Free Microsoft Certified: Azure Solutions Architect Expert (AZ-305) Sample Questions

Correct answer: B — Append

• A. Incorrect. The 'Deny' effect would block the creation or update of any resource that does not already have the 'CostCenter' tag. The requirement is to automatically add the tag if it's missing, not to prevent the resource's creation.
• B. Correct. The 'Append' effect is specifically designed for this scenario. It adds specified fields, such as a tag, to a resource during creation or update if that field is missing. Crucially, it does not overwrite an existing value if the user provides one, thus preserving any user-specified 'CostCenter' tag value.
• C. Incorrect. The 'Modify' effect can add, update, or remove properties on a resource. While it could be used to add a tag, it is more commonly used to enforce a specific value by overwriting whatever the user provides. 'Append' is the more precise and less intrusive effect for adding a tag only when it is absent.
• D. Incorrect. The 'AuditIfNotExists' effect does not alter resources. It is used to audit and report on resources that lack a specified property or configuration, creating a non-compliance event. It does not add or modify tags.

Correct answer: B — Assign to the Finance management group.

• A. Incorrect. While technically feasible, this approach is not recommended. Assigning a policy at a broad scope like the Root Management Group and then creating exemptions adds unnecessary complexity and management overhead. The best practice is to assign policies at the most specific scope that meets the requirements.
• B. Correct. This is the most precise and efficient solution. By assigning the policy directly to the Finance management group, it applies only to the subscriptions within that group, both current and future. This meets the requirement to restrict the Finance department without affecting the DataScience management group or any other part of the hierarchy.
• C. Incorrect. Assigning the policy at the Root Management Group would cause all child management groups, including DataScience, to inherit the policy. This would incorrectly block the DataScience group from creating the necessary expensive VM SKUs, directly violating one of the core requirements.
• D. Incorrect. While this would achieve the desired outcome for existing subscriptions, it is not scalable or maintainable. Each new subscription added to the Finance management group would require a separate policy assignment, increasing administrative effort and the risk of inconsistent governance.

Correct answer: B — Azure Monitor Agent (AMA)

• A. Incorrect. The Azure Connected Machine agent is used to connect non-Azure (hybrid) machines to Azure via Azure Arc, enabling them to be managed as Azure resources. It does not natively collect performance counters or event logs for Log Analytics.
• B. Correct. The Azure Monitor Agent (AMA) is the modern, recommended agent for collecting telemetry from the guest operating system of both Azure and hybrid virtual machines. It is specifically designed to gather Windows Event Logs, performance counters, and other data sources and forward them to an Azure Monitor Logs (Log Analytics workspace) using Data Collection Rules (DCRs).
• C. Incorrect. The Dependency Agent is a supplementary agent used with VM insights and Service Map. Its primary function is to collect data about running processes and their network dependencies, not to collect general performance counters or Windows Event Logs.
• D. Incorrect. The Telegraf Agent is a popular open-source agent for collecting metrics. While it can be configured to send data to Azure Monitor, it is not the primary, natively integrated agent recommended for collecting standard Windows Event Logs and performance counters into a Log Analytics workspace.

Correct answer: C — Configure Diagnostic Settings to send the logs to a Log Analytics workspace.

• A. Incorrect. The default retention period for Microsoft Entra ID logs is insufficient. Depending on the license, it is 7 days (Free) or 30 days (P1/P2), which does not meet the 365-day requirement. Furthermore, the native Entra ID log interface does not provide the full KQL querying capabilities required.
• B. Incorrect. While exporting logs to an Azure Storage account is a valid and cost-effective method for long-term retention (archiving), a storage account does not have a native engine to query the data using KQL. An additional service, like Azure Data Explorer or Azure Synapse Analytics, would be needed to query the archived logs.
• C. Correct. This is the ideal solution that meets both requirements directly. By configuring Diagnostic Settings in Microsoft Entra ID, you can send sign-in and audit logs to a Log Analytics workspace. Log Analytics uses Kusto Query Language (KQL) for analysis and allows you to configure data retention for up to 730 days (2 years), easily satisfying the 365-day compliance requirement.
• D. Incorrect. Streaming logs to an Azure Event Hub is designed for real-time data ingestion and forwarding to other systems, such as SIEMs or other analytics platforms. Event Hub itself does not provide long-term storage or a KQL query engine. It's a data pipeline, not a final destination for storage and querying.

Correct answers: A, B, C — SMS/Push/Voice; Email Azure Resource Manager Role; Webhook

• A. Correct. Azure Action Groups provide built-in notification types to send alerts directly to individuals. This includes sending an SMS to a phone number, a voice call to a phone number, or a push notification to the Azure mobile app.
• B. Correct. This is a valid notification type that allows sending an email to users assigned to specific Azure Resource Manager (ARM) roles at the subscription level, such as Owner, Contributor, or Reader. This ensures that notifications are routed to the appropriate personnel based on their defined responsibilities.
• C. Correct. A webhook is a supported action type in an Action Group. It is commonly used to notify external systems or trigger automated processes by sending an HTTP POST request to a specified endpoint when an alert is fired. This is a key method for integrating Azure alerts with third-party tools and custom workflows.
• D. Incorrect. There is no direct, built-in action type within an Action Group to start a virtual machine. To achieve this, you would need to use a more powerful action type like an Automation Runbook, Azure Function, or Logic App, which would contain the script or logic to perform the start operation.
• E. Incorrect. Action Groups do not have a direct action type to execute a SQL stored procedure. Similar to starting a VM, this task would require an intermediary service like an Azure Function, Logic App, or Automation Runbook, which would be triggered by the Action Group to connect to the database and run the procedure.

