Microsoft Certified: Azure Solutions Architect Expert — Practice Set 1

Question 1

A company wants to centralise collection of diagnostic logs from all Azure resources across 10 subscriptions into a single location for querying and long-term retention. Which Azure service should you recommend?

Accepted Answer

Azure Monitor Log Analytics workspace is the recommended centralised log repository that ingests diagnostic logs from multiple subscriptions via diagnostic settings, supports Kusto Query Language (KQL) for analysis, and provides configurable retention. Storage Accounts (A) store blobs but lack native query capability. Event Hubs (C) is a streaming platform for real-time ingestion, not a query store. Defender for Cloud (D) analyses security posture but is not a general-purpose log store.

Question 2

An organisation needs to route activity logs from all subscriptions in an Azure management group to a partner SIEM tool in near real-time. Which Azure service should you recommend for routing those logs?

Accepted Answer

Azure Event Hubs is the recommended solution for routing logs to external SIEM tools in near real-time. Diagnostic settings can stream logs directly to an Event Hubs namespace, and most SIEMs provide a native Event Hubs connector. Log Analytics (A) is for querying, not streaming to external systems. Storage Accounts (B) support archival but not streaming. Service Bus (D) is a messaging broker for application messages, not telemetry routing.

Question 3

A solutions architect must recommend an authentication solution for a web application that allows external partner users (in their own Azure AD tenants) to sign in without creating guest accounts. Which solution meets this requirement with the least operational overhead?

Accepted Answer

Microsoft Entra External ID with direct federation lets partner users authenticate against their own identity provider without requiring guest account provisioning per user. B2C (A) is designed for consumer-facing apps, not B2B partner federation. B2B invitation (C) still creates guest accounts, which the question explicitly excludes. AD FS (D) requires infrastructure management and per-tenant trust configuration — high overhead.

Question 4

A company stores connection strings, API keys, and TLS certificates used by multiple Azure services. They require centralised management, automatic certificate rotation, and fine-grained access policies tied to managed identities. Which solution should you recommend?

Accepted Answer

Azure Key Vault is specifically designed to store secrets, certificates, and keys with HSM-backed protection, automatic certificate rotation via integrated Certificate Authorities, and access policies tied to managed identities. App Configuration (A) manages feature flags and non-secret settings. Blob Storage with CMK (C) encrypts data at rest but is not a secrets management solution. Environment variables (D) are instance-scoped and cannot be rotated centrally.

Question 5

Contoso has 50 Azure subscriptions organised under a single management group. The security team requires that no virtual machines can be deployed without a specific tag indicating the cost centre, and that all VMs must use approved VM SKUs only. The policy must be enforced automatically without relying on manual review. Which approach best meets these requirements?

Accepted Answer

Assigning Azure Policy at the management group level propagates the policy to all child subscriptions automatically, enforcing tag requirements and allowed SKUs at deployment time via deny effects. Blueprints (A) are deprecated in favour of Policy and would require per-subscription assignment. RBAC (C) controls who can deploy, not what they can deploy. Third-party tools (D) add cost and management overhead without Azure-native enforcement.

Question 6

An architect must design a management group and subscription structure for a large enterprise with separate environments for Production, Development, and Testing, plus distinct business units that each require independent billing and budget controls. Which two design principles should be applied? Choose 2.

Accepted Answer

Separate subscriptions per environment (B) isolate blast radius, allow independent spend limits and budget alerts per environment, and support different policy requirements. Management groups (C) provide a hierarchy above subscriptions for consistent policy and RBAC inheritance across all business unit subscriptions. A single subscription (A) cannot provide independent billing isolation. Resource groups (D) are not a substitute for subscription-level isolation — they share quota and subscription-wide policies. Broad Owner rights for developers (E) violates least privilege.

Question 7

An organisation wants to authorise access to Azure resources using Attribute-Based Access Control (ABAC) conditions to restrict access to specific blob containers based on a tag value on those resources. Which Azure feature enables this?

Accepted Answer

Azure RBAC role assignment conditions allow you to add ABAC conditions — such as restricting access based on blob index tags or resource attributes — directly on role assignments. Policy with DeployIfNotExists (A) deploys remediation resources but does not restrict access. Conditional Access (C) evaluates authentication context, not resource attributes. PIM (D) manages just-in-time privileged role activation, not attribute-based access filtering.

