AZ-305 — frequently asked questions

Container insights only reports resource, restart and log telemetry for Kubernetes and Arc-enabled clusters, and it does not even cover Azure Container Instances. It never simulates a user interaction, so it cannot surface UI failures.

A timer-triggered function calls TrackAvailability() to send the multi-step result straight into Application Insights, so you write a few lines instead of building a custom synthetic monitoring runner.

Multiple node pools only separate workloads and scale independently; because they all sit in the same zone, a datacenter maintenance event or outage still takes every node offline.

No. An AKS cluster is region-scoped, so cross-region resilience requires multiple clusters plus global traffic routing such as Azure Front Door or Traffic Manager.

It only reads role assignments; it does not email the manager a review task or automatically revoke permissions that the manager fails to approve, so it would require heavy custom development.

Yes. When the review is configured to auto-apply results, any permission the reviewer does not approve within the review period is removed automatically.

ADLS Gen2 enables a hierarchical namespace, and the exam treats encryption scopes with per-container customer-managed keys as a GPv2 blob feature; it also adds analytics overhead not required here.

Each blob container gets its own encryption scope that references a distinct customer-managed key in Azure Key Vault, while the account-level key still encrypts all data in the storage account.

A forest trust only enables on-premises Kerberos authentication. Azure RBAC requires a user object in the Contoso Azure AD tenant, and a forest trust does not create one.

Yes. Once the Fabrikam developers exist as guest users in the Contoso tenant, they can be assigned Contributor on the resource group just like any other security principal.

Both are enabled on top of a Log Analytics workspace rather than owning one; Sentinel adds SIEM data and Application Insights adds app telemetry to the same workspace.

Only real splitting factors: data residency or geography, separate access control between teams, or different retention and pricing tiers per data set.

Yes. Azure Policy assignments inherit to every child scope below the assignment, so MG1's assignment covers both Sub2 and Sub4 automatically.

It narrows the assignment so only Microsoft.Compute/virtualMachines in East US are evaluated; the PA2 definition itself is untouched and other regions or resource types are skipped.

The image workload needs massively parallel, dynamically scaled HPC processing, which is Azure Batch's core design; Functions targets short event-driven executions instead.

The question states Project3 does not support containers, so it must be lifted and shifted onto an Azure Virtual Machine that preserves OS and local file system behaviour.

No. A resource lock protects the account or container resource itself, while the blobs inside can still be overwritten or deleted, so a container-level immutable policy is required.

Premium block blobs are provisioned for high transaction rates and low latency and cost far more per GB; for a <10 GB dataset read daily, GPv2 with the hot tier minimizes overall access charges.

No. DFS Replication is an on-premises multi-master Windows feature; Azure File Sync is the supported service for syncing Windows Server shares with an Azure file share and Azure VM server endpoints.

Only SMB lets Windows 11 map drive letters and it listens on TCP port 445, which the scenario explicitly requires; NFS and FTP cannot satisfy both conditions.

Functions require custom code for every step, increasing dev time. Logic Apps provides pre-built connectors for faster implementation.

No, Event Grid only routes events. You still need a handler like Logic Apps or Functions to process the data and update the database.

Import mode gives fast reports but copies the transformed data into the semantic model, which violates the requirement to minimize duplication of data. Direct Lake reads the Delta tables in OneLake directly, so it is both fast and non-duplicating.

No. A shortcut is a pointer, so Dataverse tables appear as Delta-Parquet folders in the lakehouse while the data stays in Dataverse. That is what satisfies the minimize-duplication requirement for the reference step.

Managed Instance storage tops out at 16 TB per instance (32 TB only on newer Business Critical premium-series hardware), so a 30-TB database must go to Azure SQL Database Hyperscale, which scales to 100 TB.

Not in General Purpose or Business Critical, which cap at 4 TB per database. It fits Azure SQL Managed Instance (16 TB) or the Hyperscale tier, so the choice depends on the project's SQL Server compatibility needs.

Cosmos DB is a non-relational, multi-model NoSQL service for rapidly changing, globally distributed SaaS-integrated solutions; it cannot host SQL Server schemas, stored procedures or Agent jobs without rewriting them.

Yes, Microsoft Fabric includes the Synapse Data Warehouse workload, which supports SQL-based Dynamic Data Masking (DDM) on table columns to restrict sensitive data exposure.

While Synapse supports DDM and auto-scaling, Fabric is the newer unified platform that offers deeper, native integration with Microsoft Dataverse, aligning with Microsoft's modern data architecture strategy.

