Exam AZ-305 All Questions

View all questions & answers for the AZ-305 exam

Exam AZ-305 topic 2 question 11 discussion

Actual exam question from Microsoft's AZ-305

Question #: 11
Topic #: 2

HOTSPOT -
You have an Azure subscription that contains the SQL servers on Azure shown in the following table.

The subscription contains the storage accounts shown in the following table.

You create the Azure SQL databases shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Box 1: Yes -
Auditing works fine for a Standard account.

Box 2: No -
Auditing limitations: Premium storage is currently not supported.

Box 3: No -
Auditing limitations: Premium storage is currently not supported.
Reference:
https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview#auditing-limitations

by default_wizard at Dec. 13, 2021, 6:30 p.m.

Comments

Submit Cancel

jkklim

Highly Voted 3 years, 4 months ago

YNN CONCEPT TO REMEMBER 1. TO WRITE INTO STORAGE, MUST BE IN SAME REGION 2. TO WIRTE IN LOG ANALYTICS SPACE - CAN BE IN DIFFERENT REGION SINCE WE ARE USING CONCEPT 1, CAN ONLY WRITE INTO SAME REGION IT HAS NOTHING TO DO WITH PRICING TIER

upvoted 187 times

vrm1358

2 months ago

If you're deploying from the Azure portal, make sure that the storage account is in the same region as your database and server. If you're deploying through other methods, the storage account can be in any region. 04/2025 https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-setup?view=azuresql#:~:text=If%20you%27re%20deploying%20from%20the%20Azure%20portal%2C%20make%20sure%20that%20the%20storage%20account%20is%20in%20the%20same%20region%20as%20your%20database%20and%20server.%20If%20you%27re%20deploying%20through%20other%20methods%2C%20the%20storage%20account%20can%20be%20in%20any%20region

upvoted 1 times

...

ValB

7 months, 3 weeks ago

The databases can be in any region because resource groups can contain resources from different regions. There is nothing here specifying in which regions are the databases. Therefore I believe that invoking the region as argument is wrong.

upvoted 2 times

alexbraila

3 months, 3 weeks ago

Yes, there is. The first table specifies the regions of the SQL servers

upvoted 2 times

...

Rayane

2 years, 5 months ago

Why are you writing in capital, LOL ?

upvoted 25 times

nigw

2 years, 5 months ago

because it's SQL :)

upvoted 92 times

annabelbm

2 years, 4 months ago

According to MS documentation: If you are deploying from the Azure portal, be sure that the storage account is in the same region as your database and server. If you are deploying through other methods, the storage account can be in any region.

upvoted 7 times

sugarbubbles

1 year, 2 months ago

So are you implying that it should be YYY?

upvoted 1 times

...

Load full discussion...

...

olympe

1 year, 10 months ago

it's wrong,this has nothing to do with regions.!!!!!!!!

upvoted 3 times

SDiwan

1 year, 4 months ago

you are wrong. For auditing, storage account needs to be in same region as db. I have tested just now in lab. It won't show any storage acocunts in other regions while configuring auditing.

upvoted 4 times

Paputzback

7 months, 2 weeks ago

I did the same thing. I created 2 LRS storage accounts. One in the EastUS, the other in Central US. I created a SQL database in WestUS. Then from Security > Auditing I enabled auditing and neither storage account appeared. So the region of the storage is definitely key.

upvoted 2 times

...

ValB

7 months, 3 weeks ago

But we don't know in which regions the databases are, because resource groups can contain resources from different regions.

upvoted 1 times

davidpetersiani

7 months ago

We know exactly where are the databases... Databases are created on a SQLsrv and we know the location of the SQL servers

upvoted 2 times

...

default_wizard

Highly Voted 3 years, 6 months ago

answer sould be Yes, No, No Auditing limitations Premium storage is currently not supported. https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview

upvoted 67 times

Shadow983

3 years, 6 months ago

I saw this in document, but I am not sure that is mean sql database or storage account.

upvoted 4 times

Shadow983

3 years, 6 months ago

BTW, the region is not the same. Y, N, N should be correct.

upvoted 15 times

makkros

3 years, 3 months ago

Who said that? Storage have indicated the Resource group only not the region

upvoted 1 times

epomatti

3 years ago

Makkros yes it DOES indicate the location.

upvoted 2 times

...

Load full discussion...

...

Eltooth

3 years, 6 months ago

https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview#auditing-limitations

upvoted 5 times

...

sonoksmy

2 years, 8 months ago

Storage 2 can be standard BlobStorage, therefore this explanation is not correct

upvoted 3 times

...

Nunyah

Most Recent 2 months ago

YYY According to https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal, "BlobStorage" Account Kind is Legacy Blob Storage. According to https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json#legacy-storage-account-types, BlobStorage supports append blobs. No reason it can't be used for audit logging. As others have said can specify storage account in a different region if not doing it in Portal. References to Premium in the question are about SQL Service Tier; Not Storage Account.

upvoted 2 times

...

ahhatem

3 months ago

At the moment, the answer is YYY. Premium accounts are supported (maybe at some point they were not, but at the moment they do). And cross region storage can actually be done via CLI but not the portal... That premium is supported: https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql that cross-region can be enabled from CLI: https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-setup?view=azuresql

upvoted 1 times

...