Question 8

A company runs an e-commerce platform on Azure with a relational database that experiences unpredictable traffic spikes. They need a solution that automatically scales compute independently of storage and minimises downtime during scaling operations. Which Azure database service tier should you recommend?

Accepted Answer

Azure SQL Database Serverless automatically scales compute up and down based on workload demand (including auto-pause during inactivity), making it ideal for unpredictable or intermittent traffic patterns. Hyperscale (B) is designed for very large databases requiring horizontal read scale-out, not auto-scaling compute for variable load. General Purpose with fixed vCores (A) requires manual scaling. SQL Managed Instance Business Critical (D) provides high availability but does not auto-scale compute.

Question 9

A multinational retailer needs to store product catalogue data in a globally distributed NoSQL database that supports multi-region writes, configurable consistency levels, and automatic indexing without schema management. Which Azure service should you recommend?

Accepted Answer

Azure Cosmos DB for NoSQL supports multi-region writes (active-active), five configurable consistency levels from strong to eventual, automatic indexing of all properties, and truly schema-less JSON document storage — all at global scale. SQL Database with geo-replication (A) supports secondary read replicas only, not multi-region writes. Redis (C) is an in-memory cache, not a durable document store. Table Storage (D) supports one write region and lacks tunable consistency or rich indexing.

Question 10

A media company stores 500 TB of video files in Azure Blob Storage. Files uploaded in the last 30 days are accessed frequently; files between 30–180 days old are accessed occasionally; files older than 180 days are rarely accessed but must be retained for 7 years for compliance. The company wants to minimise storage costs while meeting all access and retention requirements. Which storage solution should you recommend?

Accepted Answer

Blob Storage lifecycle management policies automate tiering based on last-modified or last-accessed date. Transitioning Hot→Cool at 30 days, Cool→Cold at 180 days, and Cold→Archive at 1 year aligns storage costs to actual access patterns while keeping all data online or rehydratable within the 7-year retention window. All-Hot (A) maximises storage cost. Archive immediately (C) would force rehydration delays for files accessed in the first 6 months. Azure Files Premium (D) is optimised for low-latency SMB workloads, not large video blob storage.

Question 11

A company needs to integrate data from multiple on-premises source systems into an Azure data lake for downstream analytics. The data includes structured CSV files and semi-structured JSON event logs. Which Azure service should you recommend for orchestrating and transforming this data integration pipeline?

Accepted Answer

Azure Data Factory is the recommended data integration and ETL/ELT service that connects to 90+ data sources (including on-premises systems via the self-hosted integration runtime), orchestrates pipelines, and transforms data using mapping data flows or Azure Databricks. Logic Apps (A) is an integration platform for API and workflow automation, not large-scale data pipelines. Functions (C) can process events but lack native pipeline orchestration. Service Bus (D) is a messaging broker, not a data integration tool.

Question 12

A financial institution needs to perform interactive ad-hoc analysis of petabyte-scale structured data stored in Azure Data Lake Storage Gen2. Queries must complete within seconds for business users. Which Azure analytics service should you recommend?

Accepted Answer

Azure Synapse Analytics dedicated SQL pool provides massively parallel processing (MPP) for petabyte-scale structured data, with columnar storage and result set caching that enables sub-second query responses for business analytics. HDInsight with Hive (A) adds operational overhead and slower cold query latency. Stream Analytics (C) processes real-time streaming data, not batch analytical queries. Analysis Services (D) is a semantic modelling layer, not a raw data query engine for petabyte scale.

Question 13

A healthcare company stores patient data in Azure SQL Database and requires data protection that covers both accidental deletion by users and ransomware attacks that might corrupt or delete rows. Which two features should you recommend enabling? Choose 2.

Accepted Answer

Point-in-time restore (D) allows recovery to any point within the backup retention period (up to 35 days), which addresses accidental row deletion or ransomware that corrupts data within that window. Long-term backup retention (A) extends retention beyond 35 days (up to 10 years), meeting compliance requirements for healthcare data. TDE with CMK (B) protects data at rest from infrastructure-level access but does not protect against deletion. SQL Database does not have a 'soft delete' feature like Blob Storage (C is incorrect). Read Scale-Out (E) is for read workload distribution, not data protection.

Question 14

A company's web tier runs on Azure Virtual Machines in a single Availability Zone. They require a high-availability solution that protects against datacenter-level failures within a region without requiring application changes. Which solution should you recommend?

