Free AZ-305 Practice Test

Azure Virtual WAN is a managed networking service that provides a unified framework for connectivity, routing, and security. It is designed for large-scale, site-to-site connectivity scenarios like the one described. It creates a hub-and-spoke architecture where the Azure Virtual WAN hub acts as the central point. This architecture inherently supports any-to-any connectivity (datacenter-to-Azure and datacenter-to-datacenter). The integrated virtual hub router provides centralized route management. Furthermore, by deploying a Secured Virtual Hub, you can integrate Azure Firewall, enabling the central management of firewall rules for all traffic. As a managed service, it significantly minimizes the administrative effort required to configure and maintain complex network topologies.

B. ExpressRoute: ExpressRoute is a connectivity service for private connections to Azure. While it can be part of the solution, it does not inherently provide central management of routes and firewall rules for a multi-site topology without significant additional configuration.
C. Azure Front Door: This is a Layer 7 (HTTP/S) load balancing and web application firewall (WAF) service. It is used for managing web traffic and is not suitable for providing network-level connectivity between datacenters.
D. Azure VPN Gateway: While VPN Gateways can connect datacenters to Azure, creating an any-to-any connectivity mesh for five sites with centralized management would be complex and administratively intensive, violating the "minimize administrative effort" requirement. ---

1. Microsoft Learn: What is Azure Virtual WAN?

Quote: "Azure Virtual WAN is a networking service that brings many networking

security

and routing functionalities together to provide a single operational interface... Key benefits include... Built-in routing

security

and connectivity in a centralized hub."

Section: Introduction. This source confirms that Virtual WAN is the service designed for centralized connectivity

routing

and security.

2. Microsoft Learn: Virtual WAN routing architecture

Quote: "Azure Virtual WAN is a networking service that provides optimized and automated branch-to-branch connectivity through Azure... The virtual hub router is the core of the hub

and it's responsible for all routing between all endpoints."

Section: Virtual hub routing. This reference supports the central management of network routes requirement.

3. Microsoft Learn: What is a secured virtual hub?

Quote: "A secured virtual hub is an Azure Virtual WAN hub with associated security and routing policies configured by Azure Firewall Manager. Use a secured virtual hub to easily create hub-and-spoke and transitive architectures with centralized security and policy management..."

Section: Introduction. This source validates the capability for central management of firewall rules.

4. Microsoft Learn: What is Azure Front Door?

Quote: "Azure Front Door is a modern cloud Content Delivery Network (CDN) service that delivers high performance

scalability

and secure user experiences for your content and applications... It operates at Layer 7 (HTTP/S layer)."

Section: Introduction. This reference confirms that Azure Front Door is a Layer 7 service and inappropriate for this network connectivity scenario.

The proposed solution, using a Privileged Identity Management (PIM) role assignment with an approver from the same tenant (contoso.com), does not fully meet the goal. While it adds a layer of protection by requiring a second administrator's approval, it is insufficient to prevent a malicious actor who has compromised the contoso.com tenant. A sophisticated attacker could potentially compromise both the requesting administrator's account and the designated approver's account, or a compromised Global Administrator could reconfigure the PIM approval workflow. This single point of failure within the same security boundary (the contoso.com tenant) means the solution does not guarantee prevention.

A. Yes: This is incorrect because the solution fails to establish true separation of duties across different security or administrative domains. An approver within the same tenant is vulnerable to a tenant-wide compromise, thus not fully preventing the malicious action as required.

1. Microsoft Learn, "About multi-user authorization for Azure Backup." This document describes the recommended feature for this exact scenario. It states, "Multi-user authorization (MUA) for Azure Backup allows you to add an additional layer of protection to critical operations on your Recovery Services vaults... MUA ensures that any critical operation is performed with the authorization of two users." It achieves this using a Resource Guard in a separate subscription or tenant, creating the necessary security boundary that the proposed PIM solution lacks.

2. Microsoft Learn, "Approve or deny requests for Microsoft Entra roles in Privileged Identity Management." Section: "Approvers." This documentation details how PIM approval works. It shows that approvers are configured within the role settings. If the approver is another user within the same tenant, it does not protect against a scenario where the entire tenant's administrative accounts are at risk of compromise.

3. Microsoft Learn, "Azure Backup security features to help protect hybrid backups from attacks." Section: "Prevent attacks." This article explicitly discusses protecting against "rogue administrators" and recommends using Multi-User Authorization (MUA) with a Resource Guard as the primary mechanism to prevent unauthorized deletion of backups, highlighting that this is a stronger control than standard role-based access control configurations.

