Microsoft AZ-305 · Azure Solutions Architect · Updated 2026
Free AZ-305 Azure Solutions Architect Practice Exam (2026)
Full-length AZ-305 mock exams with a realistic number of questions and the real exam time. Design scenarios across identity, data, business continuity and infrastructure, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
50 questions · 1 hour 40 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 5
🏆
Question 1Infrastructure
Fabrikam runs a nightly video transcoding workload on Azure VMs. Each job pulls files from a queue and saves checkpoints, so it can resume if a VM stops unexpectedly. Jobs can finish at any time before 6 AM. You need to recommend a VM purchasing option that minimizes compute costs. What should you recommend?
Correct answer: C. Azure Spot Virtual Machines
Spot VMs use spare Azure capacity at a deep discount and suit interruptible, checkpointed batch work that has flexible timing. Reserved VM Instances need a one-year or three-year commitment and bill around the clock, which is a poor fit for VMs that run only a few hours each night.
Spot VMs use spare Azure capacity at a deep discount and suit interruptible, checkpointed batch work that has flexible timing. Reserved VM Instances need a one-year or three-year commitment and bill around the clock, which is a poor fit for VMs that run only a few hours each night.
Question 2Identity & Governance
Wide World Importers has Azure resources in Europe and the United States. Regulations require that log data from European resources stay in an EU region and that log data from US resources stay in a US region. A central operations team in the United States must be able to query logs from both geographies. You need to recommend a Log Analytics workspace design that meets the requirements and minimizes the number of workspaces. What should you recommend?
Correct answer: B. One workspace in an EU region and one in a US region
Data residency is set by the region of the workspace, so you need one workspace in each geography, and the operations team can run cross-workspace queries across both. A single US workspace with resource-context access controls who can see the data, but it still stores European logs in the United States.
Data residency is set by the region of the workspace, so you need one workspace in each geography, and the operations team can run cross-workspace queries across both. A single US workspace with resource-context access controls who can see the data, but it still stores European logs in the United States.
Question 3Data Storage
Contoso runs 40 SQL Server 2019 databases on premises. The applications rely on SQL Server Agent jobs and on cross-database queries that join tables in different databases on the same instance. Contoso plans to migrate the databases to Azure and wants Microsoft to handle patching and backups. You need to minimize administrative effort. What should you recommend?
Correct answer: D. Azure SQL Managed Instance
Azure SQL Managed Instance supports SQL Server Agent and cross-database queries within the instance, and Microsoft manages patching and backups. SQL Server on Azure Virtual Machines also supports these features, but you must manage the operating system and SQL Server yourself. Azure SQL Database does not support SQL Server Agent or native cross-database queries.
Azure SQL Managed Instance supports SQL Server Agent and cross-database queries within the instance, and Microsoft manages patching and backups. SQL Server on Azure Virtual Machines also supports these features, but you must manage the operating system and SQL Server yourself. Azure SQL Database does not support SQL Server Agent or native cross-database queries.
Question 4Business Continuity
Fabrikam, Inc. runs production workloads on Azure managed disks and Azure Kubernetes Service (AKS) clusters in the East US region. The company wants to protect both workloads by using Azure Backup. Management requires a single vault for both workloads to minimize administrative effort. What should you include in the solution?
Correct answer: A. A Backup vault
Azure Disk Backup and AKS backup are both managed through a Backup vault, so one Backup vault covers both workloads. A Recovery Services vault supports workloads such as Azure VMs, SQL Server in Azure VMs and Azure Files, but it does not support managed disk or AKS backups.
Azure Disk Backup and AKS backup are both managed through a Backup vault, so one Backup vault covers both workloads. A Recovery Services vault supports workloads such as Azure VMs, SQL Server in Azure VMs and Azure Files, but it does not support managed disk or AKS backups.
Question 5Infrastructure
Litware is building a platform that relies on custom Kubernetes operators and custom resource definitions (CRDs). The operations team deploys with Helm charts and needs direct access to the Kubernetes API. Some workloads need GPU nodes. You need to recommend a hosting service for the platform. What should you recommend?
Correct answer: B. Azure Kubernetes Service
AKS exposes the full Kubernetes API, so the team can install custom operators, define CRDs, deploy Helm charts, and add GPU node pools. Azure Container Apps runs on Kubernetes but does not expose the Kubernetes API, so custom operators and CRDs are not supported.
AKS exposes the full Kubernetes API, so the team can install custom operators, define CRDs, deploy Helm charts, and add GPU node pools. Azure Container Apps runs on Kubernetes but does not expose the Kubernetes API, so custom operators and CRDs are not supported.