Accepted Answer

Deploying VMs across multiple Availability Zones provides physical separation across independent datacenters within the same region, protecting against datacenter-level failures. An Azure Standard Load Balancer distributes traffic across zones. Availability Sets (C) protect against rack-level failures within a single datacenter but not datacenter-level failures. Auto-shutdown (B) and Spot VMs (D) do not address availability at all.

Question 15

A company runs critical workloads on Azure VMs and requires a disaster recovery solution with an RPO of less than 1 hour and an RTO of less than 4 hours for failover to a secondary Azure region. Which solution meets these requirements?

Accepted Answer

Azure Site Recovery continuously replicates Azure VM data to a secondary region with an RPO as low as a few minutes and supports orchestrated failover with pre-defined recovery plans, enabling RTO within minutes to hours. Azure Backup with GRS (A) replicates backup data but recovery requires deploying new VMs from backup — RTO would exceed 4 hours for large workloads. Weekly snapshots (C) give an RPO of up to 7 days, far exceeding the 1-hour requirement. Scale Sets in a single region (D) provide scaling, not cross-region disaster recovery.

Question 16

A company needs a high availability solution for Azure SQL Database that provides automatic failover to a secondary replica with no data loss (RPO = 0) and sub-second RTO. Which Azure SQL Database feature should you recommend?

Accepted Answer

Auto-failover groups in the Business Critical tier use synchronous replication within the same region (built-in Always On Availability Groups), providing zero data loss (RPO = 0) and sub-second automatic failover. Active geo-replication (A) uses asynchronous replication, so RPO > 0. Zone-redundant configuration (C) protects against zone failures within one region but not region-wide outages. Point-in-time restore (D) requires manual intervention and does not meet sub-second RTO.

Question 17

A company stores 200 TB of unstructured data in Azure Blob Storage (Hot tier). They require protection against accidental deletion with a recovery point objective of the moment before deletion and the ability to recover without Azure Support involvement. Which solution should you recommend?

Accepted Answer

Soft delete for blobs retains deleted blobs in a soft-deleted state for the configured retention period (up to 365 days) and allows self-service recovery from the Azure portal or APIs without requiring Azure Support. This effectively provides point-of-deletion recovery. Blob versioning (D) creates versions on every overwrite and is better for protecting against overwrites; soft delete is the recommended solution specifically for accidental deletion recovery. Azure Backup (A) has a minimum backup interval of 1 hour so RPO cannot be 'moment before deletion'. GRS (B) replicates data to another region but does not protect against accidental deletion.

Question 18

A company needs to run a containerised microservices application on Azure. They want a fully managed orchestration platform that handles scheduling, autoscaling, and rolling updates without managing the underlying cluster nodes. Which service should you recommend?

Accepted Answer

Azure Kubernetes Service (AKS) provides a managed Kubernetes control plane with built-in scheduling, Horizontal Pod Autoscaler, and rolling update capabilities. The control plane is fully managed by Microsoft; customers manage node pools but can further use AKS node auto-provisioning. ACI (A) runs individual containers without orchestration. App Service containers (C) suit single-container web apps, not microservices meshes. Service Fabric (D) is a platform-as-a-service for microservices but has steeper learning curve and is not the primary recommendation for Kubernetes workloads.

Question 19

A company needs to process large batch data transformation jobs that run nightly for 4 hours and then terminate. The workload requires 200 vCPUs and can tolerate interruptions with checkpointing. Which compute solution minimises cost while meeting requirements?

Accepted Answer

Azure Batch with Spot VMs is the optimal solution for large-scale, interruptible batch jobs. Spot VMs offer up to 90% discount over pay-as-you-go pricing; Azure Batch handles task scheduling, retry logic for evictions, and pool autoscaling, and the pool can be spun down after the 4-hour job window. Dedicated Hosts (B) are for compliance isolation scenarios, not cost optimisation. App Service Premium (C) is for web apps, not batch compute jobs. HDInsight running 24/7 (D) would incur unnecessary costs during non-processing hours.

Question 20

A company wants to decouple order processing from their e-commerce front end. When an order is placed, a message should be reliably queued so that the fulfilment service processes it exactly once in the order it was received, and the front end should not wait for processing to complete. Which Azure service should you recommend?

Accepted Answer

Azure Service Bus queues support First-In-First-Out (FIFO) message ordering using message sessions, at-least-once and exactly-once delivery semantics, dead-lettering, and message lock — exactly the right choice for order processing that requires ordering guarantees. Event Grid (A) is event-driven pub/sub, not a reliable ordered queue. Event Hubs (B) is a high-throughput streaming platform without built-in FIFO per-consumer ordering. Storage Queues (D) do not guarantee ordering at scale.