Azure Migrate is the purpose-built service for discovering, assessing, and migrating on-premises workloads to Azure. The "Azure Migrate: Discovery and assessment" tool specifically addresses the scenario by deploying an appliance in the VMware environment to discover VMs and collect performance data. Based on this data, it provides recommendations for the appropriate number and size (SKU) of Azure VMs required to support the workloads. This automated process of discovery and assessment directly fulfills the requirement while minimizing administrative effort, as it avoids manual inventory and performance analysis.

A. Azure Cost Management: This service is used to monitor, control, and optimize the costs of resources that are already running in Azure, not for pre-migration assessment of on-premises workloads.
B. Azure Pricing calculator: This is a tool for manually estimating costs. It requires you to already know the specific Azure VM sizes and quantities you plan to use; it does not assess your current environment to provide these recommendations.
D. Azure Advisor: This service provides recommendations to optimize existing Azure deployments for reliability, security, performance, and cost. It does not assess on-premises environments for migration planning.

1. Azure Migrate Documentation: "About Azure Migrate". Microsoft Learn. "Azure Migrate provides a centralized hub to assess and migrate on-premises servers, infrastructure, applications, and data to Azure. The hub provides Azure Migrate tools for assessment and migration, as well as third-party independent software vendor (ISV) offerings."

2. Azure Migrate Documentation: "Assessment overview for VMware VMs". Microsoft Learn. "An Azure VM assessment in the Azure Migrate: Discovery and assessment tool helps you to evaluate on-premises VMware VMs for migration to Azure... The assessment provides Azure sizing recommendations for on-premises VMs." This section explicitly details performance-based sizing which is key to the question.

3. Azure Advisor Documentation: "Introduction to Azure Advisor". Microsoft Learn. "Advisor is a personalized cloud consultant that helps you follow best practices to optimize your Azure deployments." This confirms its scope is limited to existing Azure resources.

4. Azure Cost Management Documentation: "What is Cost Management + Billing?". Microsoft Learn. This document outlines the capabilities for analyzing, managing, and optimizing Azure costs, which presumes the existence of Azure resources.

The proposed solution is incorrect because enforcing the location of a resource group does not enforce the location of the resources created within it. A resource can be deployed to a different region than its parent resource group. The resource group's location only specifies where the metadata for that group is stored. To meet the regulatory requirement of restricting App Service instance locations, an Azure Policy must be applied directly to the App Service resource type (Microsoft.Web/sites) to restrict its location property to the list of approved Azure regions. This ensures direct compliance, whereas the proposed solution creates a compliance gap.

A (Yes): This is incorrect. A resource's location is independent of its resource group's location. Therefore, a policy restricting the resource group's location does not guarantee that the App Service instances within it will be in an approved region.

1. Microsoft Learn

Azure Resource Manager documentation

"What is a resource group?": Under the "Resources" section

it states

"The location of the resource group can be different than the location of the resources. [...] The resource group stores metadata about the resources. When you specify a location for the resource group

you're specifying where that metadata is stored." This confirms that resource and resource group locations are independent.

2. Microsoft Learn

Azure Policy documentation

"Tutorial: Create and manage policies to enforce compliance": In the "Apply a policy" section

it describes the "Allowed locations" policy. The documentation explains

"This policy definition enables you to restrict the locations your organization can specify when deploying resources." This policy should be assigned and scoped to the App Service resource type to meet the requirement directly.

3. Microsoft Learn

Azure Policy built-in definitions

"Allowed locations": The policy definition ("policyRule": { "if": { "not": { "field": "location"

"in": "[parameters('listOfAllowedLocations')]" } }

"then": { "effect": "deny" } }) demonstrates that the policy acts on the location field of a resource

not its resource group. To be effective for this scenario

it must be applied to the Microsoft.Web/sites resource type.

The Data Migration Assistant (DMA) is the correct tool for migrating an on-premises SQL Server database to an Azure SQL Database. DMA is designed to detect compatibility issues and feature parity problems between source and target, and it can perform the migration of the schema, data, and uncontained objects.

The Azure Cosmos DB Data Migration Tool is the appropriate choice for migrating a specific table from SQL Server to an Azure Cosmos DB account. This tool is purpose-built to import data from various sources, including relational databases like SQL Server, into Azure Cosmos DB. It efficiently handles the data transformation from a tabular format to the document model used by the Cosmos DB SQL API.

AzCopy is incorrect as it's a command-line utility for copying blobs or files to or from Azure Storage accounts. Data Management Gateway is a legacy name for the Self-hosted Integration Runtime, which is a component of Azure Data Factory used for data integration, not a standalone migration tool.

Microsoft Docs: Overview of Data Migration Assistant. This document outlines the capabilities of DMA, stating, "Data Migration Assistant (DMA) helps you upgrade to a modern data platform by detecting compatibility issues that can impact database functionality in your new version of SQL Server or Azure SQL Database." It further specifies its use for migrating "an on-premises SQL Server instance to an Azure SQL Database."