Correct answer: A — Apply an Azure Policy with a 'Deny' effect.

• A. Correct. An Azure Policy with a 'Deny' effect is evaluated by Azure Resource Manager after authentication but before an action is executed. It can be configured to block specific actions, such as 'Microsoft.Management/managementGroups/delete'. This enforcement happens regardless of a user's RBAC role, meaning it will prevent even an administrator with the Owner role from performing the denied action, thus satisfying the requirements.
• B. Incorrect. While Azure Blueprints can deploy resource locks as part of an environment setup, a user with the Owner role inherently has the 'Microsoft.Authorization/locks/delete' permission. This allows them to remove any locks applied, making this solution ineffective against an administrator with Owner privileges.
• C. Incorrect. A 'CanNotDelete' resource lock can be removed by any principal with the Owner or User Access Administrator role. Therefore, it does not provide persistent protection against accidental deletion by a global administrator with the Owner role. Additionally, resource locks protect resources within a scope, not the management group object itself.
• D. Incorrect. This option directly contradicts the requirement that the solution must persist 'even if the administrator has the Owner role'. Removing the role is not a valid solution based on the problem's constraints.

Correct answers: A, C, D — Set the 'Supported account types' to 'Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)'.; Configure the Redirect URI.; Enable the 'ID tokens' check box in Authentication settings.

• A. This is the primary setting that defines an application as multi-tenant. By selecting 'Accounts in any organizational directory', you allow users from any Microsoft Entra ID tenant to authenticate against your application, which is the core requirement for the SaaS solution.
• B. This is incorrect. The App Registration is created in your (the publisher's) tenant. When a user or administrator from a customer's tenant consents to the application, a service principal (which is represented as an Enterprise Application) is automatically created in their tenant. The publisher does not manually create this in the customer's tenant.
• C. This is a mandatory configuration for any application using OAuth 2.0 or OpenID Connect. The Redirect URI is the endpoint in your application where Microsoft Entra ID will send the security tokens (like the ID token or authorization code) after the user has successfully authenticated. Without it, the authentication flow cannot be completed.
• D. This is required for the application to perform user sign-in. By enabling the 'ID tokens' option, you are configuring the application to request an ID token as part of the OpenID Connect flow. The ID token contains claims about the authenticated user, allowing your application to verify their identity.
• E. This is incorrect and represents a major security vulnerability. A client secret is used by the application to prove its own identity to the identity provider and must be kept confidential. It should never be shared with customers or any other third party.

Correct answer: B — False

• A. The statement is false. The proposed solution does not meet the goal. While Microsoft Entra Identity Protection can enforce MFA based on sign-in risk, it lacks the core capabilities to manage temporary, just-in-time (JIT) role assignments or to require a justification for access. These are essential requirements of the scenario.
• B. The statement is true. The proposed solution does not meet the goal. The requirements for temporary access, justification, and MFA upon role activation are key features of Microsoft Entra Privileged Identity Management (PIM). Identity Protection is designed to protect against risky sign-ins, not to manage the lifecycle of privileged role assignments, making PIM the correct service for this use case.

Correct answer: B — Self-hosted Integration Runtime

• A. Incorrect. The Azure Integration Runtime is a fully managed, serverless compute in Azure used for cloud-to-cloud data integration. A Managed Private Endpoint allows this runtime to securely connect to other Azure PaaS services over the Azure private backbone, but it does not facilitate connections to on-premises data sources. It cannot be installed on-premises and does not solve the requirement of connecting without opening inbound firewall ports.
• B. Correct. The Self-hosted Integration Runtime (SHIR) is specifically designed for hybrid data integration scenarios. It is an agent installed on a machine within the on-premises network. The SHIR initiates outbound HTTPS connections to the Azure Data Factory service to poll for jobs, meaning no inbound ports need to be opened on the on-premises firewall. All data transferred is encrypted in transit using TLS. The SHIR can also be scaled out for high-throughput data movement, making it suitable for copying large volumes like 10 TB daily.
• C. Incorrect. The Azure-SSIS Integration Runtime is a specialized component used to lift and shift existing SQL Server Integration Services (SSIS) packages to run in Azure. While it can connect to on-premises data sources, it would still require another component, such as a Self-hosted Integration Runtime or VNet integration with a VPN/ExpressRoute, to establish that connectivity securely without opening inbound ports. Therefore, it is not the primary component that solves the core problem.
• D. Incorrect. Azure Data Box Gateway is a virtual appliance used for large-scale, often offline, data transfers to Azure Storage. It is a storage migration service, not an integration runtime component for Azure Data Factory. It does not provide the direct, orchestrated connectivity for an ADF pipeline to query and pull data from an on-premises database like Oracle for a daily ETL process.

