Designing Microsoft Azure Infrastructure Solutions (AZ-305) — All Questions

An application running on an Azure VM must call Azure Key Vault and Azure Storage without any credentials stored in code or configuration. What should the architect design?

• a.A shared access key embedded in app settings
• b.A service principal with a client secret in code
• c.A managed identity for the VM granted access to Key Vault and Storage✓
• d.A local administrator account on the VM

A managed identity lets the VM authenticate to Entra ID-integrated services with no stored secrets, and you grant it least-privilege access via RBAC. Embedded keys or a client secret in code store credentials that can leak, and a local admin account does not authenticate to Azure services.

An organization wants administrators to have elevated privileges only when needed, with time-bound access, approval, and auditing. Which capability should be designed in?

• a.Microsoft Entra Privileged Identity Management (PIM)✓
• b.Standing Owner role assignments for all admins
• c.A single shared admin account
• d.Resource locks

PIM provides just-in-time, time-bound role elevation with approval workflows and auditing, minimizing standing privilege. Permanent Owner assignments and shared accounts increase risk, and resource locks prevent deletion but do not manage privileged access.

An architect must enforce that all resources across many subscriptions are tagged with a cost center and can only use approved VM SKUs. Which design element enforces this at scale?

• a.Manual review in each subscription
• b.A single resource group
• c.RBAC role assignments only
• d.Azure Policy initiatives applied at the management group scope✓

Azure Policy (grouped into initiatives) applied at a management group enforces and audits rules like required tags and allowed SKUs across all child subscriptions. Manual review does not scale, a resource group is too narrow, and RBAC controls who can act, not resource configuration.

To centralize platform and resource logs from many subscriptions for querying and alerting, which design should an architect choose?

• a.Store logs on each VM's local disk
• b.Send diagnostic logs to a central Log Analytics workspace in Azure Monitor✓
• c.Email logs to administrators
• d.Disable logging to reduce cost

Routing diagnostic and platform logs to a central Log Analytics workspace lets you query with KQL, correlate across resources, and configure alerts. Local disk logs are siloed and lost with the VM, emailing logs does not scale, and disabling logging removes observability.

A retail company needs to manage sign-in and profiles for millions of external consumer customers of its app. Which identity design is appropriate?

• a.Azure AD B2C / Microsoft Entra External ID for customers✓
• b.Creating a member user in the corporate tenant for each customer
• c.A single shared guest account
• d.Local application accounts with plaintext passwords

Azure AD B2C (Microsoft Entra External ID) is purpose-built for customer identity at scale, supporting social and local sign-in and custom flows. Creating internal member users per customer does not scale or isolate consumers, a shared account is insecure, and plaintext local accounts are unacceptable.

An application team needs to monitor request rates, dependency failures, and response times inside a web application. Which service should the architect design in?

• a.Azure Policy
• b.Network Watcher
• c.Application Insights✓
• d.Azure Blueprints

Application Insights, part of Azure Monitor, instruments applications to collect telemetry such as request rates, dependencies, exceptions, and latency. Azure Policy governs configuration, Network Watcher diagnoses networking, and Blueprints deploy governed environments.