AZ-305: Azure Solutions Architect Expert Practice Exam

What the AZ-305 exam covers

• Design Identity, Governance, and Monitoring Solutions191 questions
• Design Data Storage Solutions176 questions
• Design Business Continuity Solutions129 questions
• Design Infrastructure Solutions220 questions

Free AZ-305 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 716.

1. Question 1Design Identity, Governance, and Monitoring Solutions

   Tailwind Traders is adopting Azure and plans to onboard 12 business units over the next year. The enterprise architect must design an Azure landing zone that enforces company-wide security baselines while allowing each business unit to manage its own workloads independently. Certain business units operate in regulated industries and require additional compliance controls. The solution must minimize ongoing administrative effort. What should the architect recommend?

   • ADeploy separate Microsoft Entra ID tenants for each business unit, federate them with B2B collaboration, and replicate the security baseline manually into every tenant to keep controls aligned
   • BCreate individual subscriptions for each business unit without a management group hierarchy, and duplicate every company-wide policy assignment onto each subscription separately whenever a unit is added
   • CCreate a single subscription for all business units, separate their individual workloads with resource groups, and apply both company-wide and industry compliance policies at the resource group scope
   • DDeploy the Azure Landing Zone accelerator with a management group hierarchy, apply company-wide policies at the intermediate level, and add child management groups per business unit for extra complianceCorrect
   ✓ Correct answer: D

   The Azure Landing Zone accelerator provides a prescriptive, modular approach to implementing enterprise-scale governance in Azure. It uses management group hierarchies to enforce security baselines at the intermediate level while enabling business units to apply additional compliance policies at their own management group levels. This design satisfies the dual requirement of enforcing company-wide baselines while maintaining autonomy. Management groups provide scope inheritance for policies and role assignments, significantly reducing administrative overhead compared to managing policies across individual subscriptions. The architecture supports regulated business units by allowing child management groups to layer additional compliance controls without conflicting with parent-level policies.

   Why the other options are wrong

   • ASplitting into per-BU tenants fragments identity and forces the security baseline to be maintained separately in each tenant, which increases administrative effort rather than minimizing it and does not provide a single governance boundary.
   • BAssigning company-wide policies directly to every subscription means each new business unit requires manual re-application and drift management, defeating the goal of minimal ongoing administrative effort that inherited management group policies would provide.
   • CA single subscription with resource-group-scoped policy cannot give business units independent management boundaries and hits subscription-level scaling and blast-radius limits, so it does not support 12 autonomous units with differing compliance needs.
2. Question 2Design Identity, Governance, and Monitoring Solutions

   An enterprise wants to design a management group hierarchy such as Root > Geography > Business Unit > Environment > Application > Cost Center beneath the root management group. What is the maximum nesting depth Azure supports, excluding the root management group and the subscription level itself?

   • AFour levels of management groups beneath the root management group
   • BSix levels of management groups beneath the root management groupCorrect
   • CTen levels of management groups beneath the root management group
   • DAn unlimited number of management group levels beneath the root management group
   ✓ Correct answer: B

   This six-level limit gives enterprises enough depth to model hierarchies like Root, Geography, Business Unit, Environment, Application, and Cost Center, with policy and RBAC assignments cascading down through each level. The limit balances organizational flexibility against manageability, and it is a fixed platform constraint rather than a configurable or unlimited value.

   Why the other options are wrong

   • AFour levels underestimates Azure's supported depth by two levels, which would force flattening a hierarchy that Azure can otherwise represent directly.
   • CTen levels overstates the platform limit; Azure caps management group nesting well below this figure.
   • DManagement group nesting is not unlimited; Azure enforces a fixed maximum depth beneath the root management group.
3. Question 3Design Data Storage SolutionsSelect all that apply

   You are designing a data integration solution where data from Azure SQL Database and Azure Cosmos DB must be combined for analytics. The solution must support both batch and real-time processing. Which two components should you include?

   • AAzure Blob Storage as the primary analytics engine
   • BAzure Queue Storage for buffering data between sources
   • CAzure Data Factory for batch data integration from Azure SQL DatabaseCorrect
   • DAzure Synapse Link for Cosmos DB for real-time analytics without ETLCorrect
   ✓ Correct answer: C, D

   For combining data from Azure SQL Database and Azure Cosmos DB for both batch and real-time analytics, this combination provides complementary capabilities. Data Factory orchestrates batch extraction from SQL Database into a common analytics layer with scheduling and transformation support. Azure Synapse Link for Cosmos DB creates a real-time analytical mirror without impacting transactional performance, automatically synchronizing Cosmos DB changes to the analytical store for instant availability in analytics queries without separate ETL jobs.