Correct answers: B, C — Connect ADF to a Git repository and redeploy ARM templates/resources to the secondary region via CI/CD; Manually export the ARM template from the ADF portal and import it to the new region

• A. Incorrect. Azure Site Recovery (ASR) is designed for the replication and failover of IaaS resources like virtual machines and physical servers. It does not support PaaS services like Azure Data Factory, which are essentially control plane services with configuration metadata.
• B. Correct. Integrating Azure Data Factory with a Git repository (like Azure DevOps or GitHub) is a best practice for source control and disaster recovery. This allows all factory artifacts (pipelines, datasets, linked services) to be stored as code. A Continuous Integration/Continuous Deployment (CI/CD) pipeline can then be used to automatically deploy these resources from the ARM templates generated from the repository to a secondary region, providing an automated and reliable recovery process.
• C. Correct. The Azure portal provides a feature to export the entire Azure Data Factory instance as an Azure Resource Manager (ARM) template. This template captures the configuration of all pipelines, datasets, linked services, and other components. In a disaster recovery scenario, this exported template can be manually deployed to a new resource group in a secondary region to recreate the factory. While less automated than a CI/CD approach, it is a valid and supported method.
• D. Incorrect. Azure Data Factory is a regional service and does not have a built-in geo-redundancy feature or setting that can be enabled at creation time. To achieve high availability across regions, you must implement a custom disaster recovery strategy, such as redeploying the instance using ARM templates.
• E. Incorrect. Azure Backup is a service used for backing up and restoring data from sources like virtual machines, SQL databases, and Azure file shares. It does not back up the configuration or control plane of Azure PaaS services like Azure Data Factory. The recovery of ADF relies on its definition, which is best managed via ARM templates.

Correct answer: C — Azure Functions

• A. Incorrect. Azure Synapse Spark Pools are designed for large-scale, distributed big data processing. They involve significant provisioning and startup overhead, making them inefficient and not cost-effective for small, sporadic jobs. This option is not truly serverless for this use case and is overly complex for the requirement.
• B. Incorrect. Azure Databricks is a powerful, managed Apache Spark platform for analytics at scale. However, it typically involves cluster management and has a higher cost overhead, making it unsuitable for short-lived, sporadic tasks on small datasets. It is not the most cost-effective or lightweight serverless choice for this scenario.
• C. Correct. Azure Functions is a serverless compute service that directly meets all the requirements. It can execute code (including Python scripts with the Pandas library) in response to triggers like an HTTP request. Its consumption-based pricing model means you only pay for execution time, making it extremely cost-effective for sporadic workloads. This is the ideal choice for a lightweight, event-driven task.
• D. Incorrect. Azure HDInsight is a managed service for open-source big data frameworks like Hadoop and Spark. It requires provisioning and managing clusters, so it is not serverless. It is designed for large-scale batch processing and would introduce unnecessary complexity and cost for a small, infrequent task.

Correct answer: C — Azure Database Migration Service (DMS)

• A. Incorrect. Data Migration Assistant (DMA) is a tool specifically designed to assess and migrate Microsoft SQL Server workloads to Azure SQL platforms (Azure SQL Database, Azure SQL Managed Instance, SQL Server on Azure VM). It does not support Oracle as a source or PostgreSQL as a target.
• B. Incorrect. SQL Server Migration Assistant (SSMA) is a suite of tools for migrating various database platforms (like Oracle, DB2, Access) to Microsoft SQL Server or Azure SQL platforms. It does not support Azure Database for PostgreSQL as a migration target.
• C. Correct. While the detailed assessment and schema conversion for an Oracle to PostgreSQL migration often rely on a tool like ora2pg, Azure Database Migration Service (DMS) is the central Azure service that orchestrates the entire migration process. A DMS migration project manages the workflow, which includes applying the converted schema and moving the data. Among the choices provided, DMS is the primary Azure service associated with executing this type of heterogeneous database migration.
• D. Incorrect. Azure Data Factory (ADF) is a cloud-based data integration and ETL service. While it excels at orchestrating data movement and transformations between a wide variety of data stores, it is not a specialized database migration tool. It lacks the built-in features for comprehensive schema assessment and automated conversion required for a database migration project.

Correct answers: C, E — SQL Server on Azure Virtual Machine; Azure SQL Edge on a container

• A. Incorrect. Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) offering that abstracts the underlying operating system. Consequently, it does not permit direct access to the OS file system or the installation of custom third-party agents, making it unsuitable for the stated requirements.
• B. Incorrect. Although Azure SQL Managed Instance provides a high degree of compatibility with on-premises SQL Server, it remains a PaaS offering. It does not grant access to the underlying guest operating system, which is necessary for installing custom third-party agents and for stored procedures to directly manipulate files on the local file system.
• C. Correct. As an Infrastructure-as-a-Service (IaaS) solution, SQL Server on an Azure Virtual Machine provides complete control over the underlying operating system. This allows for the installation of any required third-party agents and enables features that give stored procedures direct access to the local file system, perfectly matching the legacy application's requirements.
• D. Incorrect. Azure Database for MySQL is a PaaS offering for the MySQL engine, not SQL Server. Like other Azure database PaaS offerings, it does not provide access to the underlying operating system for installing custom agents or performing file system operations.
• E. Correct. Azure SQL Edge runs within a container on a host that you control, such as an Azure VM. This deployment model allows you to mount host file system volumes into the container, providing the necessary file system access for the application. Furthermore, the required third-party agents can be installed directly on the host VM or run in separate containers on the same host, satisfying both legacy requirements.