Question 6Identity & Governance
Litware, Inc. runs 300 Windows and Linux servers in its own datacenter and 80 servers in Amazon Web Services (AWS). The company wants to collect performance data and event logs from all the servers into a Log Analytics workspace. The servers must be governed with Azure Policy and tagged like Azure resources. You need to recommend a solution that uses a supported agent and minimizes administrative effort. What should you include in the recommendation?
Correct answer: A. Azure Arc-enabled servers with the Azure Monitor Agent
Azure Arc represents non-Azure servers as Azure resources, so you can apply Azure Policy and tags and deploy the Azure Monitor Agent to them at scale. The Log Analytics agent was retired in August 2024 and is no longer a supported option.
Azure Arc represents non-Azure servers as Azure resources, so you can apply Azure Policy and tags and deploy the Azure Monitor Agent to them at scale. The Log Analytics agent was retired in August 2024 and is no longer a supported option.
Question 7Data Storage
Fabrikam has a development database in Azure SQL Database that developers use for about two hours a day on weekdays. The database is idle at night and on weekends. During working hours, the load varies and is hard to predict. You need to recommend a compute option that minimizes costs. What should you recommend?
Correct answer: D. General Purpose serverless with auto-pause
Serverless compute scales automatically with demand and bills compute per second. Auto-pause stops compute billing during idle periods, so you pay only for storage at night and on weekends. Provisioned compute and the DTU model bill for compute continuously, even when the database is idle.
Serverless compute scales automatically with demand and bills compute per second. Auto-pause stops compute billing during idle periods, so you pay only for storage at night and on weekends. Provisioned compute and the DTU model bill for compute continuously, even when the database is idle.
Question 8Infrastructure
Contoso plans an Azure Functions app that handles HTTP requests with unpredictable traffic. The app must reach a database through a private endpoint in a virtual network. The app is idle for many hours each day, and costs during idle periods must be minimized. You need to recommend a hosting plan. What should you recommend?
Correct answer: A. Flex Consumption
The Flex Consumption plan supports virtual network integration and scales to zero, so the app costs very little while idle. The Consumption plan cannot integrate with a virtual network, and the Elastic Premium plan always bills for at least one instance, even when there is no traffic.
The Flex Consumption plan supports virtual network integration and scales to zero, so the app costs very little while idle. The Consumption plan cannot integrate with a virtual network, and the Elastic Premium plan always bills for at least one instance, even when there is no traffic.
Question 9Business Continuity
Litware, Inc. runs SQL Server 2022 databases on Azure virtual machines. The company requires a recovery point objective (RPO) of 15 minutes for the databases and point-in-time restore for 30 days. The solution must minimize administrative effort and must not rely on custom scripts. What should you recommend?
Correct answer: C. Azure Backup for SQL Server in Azure VMs
Azure Backup for SQL Server in Azure VMs supports log backups as often as every 15 minutes and point-in-time restore, all managed from a Recovery Services vault. An Enhanced VM backup policy can run at most every 4 hours, so it cannot meet a 15-minute RPO.
Azure Backup for SQL Server in Azure VMs supports log backups as often as every 15 minutes and point-in-time restore, all managed from a Recovery Services vault. An Enhanced VM backup policy can run at most every 4 hours, so it cannot meet a 15-minute RPO.
Question 10Identity & Governance
Fourth Coffee has 40 Azure Monitor alert rules across several subscriptions. When any critical alert fires, the on-call engineers must receive an SMS message and a voice call, and a webhook must open a ticket in the company's IT service management tool. The notification settings must be defined once and reused by all the alert rules. What should you recommend?
Correct answer: A. One action group that every alert rule references
An action group is a reusable set of notifications and actions, such as SMS, voice calls, email and webhooks, that many alert rules can reference. A Service Health alert only covers Azure platform incidents and maintenance, so it does not fire for the company's own critical alert conditions.
An action group is a reusable set of notifications and actions, such as SMS, voice calls, email and webhooks, that many alert rules can reference. A Service Health alert only covers Azure platform incidents and maintenance, so it does not fire for the company's own critical alert conditions.
Question 11Infrastructure
Adatum Corporation runs a financial risk simulation every night. The simulation splits into thousands of independent tasks, and each task runs a command-line executable for several minutes. The company wants Azure to handle job scheduling, task retries, and automatic scaling of the compute nodes. You need to recommend a solution that minimizes administrative effort. What should you recommend?
Correct answer: D. Azure Batch pools and jobs
Azure Batch manages pools of compute nodes, schedules large numbers of parallel tasks, retries failed tasks, and autoscales the pool. A scale set with cron jobs would force the team to build and maintain its own scheduling and retry logic.