   Why the other options are wrong

   • AAzure Blob Storage as the primary analytics engine is incorrect because Blob Storage is a data store, not an analytics engine; it lacks the query processing capabilities needed for analytics.
   • BAzure Queue Storage for buffering data between sources is incorrect because Queue Storage is a message queue service, not suitable for buffering bulk analytical data or performing analytics operations.
4. Question 4Design Business Continuity Solutions

   An organization is designing a disaster recovery plan for an application that uses Azure Kubernetes Service (AKS) with persistent volumes. The application must fail over to a secondary region with an RTO of 2 hours. What should you recommend?

   • ARun Azure Container Instances in the secondary region as the failover target for the containerized workload
   • BDeploy an active-active AKS cluster in both regions using Azure Cosmos DB to replace all persistent volumes
   • CProtect the AKS cluster with Azure Site Recovery by replicating the worker node VMs to the secondary region
   • DDeploy a passive AKS cluster in the secondary region with Azure Disk backup, GitOps, and Front Door routingCorrect
   ✓ Correct answer: D

   A 2-hour RTO for AKS with persistent volumes is best met by a warm-passive design that balances cost and recovery speed. A passive secondary cluster stays minimal until needed, Azure Disk backups restore the persistent-volume data, and GitOps (Flux or Argo CD) reapplies the version-controlled cluster configuration to quickly bring workloads back. Azure Front Door then redirects user traffic to the secondary region once failover completes. This combination recovers both state and configuration within the RTO without paying to run a full active-active cluster.

   Why the other options are wrong

   • AAzure Container Instances runs single, stateless containers and cannot host a full stateful Kubernetes workload with persistent volumes; it lacks the orchestration, scaling, and storage integration needed to serve as an AKS failover target.
   • BActive-active with Cosmos DB forces re-architecting all persistent state into a document database, which is not feasible for arbitrary volume-backed workloads; it also costs far more than a passive standby and is unnecessary for a 2-hour RTO.
   • CAzure Site Recovery does not support replicating AKS-managed worker nodes; the control plane and node pools are managed by AKS, so ASR cannot reliably recover the cluster, and replicated node disks would not reconstitute a working cluster.
5. Question 5Design Infrastructure Solutions

   Which deployment strategy minimizes downtime when updating a web application?

   • AManual deployment
   • BBig bang deployment
   • CBlue-green deploymentCorrect
   • DCanary only
   ✓ Correct answer: C

   Blue-green deployment minimizes downtime by maintaining two identical production environments (blue and green), deploying the new version to one environment while the other continues serving traffic. Once the new version is validated, traffic is instantly switched from one environment to the other, resulting in zero or minimal downtime. This strategy eliminates the need for staged rollouts and enables instant rollback if issues are discovered post-deployment.

   Why the other options are wrong

   • AManual deployment is incorrect because manual processes are slow and error-prone, resulting in extended downtime during updates.
   • BBig bang deployment is incorrect because deploying all changes at once to the production environment results in extended downtime and high risk of widespread failures.
   • DCanary only is incorrect because canary deployments gradually shift traffic to a new version but do not minimize downtime like blue-green; they are designed for risk reduction rather than minimal downtime.
6. Question 6Design Infrastructure Solutions

   You are designing a networking solution for an Azure application that needs to access an Azure SQL Database without traversing the public internet. Which networking feature should you implement?

   • AVNet service endpoints for Azure SQL
   • BAzure Private Endpoint for Azure SQL DatabaseCorrect
   • CAzure SQL Database firewall rules with allowed IP ranges
   • DAzure ExpressRoute for all database traffic
   ✓ Correct answer: B

   Azure Private Endpoint is the networking feature purpose-built to provide private connectivity to Azure PaaS services. When you create a private endpoint for an Azure SQL Database, the logical server gets a private IP address drawn from your VNet address space and becomes reachable from within the VNet (and from on-premises through ExpressRoute or VPN). Traffic to the database flows over Azure Private Link on the Microsoft backbone and never traverses the public internet, and you can fully disable the public endpoint so the service is not publicly addressable at all. This delivers complete network isolation while retaining full SQL Database functionality such as encryption, auditing, and threat detection.

   Why the other options are wrong

   • AVNet service endpoints keep traffic on the Microsoft Azure backbone (not the public internet), but the database still uses its public endpoint/IP and is not assigned a private IP inside your VNet; access is only restricted by network rules, so the service remains publicly addressable.
   • CAzure SQL firewall rules with allowed IP ranges only filter by source IP and leave the database exposed on its public endpoint, so they do not provide true private connectivity.
   • DExpressRoute provides private on-premises-to-Azure connectivity but does not, by itself, give an Azure-hosted application private access to a SQL Database; a Private Endpoint is still required to remove the public endpoint.
7. Question 7Design Infrastructure Solutions

   A team wants repeatable, version-controlled provisioning of its Azure infrastructure. Which approach should the design recommend?