[Removed]

7 months, 1 week ago

CORRECT (they must be in the same region)

upvoted 1 times

...

enigma65

7 months, 3 weeks ago

Box 1: Yes Be sure that the destination is in the same region as your database and server. Box 2: No Since the regions are not the same. Box 3: Yes Blob Storage is always standard but SQL database premium supports audit logs.

upvoted 4 times

rfg_94

5 months, 1 week ago

Agree. YNY Box 1: Yes The storage account and SQL server are in the same region, ensuring compliance with the requirement that audit logs be stored in a storage account in the same region as the server. Box 2: No Since the regions are different, the audit logs cannot be stored in storage2 for SQLdb2. Box 3: Yes The region requirement is met, and SQL Database in the Premium pricing tier supports audit logging to Blob Storage.

upvoted 2 times

...

ValB

7 months, 3 weeks ago

Sql server auditing when the storage account is is behind a virtual network or firewall can only use storage accounts only of type general purpose v2 or premium storage with BlockBlobStorage, but not general purpose v1 and neither Blob Storage account. The databases can be actually in any regions because resource groups can contain resources from different regions.

upvoted 1 times

...

Thanveer

8 months, 1 week ago

Yes No No

upvoted 1 times

...

KarimaMaf

10 months ago

If you are deploying from the Azure portal, make sure that the storage account is in the same region as your database and server. If you are deploying through other methods, the storage account can be in any region. https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-setup?view=azuresql

upvoted 1 times

...

23169fd

12 months ago

it should be Y Y Y Key Points from Azure Documentation: Region: Audit logs can be stored in any region within the same subscription. Pricing Tier: Pricing tiers (Standard, Premium) do not restrict auditing capabilities. Account Kind: Audit logs can be stored in both general-purpose v2 (StorageV2) and BlobStorage accounts.

upvoted 2 times

cosmicT73

9 months, 2 weeks ago

as per microsoft ,: Premium storage with BlockBlobStorage is supported. Standard storage is supported. However, for audit to write to a storage account behind a VNet or firewall, you must have a general-purpose v2 storage account. If you have a general-purpose v1 or Blob Storage account, upgrade to a general-purpose v2 storage account.

upvoted 2 times

_punky_

8 months ago

https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql#remarks Reference: Premium storage with BlockBlobStorage is supported. Standard storage is supported. However, for audit to write to a storage account behind a virtual network or firewall, you must have a general-purpose v2 storage account. If you have a general-purpose v1 or Blob Storage account, upgrade to a general-purpose v2 storage account. For specific instructions see, Write audit to a storage account behind VNet and firewall. For more information, see Types of storage accounts. Conclusion: As you know to deploy storage account you need to create a Vnet in RG the same rule applies for the SQLDBs. So YNY: Storage1 is in RG1 where SQL1 is in RG1 both are in the same Vnet(implicitly). Storage2 is in different RG2 than SQLDB2 Storage3 would work with SQLDB3 but there is problem that storage account is in different region than RG and DB3 so that means(implicitly) you have to have 2 Vnets, the problem is that Central US is not paired with West US region and therefore they cannot be - N

upvoted 2 times

_punky_

8 months ago

YNN - Correction The key factors for determining if audit logs can be stored in a particular storage account are the region and resource group, not the pricing tier of the database.

upvoted 1 times

...

RickySmith

1 year, 1 month ago

YYY https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-setup?view=azuresql#audit-to-storage-destination It has nothing to do with the pricing tier of the SQL server or the stoprage. It does depend on what is being used to configure the auditing. If you try to configure via Azure Portal, then it needs to be same region. If you are trying to configure via CLI, then it can be any region.

upvoted 1 times

Lazylinux

1 year, 1 month ago

U Must have been talking to Bill Gates!! Ans YNN

upvoted 2 times

ahhatem

3 months ago

Actually, he is right.. the documentation explicitly says this!! That premium is supported: https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql that cross-region can be enabled from CLI: https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-setup?view=azuresql

upvoted 1 times

...

Markoduk

1 year, 3 months ago

Yes No No 1. is a given 2. https://learn.microsoft.com/en-us/azure/azure-sql/database/audit-write-storage-account-behind-vnet-firewall?view=azuresql#prerequisites The storage account must be on the same tenant and at the same location as the logical SQL server (it's OK to be on different subscriptions). 3. BlockBlobStorage in not mentioned!? (Blob Storage) https://learn.microsoft.com/en-us/azure/azure-sql/database/audit-write-storage-account-behind-vnet-firewall?view=azuresql#prerequisites The premium storage with BlockBlobStorage is supported

upvoted 1 times

...

SDiwan

1 year, 4 months ago

Test in Lab. Answer is indeed Y,N,N. Reason: While configuring auditing for azure sql db, azure portal only will show storage accounts which are in same region. Both standard and premium storage accounts can be used but they need to be in same region as db.

upvoted 3 times

...

JimmyYop

1 year, 5 months ago

appeared in Exam 01/2024

upvoted 6 times

...

cesco1286

1 year, 6 months ago

Y, N, N should be the correct response now. as of december 2023, Premium storage is supported for SQL Auditing - but you can't write to a different region (just try it in the portal, see if storages in different regions pop up ;)

upvoted 3 times

...

nav109

1 year, 7 months ago

Got this on Nov. 17, 2023

upvoted 5 times

...

ncseffai

1 year, 8 months ago

I tried. MY SQL server is in West Europe. I created a Standard V2 storage account in North Europe. When I try to configure the auditing the storage account does not show up in the dropdown. A standard v2 storage account in west Europe is in the list however.

upvoted 2 times

...

Load full discussion...