Azure Batch manages pools of compute nodes, schedules large numbers of parallel tasks, retries failed tasks, and autoscales the pool. A scale set with cron jobs would force the team to build and maintain its own scheduling and retry logic.
Question 12Data Storage
Litware, Inc. is a SaaS provider that hosts a separate Azure SQL database for each of its 300 customers. Each database is small and is active throughout the day, but each one peaks at a different time. Average utilization across all the databases is low. You need to recommend a solution that handles each customer's peaks and minimizes compute costs. What should you recommend?
Correct answer: B. Add the databases to an elastic pool
An elastic pool lets many databases share one set of compute resources, so databases that peak at different times can use capacity that the others are not using. This is the most cost-effective choice for many databases with varying usage. Serverless compute is billed per database and saves money mainly when a database is idle, which is not the case here.
An elastic pool lets many databases share one set of compute resources, so databases that peak at different times can use capacity that the others are not using. This is the most cost-effective choice for many databases with varying usage. Serverless compute is billed per database and saves money mainly when a database is idle, which is not the case here.
Question 13Identity & Governance
Humongous Insurance has an on-premises Active Directory Domain Services (AD DS) forest with 5,000 users. Users must sign in to Microsoft 365 and Azure with their existing on-premises passwords. Sign-in must keep working if the on-premises datacenter is offline, and Microsoft Entra ID Protection must be able to detect leaked credentials. The solution must minimize on-premises infrastructure. Which authentication method should you recommend?
Correct answer: C. Password hash synchronization
Password hash synchronization lets Microsoft Entra ID validate passwords in the cloud, so sign-in works during an on-premises outage, and it enables leaked credential detection. Pass-through authentication needs on-premises agents and domain controllers to validate each sign-in, so users cannot sign in when the datacenter is down.
Password hash synchronization lets Microsoft Entra ID validate passwords in the cloud, so sign-in works during an on-premises outage, and it enables leaked credential detection. Pass-through authentication needs on-premises agents and domain controllers to validate each sign-in, so users cannot sign in when the datacenter is down.
Question 14Business Continuity
Lucerne Publishing backs up 200 Azure virtual machines in the Central US region to a Recovery Services vault. Auditors require the company to prove that it can restore the VMs in the paired region at any time, including during drills when there is no outage. The company must not have to wait for Microsoft to declare a regional disaster. How should you configure the vault storage?
Correct answer: B. GRS with Cross Region Restore
Cross Region Restore lets you restore backup data in the paired region at any time, so it supports drills and does not depend on a declared outage. It requires geo-redundant vault storage. With GRS alone, the data is replicated to the paired region, but you can restore it there only after Microsoft declares a disaster in the primary region.
Cross Region Restore lets you restore backup data in the paired region at any time, so it supports drills and does not depend on a declared outage. It requires geo-redundant vault storage. With GRS alone, the data is replicated to the paired region, but you can restore it there only after Microsoft declares a disaster in the primary region.
Question 15Infrastructure
Northwind Traders publishes order messages that three backend services must each receive. One of the services must process all messages for the same customer in the order they were sent. The solution must also support transactions and dead-lettering. You need to recommend a messaging solution. What should you recommend?
Correct answer: D. Service Bus topic with sessions
A Service Bus topic delivers a copy of each message to every subscription, and sessions guarantee first-in, first-out processing for messages that share a session ID such as a customer ID. Service Bus also supports transactions and dead-letter queues. Event Hubs keeps order only within a partition and has no transactions or dead-letter queues.
A Service Bus topic delivers a copy of each message to every subscription, and sessions guarantee first-in, first-out processing for messages that share a session ID such as a customer ID. Service Bus also supports transactions and dead-letter queues. Event Hubs keeps order only within a partition and has no transactions or dead-letter queues.
Question 16Data Storage
Woodgrove Bank stores customer national ID numbers in an Azure SQL Database table. Regulations require that database administrators and cloud operators must never be able to view the plaintext values. The client application must still be able to read and write the values. Which feature should you recommend?
Correct answer: B. Always Encrypted
Always Encrypted encrypts data inside the client driver, and the encryption keys are never revealed to the database engine, so administrators cannot see plaintext. Transparent data encryption protects data at rest, but the values are decrypted for anyone who can query the table. Dynamic data masking only hides values from non-privileged users and does not stop administrators.
Always Encrypted encrypts data inside the client driver, and the encryption keys are never revealed to the database engine, so administrators cannot see plaintext. Transparent data encryption protects data at rest, but the values are decrypted for anyone who can query the table. Dynamic data masking only hides values from non-privileged users and does not stop administrators.
Question 17Identity & Governance
Tailspin Toys works with an external design agency whose employees have accounts in the agency's own Microsoft Entra tenant. The agency staff need access to an internal web app that is registered in the Tailspin Toys tenant. Tailspin Toys does not want to manage passwords for agency staff, and access must stop when an employee leaves the agency. What should you recommend?