Correct answer: A — True

• A. The statement is true because Azure SQL Managed Instance supports distributed transactions coordinated by the Microsoft Distributed Transaction Coordinator (MSDTC). This capability allows for transactions spanning multiple databases within managed instances and also with other MSDTC participants, including on-premises SQL Server instances. To enable this hybrid functionality, proper network connectivity, such as a Site-to-Site VPN or ExpressRoute, is required to facilitate communication between the on-premises resources and Azure.
• B. The statement is false because Azure SQL Managed Instance does support distributed transactions. While it was a limitation in the past, the service now has built-in support for MSDTC, making it a suitable platform-as-a-service (PaaS) offering for migrating complex on-premises SQL Server workloads that rely on this feature for transactions across databases or hybrid environments.

Correct answer: B — Bounded Staleness

• A. Incorrect. Strong consistency (linearizability) guarantees that reads always return the most recent committed write. While this preserves global ordering, it incurs the highest latency for a globally distributed application because it requires cross-region coordination to achieve a quorum for every read and write operation. This violates the primary requirement of minimizing latency.
• B. Correct. Bounded Staleness is specifically designed for this scenario. It allows you to configure a maximum staleness window, either by a number of object versions or by a time interval. By setting the time bound to 5 minutes, you can guarantee that reads are never older than the specified requirement. This level provides low-latency reads by serving data from the local replica, ensuring high availability and performance for a global user base, while also guaranteeing that writes are globally ordered.
• C. Incorrect. Session consistency provides guarantees within a single client session (e.g., monotonic reads, read-your-writes). While it offers a good balance of performance and consistency for individual users, it does not provide a global guarantee on data staleness across all users and regions. Therefore, it cannot ensure that every user worldwide will read data that is no older than 5 minutes.
• D. Incorrect. Consistent Prefix ensures that reads never see out-of-order writes; they will always see a valid prefix of the total write sequence. However, it does not provide any time-based guarantees on how stale the data can be. Data could be arbitrarily stale, thus failing to meet the strict 5-minute freshness requirement.

Correct answer: A — Time-based retention policy with a locked state.

• A. This is the correct solution. Azure Blob Storage's immutable storage feature allows for time-based retention policies. When this policy is set and then locked, it transitions the data to a Write-Once, Read-Many (WORM) state. Once locked, the policy cannot be removed or shortened, and the blobs cannot be modified or deleted by any user, including account administrators, for the duration of the retention period. This directly meets the firm's legal and compliance requirements.
• B. Incorrect. A legal hold policy also makes data immutable, but it is used for an indefinite period, typically for eDiscovery or legal investigations. The hold remains in effect until it is explicitly removed by an authorized user. This does not meet the requirement for a fixed 5-year period, and it can be removed, which violates the 'no one can delete' constraint once the policy is active.
• C. Incorrect. Azure RBAC, including Deny assignments, controls user permissions and access to resources. However, it does not make the data itself immutable at the storage service level. A user with sufficient privileges, like an Owner, could change the RBAC assignments. This approach does not provide the guaranteed, non-removable WORM state that a locked immutability policy offers.
• D. Incorrect. Soft delete is a data protection feature designed to recover from accidental deletions. It does not prevent blobs from being deleted or modified; it simply retains them in a soft-deleted state for a configurable period before permanent deletion. The primary purpose is recovery, not enforcing immutability for compliance.

Correct answers: A, B — Azure Data Box; Azure File Sync

• A. Azure Data Box is a physical, secure appliance provided by Microsoft specifically for offline transfer of very large datasets. For a 500 TB migration with insufficient bandwidth, you can copy the data to the Data Box device on-premises and then ship it to an Azure datacenter. This process, known as offline seeding, perfectly addresses the requirement to transfer the initial bulk data without relying on the limited internet connection.
• B. Azure File Sync is designed to centralize your organization's file shares in Azure Files while maintaining the performance and compatibility of an on-premises file server. After the initial 500 TB is seeded to Azure Files using Azure Data Box, Azure File Sync can be deployed to synchronize any changes that occurred during shipping and to provide continuous, ongoing synchronization between the on-premises server and Azure Files.
• C. AzCopy is a command-line utility for copying data to and from Azure storage over the network. It is not a suitable choice for the initial 500 TB transfer because the scenario explicitly states that internet bandwidth is insufficient. It does not provide an offline transfer method or a continuous synchronization service.
• D. Azure Migrate is a centralized hub of tools and services for assessing and migrating on-premises servers, virtual machines, applications, and databases to Azure. It is not the primary tool for a large-scale, offline file data transfer to Azure Files.
• E. Azure Storage Explorer is a graphical user interface (GUI) tool for managing Azure storage resources. Like AzCopy, it relies on network connectivity for data transfers and is not designed for offline seeding of terabyte-scale data or for providing automated, continuous file synchronization.