Source: Microsoft Corporation. (2023). Overview of Data Migration Assistant. SQL Server Documentation. Retrieved from https://learn.microsoft.com/en-us/sql/dma/dma-overview

Microsoft Docs: Import data into Azure Cosmos DB for NoSQL with the desktop data migration tool. This guide details the usage of the Cosmos DB Data Migration tool. In the "Supported data sources" section, it explicitly lists Microsoft SQL Server as a source from which data can be imported into Azure Cosmos DB.

Source: Microsoft Corporation. (2024). Import data into Azure Cosmos DB for NoSQL with the desktop data migration tool. Azure Cosmos DB Documentation. Retrieved from https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/import-data

Statement 1: PA1 will only evaluate the resources in Sub2. (No) Azure Policy assignments are inherited by all child resources. Since policy PA1 is assigned to management group MG1, it applies to all subscriptions within MG1. According to the tables, MG1 contains both Sub2 and Sub4. Therefore, PA1 will evaluate the resources in both subscriptions, not only Sub2.

Statement 2: PA2 will evaluate all the virtual machines deployed to the East US region. (Yes) The question states that PA2 is modified to include a resource selector. Resource selectors filter the resources that a policy assignment evaluates. In this case, the selector narrows the evaluation to only virtual machines (Microsoft.Compute/virtualMachines) in the East US location. Assuming the policy is assigned at a scope that includes all subscriptions (like the Tenant Root Group), it will evaluate VM1, VM2, and VM3, as they all meet these criteria.

Statement 3: PA3 will evaluate VM3. (Yes) The modification to PA3 adds an exclusion for Sub1. An exclusion prevents the policy from being evaluated on the specified scope and its children. VM3 is in Sub3. Since the policy assignment is not excluded from Sub3, and assuming it has a broad assignment scope that includes MG2 (where Sub3 resides), the policy will evaluate VM3. The exclusion of Sub1 has no impact on the evaluation of resources in Sub3.

Azure Policy Scope: Microsoft Learn. (n.d.). Understand scope in Azure Policy. This document explains that policy assignments are inherited by child resources and management groups. Section "Inheritance" details how assignments flow down the hierarchy.

Azure Policy Exclusions: Microsoft Learn. (n.d.). Understand scope in Azure Policy. The "Exclusions" section clarifies that an excluded scope is not evaluated by a specific policy assignment.

Azure Policy Resource Selectors: Microsoft Learn. (n.d.). Scope in Azure Policy. The "Resource selectors (Preview)" section describes how this feature allows targeting specific resources within an assignment's scope based on properties like location and type.

To meet the requirements using modern, policy-based controls, you should use Azure AD Identity Protection to manage the MFA registration process. Identity Protection includes a specific MFA registration policy that can be targeted to require users to set up their MFA methods before it's enforced.

To enforce the use of MFA during sign-in, a Conditional Access policy (capolicy1) is the appropriate tool. Within this policy, the Grant control is configured to "Require multifactor authentication." This control specifically enforces the MFA challenge for users and applications that fall within the policy's scope, such as administrators accessing the Azure portal. Session controls apply after authentication, and a sign-in risk policy would only trigger for risky sign-ins, not all of them as required.

Microsoft Entra Documentation (formerly Azure AD): "Configure the Microsoft Entra multifactor authentication registration policy" states that "Microsoft Entra ID Protection helps you manage the roll-out of Microsoft Entra multifactor authentication registration by configuring a Conditional Access policy to require MFA registration..." This document confirms that the MFA registration policy is part of Identity Protection.

Microsoft Entra Documentation: "Conditional Access: Grant" explains the available controls within a policy. Under section "Grant controls", it lists "Require multifactor authentication" as the primary control to force users to perform MFA. This supports the selection of "Grant control" as the mechanism for enforcement.

Azure Blob storage is the optimal choice for image storage. It's specifically designed to store massive amounts of unstructured data, such as images, videos, and documents. It easily accommodates files up to 50 MB and provides server-side encryption by default, satisfying both requirements. Storing large binary files directly in a database is generally inefficient and not recommended.

Azure SQL Database is the most suitable service for customer accounts. Customer account data is typically structured and relational (e.g., user ID, name, email, password). As a fully managed relational database-as-a-service, Azure SQL Database provides transactional consistency, data integrity, and robust querying capabilities, which are essential for managing user account information effectively.

Azure Blob Storage Documentation: Microsoft's official documentation states that Azure Blob storage is optimized for storing massive amounts of unstructured data. Common use cases include "Serving images or documents directly to a browser" and "Storing files for distributed access."