Correct answer: C. Microsoft Entra B2B collaboration
B2B collaboration adds agency staff as guest users who sign in with their home tenant credentials, so when the agency disables an account, that person can no longer sign in. B2B direct connect currently supports only Teams Connect shared channels, so it does not grant access to a custom web app.
B2B collaboration adds agency staff as guest users who sign in with their home tenant credentials, so when the agency disables an account, that person can no longer sign in. B2B direct connect currently supports only Teams Connect shared channels, so it does not grant access to a custom web app.
Question 18Infrastructure
Tailspin Toys uploads product images to Azure Blob Storage. When a new blob is created, a thumbnail function and an indexing logic app must react within seconds. The solution must push events to both handlers, filter events by blob path, and avoid polling. You need to recommend a service to route the blob events. What should you recommend?
Correct answer: A. Azure Event Grid
Event Grid has a built-in system topic for Blob Storage that pushes events to multiple handlers in near real time, with subject filters such as a blob path prefix. Service Bus queues require consumers to pull messages, and a queue delivers each message to only one receiver.
Event Grid has a built-in system topic for Blob Storage that pushes events to multiple handlers in near real time, with subject filters such as a blob path prefix. Service Bus queues require consumers to pull messages, and a queue delivers each message to only one receiver.
Question 19Business Continuity
Contoso, Ltd. runs a line-of-business application on 12 Azure virtual machines in the West Europe region. If West Europe becomes unavailable, the application must run in North Europe within one hour, with no more than 15 minutes of data loss. The solution must minimize administrative effort. What should you recommend?
Correct answer: D. Azure Site Recovery replication
Azure Site Recovery continuously replicates the VMs to North Europe and uses recovery plans to orchestrate failover, so it can meet an RPO of minutes and an RTO under one hour. Azure Backup with a geo-redundant vault creates recovery points hours apart and restores take longer, so it cannot meet the RPO or RTO.
Azure Site Recovery continuously replicates the VMs to North Europe and uses recovery plans to orchestrate failover, so it can meet an RPO of minutes and an RTO under one hour. Azure Backup with a geo-redundant vault creates recovery points hours apart and restores take longer, so it cannot meet the RPO or RTO.
Question 20Identity & Governance
Northwind Traders uses GitHub Actions with GitHub-hosted runners to deploy Bicep templates to Azure. The security team prohibits storing client secrets or certificates in GitHub. The deployment identity must still authenticate to Microsoft Entra ID and receive Azure RBAC permissions. What should you recommend for authentication?
Correct answer: A. Workload identity federation using OIDC
Workload identity federation lets GitHub exchange its OpenID Connect (OIDC) token for a Microsoft Entra access token, so no secret or certificate is stored in GitHub. A system-assigned managed identity can only be used by the Azure resource it belongs to, and GitHub-hosted runners are not Azure resources.
Workload identity federation lets GitHub exchange its OpenID Connect (OIDC) token for a Microsoft Entra access token, so no secret or certificate is stored in GitHub. A system-assigned managed identity can only be used by the Azure resource it belongs to, and GitHub-hosted runners are not Azure resources.
Question 21Infrastructure
Wide World Importers exposes 12 REST APIs hosted on App Service and AKS to partner companies. Each partner must call the APIs with a subscription key and must be limited to 1,000 calls per hour. The company also wants a self-service portal where partners can read the API documentation. You need to recommend a solution. What should you recommend?
Correct answer: C. Azure API Management
API Management provides subscription keys, rate limiting policies per key, and a developer portal with API documentation, all in front of multiple backends. Application Gateway is a layer 7 load balancer and has no subscription keys, per-partner quotas, or developer portal.
API Management provides subscription keys, rate limiting policies per key, and a developer portal with API documentation, all in front of multiple backends. Application Gateway is a layer 7 load balancer and has no subscription keys, per-partner quotas, or developer portal.
Question 22Data Storage
Tailspin Toys owns SQL Server Enterprise Edition licenses with active Software Assurance. The company plans to move several databases to Azure SQL Database. Management wants to reuse the existing licenses to reduce costs. The team also wants to size compute and storage independently. What should you recommend?
Correct answer: D. vCore model with Azure Hybrid Benefit
The vCore model lets you choose compute and storage independently, and it supports Azure Hybrid Benefit, which applies existing SQL Server licenses with Software Assurance to lower the price. The DTU model bundles resources into fixed sizes and does not support Azure Hybrid Benefit. License-included vCore pricing works technically, but it does not reuse the licenses Tailspin Toys already owns.