   • ABuild resources in the portal and script them later
   • BStore the deployment files only on one engineer's laptop
   • CDefine infrastructure as code using Bicep templatesCorrect
   • DChange live resources by hand without updating templates
   ✓ Correct answer: C

   Declarative infrastructure as code with Bicep, ARM templates, or Deployment Stacks makes provisioning repeatable, reviewable, and version controlled in source. It removes reliance on manual portal steps and prevents configuration drift. Templates should live in a shared repository rather than on an individual machine.

   Why the other options are wrong

   • APortal-first work is not repeatable and invites drift before scripting catches up.
   • BTemplates on a single laptop are not shared, reviewed, or backed up.
   • DEditing live resources by hand causes drift from the source templates.
8. Question 8Design Data Storage Solutions

   A team assumes that switching a storage account to customer-managed keys requires no extra setup because Key Vault access and permissions configure themselves. What is actually required?

   • ANothing further is needed; selecting customer-managed keys alone finishes the whole configuration end to end
   • BOnly enabling the infrastructure encryption checkbox found on the storage account's encryption blade
   • COnly uploading a signed TLS certificate to the storage account's network security settings page
   • DCreating and configuring a Key Vault, then granting the storage account's managed identity access to the keyCorrect
   ✓ Correct answer: D

   Switching a storage account to customer-managed keys involves creating or selecting a Key Vault, enabling its soft delete and purge protection, and granting the storage account's managed identity the specific key permissions needed to use the key. None of this happens by itself when the customer-managed key option is selected; every step must be configured before the account can complete the change.

   Why the other options are wrong

   • AKey Vault access and key permissions must be explicitly granted to the storage account's identity; nothing configures itself.
   • BInfrastructure encryption is a separate double-encryption feature; enabling it does not set up customer-managed key access.
   • CTLS certificates secure network traffic to the account; they play no role in granting Key Vault key permissions.
9. Question 9Design Infrastructure Solutions

   What does an Azure Migrate assessment provide before any on-premises servers are actually moved?

   • AAzure readiness, right-sized target VM recommendations, and cost estimates based on discovered dataCorrect
   • BAutomatic migration of every discovered server immediately, without any preceding assessment step at all
   • CA fixed guaranteed migration cost that has no dependency on any actual discovered workload data
   • DDirect replacement of on-premises backup systems, with no sizing or cost analysis performed
   ✓ Correct answer: A

   Azure Migrate is a central hub for discovering, assessing, and planning the migration of on-premises servers, databases, and applications. Its assessment reports Azure readiness for each discovered machine, recommends appropriately sized target VM SKUs using observed performance data, and estimates monthly compute and storage costs. These planning outputs build the business case and migration plan before any workload is actually moved.

   Why the other options are wrong

   • BDiscovery and assessment in Azure Migrate happen before migration; servers are not moved automatically as a side effect of assessing them.
   • CCost estimates from Azure Migrate are derived from discovered workload data and sizing, not a figure independent of that data.
   • DBackup replacement is unrelated to what an Azure Migrate assessment reports; it focuses on readiness, sizing, and cost.
10. Question 10Design Infrastructure Solutions

    You are designing an Azure App Service web app that must call an Azure SQL Database. The database has Public network access disabled and is reachable only through a private endpoint in a VNet. The web app itself does not need a private endpoint, but it must be able to send outbound traffic into that VNet to reach the database's private endpoint. Which App Service feature should you configure?

    • ARegional virtual network integrationCorrect
    • BHybrid Connections
    • CAn App Service private endpoint for inbound traffic
    • DAccess restrictions with service tags
    ✓ Correct answer: A

    Regional virtual network integration injects the app's outbound traffic into a delegated subnet in your VNet, allowing the app to resolve and reach private endpoints (such as the SQL private endpoint) over private IP space. The scenario specifically needs outbound connectivity into the VNet, which is exactly what VNet integration provides.

    Why the other options are wrong

    • BHybrid Connections create TCP relays to a single host:port endpoint, typically for on-premises resources; they are not the standard way to reach an Azure private endpoint inside a VNet.
    • CAn App Service private endpoint controls inbound access to the app, not the app's outbound path to the database's private endpoint.
    • DAccess restrictions filter inbound requests to the app and do not establish any outbound route into the VNet.

Who this AZ-305 practice exam is for

This practice set is for anyone preparing for the AZ-305: Azure Solutions Architect Expert exam at the advanced level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AZ-305 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AZ-305 exam.

Related Microsoft resources

• AZ-305 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Best AZ-104 Practice Exams (2026)Comparison
• AZ-104 vs AZ-305Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AZ-400 practice examRelated
• AZ-700 practice examRelated
• AZ-900 practice examRelated

AZ-305 practice exam FAQ