For this question's wording, yes: it is the managed Citus-based service whose distributed tables shard rows across nodes. Citus sharding now also runs as an extension on Azure Database for PostgreSQL flexible server.

Read replicas only scale read traffic and partitions stay on one node's storage. Only Citus distributed tables place different row ranges on different worker nodes, scaling writes horizontally.

Both replicate over the network, and DB1 must not be transmitted over the internet. At 500 TB, only Azure Data Box moves the data offline via a physical appliance.

Azure Migrate supports assessment and a test failover through Azure Site Recovery replication, satisfying the test-migration and minimal-downtime requirements that a raw disk copy cannot.

Data Lake Storage is a storage service, not an analytics engine. It cannot run code in Python/Scala or generate visualizations directly.

While possible via connectors, HDInsight does not have the native, optimized, out-of-the-box Power BI integration that Databricks provides.

API keys are simpler to manage and revoke individually via subscriptions, whereas certificates require complex PKI infrastructure and cannot be easily revoked per-user without reissuing.

Yes, if configured correctly in APIM policies, requests without valid subscription keys will be rejected, effectively blocking anonymous users.

Redis is an in-memory cache, not a persistent table storage solution. It lacks the Table API compatibility and is too expensive for bulk structured data storage.

No. While legacy Azure Table Storage exists, Cosmos DB's Table API is fully compatible with the same REST endpoints but adds features like dedicated throughput and global distribution.

No, you must enable weekly LTR backups as a prerequisite before enabling monthly or yearly LTR backups.

Azure SQL Database LTR allows you to retain backups for up to 10 years.

No, only Premium v2, Premium v3, and Enterprise tiers support Availability Zones for App Service apps.

While ASE v3 offers isolation and zone redundancy, its high base cost violates the 'minimize costs' constraint in the scenario.

An availability set scopes its fault and update domains to a single zone, so its VMs can never be spread across availability zones. Only a zone-aware grouping such as a scale set in flexible orchestration mode meets that requirement.

Uniform orchestration mode keeps update-domain semantics and supports co-locating instances in a proximity placement group for low latency. Flexible mode manages instances as individual VMs and is the better fit for zone-spanning, not for that PPG plus update-domain profile.

Istio's VirtualService and DestinationRule weight fields perform layer-7 canary and blue/green splitting, whereas Dapr building blocks cover state and pub/sub, not weighted traffic distribution.

Yes. The Istio-based service mesh add-on is managed and upgraded by Azure, so you get traffic routing and splitting without running or patching your own Istio control plane.

Flexible mode allows a single scale set to mix Spot and on-demand VMs, so you can keep a baseline of on-demand instances for capacity while using cheaper Spot VMs during surges.

Yes, Azure Site Recovery supports replicating VMSS in Flexible orchestration mode, making it the correct choice for region-failure recovery.

Uniform orchestration groups VMs into a limited set of domains (usually max 5), meaning multiple VMs may share the same domain, violating the requirement for individual isolation.

Max Spreading distributes VM instances as evenly as possible across all available underlying hardware, ensuring each instance is placed in a unique fault and update domain.

Azure Front Door is a global service with higher cost; for a single-region App Service app, Application Gateway WAF_v2 satisfies the WAF requirement at lower cost.

No. By default App Service outbound traffic goes to the public internet. Regional virtual network integration routes outbound calls through the VNet, keeping DB1 traffic off the internet.

DevOps pipelines are excellent for commit-triggered builds but require extra configuration to detect external base image changes, increasing admin effort compared to native ACR triggers.

Yes, ACR Tasks supports pulling from private registries using service principals or managed identities, though this question specifies a public Docker Hub source.

A ZIP package contains the app's code payload, not the instance configuration such as app settings, slots or scale rules, so its history does not track configuration changes.

No. The apps are code-based, not containerized, and a container image still does not declare App Service configuration settings or their version history.

App1 already emits webhooks, so a Request trigger lets it push each new record instantly; a recurrence trigger would poll App1 and require extra interval and deduplication logic.

Yes, but it requires custom code for Teams authentication and message formatting, so it does not meet the requirement to minimize development effort like the Logic Apps Teams connector does.

Azure SQL Database requires Elastic Query objects such as external data sources and external tables, which adds setup work compared with Managed Instance's native T-SQL.

Yes, but it is IaaS and requires OS patching, HA, and performance tuning, so it does not minimize development effort like Managed Instance.

Vaulted blob backup protects against deletion or corruption; it is not the continuous cross-region replication mechanism that ADLS Gen2 disaster recovery requires.