Correct answer: B — Read-access geo-redundant storage (RA-GRS)

• A. Incorrect. Geo-redundant storage (GRS) protects against regional outages by asynchronously replicating data to a secondary region. However, read access to the data in the secondary region is only possible after a failover initiated by Microsoft, so it does not meet the requirement for continuous read access.
• B. Correct. Read-access geo-redundant storage (RA-GRS) builds upon GRS by providing a read-only endpoint to the data in the secondary region. This endpoint is available at all times, even when the primary region is fully operational, thus satisfying both the requirement for regional outage protection and constant read access to the secondary replica.
• C. Incorrect. Zone-redundant storage (ZRS) provides high availability within a single region by synchronously replicating data across three different Availability Zones. It protects against zone-level failures but does not protect against a complete regional outage.
• D. Incorrect. Locally-redundant storage (LRS) replicates data three times within a single data center in one region. It offers the lowest cost and durability and does not protect against datacenter, zone, or regional outages.

Correct answers: B, C — Distribute instances across Availability Zones.; Distribute instances across Fault Domains.

• A. Incorrect. Setting the fault domain count to 1 is the opposite of what is required for high availability. This configuration would place all instances within a single hardware rack (fault domain), creating a single point of failure and reducing resilience against hardware issues.
• B. Correct. Distributing instances across Availability Zones is a fundamental strategy for achieving high availability within a region. Availability Zones are physically separate datacenters with independent power, cooling, and networking. This protects the application from a zone-level failure, which is a key requirement for the highest availability.
• C. Correct. Distributing instances across Fault Domains provides protection against localized hardware failures, such as a rack or power supply failure, within a single Availability Zone. This complements distribution across Availability Zones to achieve maximum resilience by protecting against failures at both the datacenter and hardware rack levels.
• D. Incorrect. Spot Instances are not suitable for high-availability workloads. While they offer significant cost savings, they can be evicted by Azure with little to no notice when the capacity is needed for pay-as-you-go workloads. This inherent unreliability makes them a poor choice for ensuring continuous availability.
• E. Incorrect. Overprovisioning is a feature primarily associated with the Uniform orchestration mode, where it helps speed up scale-out operations. It does not directly enhance high availability or fault tolerance. Furthermore, in Flexible orchestration mode, instance management is more explicit, making this setting less relevant.

Correct answer: B — False

• A. The statement is false. Deploying two or more virtual machines into the same Availability Set provides a Service Level Agreement (SLA) of 99.95%. This is insufficient to meet the stated requirement of a 99.99% SLA.
• B. The statement is true. The proposed solution does not meet the goal because an Availability Set for two or more VMs offers a 99.95% SLA. To achieve the required 99.99% SLA, the virtual machines must be deployed across two or more Availability Zones, which protects against entire datacenter failures.

Correct answer: B — Use Azure Backup with the AKS Backup extension.

• A. Incorrect. While Velero is a powerful open-source tool that can back up Kubernetes resources and persistent volumes to Azure Storage and supports granular restores, Azure now offers a native, fully managed solution. For an enterprise environment seeking an integrated experience, the native Azure service is the preferred recommendation.
• B. Correct. Azure Backup for AKS is the native, managed Azure service specifically designed for this scenario. It installs a backup extension on the AKS cluster, enabling backups of both Kubernetes cluster resources and persistent volumes (using disk snapshots). Backups are stored centrally and securely in an Azure Backup Vault, and the service supports granular, item-level restores. This provides a fully integrated and supported solution within the Azure ecosystem.
• C. Incorrect. Taking snapshots of the OS disks of agent nodes is not a valid backup strategy for AKS. This method does not capture the Kubernetes cluster configuration, which is stored in etcd on the control plane nodes. Furthermore, persistent volumes are typically separate managed data disks attached to nodes, not part of the OS disk, so their data would also be missed.
• D. Incorrect. Azure Site Recovery (ASR) is a disaster recovery service that operates at the virtual machine level. While it can replicate the underlying VM Scale Set of the AKS cluster, it is not Kubernetes-aware. ASR cannot back up or restore individual Kubernetes objects like deployments or services, and therefore does not support the granular restore requirement.

Correct answer: B — No, GZRS does not provide a defined RPO SLA and secondary access requires RA-GZRS.

• A. Incorrect. GZRS uses asynchronous replication to a secondary region. This process inherently has a replication lag, meaning it cannot provide a Recovery Point Objective (RPO) of zero. An RPO of zero would imply synchronous replication, which GZRS does not offer.
• B. Correct. The proposed GZRS solution fails to meet the requirements for two main reasons. First, while Microsoft states the typical RPO for GZRS is under 15 minutes, there is no formal Service Level Agreement (SLA) guaranteeing this, making it unsuitable for a strict RPO requirement. Second, standard GZRS does not allow read access to the data in the secondary region unless a failover occurs. To meet the requirement for the data to be readable at all times, you must configure Read-Access Geo-Zone-Redundant Storage (RA-GZRS).
• C. Incorrect. While Object Replication can be used for more granular, account-to-account replication which helps in meeting RPO targets, it is not the only solution, and it does not have a formal RPO SLA either. The most direct reason the proposed GZRS solution fails is that it lacks the read-access capability, which is provided by RA-GZRS.
• D. Incorrect. GZRS automatically performs the replication to the secondary region, but due to the asynchronous nature of this cross-region replication, it does not guarantee a specific RPO. The replication lag can vary, so it does not meet the requirement for a defined 15-minute RPO.

