AZ-305: Azure Solutions Architect Expert Practice Exam

What the AZ-305 exam covers

• Design Identity, Governance, and Monitoring Solutions183 questions
• Design Data Storage Solutions169 questions
• Design Business Continuity Solutions123 questions
• Design Infrastructure Solutions212 questions

Free AZ-305 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 687.

1. Question 1Design Identity, Governance, and Monitoring Solutions

   Tailwind Traders is adopting Azure and plans to onboard 12 business units over the next year. The enterprise architect must design an Azure landing zone that enforces company-wide security baselines while allowing each business unit to manage its own workloads independently. Certain business units operate in regulated industries and require additional compliance controls. The solution must minimize ongoing administrative effort. What should the architect recommend?

   • ADeploy separate Microsoft Entra ID tenants for each business unit, federate them with B2B collaboration, and replicate the security baseline manually into every tenant to keep controls aligned
   • BCreate individual subscriptions for each business unit without a management group hierarchy, and duplicate every company-wide policy assignment onto each subscription separately whenever a unit is added
   • CCreate a single subscription for all business units, separate their individual workloads with resource groups, and apply both company-wide and industry compliance policies at the resource group scope
   • DDeploy the Azure Landing Zone accelerator with a management group hierarchy, apply company-wide policies at the intermediate level, and add child management groups per business unit for extra complianceCorrect
   ✓ Correct answer: D

   The Azure Landing Zone accelerator provides a prescriptive, modular approach to implementing enterprise-scale governance in Azure. It uses management group hierarchies to enforce security baselines at the intermediate level while enabling business units to apply additional compliance policies at their own management group levels. This design satisfies the dual requirement of enforcing company-wide baselines while maintaining autonomy. Management groups provide scope inheritance for policies and role assignments, significantly reducing administrative overhead compared to managing policies across individual subscriptions. The architecture supports regulated business units by allowing child management groups to layer additional compliance controls without conflicting with parent-level policies.

   Why the other options are wrong

   • ASplitting into per-BU tenants fragments identity and forces the security baseline to be maintained separately in each tenant, which increases administrative effort rather than minimizing it and does not provide a single governance boundary.
   • BAssigning company-wide policies directly to every subscription means each new business unit requires manual re-application and drift management, defeating the goal of minimal ongoing administrative effort that inherited management group policies would provide.
   • CA single subscription with resource-group-scoped policy cannot give business units independent management boundaries and hits subscription-level scaling and blast-radius limits, so it does not support 12 autonomous units with differing compliance needs.
2. Question 2Design Identity, Governance, and Monitoring Solutions

   Fabrikam Inc. has 50 Azure subscriptions organized under a management group hierarchy. They want to ensure that all newly created subscriptions automatically inherit a set of mandatory tags and are restricted to deploying resources only in US regions. What is the most efficient approach?

   • AAssign Azure Policy initiatives at each subscription level as they are created
   • BCreate an Azure Automation runbook that applies policies to new subscriptions on a schedule
   • CUse Azure Deployment Stacks to define the tag and policy assignments per subscription
   • DAssign Azure Policy initiatives at the top-level management group that contains all subscriptionsCorrect
   ✓ Correct answer: D

   Management group hierarchy enables policy inheritance, allowing you to assign policy initiatives once at the top level and have them automatically apply to all subscriptions at any nesting depth. When you assign tag policies and region restriction policies at the top management group, all 50 subscriptions (and any future subscriptions added to the hierarchy) automatically inherit these policies without requiring individual assignments. New subscriptions created under the management group hierarchy automatically inherit the assigned policies, providing the automatic inheritance required by this scenario. This is far more efficient than assigning policies individually or waiting for subscriptions to be created and then applying policies. Policy inheritance makes management group assignment the most scalable governance approach for organizations with multiple subscriptions.

   Why the other options are wrong

   • AAssign Azure Policy initiatives at each subscription level as they are created is incorrect because it requires repeated manual assignments for each new subscription.
   • BCreate an Azure Automation runbook that applies policies to new subscriptions on a schedule is incorrect because while automation can help, management group inheritance is the native, more efficient solution.
   • CDeployment stacks manage resource deployments, not ongoing tag and policy enforcement across 50 subscriptions, which management-group policy initiatives provide.
3. Question 3Design Data Storage SolutionsSelect all that apply

   You are designing a storage solution for a healthcare application that must comply with HIPAA. The solution requires encryption at rest with customer-managed keys and must prevent accidental deletion of critical patient records. Which two features should you enable?

   • AImmutable blob storage configured with time-based retention policiesCorrect
   • BAzure Storage encryption using default Microsoft-managed keys
   • CBlob soft delete configured with a 7-day retention period
   • DAzure Storage encryption with customer-managed keys in Key VaultCorrect
   ✓ Correct answer: A, D

   For a HIPAA-compliant healthcare application requiring encryption at rest and prevention of accidental deletion, immutable blob storage prevents modification or deletion of patient records after write, ensuring compliance with data retention regulations. Time-based retention policies enforce legal holds that prevent deletion until the retention period expires. Combined with customer-managed key encryption in Azure Key Vault, this configuration provides defense-in-depth: encryption with keys the organization controls, immutability preventing accidental or malicious deletion, and audit trails for all access and modifications.