Source: Microsoft Docs, "Introduction to Azure Blob storage," Use cases section.

Azure SQL Database Documentation: The official documentation describes Azure SQL Database as a fully managed relational database service built for the cloud. It is ideal for applications that require a relational data model with transactional consistency and data integrity, making it a standard choice for storing structured data like user profiles and customer accounts.

Source: Microsoft Docs, "What is Azure SQL Database?," Overview section.

Comparison of Azure Storage Options: Microsoft's "Choose a data storage approach in Azure" guide recommends Blob storage for "images, videos, documents...large binary objects" and relational databases like Azure SQL Database for "transactional data" and data requiring a "high degree of integrity," such as customer information.

Source: Microsoft Azure Architecture Center, "Choose a data storage approach in Azure," Relational databases and Blob storage sections.

The Azure SQL Migration extension for Azure Data Studio leverages the Azure Database Migration Service (DMS) to orchestrate the data movement. For DMS, which runs in an Azure Virtual Network, to access the on-premises SQL Server, a secure network path must be established between the Azure VNet and the on-premises network. Configuring a Site-to-Site (S2S) VPN is a standard and fundamental method to create this required connectivity. This network infrastructure is a prerequisite that must be in place before DMS can connect to the source database and begin the migration process.

B. The migration wizard within the Azure SQL Migration extension is designed to automatically assess and migrate the schema from the source database to the target.
C. While managed identities are used for secure authentication between Azure services, establishing the underlying network connectivity to the on-premises source is a more foundational first step.
D. The Azure SQL Migration extension supports migrations from SQL Server 2008 and later versions. Therefore, upgrading a SQL Server 2016 database is not a required step.

1. Microsoft Documentation

Azure Database Migration Service: In the tutorial for online migrations using Azure Data Studio

the prerequisites for creating a DMS instance state: "When you create an instance of DMS

you must ensure that the service is created in an Azure virtual network that has site-to-site connectivity to your on-premises servers by using either ExpressRoute or VPN."

Source: Microsoft Learn

"Tutorial: Migrate SQL Server to Azure SQL Database online using DMS in Azure Data Studio"

Section: "Create an instance of Azure Database Migration Service".

2. Microsoft Documentation

Azure SQL Migration extension: The documentation on supported sources confirms that SQL Server 2016 is a valid source

making an upgrade unnecessary.

Source: Microsoft Learn

"Azure SQL Migration extension for Azure Data Studio"

Section: "Supported source and target servers".

3. Microsoft Documentation

Site-to-Site VPN: This document outlines the process of creating a secure connection between an on-premises network and an Azure virtual network

which is the foundational step mentioned in the correct answer.

Source: Microsoft Learn

"What is Azure VPN Gateway?"

Section: "Site-to-Site VPN".

The requirement is for multiple, distinct applications to process messages based on specific transaction details. An Azure Service Bus topic utilizes a publish/subscribe (pub/sub) pattern, which is ideal for this one-to-many communication scenario. The sales application (App1) can publish all shipping messages to a single topic. Each consuming application, including App2 and any future applications, can create its own subscription to that topic. Crucially, each subscription can have filter rules based on message properties (e.g., shipping destination, item type). This ensures that each application receives only a copy of the messages relevant to its function, fulfilling the core requirement in a scalable and decoupled manner.

A. one Azure Service Bus queue: A queue follows a competing consumer pattern where a message is processed by only one receiver, which fails the requirement for multiple applications to process messages.
C. one Azure Data Factory pipeline: Azure Data Factory is a data integration and ETL/ELT orchestration service, not a real-time messaging system designed for application decoupling.
D. multiple storage account queues: This approach would require the producer (App1) to know which queue to send a message to, creating tight coupling and making the system difficult to modify when new applications are added. ---

1. Microsoft Documentation | Azure Service Bus | Topics and subscriptions: "In contrast to queues, in which each message is processed by a single consumer, topics and subscriptions provide a one-to-many form of communication, in a publish/subscribe pattern. It's useful for scaling to a large number of recipients." This directly supports the need for multiple applications to receive messages.

2. Microsoft Documentation | Azure Service Bus | Subscription filters and actions: "Subscribers can define which messages they want to receive from a topic. These messages are specified in the form of one or more named subscription rules. Each rule consists of a filter condition that selects particular messages...". This directly addresses the requirement for applications to process messages "based on the specific details of the transactions."

3. Microsoft Documentation | Compare Azure messaging services: In the "Service Bus" section, it recommends using "Topics and subscriptions" for a "publish/subscribe" model. It contrasts this with queues, which are for "point-to-point" communication. This comparison clarifies why a topic is superior to a queue for this scenario.