Question 21

Fabrikam is migrating its on-premises monolithic .NET application to Azure. The application layer currently runs on 10 physical servers. After a lift-and-shift migration to Azure VMs, the team wants to gradually adopt PaaS without refactoring the existing codebase. The application requires Windows OS and IIS. Which migration path is most appropriate for the PaaS adoption phase with minimal code changes?

Accepted Answer

Azure App Service supports .NET and IIS-compatible web applications natively on Windows, and the Azure App Service Migration Assistant automates assessment and lift-and-shift to App Service with minimal code changes. This achieves PaaS adoption without refactoring. Microservices rewrite (A) requires significant code refactoring, violating the 'minimal changes' constraint. ACI (C) can host Windows containers but requires containerisation first. Virtual Desktop (D) is for desktop/app streaming to end users, not for hosting web services.

Question 22

An architect needs to optimise network security for an Azure workload. Inbound internet traffic to the web tier must be inspected for Layer 7 threats, and internal traffic between application tiers must be filtered at Layer 4. Which two services should be deployed together to achieve this? Choose 2.

Accepted Answer

Azure Application Gateway with WAF (A) provides Layer 7 (HTTP/HTTPS) inspection and protection against OWASP threats for inbound internet traffic. Azure Firewall (C) is a managed, stateful Layer 4 (and Layer 7 for some protocols) network security service that can enforce filtering rules on internal east-west traffic between application tiers. DDoS Protection Standard (B) protects against volumetric DDoS attacks but does not perform Layer 7 inspection. Traffic Manager (D) is a DNS-based global load balancer with no traffic inspection. VPN Gateway (E) is for hybrid connectivity, not internal tier filtering.

Question 23

A solutions architect needs to recommend a load-balancing solution for a public-facing web application that requires SSL offload, cookie-based session affinity, and URL-path-based routing to different backend pools. Which Azure service meets all three requirements?

Accepted Answer

Azure Application Gateway is a Layer 7 load balancer that natively supports SSL termination, cookie-based session affinity, and URL-path-based routing rules to direct traffic to different backend pools. Azure Load Balancer (A) operates at Layer 4 and does not support SSL offload, session affinity, or URL routing. Traffic Manager (B) uses DNS-based routing and cannot perform SSL offload or path-based routing. Azure Front Door (D) is a global CDN/load balancer and does support these features, but Application Gateway is the recommended choice for regional HTTP/S load balancing with these exact requirements.

Question 24

An organisation is designing a serverless application architecture for an event-driven order confirmation system. When a new order is placed in Azure Cosmos DB, an email confirmation should be triggered, and telemetry should be logged to Application Insights. Which two Azure services should be used together to implement this event-driven trigger pattern? Choose 2.

Accepted Answer

Azure Functions with the Cosmos DB trigger binding (A) uses the Cosmos DB change feed to fire automatically when new documents are inserted, eliminating polling. The same function can use the SendGrid output binding (E) to send confirmation emails without writing SMTP code. Together they form a fully serverless event-driven pipeline. Logic Apps with a scheduled trigger (B) would poll on a schedule, not react to individual inserts. Event Grid (C) would require Cosmos DB to publish events, which uses a different integration path than direct Functions trigger. Service Bus (D) adds a messaging intermediary not needed here.

Question 25

A global company is evaluating migration of its on-premises Oracle database to Azure. The database is 4 TB, contains stored procedures written in PL/SQL, and the team has limited Oracle DBA resources. They want to minimise operational overhead post-migration and prefer a fully managed PaaS service. The architecture team has assessed that the application can accept a 2-week migration window. Which migration strategy should you recommend?

Accepted Answer

Azure SQL Managed Instance provides near-100% SQL Server compatibility including T-SQL stored procedures (PL/SQL must be converted, but DMS includes SSMA for Oracle to automate conversion), is fully managed PaaS, and eliminates OS/database patching overhead. With a 2-week migration window, offline DMS migration (B) is simpler and lower-risk than online migration (C), which is needed only when downtime must be near-zero. Lift-and-shift to Oracle on Azure VM (A) retains full IaaS operational overhead, violating the 'minimise overhead' requirement. Cosmos DB (D) requires a complete application rearchitecture — stored procedures cannot be simply converted to JavaScript triggers.

AZ-305 — Azure Solutions Architect Expert