How many Troubleshooting Scenario Questions questions are on this page?

This page has 8 Troubleshooting Scenario Questions scenario questions for the AZ-305 exam, each with detailed explanations and wrong-answer analysis.

How should I approach AZ-305 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft Azure Solutions Architect Expert AZ-305 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Microsoft Azure Solutions Architect Expert AZ-305 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

AZ-305

exam code

Microsoft

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

A company wants to monitor sign-in activity for their Microsoft Entra ID-integrated applications. They need to detect risky sign-ins, such as sign-ins from anonymous IP addresses or unfamiliar locations, and automatically block or require multi-factor authentication. They also need a dashboard showing risk events and the ability to investigate and remediate. Which Microsoft Entra ID feature should they use?

A
Microsoft Entra ID Identity Protection
Identity Protection detects risky sign-ins and user behavior, provides a risk dashboard, and integrates with Conditional Access to enforce policies like blocking or requiring MFA.
B
Microsoft Entra ID Privileged Identity Management (PIM)
Why wrong: PIM manages just-in-time access to privileged roles and provides monitoring of role activations, but it does not detect risky sign-ins for all users.
C
Microsoft Entra ID Access Reviews
Why wrong: Access Reviews allow administrators to periodically review group memberships and application access, but they do not detect risky sign-ins in real time.
D
Microsoft Entra ID Self-Service Password Reset (SSPR)
Why wrong: SSPR enables users to reset their own passwords, but it does not provide sign-in risk detection or automated remediation based on risk.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. You are analyzing a deployment of a Custom Script Extension on an Azure VM. The extension fails to run. What is the most likely cause?

Exhibit

{
  "properties": {
    "targetResourceId": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/prod-rg/providers/Microsoft.Compute/virtualMachines/vm-prod-01",
    "configuration": {
      "protectedSettings": {
        "commandToExecute": "powershell -ExecutionPolicy Unrestricted -File configure.ps1"
      }
    },
    "extensionType": "CustomScriptExtension",
    "publisher": "Microsoft.Compute",
    "typeHandlerVersion": "1.10"
  }
}

A
The VM agent is not installed.
Why wrong: The agent must be installed, but the exhibit does not indicate it's missing.
B
The VM has no outbound internet connectivity.
Why wrong: The script is local, not downloaded.
C
The 'protectedSettings' property is misconfigured.
The commandToExecute should be under 'settings' or 'protectedSettings' with proper JSON structure.
D
The extension type is incorrect.
Why wrong: CustomScriptExtension is valid.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

Refer to the exhibit. You run the KQL query in Azure Monitor Log Analytics. Which user accounts should you investigate first?

Exhibit

Refer to the exhibit.

```kql
SigninLogs
| where TimeGenerated > ago(1d)
| where RiskLevelDuringSignIn == "medium"
| where RiskEventTypes has_any ("unfamiliarFeatures", "anonymousIPAddress")
| summarize Count = count() by UserPrincipalName
| where Count > 5
```

A
Users with the highest number of sign-in attempts.
Why wrong: The query filters by risk level and event types, not total attempts.
B
Users who had sign-ins from anonymous IP addresses.
Why wrong: The query includes anonymousIPAddress but requires count > 5 and medium risk.
C
Users who have unfamiliar features in their sign-ins.
Why wrong: The query includes unfamiliarFeatures but combined with count > 5.
D
Users with more than 5 medium-risk sign-ins in the last day.
Exactly what the query returns.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

Refer to the exhibit. A custom Azure RBAC role is defined as shown. A user assigned this role is unable to delete blobs in a container. What is the most likely reason?

Exhibit

Refer to the exhibit.

```json
{
  "roleName": "CustomStorageRole",
  "permissions": [{
    "actions": [
      "Microsoft.Storage/storageAccounts/blobServices/containers/read",
      "Microsoft.Storage/storageAccounts/blobServices/containers/write"
    ],
    "notActions": [],
    "dataActions": [
      "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
      "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write"
    ],
    "notDataActions": []
  }]
}
```

A
The role is scoped to the storage account but not to the container
Why wrong: The role can be assigned at any scope; container-level assignment would work.
B
The role does not include read permission on blobs
Why wrong: Read permission is included in dataActions.
C
The role does not include any dataActions
Why wrong: DataActions for read and write are present.
D
The role does not include delete permission on blobs
Delete action is missing from dataActions.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

Refer to the exhibit. You are testing a disaster recovery plan for three Azure VMs. The recovery plan in the exhibit is failing during a test failover. VM3 fails to start after failover. What is the most likely cause?

Exhibit

{
  "properties": {
    "replicationMode": "PrimaryToSecondary",
    "recoveryPlan": {
      "groups": [
        {
          "groupType": "Boot",
          "replicationProtectedItems": ["vm1", "vm2"]
        },
        {
          "groupType": "Shutdown",
          "replicationProtectedItems": ["vm3"]
        }
      ],
      "primaryLocation": "eastus",
      "recoveryLocation": "westus"
    }
  }
}

A
VM3 is not replicated properly.
Why wrong: The exhibit shows it is in the plan.
B
The boot order is incorrect; VM3 should be before VM1.
Why wrong: No boot order specified.
C
VM3 is in a Shutdown group, which means it is not started during failover.
Shutdown group is used for graceful shutdown, not startup.
D
The primary and recovery locations are swapped.
Why wrong: Locations are correct.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

Refer to the exhibit. The JSON shows role assignments for user1. The role definition IDs are: b24988ac-6180-42a0-ab88-20f7382dd24c = Key Vault Secrets User, 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 = Reader. User1 reports being unable to list secrets in the key vault 'vault-prod' using Azure CLI. What is the most likely cause?

