AZ-305 — Frequently Asked Questions

Container insights only reports resource, restart and log telemetry for Kubernetes and Arc-enabled clusters, and it does not even cover Azure Container Instances. It never simulates a user interaction, so it cannot surface UI failures.

A timer-triggered function calls TrackAvailability() to send the multi-step result straight into Application Insights, so you write a few lines instead of building a custom synthetic monitoring runner.

Multiple node pools only separate workloads and scale independently; because they all sit in the same zone, a datacenter maintenance event or outage still takes every node offline.

No. An AKS cluster is region-scoped, so cross-region resilience requires multiple clusters plus global traffic routing such as Azure Front Door or Traffic Manager.

It only reads role assignments; it does not email the manager a review task or automatically revoke permissions that the manager fails to approve, so it would require heavy custom development.

Yes. When the review is configured to auto-apply results, any permission the reviewer does not approve within the review period is removed automatically.

ADLS Gen2 enables a hierarchical namespace, and the exam treats encryption scopes with per-container customer-managed keys as a GPv2 blob feature; it also adds analytics overhead not required here.

Each blob container gets its own encryption scope that references a distinct customer-managed key in Azure Key Vault, while the account-level key still encrypts all data in the storage account.

A forest trust only enables on-premises Kerberos authentication. Azure RBAC requires a user object in the Contoso Azure AD tenant, and a forest trust does not create one.

Yes. Once the Fabrikam developers exist as guest users in the Contoso tenant, they can be assigned Contributor on the resource group just like any other security principal.

Both are enabled on top of a Log Analytics workspace rather than owning one; Sentinel adds SIEM data and Application Insights adds app telemetry to the same workspace.

Only real splitting factors: data residency or geography, separate access control between teams, or different retention and pricing tiers per data set.

Yes. Azure Policy assignments inherit to every child scope below the assignment, so MG1's assignment covers both Sub2 and Sub4 automatically.

It narrows the assignment so only Microsoft.Compute/virtualMachines in East US are evaluated; the PA2 definition itself is untouched and other regions or resource types are skipped.

The image workload needs massively parallel, dynamically scaled HPC processing, which is Azure Batch's core design; Functions targets short event-driven executions instead.

The question states Project3 does not support containers, so it must be lifted and shifted onto an Azure Virtual Machine that preserves OS and local file system behaviour.

A resource lock protects only the account resource from deletion; blobs inside can still be overwritten or deleted. Immutability must come from a container-level retention policy.

No. A legal hold has no expiry and stays until manually cleared, so it cannot express 'deletable after five years'; a five-year time-based interval can.

No. A resource lock protects the account or container resource itself, while the blobs inside can still be overwritten or deleted, so a container-level immutable policy is required.

Premium block blobs are provisioned for high transaction rates and low latency and cost far more per GB; for a <10 GB dataset read daily, GPv2 with the hot tier minimizes overall access charges.

No. DFS Replication is an on-premises multi-master Windows feature; Azure File Sync is the supported service for syncing Windows Server shares with an Azure file share and Azure VM server endpoints.

Only SMB lets Windows 11 map drive letters and it listens on TCP port 445, which the scenario explicitly requires; NFS and FTP cannot satisfy both conditions.

Import mode gives fast reports but copies the transformed data into the semantic model, which violates the requirement to minimize duplication of data. Direct Lake reads the Delta tables in OneLake directly, so it is both fast and non-duplicating.

No. A shortcut is a pointer, so Dataverse tables appear as Delta-Parquet folders in the lakehouse while the data stays in Dataverse. That is what satisfies the minimize-duplication requirement for the reference step.

Managed Instance storage tops out at 16 TB per instance (32 TB only on newer Business Critical premium-series hardware), so a 30-TB database must go to Azure SQL Database Hyperscale, which scales to 100 TB.

Not in General Purpose or Business Critical, which cap at 4 TB per database. It fits Azure SQL Managed Instance (16 TB) or the Hyperscale tier, so the choice depends on the project's SQL Server compatibility needs.

Cosmos DB is a non-relational, multi-model NoSQL service for rapidly changing, globally distributed SaaS-integrated solutions; it cannot host SQL Server schemas, stored procedures or Agent jobs without rewriting them.

For this question's wording, yes: it is the managed Citus-based service whose distributed tables shard rows across nodes. Citus sharding now also runs as an extension on Azure Database for PostgreSQL flexible server.

Read replicas only scale read traffic and partitions stay on one node's storage. Only Citus distributed tables place different row ranges on different worker nodes, scaling writes horizontally.

Both replicate over the network, and DB1 must not be transmitted over the internet. At 500 TB, only Azure Data Box moves the data offline via a physical appliance.

Azure Migrate supports assessment and a test failover through Azure Site Recovery replication, satisfying the test-migration and minimal-downtime requirements that a raw disk copy cannot.

An availability set scopes its fault and update domains to a single zone, so its VMs can never be spread across availability zones. Only a zone-aware grouping such as a scale set in flexible orchestration mode meets that requirement.

Uniform orchestration mode keeps update-domain semantics and supports co-locating instances in a proximity placement group for low latency. Flexible mode manages instances as individual VMs and is the better fit for zone-spanning, not for that PPG plus update-domain profile.

Istio's VirtualService and DestinationRule weight fields perform layer-7 canary and blue/green splitting, whereas Dapr building blocks cover state and pub/sub, not weighted traffic distribution.

Yes. The Istio-based service mesh add-on is managed and upgraded by Azure, so you get traffic routing and splitting without running or patching your own Istio control plane.

Flexible mode allows a single scale set to mix Spot and on-demand VMs, so you can keep a baseline of on-demand instances for capacity while using cheaper Spot VMs during surges.

Yes, Azure Site Recovery supports replicating VMSS in Flexible orchestration mode, making it the correct choice for region-failure recovery.

Azure Front Door is a global service with higher cost; for a single-region App Service app, Application Gateway WAF_v2 satisfies the WAF requirement at lower cost.

No. By default App Service outbound traffic goes to the public internet. Regional virtual network integration routes outbound calls through the VNet, keeping DB1 traffic off the internet.

App1 already emits webhooks, so a Request trigger lets it push each new record instantly; a recurrence trigger would poll App1 and require extra interval and deduplication logic.

Yes, but it requires custom code for Teams authentication and message formatting, so it does not meet the requirement to minimize development effort like the Logic Apps Teams connector does.