The vCore model lets you choose compute and storage independently, and it supports Azure Hybrid Benefit, which applies existing SQL Server licenses with Software Assurance to lower the price. The DTU model bundles resources into fixed sizes and does not support Azure Hybrid Benefit. License-included vCore pricing works technically, but it does not reuse the licenses Tailspin Toys already owns.
Question 23Identity & Governance
Adatum Corporation has an operations team that must start, restart and deallocate virtual machines in a production subscription. The team must not be able to create, delete or resize virtual machines or change any networking settings. You need to grant the required access by following the principle of least privilege. What should you recommend?
Correct answer: D. A custom role limited to those actions
A custom role can include only the start, restart and deallocate actions on virtual machines, which grants exactly the access the team needs. Virtual Machine Contributor also allows creating, deleting and resizing virtual machines, so it grants more than the team should have.
A custom role can include only the start, restart and deallocate actions on virtual machines, which grants exactly the access the team needs. Virtual Machine Contributor also allows creating, deleting and resizing virtual machines, so it grants more than the team should have.
Question 24Infrastructure
Proseware runs 20 microservices across AKS and App Service. Developers need a central store for non-secret settings and feature flags that apps can refresh at runtime without being redeployed. Some settings must reference secrets that are stored in Azure Key Vault. You need to recommend a configuration solution. What should you recommend?
Correct answer: B. Azure App Configuration
Azure App Configuration centralizes settings and feature flags, supports dynamic refresh in running apps, and can hold Key Vault references for secrets. Key Vault is built to store secrets, keys, and certificates, and it has no feature flag management.
Azure App Configuration centralizes settings and feature flags, supports dynamic refresh in running apps, and can hold Key Vault references for secrets. Key Vault is built to store secrets, keys, and certificates, and it has no feature flag management.
Question 25Data Storage
Adatum Corporation is building a social app on Azure Cosmos DB for NoSQL. After a user posts a comment, that user must see the comment immediately when the page reloads. Other users can see new comments after a short delay. You need to minimize read latency and request unit (RU) consumption. Which default consistency level should you configure?
Correct answer: C. Session
Session consistency guarantees that a client reads its own writes within its session, while other sessions may see the update later. It has lower read latency and RU cost than strong consistency, which charges more RUs per read. Consistent prefix and eventual consistency do not guarantee that a user sees their own write right away.
Session consistency guarantees that a client reads its own writes within its session, while other sessions may see the update later. It has lower read latency and RU cost than strong consistency, which charges more RUs per read. Consistent prefix and eventual consistency do not guarantee that a user sees their own write right away.
Question 26Business Continuity
Tailwind Traders hosts six Azure SQL Database databases on one logical server in the East US 2 region. The databases support a single order processing application. If East US 2 fails, all six databases must fail over to Central US together, and the application connection strings must not change after failover. What should you recommend?
Correct answer: D. A failover group for the server
A failover group fails over multiple databases as a unit and provides read-write and read-only listener endpoints that keep the same DNS names after failover. Active geo-replication is configured per database and has no listener endpoint, so the application would need new connection strings after failover.
A failover group fails over multiple databases as a unit and provides read-write and read-only listener endpoints that keep the same DNS names after failover. Active geo-replication is configured per database and has no listener endpoint, so the application would need new connection strings after failover.
Question 27Infrastructure
Fabrikam has defined its cloud adoption strategy and created a plan with a prioritized list of workloads to migrate. Before the first workload moves, the cloud team must deploy Azure landing zones that provide networking, identity, and subscription organization. According to the Microsoft Cloud Adoption Framework, which methodology covers this work?
Correct answer: C. Ready
The Ready methodology prepares the Azure environment before migration, and deploying landing zones is its core activity. The Plan methodology happens earlier and produces the workload inventory and adoption plan, not the deployed environment.
The Ready methodology prepares the Azure environment before migration, and deploying landing zones is its core activity. The Plan methodology happens earlier and produces the workload inventory and adoption plan, not the deployed environment.
Question 28Identity & Governance
Contoso, Ltd. has about 600 guest users who receive app access through Microsoft Entra security groups. A compliance policy requires group owners to confirm every quarter whether each guest still needs access. If an owner denies access or does not respond, the guest must be removed from the group automatically. What should you recommend?
Correct answer: B. Recurring Microsoft Entra access reviews
Access reviews can run on a quarterly schedule, ask group owners to review guest members, and automatically apply the results, including removing guests when reviewers do not respond. Privileged Identity Management for groups provides just-in-time membership activation, which is a different control from periodic recertification by owners.
Access reviews can run on a quarterly schedule, ask group owners to review guest members, and automatically apply the results, including removing guests when reviewers do not respond. Privileged Identity Management for groups provides just-in-time membership activation, which is a different control from periodic recertification by owners.
