AZ-305 · Architecture test

An organization has 40 Azure subscriptions across production, test and several business units. Security requirements must be consistent, while some rules vary by unit. Which design provides the most scalable governance?

An App Service application must read secrets from Key Vault without storing a password, certificate or client secret in configuration. What should the architect recommend?

External consultants should use their home organization accounts for time-limited access to internal applications, and access must be reviewable. Which solution fits best?

A security team must run KQL queries across platform logs from many subscriptions and correlate data across resources. What is the key design element?

An operations team should manage virtual machines in one resource group but not networks or other resource groups. How should access be designed?

Production administrators need privileged access only during incidents, with MFA, justification and approval. Which service is designed for this?

A solution must notify operations when error rate rises and start an automated incident workflow. Which design is most direct?

A global application stores JSON documents and needs low read latency across regions, tunable consistency and automatic distribution. Which service fits best?

A new relational application has unpredictable usage, long idle periods and must pause compute automatically to reduce cost. What should be recommended?

Documents in Blob Storage should move to a cheaper tier after 90 days and be deleted after seven years. What achieves this with the least custom code?

A solution must retain PostgreSQL compatibility, use a managed service and survive one availability-zone failure. Which design is most relevant?

A team needs scheduled, monitored movement of data between on-premises SQL sources, Blob Storage and analytics. Which service should it use?

A requirement allows at most five minutes of data loss and requires service restoration within one hour. What do the five minutes describe?

Virtual machines must replicate to another Azure region and start there through an orchestrated failover plan. Which service is designed for this?

Two Azure SQL logical servers in different regions need a readable secondary and stable listener that can switch regions. What should be used?

An application spans three availability zones in one region. Which risk remains unaddressed by that design alone?

An order system needs durable commands, dead-lettering and FIFO processing per customer. Which service fits best?

Several independent subscribers should react when a blob is created. Events are discrete and the publisher should not know the consumers. What should be used?

A public web service has global users and needs edge acceleration, global routing, TLS and WAF. Which ingress service is most relevant?

A regional web application needs layer-7 routing, TLS termination and WAF inside a virtual network. What should be selected?

A PaaS database must be reached from a VNet over a private IP while public network access is disabled. Which pattern should be used?

Short-lived code should run when a message arrives, scale to zero and bill by use without container administration. What is the first choice?

A team has containerized microservices and needs HTTP and event-driven scaling plus revisions, but does not want to operate Kubernetes. What fits best?

When is Azure Kubernetes Service a more natural choice than Container Apps?

A large on-premises datacentre needs private, predictable connectivity to an Azure hub-and-spoke network without using the public internet. What belongs in the design?