   Why the other options are wrong

   • BAzure Storage encryption with Microsoft-managed keys is incorrect because Microsoft-managed keys do not meet requirements for customer-controlled encryption; while Azure manages the keys, the organization has no direct control over key rotation or revocation.
   • CSoft delete with a 7-day retention period is incorrect because soft delete only prevents accidental deletion for seven days and can be permanently purged; it does not enforce long-term compliance with regulatory retention requirements or provide true immutability.
4. Question 4Design Data Storage Solutions

   Which database service should you recommend for a globally distributed NoSQL workload?

   • AAzure Cosmos DBCorrect
   • BAzure Table Storage
   • CAzure Database for PostgreSQL
   • DAzure SQL Database
   ✓ Correct answer: A

   Globally distributed NoSQL workloads require a database service with automatic multi-region replication, flexible data models, and tunable consistency levels. Azure Cosmos DB provides native support for document, key-value, graph, and table data models while automatically replicating data across unlimited Azure regions. Applications can write to the nearest region with guarantee of strong consistency within seconds or eventual consistency for maximum availability. Cosmos DB is the only Azure service specifically designed for this global NoSQL scale.

   Why the other options are wrong

   • BAzure Table Storage is incorrect because Table Storage is regional and lacks the global distribution and multi-model capabilities required for globally distributed workloads.
   • CAzure Database for PostgreSQL is incorrect because PostgreSQL is a relational database, not a NoSQL service, and requires manual replication setup.
   • DAzure SQL Database is incorrect because SQL Database is relational, not NoSQL, and not designed for the global distribution patterns of NoSQL workloads.
5. Question 5Design Business Continuity Solutions

   Azure Site Recovery supports failover of Azure VMs from one Azure region to another and provides the ability to run test failovers without impacting production workloads.

   • AFalse
   • BTrueCorrect
   ✓ Correct answer: B

   Azure Site Recovery fully supports failover of Azure VMs from one Azure region to another, with complete replication and recovery capabilities. The service provides the ability to run test failovers that create isolated test environments without any impact to production workloads, allowing you to validate recovery procedures, verify application functionality, and ensure RTO compliance before an actual disaster.

   Why the other options are wrong

   • AFalse is incorrect. The statement is true. Azure Site Recovery fully supports failover of Azure VMs from one Azure region to another, with complete replication and recovery capabilities.
6. Question 6Design Infrastructure Solutions

   Parnell Aerospace needs to deploy a high-performance computing (HPC) workload for computational fluid dynamics simulations. The workload requires tight inter-node communication with ultra-low latency between VMs. Which Azure feature should you use to optimize network performance between the VMs?

   • AAzure Virtual Network peering with low-latency settings
   • BAzure Proximity Placement Groups with InfiniBand-enabled VM sizesCorrect
   • CAzure Accelerated Networking on each VM
   • DAzure ExpressRoute Direct for VM-to-VM communication
   ✓ Correct answer: B

   For HPC workloads requiring ultra-low latency inter-node communication, Proximity Placement Groups (PPGs) are the specialized Azure feature designed to co-locate VMs with minimal physical distance between them, reducing network latency significantly. Combined with InfiniBand-enabled VM sizes (such as H-series or N-series with InfiniBand), this provides dedicated high-speed, low-latency networking fabric optimized for tightly-coupled parallel computing. InfiniBand offers substantially lower latency (sub-microsecond) compared to standard Ethernet networking, which is critical for computational fluid dynamics simulations where node-to-node communication happens thousands of times per second. The PPG ensures Azure places these InfiniBand-enabled VMs on the same physical cluster, preventing any performance degradation from remote placement and maintaining consistent, predictable ultra-low latency performance essential for HPC applications.

   Why the other options are wrong

   • AAzure Virtual Network peering with low-latency settings is incorrect because VNet peering provides cross-VNet connectivity and does not provide the sub-microsecond InfiniBand-level latency required for tightly-coupled HPC workloads, and peering is designed for inter-VNet scenarios, not intra-cluster communication.
   • CAzure Accelerated Networking on each VM is incorrect because while Accelerated Networking reduces latency at the individual VM level (SR-IOV), it does not provide the same ultra-low latency as InfiniBand and does not address the physical placement optimization that PPGs provide for ensuring closely-located nodes.
   • DAzure ExpressRoute Direct for VM-to-VM communication is incorrect because ExpressRoute is designed for on-premises to Azure connectivity, not VM-to-VM communication within a cluster, and it cannot provide the InfiniBand-level latency that HPC requires.
7. Question 7Design Data Storage Solutions

   A design must detect approaching capacity limits and throttling on Azure Storage accounts before they affect users. Which monitoring approach should be adopted?