Question 29Data Storage
Northwind Traders stores scanned invoices in Azure Blob Storage. Invoices are read often during the first 30 days and rarely after that, but auditors must be able to open any invoice immediately when they request it. Invoices are kept for seven years. You need to minimize storage costs and administrative effort. What should you recommend?
Correct answer: C. A lifecycle policy that moves blobs to cold after 30 days
A lifecycle management policy moves blobs automatically with no code to maintain, and the cold tier keeps data online at a lower storage price than the cool tier. The archive tier is cheaper, but archived blobs are offline and must be rehydrated, which can take hours. A custom Azure Functions job meets the cost goal but adds code that you must build and maintain.
A lifecycle management policy moves blobs automatically with no code to maintain, and the cold tier keeps data online at a lower storage price than the cool tier. The archive tier is cheaper, but archived blobs are offline and must be rehydrated, which can take hours. A custom Azure Functions job meets the cost goal but adds code that you must build and maintain.
Question 30Infrastructure
Litware has 600 TB of archived video files in an on-premises data center. The data center has a 100 Mbps internet connection that is heavily used during business hours. The files must be in Azure Blob Storage within six weeks. You need to recommend a transfer method. What should you recommend?
Correct answer: A. Azure Data Box devices
Azure Data Box ships physical storage devices, so large datasets move offline without using the internet link. Copying 600 TB with AzCopy over a 100 Mbps connection would take more than a year, even with full use of the bandwidth.
Azure Data Box ships physical storage devices, so large datasets move offline without using the internet link. Copying 600 TB with AzCopy over a 100 Mbps connection would take more than a year, even with full use of the bandwidth.
Question 31Identity & Governance
Fabrikam, Inc. has a data platform subscription. Team leads must be able to assign the Storage Blob Data Reader and Storage Blob Data Contributor roles to developers. The team leads must not be able to assign any other role, such as Owner or User Access Administrator. You need to recommend a solution that follows the principle of least privilege. What should you recommend?
Correct answer: B. Role Based Access Control Administrator with a condition
The Role Based Access Control Administrator role lets users manage role assignments, and a condition can limit them to assigning only the two storage data roles. User Access Administrator without a condition can assign any role, including Owner, so it does not meet the least privilege requirement.
The Role Based Access Control Administrator role lets users manage role assignments, and a condition can limit them to assigning only the two storage data roles. User Access Administrator without a condition can assign any role, including Owner, so it does not meet the least privilege requirement.
Question 32Business Continuity
Wingtip Toys runs a global game leaderboard on Azure Cosmos DB for NoSQL. Players in North America, Europe and Asia must get low write latency in their own geography. Writes must continue without interruption if one Azure region fails, and the database must offer the highest available write SLA. What should you configure?
Correct answer: A. Multi-region writes in three regions
Multi-region writes let every region accept writes locally and provide a 99.999 percent SLA for both reads and writes. With one write region and service-managed failover, distant players see higher write latency, and writes stop until the failover completes.
Multi-region writes let every region accept writes locally and provide a 99.999 percent SLA for both reads and writes. With one write region and service-managed failover, distant players see higher write latency, and writes stop until the failover completes.
Question 33Infrastructure
Contoso has 900 VMware VMs on-premises. Before migration, the company needs right-sizing recommendations, monthly Azure cost estimates, and a map of network dependencies between servers. Security policy prohibits installing agents on the servers. You need to recommend a discovery and assessment solution. What should you recommend?
Correct answer: C. Azure Migrate appliance, agentless
The Azure Migrate appliance discovers VMware VMs through vCenter Server, produces sizing and cost assessments, and supports agentless dependency analysis. VM insights can map dependencies, but it requires agents on every server, which the policy prohibits.
The Azure Migrate appliance discovers VMware VMs through vCenter Server, produces sizing and cost assessments, and supports agentless dependency analysis. VM insights can map dependencies, but it requires agents on every server, which the policy prohibits.
Question 34Identity & Governance
Relecloud runs an API in Azure App Service that uses a system-assigned managed identity. The API must read secret values from a key vault that uses the Azure RBAC permission model. The API must not be able to create, change or delete secrets, and it must not access keys or certificates. Which role should you assign to the managed identity on the key vault?
Correct answer: D. Key Vault Secrets User
Key Vault Secrets User grants read access to secret contents and nothing more, which matches the least privilege requirement. Key Vault Reader can read vault and secret metadata but cannot read secret values, so the API would fail to retrieve its secrets.
Key Vault Secrets User grants read access to secret contents and nothing more, which matches the least privilege requirement. Key Vault Reader can read vault and secret metadata but cannot read secret values, so the API would fail to retrieve its secrets.