Correct answer: B — Recover the deleted secret, then restore the specific version if needed.

• A. This is incorrect. Purging a secret is a permanent and irreversible action that completely removes the secret and all its versions from the Key Vault. This is the opposite of recovery and would make it impossible to restore the desired version.
• B. This is the correct sequence. Since soft delete is enabled and the secret was deleted 20 days ago (which is within the 90-day retention period), the secret is in a recoverable state. The first step is to recover the soft-deleted secret object. This action restores the secret and all its associated versions. Once recovered, you can access and use the specific version that you need.
• C. This is incorrect. While Azure Key Vault can be backed up to a Recovery Services Vault, this method is designed for full vault disaster recovery scenarios, not for recovering a single soft-deleted item. Using the native soft delete recovery feature is the simpler, intended, and more direct method for this situation.
• D. This is incorrect. The 'Backup' command on the Key Vault blade is used to create a backup of the Key Vault's secrets, not to restore or recover them. The required action is to recover the item from its soft-deleted state.

Correct answer: B — Azure App Configuration

• A. Incorrect. Azure Key Vault is primarily designed for securely storing and managing secrets, keys, and certificates. While it can store configuration values as secrets and supports versioning, it is not intended for general application configuration management and lacks native support for feature flags or point-in-time snapshots of a full configuration set.
• B. Correct. Azure App Configuration is a dedicated service for centrally managing application settings and feature flags. It allows for dynamic configuration updates that can be consumed by applications without requiring a redeployment. It also supports point-in-time snapshots of configuration through its revision history and use of labels, meeting all the requirements of the scenario.
• C. Incorrect. Azure Service Bus is a fully managed enterprise message broker with message queues and publish-subscribe topics. Its purpose is to decouple applications and services, not to store or manage application configuration or feature flags.
• D. Incorrect. Azure Application Insights is an Application Performance Management (APM) service. It is used for monitoring live applications by collecting telemetry data like logs, metrics, and traces to detect and diagnose performance issues. It does not provide any capabilities for configuration or feature flag management.

Correct answer: C — Azure Storage Queues

• A. Incorrect. Azure Service Bus Queues in the Standard and Premium tiers have a maximum size limit of 80 GB, which does not meet the requirement. While they offer advanced features like transactions and sessions, these are not required and contribute to a higher cost compared to other options.
• B. Incorrect. Azure Service Bus Topics are designed for publish-subscribe (one-to-many) messaging patterns, not for a simple one-to-one queue. They also share the same 80 GB size limitation and higher cost structure as Service Bus Queues, making them inappropriate for this scenario.
• C. Correct. Azure Storage Queues are highly scalable, with a single queue's size limited only by the capacity of the storage account (up to 5 PiB), easily exceeding the 80 GB requirement. They are the most cost-effective solution for large volumes of simple messages. The auditing requirement can be met by application logic that copies the message to a persistent store like Azure Blob Storage before deleting it from the queue. Lastly, Storage Queues do not provide ordering guarantees, which aligns perfectly with the requirements.
• D. Incorrect. Azure Event Hubs is a big data streaming platform designed for high-throughput event ingestion and telemetry, not a traditional message queueing service. It uses a partitioned consumer model rather than the competing consumer pattern typical of queues. It would be overly complex and not cost-effective for this specific requirement.

Correct answer: C — Dead-letter Queue (DLQ)

• A. Incorrect. Sessions are used to group related messages to ensure guaranteed first-in, first-out (FIFO) ordered processing within a session. They are not designed to handle messages that repeatedly fail processing.
• B. Incorrect. Duplicate Detection identifies and discards duplicate messages sent to a queue or topic within a specified time window. It does not handle message delivery failures or the routing of failed messages.
• C. Correct. The Dead-letter Queue (DLQ) is a sub-queue specifically designed to hold messages that cannot be processed or delivered successfully. Service Bus automatically moves a message to the DLQ after its delivery count exceeds the configurable 'MaxDeliveryCount' property. By setting this property to 10, any message that fails processing 10 times is moved to the DLQ for later inspection, preventing so-called 'poison messages' from blocking the main queue.
• D. Incorrect. Auto-forwarding chains a queue or subscription to another queue or topic. It automatically forwards all incoming messages from the source to a destination entity. This is used for building complex messaging topologies, not for handling message processing failures based on a delivery count.

