechanism for enforcement.

Azure Blob storage is the optimal choice for image storage. It's specifically designed to store massive amounts of unstructured data, such as images, videos, and documents. It easily accommodates files up to 50 MB and provides server-side encryption by default, satisfying both requirements. Storing large binary files directly in a database is generally inefficient and not recommended.

Azure SQL Database is the most suitable service for customer accounts. Customer account data is typically structured and relational (e.g., user ID, name, email, password). As a fully managed relational database-as-a-service, Azure SQL Database provides transactional consistency, data integrity, and robust querying capabilities, which are essential for managing user account information effectively.

Azure Blob Storage Documentation: Microsoft's official documentation states that Azure Blob storage is optimized for storing massive amounts of unstructured data. Common use cases include "Serving images or documents directly to a browser" and "Storing files for distributed access."

Source: Microsoft Docs, "Introduction to Azure Blob storage," Use cases section.

Azure SQL Database Documentation: The official documentation describes Azure SQL Database as a fully managed relational database service built for the cloud. It is ideal for applications that require a relational data model with transactional consistency and data integrity, making it a standard choice for storing structured data like user profiles and customer accounts.

Source: Microsoft Docs, "What is Azure SQL Database?," Overview section.

Comparison of Azure Storage Options: Microsoft's "Choose a data storage approach in Azure" guide recommends Blob storage for "images, videos, documents...large binary objects" and relational databases like Azure SQL Database for "transactional data" and data requiring a "high degree of integrity," such as customer information.

Source: Microsoft Azure Architecture Center, "Choose a data storage approach in Azure," Relational databases and Blob storage sections.

Azure SQL Managed Instance is the most suitable deployment solution. As a platform-as-a-service (PaaS) offering, it is optimized for migrating on-premises SQL Server instances with minimal changes, thereby reducing administrative effort. Crucially, it supports user-initiated COPY_ONLY backups, which is a specific requirement. While SQL Server on Azure VMs also supports this, it requires significantly more administrative overhead for managing the virtual machine and operating system.

An Auto-failover group is the best resiliency solution. It automates the replication of all databases within a managed instance to a secondary instance in another Azure region. It also provides automatic failover capabilities, which directly meets the requirements to have multiple replicated instances across regions and to minimize the administrative effort needed for business continuity. Active geo-replication requires manual failover, and a zone-redundant deployment only provides resiliency within a single region.

Microsoft Documentation, Azure SQL Managed Instance: In the "Backup and restore" section, it is stated that "User-initiated copy-only backups are also supported." This confirms the feature is available for migration and other purposes.

Source: Microsoft Learn, "Automated backups in Azure SQL Managed Instance", under the "User-initiated backups" section.

Microsoft Documentation, Business Continuity Overview: This document compares different business continuity features. It specifies that Auto-failover groups provide "Automatic asynchronous replication and failover of a group of databases," contrasting with Active geo-replication where failover is user-initiated.

Source: Microsoft Learn, "Overview of business continuity with Azure SQL Database & Azure SQL Managed Instance", in the feature comparison table.

Microsoft Documentation, Auto-Failover Groups: This resource details the functionality, stating, "Auto-failover groups are a declarative way to manage failover of databases in SQL Managed Instance at scale... you can initiate a manual failover or you can delegate it to the Azure service based on a user-defined policy." This highlights the reduced administrative effort.

Source: Microsoft Learn, "Auto-failover groups and best practices (Azure SQL Managed Instance)", Introduction section.

The requirement is for multiple, distinct applications to process messages based on specific transaction details. An Azure Service Bus topic utilizes a publish/subscribe (pub/sub) pattern, which is ideal for this one-to-many communication scenario. The sales application (App1) can publish all shipping messages to a single topic. Each consuming application, including App2 and any future applications, can create its own subscription to that topic. Crucially, each subscription can have filter rules based on message properties (e.g., shipping destination, item type). This ensures that each application receives only a copy of the messages relevant to its function, fulfilling the core requirement in a scalable and decoupled manner.

A. one Azure Service Bus queue: A queue follows a competing consumer pattern where a message is processed by only one receiver, which fails the requirement for multiple applications to process messages.

C. one Azure Data Factory pipeline: Azure Data Factory is a data integration and ETL/ELT orchestration service, not a real-time messaging system designed for application decoupling.

D. multiple storage account queues: This approach would require the producer (App1) to know which queue to send a message to, creating tight coupling and making the system difficult to modify when new applications are added.

---

1. Microsoft Documentation | Azure Service Bus | Topics and subscriptions: "In contrast to queues

in which each message is processed by a single consumer

topics and subscriptions provide a one-to-many form of communication

in a publish/subscribe pattern. It's useful for scaling to a large number of recipients." This directly supports the need for multiple applications to receive messages.

2. Microsoft Documentation | Azure Service Bus | Subscription filters and actions: "Subscribers can define which messages they want to receive from a topic. These messages are specified in the form of one or more named subscription rules. Each rule consists of a filter condition that selects particular messages...". This directly addresses the requirement for applications to process messages "based on the specific details of the transactions."

3. Microsoft Documentation | Compare Azure messaging services: In the "Service Bus" section

it recommends using "Topics and subscriptions" for a "publish/subscribe" model. It contrasts this with queues

which are for "point-to-point" communication. This comparison clarifies why a topic is superior to a queue for this scenario.