Question 35Data Storage
Proseware, Inc. stores product images in an Azure Storage account in the East US 2 region. The images must remain readable and writable in East US 2 if a single availability zone fails. If the entire region becomes unavailable, the company website must still read the images from another region without waiting for a failover. Which redundancy option should you recommend?
Correct answer: D. Read-access geo-zone-redundant storage
RA-GZRS copies data synchronously across three availability zones in the primary region and asynchronously to a secondary region, and the secondary endpoint is always readable. GZRS without read access requires a failover before the secondary copy can be read. RA-GRS uses locally redundant storage in the primary region, so a zone failure can make the primary unavailable.
RA-GZRS copies data synchronously across three availability zones in the primary region and asynchronously to a secondary region, and the secondary endpoint is always readable. GZRS without read access requires a failover before the secondary copy can be read. RA-GRS uses locally redundant storage in the primary region, so a zone failure can make the primary unavailable.
Question 36Infrastructure
Adatum uses a hub-and-spoke network in Azure. The hub virtual network has a site-to-site VPN gateway that connects to the on-premises network, and each spoke is peered to the hub. Workloads in the spokes must reach on-premises servers, and no additional gateways can be deployed. What should you include in the solution?
Correct answer: A. Gateway transit on the peerings
Allowing gateway transit on the hub side of each peering and using remote gateways on the spoke side lets every spoke share the hub VPN gateway. A gateway in each spoke would work but adds cost and breaks the constraint against additional gateways.
Allowing gateway transit on the hub side of each peering and using remote gateways on the spoke side lets every spoke share the hub VPN gateway. A gateway in each spoke would work but adds cost and breaks the constraint against additional gateways.
Question 37Business Continuity
Adatum Corporation runs a two-VM application tier in an Azure region that supports availability zones. The company requires a 99.99 percent VM connectivity SLA and protection against the failure of an entire datacenter. The solution must minimize costs by using only one region. What should you recommend?
Correct answer: B. VMs across availability zones
Deploying two or more VMs across availability zones gives a 99.99 percent connectivity SLA and protects against a datacenter failure within the region. An availability set spreads VMs across fault and update domains inside one datacenter and offers only a 99.95 percent SLA.
Deploying two or more VMs across availability zones gives a 99.99 percent connectivity SLA and protects against a datacenter failure within the region. An availability set spreads VMs across fault and update domains inside one datacenter and offers only a 99.95 percent SLA.
Question 38Identity & Governance
Lamna Healthcare uses customer-managed keys in Azure Key Vault to encrypt storage accounts and Azure SQL databases. Soft delete is enabled on the vault with a 90-day retention period. The security team must ensure that no one, including a vault administrator, can permanently remove a deleted key before the retention period ends. What should you recommend?
Correct answer: D. Enable purge protection on the key vault
Purge protection blocks the purging of deleted vaults and objects until the retention period ends, and once it is enabled it cannot be turned off. A CanNotDelete lock protects only the vault resource on the management plane, so it does not stop a user with data plane permissions from deleting and purging keys.
Purge protection blocks the purging of deleted vaults and objects until the retention period ends, and once it is enabled it cannot be turned off. A CanNotDelete lock protects only the vault resource on the management plane, so it does not stop a user with data plane permissions from deleting and purging keys.
Question 39Data Storage
Relecloud is building a data lake for Apache Spark jobs that write millions of files. Each job renames and deletes entire directories, and these operations must be fast and atomic. The security team requires POSIX-style access control lists (ACLs) on folders. You plan to use an Azure Storage account. What should you enable on the account?
Correct answer: C. Hierarchical namespace
Enabling the hierarchical namespace turns the account into Azure Data Lake Storage, which supports atomic directory rename and delete operations and POSIX-style ACLs on directories and files. In a flat blob namespace, folders are virtual, so each blob must be renamed or deleted one at a time. Premium performance lowers latency but adds no directories or ACLs.
Enabling the hierarchical namespace turns the account into Azure Data Lake Storage, which supports atomic directory rename and delete operations and POSIX-style ACLs on directories and files. In a flat blob namespace, folders are virtual, so each blob must be renamed or deleted one at a time. Premium performance lowers latency but adds no directories or ACLs.
Question 40Infrastructure
Northwind stores sensitive files in an Azure Storage account. Users in the on-premises network connect to Azure through ExpressRoute private peering. Traffic to the storage account must use only private IP addresses, and public network access to the account must be disabled. What should you include in the solution?
Correct answer: B. A private endpoint
A private endpoint gives the storage account a private IP address in a virtual network, which on-premises users can reach over ExpressRoute private peering while public access stays disabled. A service endpoint still uses the public endpoint of the service and only applies to traffic from Azure subnets, not from on-premises.