   • ACheck the portal dashboard occasionally and react manually whenever something on it happens to look wrong
   • BConfigure Azure Monitor metric alert rules for capacity and throttling thresholdsCorrect
   • CEnable diagnostic logging on the accounts but configure no alert rules of any kind against the collected metrics
   • DWait for throttling errors to surface in the application logs first and only then begin investigating capacity
   ✓ Correct answer: B

   Azure Storage emits platform metrics such as used capacity, transactions, and throttled requests. Configuring Azure Monitor alert rules against these metrics enables proactive notification before limits are reached, which is the recommended design for reliability rather than reacting after users are affected.

   Why the other options are wrong

   • AOccasional manual dashboard checks are reactive and easily miss short-lived issues.
   • CCollecting metrics without alert rules means no one is notified when thresholds are crossed.
   • DWaiting for errors to appear in application logs is reactive and allows user impact to occur first.
8. Question 8Design Data Storage SolutionsSelect all that apply

   Litware Inc must guarantee that no administrator, including a Microsoft operator, can read a confidential column of national ID numbers in plaintext, even while the query engine processes it, and the storage account holding related exports must retain its encryption keys under the company's own control in a hardware security module. Which TWO should the architect configure? (Choose two.)

   • AAlways Encrypted with secure enclavesCorrect
   • BCustomer-managed keys in Azure Key Vault Managed HSMCorrect
   • CTransparent data encryption with a service-managed key
   • DDynamic data masking
   • EAzure SQL Database auditing
   ✓ Correct answer: A, B

   Always Encrypted with secure enclaves encrypts sensitive columns so the data stays ciphertext to the database engine and administrators, while enclaves still allow rich in-place operations, preventing even Microsoft operators from seeing plaintext. Customer-managed keys in Azure Key Vault Managed HSM place the storage account encryption keys in a FIPS-validated hardware security module that only the company controls. Together they meet the never-in-plaintext column requirement and the customer-controlled HSM key requirement.

   Why the other options are wrong

   • CTransparent data encryption with a service-managed key protects data at rest but decrypts it in memory, so administrators and the engine can still read plaintext.
   • DDynamic data masking only obscures results for unprivileged users at query time; the underlying data remains readable and unencrypted to the engine.
   • EAuditing records who accessed data but does not encrypt the column or place keys under customer HSM control.
9. Question 9Design Infrastructure Solutions

   Adatum Corporation wants a global HTTP entry point that provides low-latency routing, TLS termination, and a web application firewall for its worldwide users. Which Azure service should the design select?

   • AAzure Front Door with the integrated WAFCorrect
   • BAzure Load Balancer for regional layer-4 traffic
   • CAzure VPN Gateway for site-to-site links
   • DAzure Traffic Manager using DNS-only routing
   ✓ Correct answer: A

   Azure Front Door is a global, layer-7 entry point that offers anycast routing to the nearest edge, TLS offload, caching, and an integrated web application firewall. It is the right choice for globally distributed web applications. Load Balancer is regional layer 4, VPN Gateway connects networks, and Traffic Manager only performs DNS-level routing without TLS or WAF.

   Why the other options are wrong

   • BLoad Balancer is a regional layer-4 service with no global HTTP or WAF features.
   • CVPN Gateway connects on-premises networks and does not front web traffic.
   • DTraffic Manager routes only at DNS level and cannot terminate TLS or run a WAF.
10. Question 10Design Data Storage Solutions

    Fabrikam Media stores its general-purpose v2 storage account in a single region. The account currently uses locally redundant storage (LRS). They need the data to remain available for read access from a secondary region even if the entire primary region becomes unavailable, with the lowest possible additional cost among options that meet this requirement. Which redundancy option should you recommend?

    • ARead-access geo-redundant storage (RA-GRS)Correct
    • BGeo-redundant storage (GRS)
    • CZone-redundant storage (ZRS)
    • DRead-access geo-zone-redundant storage (RA-GZRS)
    ✓ Correct answer: A

    Geo-redundant options copy data asynchronously to a paired secondary region. The read-access variants (RA-GRS and RA-GZRS) additionally expose the secondary endpoint for reads during a primary outage. RA-GRS uses LRS in each region and is less expensive than RA-GZRS, which adds zone redundancy in the primary, so RA-GRS is the lowest-cost option that meets the secondary-region read requirement.

    Why the other options are wrong

    • BPlain GRS replicates to the secondary region but does not allow read access to the secondary copy unless a failover is initiated, so it does not meet the read-availability requirement.
    • CZRS replicates only across zones within the primary region and provides no secondary-region copy, so it does not survive a full regional outage.
    • DRA-GZRS meets the read requirement but adds zone redundancy in the primary region, making it more expensive than RA-GRS, which is the lowest-cost qualifying option.

Related Microsoft resources

• AZ-305 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

AZ-305 practice exam FAQ