Correct answer: B — Azure Functions on a Premium Plan

• A. Incorrect. While Azure Functions on a Consumption Plan is a serverless, event-driven, and cost-effective option, it has a maximum execution timeout of 10 minutes. Since the processing can take up to 15 minutes, this plan cannot reliably handle the longest-running jobs.
• B. Correct. Azure Functions on a Premium Plan offers a serverless model with automatic scaling for unpredictable workloads while supporting long-running executions (60 minutes by default, effectively unlimited). This meets the 15-minute requirement. It minimizes administrative effort and, while more expensive than the Consumption plan, is the most appropriate serverless option that fulfills all constraints.
• C. Incorrect. Azure Logic Apps are designed for workflow orchestration and connecting services, not for executing complex or long-running custom C# code. The processing logic described would be inefficient and costly to implement in a Logic App.
• D. Incorrect. Azure App Service WebJobs are not a true serverless offering. They run on an App Service Plan, which requires provisioning and managing underlying compute resources. This results in more administrative effort and is less cost-effective for unpredictable, event-driven workloads compared to the Functions Premium Plan.

Correct answer: B — Azure VMware Solution (AVS)

• A. Incorrect. Azure Virtual Networks (VNets) are fundamentally Layer 3 constructs. Azure does not offer a native 'bridged VNet' service that provides Layer 2 network extension to an on-premises environment. Therefore, this approach cannot meet the strict requirement for Layer 2 adjacency and IP address retention.
• B. Correct. Azure VMware Solution (AVS) is a first-party Azure service that provides a dedicated, private cloud environment containing a VMware vSphere cluster built from bare-metal Azure infrastructure. It is specifically designed for migrating and running on-premises VMware workloads. AVS utilizes VMware technologies like HCX (Hybrid Cloud Extension) to facilitate L2 network extension, allowing for seamless migration of VMs while retaining their original IP addresses and maintaining Layer 2 adjacency with the on-premises network. This directly meets all the stated requirements with minimal architectural changes.
• C. Incorrect. Azure Dedicated Host provides physical servers dedicated to a single Azure subscription, offering hardware isolation for standard Azure VMs. It does not include the VMware software stack (vSphere, vSAN, NSX-T) or the specific networking capabilities like L2 extension required to migrate a VMware environment without re-architecting the network.
• D. Incorrect. Azure Virtual Machine Scale Sets are used to deploy and manage a set of identical, auto-scaling virtual machines. This service is intended for scalable, often stateless, workloads and does not provide any features for VMware migration, Layer 2 adjacency, or the retention of on-premises IP addresses.

Correct answers: A, B — Azure Container Instances (ACI) with GPU resources; Azure Container Apps with GPU workload profiles

• A. Correct. Azure Container Instances (ACI) is a serverless container-as-a-service offering. It supports deploying container groups with allocated GPU resources, making it an ideal choice for short-lived, GPU-intensive workloads like machine learning inference without the need to manage any underlying virtual machines or orchestration platform.
• B. Correct. Azure Container Apps is a serverless application-centric hosting service built on Kubernetes. It supports dedicated GPU-enabled workload profiles, which allow you to run containerized applications requiring GPU acceleration in a serverless environment, benefiting from features like scaling and Dapr integration.
• C. Incorrect. Azure App Service for Containers is a Platform-as-a-Service (PaaS) offering optimized for hosting containerized web applications and APIs. It is not designed for compute-intensive tasks and does not provide access to GPU resources.
• D. Incorrect. Azure Functions is a serverless Function-as-a-Service (FaaS) platform designed for running event-driven, short-lived code snippets. It does not provide direct access to GPU hardware, making it unsuitable for this workload.
• E. Incorrect. Azure Service Fabric Mesh has been retired and is no longer a supported service. Even when it was available, it did not offer native, managed GPU support for containerized applications.

Correct answer: B — Plan

• A. Incorrect. The Strategy phase focuses on defining the high-level business justification, motivations, and expected outcomes of the cloud adoption effort. While financial considerations are part of this, the detailed digital estate assessment and TCO calculation occur in a later phase.
• B. Correct. The Plan phase is where the detailed assessment of the existing digital estate primarily occurs. Activities in this phase include inventorying on-premises assets, rationalizing the portfolio, and creating a detailed financial model, including the TCO analysis required to provide a comprehensive business case to stakeholders like the CFO. This assessment forms the basis for the cloud adoption plan.
• C. Incorrect. The Ready phase focuses on preparing the Azure environment for the planned migration. This involves setting up Azure landing zones, implementing governance, and ensuring the organization is operationally ready. The financial analysis and digital estate assessment should already be completed to inform these readiness activities.
• D. Incorrect. The Adopt phase involves the actual execution of the migration and modernization of workloads as defined in the cloud adoption plan. By the time you reach this phase, the digital estate assessment, TCO calculation, and financial justification should have been completed and approved.

Correct answer: B — App Service Migration Assistant

• A. Incorrect. The Azure Migrate: App Containerization tool is designed for assessing and containerizing applications by generating Dockerfiles and container images. Its primary targets are container platforms like Azure Kubernetes Service (AKS) or Azure Container Instances (ACI), not for performing a direct compatibility assessment to identify blockers for Azure App Service.
• B. Correct. The App Service Migration Assistant is the purpose-built tool for this scenario. It is specifically designed to scan on-premises web applications, including Java applications on Tomcat, to identify compatibility issues, blocking dependencies, and other potential migration problems. It generates a detailed report with guidance on what needs to be addressed before migrating to Azure App Service.
• C. Incorrect. Azure Advisor is a service that provides personalized, best-practice recommendations to optimize your existing Azure resources for high availability, security, performance, and cost. It does not perform pre-migration compatibility scans on on-premises applications.
• D. Incorrect. The Data Migration Assistant (DMA) is a tool focused on database migrations. It helps assess database compatibility and migrate databases, for example, from an on-premises SQL Server to Azure SQL Database. It does not evaluate web application compatibility for a platform like Azure App Service.