No. Geo-backup in Azure Synapse applies to dedicated SQL pool data, not to the external Data Lake Storage Gen2 account.

Virtual WAN hubs include managed S2S VPN, ExpressRoute, and user VPN gateways, so the spoke VNets do not need their own virtual network gateways for this connectivity.

No. The migration replaces the hub VNet gateway role with Virtual WAN hub gateways, while the VNets connect to the Virtual WAN hub through VNet connections.

Only one child domain is targeted for writeback. Entra Connect Sync already handles inbound synchronization from all three child domains, so it does not require extra provisioning agents.

Yes. Scoping filters and conditional attribute mappings can separate employee and contractor logic within the same destination app, keeping the app count at two.

ExpressRoute gives private connectivity to Azure but does not by itself provide datacenter-to-datacenter transit routing or centralized firewall rule management. Those requirements point to Azure Virtual WAN hubs.

No. Virtual WAN uses ExpressRoute circuits or site-to-site VPN connections to attach datacenters, then adds managed hubs, transitive routing, and centralized firewall policy.

Functions is event-driven and scales per trigger with no cluster to operate, which matches the arrival-based workload. AKS adds orchestration overhead the app's description never asks for.

Batch schedules jobs and tasks across managed pools for large parallel compute with no long-running cluster. AKS is for hosting containerized services you continuously operate.

VM Image Builder creates custom images but does not deploy VMs or provide CI/CD orchestration, and the scenario requires standard Microsoft disk images.

Azure Pipelines supports approvals and checks that can require virtual machine administrators to authorize a deployment before the new VM is created.

Event Hubs can ingest telemetry but does not deploy or manage IoT Edge runtimes; the scenario requires IoT Hub standard tier for edge modules and routing.

No. IoT Edge requires the standard tier; basic tier is limited to basic device-to-cloud and cloud-to-device messaging.

Because creating the account in AD DS lets the existing Microsoft Entra Connect Sync handle the Entra tenant copy, while targeting Entra directly would not create the on-premises AD DS user.

No. HR-driven provisioning needs a supported HR connector such as Workday or SuccessFactors; for a custom app's CSV, use API-driven inbound provisioning.

ExpressRoute provides private, dedicated connectivity and supports Global Reach for full integration between on-premises, AVS, and Azure VNets; VPN is not supported as the primary AVS fabric connection.

No, Azure VMware Solution requires a minimum of three hosts per cluster to provide redundancy and meet the service SLA.

Private DNS queries are answered in the client VM's VNet, so the zone link must exist on each spoke that hosts VM1 or VM2; HubVNet needs a link only if a hub workload also resolves Sql1.

No. The A record is created in privatelink.database.windows.net when the private endpoint is configured; VNet links control which clients can resolve that record, not record creation.

Azure File Sync continuously syncs the on-premises SMB share to the premium Azure Files share and allows a short cutover, while Storage Migration Service is primarily for Windows file-server-to-file-server migrations.

Yes. Azure Migrate Discovery and assessment sizes VM1, and Azure Migrate Server Migration replicates the Hyper-V VM and performs the cutover.

No. It tracks Azure resource configuration changes; registry edits inside the guest OS are captured by Azure Automation Change Tracking and Inventory.

VM Insights focuses on performance and dependency data, not a configuration change audit trail; DNS setting changes require Azure Monitor Change Analysis.

It has no native Azure Repos build pipeline, no automatic pull request preview environments, and no /api routing, so you would build and maintain that tooling yourself.

Yes. Static Web Apps supports Azure DevOps/Azure Repos as a source, triggering builds and deployments on commits and creating preview environments for pull requests.

It provisions Fabrikam B2B identities in Contoso, but it does not provide access packages, approvals, or assignment expiration; entitlement management handles those governance controls.

Yes, entitlement management supports delegated administration, so Fabrikam admins can manage access package assignments for their users when Contoso grants that role.

Yes. Modify supports remediation tasks alongside DeployIfNotExists, but it edits properties on the resource being deployed rather than deploying a missing companion resource.

Yes. Azure Policy supports both, but the identity must be granted the roles the remediation template requires at the assignment scope.

100,000 devices writing directly would exhaust database throughput, require costly scale-up, and lose data when the database is unavailable. Event Hubs buffers and decouples the ingestion tier from the SQL tier.

Use a one-hour tumbling window grouped by the instance identifier and apply AVG() to the CPU field. The query output is written natively to Azure SQL Database as the sink.

Log Analytics stores and queries telemetry, but without Application Insights instrumentation or custom client-side code it does not automatically capture page load and end-user response timing.