Exhibit

{
  "roleAssignments": [
    {
      "principalId": "user1@contoso.com",
      "roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c",
      "scope": "/subscriptions/1234-5678/resourceGroups/rg-prod/providers/Microsoft.KeyVault/vaults/vault-prod"
    },
    {
      "principalId": "user1@contoso.com",
      "roleDefinitionId": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
      "scope": "/subscriptions/1234-5678/resourceGroups/rg-prod"
    }
  ]
}

A
User1 does not have any role assignment on the key vault
Why wrong: User1 has a role assignment at vault scope.
B
The Key Vault Secrets User role does not include the ability to list secrets
The role only allows reading secret values, not listing.
C
User1 must have the Contributor role on the key vault
Why wrong: Contributor is not required; Key Vault Secrets Officer can list.
D
The Reader role at resource group scope overrides the vault role
Why wrong: Permissions are additive, not overriding.

Full breakdown with real-world context →

Question 7mediummultiple choice

Full question →

Refer to the exhibit. A custom role is created. A user assigned this role reports being unable to view the VM's boot diagnostics in the Azure portal. What is the most likely reason?

Exhibit

{
  "roleDefinition": {
    "Name": "Custom VM Operator",
    "Actions": [
      "Microsoft.Compute/virtualMachines/start/action",
      "Microsoft.Compute/virtualMachines/restart/action",
      "Microsoft.Compute/virtualMachines/deallocate/action",
      "Microsoft.Compute/virtualMachines/read"
    ],
    "NotActions": [],
    "AssignableScopes": ["/subscriptions/1234-5678"]
  }
}

A
The user does not have permission to start or restart the VM
Why wrong: The role includes start and restart.
B
The VM is stopped and deallocated
Why wrong: Boot diagnostics can be viewed even when VM is stopped.
C
The role lacks permissions to the diagnostics storage account
Missing storage account permissions.
D
The role does not include Microsoft.Compute/virtualMachines/read
Why wrong: The role includes read.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

Refer to the exhibit. The ARM template provisions a VM. The deployment succeeds but the VM fails to start. What is the most likely cause?

Exhibit

{
  "parameters": { "vmName": { "value": "prod-vm-001" } },
  "resources": [
    {
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2023-03-01",
      "name": "[parameters('vmName')]",
      "location": "[resourceGroup().location]",
      "properties": {
        "hardwareProfile": { "vmSize": "Standard_D2s_v3" },
        "storageProfile": {
          "osDisk": { "createOption": "fromImage", "managedDisk": { "storageAccountType": "Premium_LRS" } },
          "dataDisks": [
            { "createOption": "empty", "diskSizeGB": 1023, "lun": 0, "managedDisk": { "storageAccountType": "StandardSSD_LRS" } }
          ]
        },
        "osProfile": {
          "computerName": "[parameters('vmName')]",
          "adminUsername": "azureuser",
          "adminPassword": "Password123!"
        },
        "networkProfile": {
          "networkInterfaces": [
            { "id": "[resourceId('Microsoft.Network/networkInterfaces', concat(parameters('vmName'), '-nic'))]" }
          ]
        }
      }
    }
  ]
}

A
The admin password is in plaintext and does not meet complexity requirements
Plaintext password violates Azure policy.
B
The data disk size 1023 GB exceeds the maximum for StandardSSD_LRS
Why wrong: StandardSSD_LRS supports up to 32 TB.
C
The network interface resource ID is incorrectly formatted
Why wrong: The ID is correctly generated.
D
The VM size Standard_D2s_v3 is not available in the region
Why wrong: Size is available in most regions.

Full breakdown with real-world context →

These AZ-305 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style AZ-305 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related AZ-305 topic practice pages

Design identity, governance, and monitoring solutions practice questions

Design data storage solutions practice questions

Design business continuity solutions practice questions

Design infrastructure solutions practice questions

SAA-C03 VPC practice questions

SAA-C03 S3 lifecycle policy questions

SAA-C03 RDS Multi-AZ questions

SAA-C03 IAM policy practice questions

SAA-C03 Route 53 failover questions

SAA-C03 CloudFront practice questions

SAA-C03 NAT gateway questions

SAA-C03 VPC endpoint questions

Practice scenarios

Refer to the exhibit. You are analyzing a deployment of a Custom Script Extension on an Azure VM. The extension fails to run. What is the most likely cause?

Exhibit

Refer to the exhibit. You run the KQL query in Azure Monitor Log Analytics. Which user accounts should you investigate first?

Exhibit

Refer to the exhibit. A custom Azure RBAC role is defined as shown. A user assigned this role is unable to delete blobs in a container. What is the most likely reason?

Exhibit

Refer to the exhibit. You are testing a disaster recovery plan for three Azure VMs. The recovery plan in the exhibit is failing during a test failover. VM3 fails to start after failover. What is the most likely cause?

Exhibit

Exhibit

Refer to the exhibit. A custom role is created. A user assigned this role reports being unable to view the VM's boot diagnostics in the Azure portal. What is the most likely reason?

Exhibit

Refer to the exhibit. The ARM template provisions a VM. The deployment succeeds but the VM fails to start. What is the most likely cause?

Exhibit