Free AZ-305 practice test

Least privilege means the narrowest role at the narrowest scope: a VM-focused role at the specific resource group grants restart without networking or delete rights across everything. Owner at subscription (C) and Contributor at management group (A) grant far too much, and sharing an admin account (B) destroys accountability.

Azure Policy — grouped into initiatives mapped to a compliance standard — continuously audits resources, reports compliance, and can auto-remediate via remediation tasks. Manual spreadsheets (D) don't scale or continuously assess, resource locks (A) only prevent changes, and Conditional Access (B) governs sign-in, not resource configuration.

Password hash synchronization (via Microsoft Entra Connect) provides hybrid identity with the same credentials across on-premises and cloud, and can authenticate in the cloud even if on-premises AD is down. Cloud-only (C) and separate passwords (A) break single-credential sign-in, and disabling sync (B) removes hybrid identity entirely.

PIM provides just-in-time, time-bound, approval-based activation of privileged roles, reducing standing access and its risk. Standing Owner assignments (C) are the anti-pattern PIM eliminates. Conditional Access (D) governs sign-in, not role activation. Azure Policy (A) governs resource configuration, not privileged access.

A CanNotDelete lock blocks deletion (even by Owners, until removed) while still permitting modifications — matching the requirement. A ReadOnly lock (B) would block configuration changes too, removing all Owners (C) breaks administration, and denying all writes (D) prevents legitimate changes.

Blob storage is Azure's object store for large-scale unstructured content, with durability options, tiering for cost, and HTTP access (often paired with a CDN). SQL Database (C) and Table Storage (A) aren't built for petabyte media files, and Redis (D) is an in-memory cache.

Azure SQL Database automated backups enable point-in-time restore to any moment within the retention period, recovering from corruption or accidental changes. Zone redundancy (B) and read replicas (C) address availability/scale, not point-in-time recovery, and a resource lock (D) prevents deletion of the resource, not data-level recovery.

The Azure SQL Database serverless compute tier auto-scales and can auto-pause during idle periods, billing only for what's used — ideal for spiky, intermittent workloads. A large 24/7 provisioned instance (B) or dedicated VM (C) pays during idle time, and Blob storage (D) isn't relational.

Azure Data Factory is the managed data-integration/ETL/ELT service for orchestrating ingestion and transformation pipelines across diverse sources. Key Vault (D) stores secrets, Front Door (A) is global HTTP load balancing/CDN, and Bastion (C) provides secure VM access — none is a data-integration orchestrator.

Read replicas (read scale-out) serve reporting queries from replicas, isolating that load from the primary's transactional writes. Running reports on the primary (B) contends with writes, deleting data (A) loses information, and Blob storage (C) isn't a relational query engine.

RA-GRS (or RA-GZRS) adds read access to the geo-replicated secondary copy, so applications can read from the secondary region even before a failover. LRS (D) is single-datacenter, ZRS (C) has no secondary region to read from, and no redundancy (B) fails the requirement.

Azure Site Recovery continuously replicates VMs to a secondary region and orchestrates failover, meeting cross-region RTO/RPO objectives. Weekly Azure Backup (B) can't meet a 15-minute RPO, availability zones (C) don't protect against a full regional failure, and a resource lock (D) is unrelated to DR.

Robust tier-1 design layers in-region HA (availability zones) with cross-region DR (replication/failover) to handle both datacenter and regional failures. A single zone with backups (B) lacks HA and fast DR, cross-region only (C) leaves in-region failures to full failover, and a lock (D) addresses neither HA nor DR.

Synchronous replication ensures each committed transaction is written to multiple replicas before acknowledging, giving near-zero RPO. Nightly backups (C) risk up to a day of loss, weekly exports (A) risk a week, and no replication (B) offers no recovery point beyond the last backup.

Azure Application Gateway is a regional layer-7 (HTTP/HTTPS) load balancer offering path-based routing, SSL offload, and integrated WAF. Load Balancer (B) is layer 4, Traffic Manager (D) is DNS-based global routing (no per-request layer-7 features or WAF), and Bastion (A) is VM access.

Azure Event Hubs is a big-data streaming ingestion service handling millions of events per second for real-time pipelines. Service Bus queues (D) target enterprise messaging at lower throughput per entity, Azure Files (C) is a file share, and SQL Database (A) is relational — neither is a high-volume event stream ingestor.

Azure Event Grid is the managed event-routing service for reactive architectures, delivering discrete events from sources to subscribers with filtering. Service Bus (B) is messaging (commands/work items), Data Factory (A) is data orchestration, and Redis (C) is a cache.

ExpressRoute provides a private, dedicated, high-bandwidth circuit between on-premises and Azure, bypassing the public internet. A site-to-site VPN (B) is encrypted but rides the public internet with variable performance, Front Door (C) is global HTTP load balancing, and DNS (D) resolves names.

Azure Front Door provides global, layer-7 HTTP(S) load balancing with path-based routing, TLS termination, and integrated WAF at the edge. A regional layer-4 Load Balancer (B) doesn't do global HTTP routing or WAF, Bastion (C) is VM access, and Service Bus (D) is messaging.

Azure Load Balancer (Standard) provides high-performance regional layer-4 (TCP/UDP) distribution across VMs. Front Door (D) is global layer 7 (HTTP), Application Gateway (A) is a regional layer-7 (HTTP) service (not general TCP), and DNS round-robin (C) lacks health-based, low-latency distribution.