No. Health check only probes instance availability and removes unhealthy instances; it does not report page load or end-user latency.

Azure Policy supports multiple assignments at the same management-group scope; both policies inherit to every finance subscription without needing separate groups.

Security has no unique policy set in the requirements; omitting VM Contributor or applying a deny assignment to security users in the shared IT/security group enforces the restriction.

Deny blocks creation when Department is missing, but this requirement says the resource group must still be created, so the tag must be added rather than enforced by denial.

DeployIfNotExists deploys a template after evaluation when a condition is unmet; it is not the effect designed to mutate the incoming resource group's tag, so modify is preferred.

No. In the Basic plan, every interactive KQL log query incurs a pay-as-you-go fee.

The Basic plan is generally better for high-volume ingestion due to its significantly lower cost per GB ingested.

Azure Disk Backup takes block-level, crash-consistent snapshots only. Drive P requires an application-consistent recovery point, which needs the VSS-based enhanced Azure VM backup policy.

Yes. Azure Disk Backup supports shared Premium SSDs at the block storage tier, so cluster shared disks can be protected with crash-consistent snapshots at lower cost than a full VM backup.

The SQL Server workload needs instance-level compatibility such as cross-database queries, which Azure SQL Database does not support; Managed Instance stays PaaS and can be zone-redundant.

Yes, Azure Database for MySQL Flexible Server supports zone redundancy in supported regions, meeting the requirement without IaaS management.

Traffic Analytics visualizes aggregated network flow data and trends. IP Flow Verify checks a single packet against NSG rules to see if it is allowed or denied.

It shows statistics on blocked flows via NSG flow logs but cannot verify if a specific new packet is allowed or denied in real-time.

Purview is a comprehensive governance tool with higher costs. For basic access review, native Azure Monitor logs are sufficient and more cost-effective.

No, the Activity Log primarily shows management-plane events (like vault creation). Data-plane access (secret reads) is in Resource Logs, also under Azure Monitor.

Yes, Application Insights includes built-in analytics for user flows, funnels, and retention to measure user experience and engagement.

Application Insights uses a Log Analytics workspace under the hood, but you configure it directly via the Application Insights resource blade for most standard monitoring tasks.

PIM requires approval for role activation, but if the approving admin is also compromised, or if the workflow is misconfigured, the attacker can gain elevated privileges. It does not technically block actions once permissions are granted.

Use Azure Backup's Immutable Vault feature, which uses WORM (Write Once Read Many) technology to prevent backups from being deleted or modified for a specified retention period, even by administrators.

Yes, assignments at a Management Group level automatically apply to all subscriptions and resources beneath it in the hierarchy.

No. Policies do not cross subscription boundaries unless they are assigned at a parent Management Group level that encompasses both subscriptions.

Diagnostic Settings are being retired in favor of the Azure Monitor Agent. AMA provides more flexible configuration and better performance for collecting guest OS logs like Windows Event Logs.

No, it stores and processes data. The Azure Monitor Agent collects the data and sends it to the workspace. The workspace then allows you to query the data or set up export rules to other destinations like storage accounts.

Sign-in risk is calculated per authentication event based on factors like location and device. User risk is calculated per identity based on historical data like leaked credentials.

No, risk-based Conditional Access policies require an Entra ID P1 or P2 license. Security Defaults can provide basic MFA without P2 but lack granular control.

Azure Storage Mover is a fully managed Azure service designed to help you migrate data from on-premises sources, such as file shares and NAS devices, to Azure Blob Storage or Data Lake Storage Gen2.

While AzCopy can copy data to Azure Blob Storage, it is not optimized for migrating entire file shares from NAS devices. Azure Storage Mover provides a more streamlined, managed approach for this specific scenario.

No. Overlay pod IPs come from a separate, non-routable pod CIDR; inbound traffic normally arrives through a LoadBalancer or ingress, while outbound traffic to on-premises is SNATed through the node IP.

Kubenet conserves VNet IPs, but AKS does not support it for Windows node pools, and it is the legacy option. The scenario makes Windows node pools a hard requirement, so kubenet fails.

Not by itself. It changes the dataplane and policy enforcement; it does not move pod IP allocation to a separate pod CIDR, so traditional Azure CNI-style VNet IP consumption remains the issue.

While IoT Hub can ingest device telemetry, Event Hubs is preferred for high-throughput industrial production lines where massive scale and direct integration with Stream Analytics are prioritized over device management features.

Yes, but it is less efficient. Functions are better for reacting to signals. Stream Analytics is optimized for complex SQL-based queries on continuous streams, making it the standard for real-time defect identification.