az-305 Advanced Practice Exam: Hard Questions 2025

Your organization has 30 Azure subscriptions across multiple business units. You must enforce the following governance requirements with minimal operational overhead: (1) only approved VM SKUs can be deployed, (2) all resources must inherit mandatory tags (CostCenter, DataClassification), and (3) a resource cannot be created unless diagnostic settings send logs to a central Log Analytics workspace in a dedicated management subscription. Some teams deploy via ARM/Bicep, others via Terraform, and some via the Azure portal. What is the best design to meet the requirements consistently across all deployment methods?

A company uses Azure Kubernetes Service (AKS) and Azure Functions. They need to allow workloads to access Azure Storage, Key Vault, and Azure SQL without storing any secrets in code or CI/CD variables. They also need centralized control over which identities can assume privileges, and they must prevent lateral movement if a workload is compromised. Which architecture best meets these requirements?

You operate a multi-region architecture with an application gateway in each region and private endpoints for PaaS services. You must implement monitoring that detects: (1) user-perceived latency issues from multiple geographies, (2) regional dependency failures (e.g., a Key Vault outage affecting only one region), and (3) configuration drift in diagnostic settings. You want a single pane of glass with minimal custom code. What is the best solution design?

A financial services company needs to store millions of small JSON documents (1–50 KB) with strict latency requirements and global reads. Writes occur primarily in one region, but reads are worldwide. Data must support point-in-time recovery, automatic indexing, and querying by multiple properties. The company also requires that if a region fails, the application continues reading with minimal downtime and without manual intervention. Which storage solution and configuration best fits?

You must design storage for a high-throughput event ingestion pipeline. Events arrive at 200 MB/s and must be retained for 30 days. Downstream analytics uses Spark and needs efficient scanning by time range. You also need to prevent users from exfiltrating data using shared keys, and you must support private connectivity from VNets in multiple regions. What is the best design?

A company runs a mission-critical Azure SQL Managed Instance (MI) in one region. The business requires: (1) RPO under 5 minutes, (2) RTO under 30 minutes for a full regional outage, (3) minimal application changes, and (4) ability to perform read-only reporting without impacting OLTP performance. Which design best meets these requirements?

You have an application deployed to two Azure regions in active-active mode. User sessions are stored in a cache, and the database is globally distributed. A recent incident showed that during a partial outage, traffic continued flowing to a degraded region causing high error rates. You need a solution that (1) automatically removes unhealthy endpoints based on application-layer signals, (2) supports instant failback when healthy, and (3) does not require code changes. Which approach is best?

You need to design a hub-and-spoke network across three regions. Requirements: (1) all egress to the internet must traverse centralized inspection (Azure Firewall), (2) spokes must communicate to shared services in the hub, (3) some spokes must not communicate with each other, (4) connectivity between regions must be private and resilient, and (5) the design should minimize route management complexity as the number of spokes grows. What is the best architecture?

A workload runs on Azure Virtual Machine Scale Sets (VMSS) behind an internal load balancer. The application is stateful and maintains in-memory session state but must still scale out during peak load. Requirements: (1) avoid losing sessions during scale-in, (2) patch instances with minimal downtime, (3) support zone redundancy, and (4) minimize manual orchestration. What design best meets these requirements?

You are designing an enterprise landing zone with strict separation of duties. The security team must control network, identity, and policy. Application teams must deploy workloads independently within guardrails. Requirements: (1) centralized logging and security monitoring across all subscriptions, (2) prevent app teams from disabling diagnostic settings or deleting security resources, (3) allow app teams to create private endpoints but only to approved PaaS services, and (4) enable consistent onboarding of new subscriptions. Which approach best meets these requirements?