Correct answers: A, B, D — NTFS; EXT4; XFS

• A. Correct. NTFS is the standard file system for Windows operating systems. Azure Data Box fully supports copying data from Windows clients over the SMB/CIFS protocol, making NTFS a supported source file system.
• B. Correct. EXT4 is a widely used journaling file system for Linux distributions. Azure Data Box supports copying data from Linux clients via the NFS protocol, which allows data residing on EXT4-formatted volumes to be migrated.
• C. Incorrect. Apple File System (APFS) is the default file system for modern macOS devices. Azure Data Box does not provide direct support for copying data from APFS-formatted volumes. To migrate data from a Mac, it must first be copied to a supported client or shared via a supported protocol like SMB.
• D. Correct. XFS is another high-performance journaling file system commonly used in Linux environments, particularly for large-scale systems. Data on XFS volumes can be copied to Azure Data Box from a Linux client using the NFS protocol.
• E. Incorrect. HFS+ (Mac OS Extended) is the predecessor to APFS for macOS. Similar to APFS, Azure Data Box does not directly support HFS+. Data from systems using HFS+ must be transferred using an intermediate system or a supported network protocol.

Correct answer: C — Azure Front Door

• A. Incorrect. Azure Traffic Manager is a DNS-based global traffic load balancer that can route traffic based on various methods, including latency. However, it operates at the DNS level and does not provide application-level features like SSL offloading or a Web Application Firewall (WAF).
• B. Incorrect. Azure Application Gateway is a regional Layer 7 load balancer that provides excellent features like SSL offloading and an integrated WAF. However, because it is a regional service, it cannot perform global load balancing across multiple regions by itself.
• C. Correct. Azure Front Door is a global, scalable entry-point that uses the Microsoft global edge network. It is a Layer 7 load balancer that perfectly meets all the requirements: global load balancing, latency-based routing to the nearest backend, SSL offloading, and an integrated Web Application Firewall (WAF).
• D. Incorrect. Azure Load Balancer is a regional Layer 4 (transport level) service that distributes TCP/UDP traffic. It does not operate at the application layer (HTTP/HTTPS) and therefore cannot provide SSL offloading or WAF capabilities. It is also not a global service.

Correct answer: B — Azure Route Server

• A. Incorrect. Azure Firewall Manager is a central management service for Azure Firewall instances and their associated security policies. It is not a routing service and does not provide the capability for BGP-based dynamic route exchange from an NVA to the virtual network.
• B. Correct. Azure Route Server is specifically designed to simplify dynamic routing in Azure. It enables BGP peering between an NVA and the Azure Virtual Network's Software Defined Networking (SDN) layer. This allows the NVA to advertise its learned routes to the Route Server, which then automatically injects these routes into the route tables of the hub and peered spoke virtual networks, eliminating the need to manually create and manage User Defined Routes (UDRs).
• C. Incorrect. Virtual Network Peering with Gateway Transit is a feature used to allow spoke virtual networks to use a VPN or ExpressRoute gateway located in the hub VNet for connectivity to on-premises networks. It does not handle the propagation of dynamic routes learned by an NVA. To direct traffic to the NVA, you would still need to use either manual UDRs or Azure Route Server.
• D. Incorrect. Azure Traffic Manager is a DNS-based global traffic load balancing service that directs client requests to the most appropriate service endpoint. It operates at the DNS layer (Layer 7) and is completely unrelated to network layer (Layer 3) routing within an Azure virtual network.

Correct answer: B — A Site-to-Site VPN connection over the internet

• A. Incorrect. While a second circuit provides redundancy for a single circuit failure, placing it in the same peering location introduces a single point of failure. If the entire peering location or the provider's edge equipment fails, both circuits will be impacted, defeating the purpose of a robust backup solution.
• B. Correct. A Site-to-Site (S2S) VPN over the internet is the standard, Microsoft-recommended design pattern for an ExpressRoute backup. It provides true path diversity by using a different network (the public internet). When configured with BGP on both the ExpressRoute and VPN gateways, it allows for automatic and seamless failover. Routes learned via the S2S VPN are less preferred when ExpressRoute is active, but they become the active path if the ExpressRoute BGP session fails.
• C. Incorrect. Azure Peering Service is used to optimize connectivity from an enterprise network to public Microsoft services (like Microsoft 365, Dynamics 365) over the internet. It does not provide private connectivity to Azure Virtual Networks and cannot function as a backup for an ExpressRoute circuit.
• D. Incorrect. Global VNet Peering is a mechanism for connecting virtual networks in different Azure regions to each other. It is used for communication entirely within the Azure backbone and does not provide connectivity from an on-premises network to Azure. Therefore, it cannot serve as a backup for an ExpressRoute circuit.