A private endpoint gives the storage account a private IP address in a virtual network, which on-premises users can reach over ExpressRoute private peering while public access stays disabled. A service endpoint still uses the public endpoint of the service and only applies to traffic from Azure subnets, not from on-premises.
Question 41Identity & Governance
Proseware, Inc. has 25 Azure subscriptions that belong to three business units, and new subscriptions are created every month. Each business unit needs its own Azure Policy assignments and role assignments. These settings must apply automatically to existing and future subscriptions in each business unit. You need to minimize administrative effort. What should you recommend?
Correct answer: C. A management group for each business unit
Policy and role assignments made at a management group are inherited by every subscription under it, including subscriptions added later. A subscription tag does not create an assignment scope, so you would still need to assign policies and roles to each subscription separately.
Policy and role assignments made at a management group are inherited by every subscription under it, including subscriptions added later. A subscription tag does not create an assignment scope, so you would still need to assign policies and roles to each subscription separately.
Question 42Business Continuity
Relecloud runs an Azure SQL Database in the General Purpose service tier in a region that supports availability zones. The database must stay available if one datacenter in the region fails. Data must remain in the primary region, and the solution must minimize costs. What should you recommend?
Correct answer: A. Zone redundancy on the database
Enabling zone redundancy places the database replicas in different availability zones in the same region, so the database survives a datacenter failure without leaving the region. Active geo-replication copies data to another region, which breaks the data location requirement and adds the cost of a secondary database.
Enabling zone redundancy places the database replicas in different availability zones in the same region, so the database survives a datacenter failure without leaving the region. Active geo-replication copies data to another region, which breaks the data location requirement and adds the cost of a secondary database.
Question 43Infrastructure
Tailspin runs a VM scale set that calls thousands of external APIs. The application has intermittent outbound connection failures caused by SNAT port exhaustion. Partners also require all outbound traffic to come from a small set of static public IP addresses. You need to recommend a solution that minimizes administrative effort. What should you recommend?
Correct answer: B. Azure NAT Gateway
NAT Gateway allocates SNAT ports dynamically across all instances in the subnet and sends outbound traffic from a few static public IP addresses. Load Balancer outbound rules can also help, but they require manual SNAT port allocation and ongoing tuning as the scale set grows.
NAT Gateway allocates SNAT ports dynamically across all instances in the subnet and sends outbound traffic from a few static public IP addresses. Load Balancer outbound rules can also help, but they require manual SNAT port allocation and ongoing tuning as the scale set grows.
Question 44Data Storage
Wingtip Toys wants to copy data every night from an on-premises SQL Server database to Azure Data Lake Storage. The SQL Server instance is on a private network and does not accept inbound connections from the internet. You need to recommend a code-free solution that minimizes development effort. What should you include in the recommendation?
Correct answer: A. Data Factory with a self-hosted integration runtime
A self-hosted integration runtime runs inside the private network and makes only outbound connections to Azure, so it can read from SQL Server without opening inbound ports. The Azure integration runtime runs in Azure and cannot reach a private on-premises server that blocks inbound traffic. Databricks notebooks require custom code, so they do not minimize development effort.
A self-hosted integration runtime runs inside the private network and makes only outbound connections to Azure, so it can read from SQL Server without opening inbound ports. The Azure integration runtime runs in Azure and cannot reach a private on-premises server that blocks inbound traffic. Databricks notebooks require custom code, so they do not minimize development effort.
Question 45Identity & Governance
Coho Winery requires that every Azure SQL database send its resource logs to a central Log Analytics workspace. The diagnostic setting must be created automatically when a database is deployed. Databases that already exist without the setting must also be fixed. You need to recommend an Azure Policy approach. What should you recommend?
Correct answer: C. The deployIfNotExists effect with remediation
The deployIfNotExists effect deploys the diagnostic setting when a matching database is created, and a remediation task can fix existing databases. The modify effect can only add, update or remove properties or tags on the evaluated resource, and a diagnostic setting is a separate extension resource.
The deployIfNotExists effect deploys the diagnostic setting when a matching database is created, and a remediation task can fix existing databases. The modify effect can only add, update or remove properties or tags on the evaluated resource, and a diagnostic setting is a separate extension resource.
Question 46Infrastructure
Contoso hosts a public web application on App Service in East US and West Europe. Users worldwide must connect to the closest healthy region, and static content must be cached at edge locations. The solution must include a web application firewall at the network edge and fail over within seconds if a region becomes unavailable. What should you recommend?
Correct answer: B. Azure Front Door
Azure Front Door is a global layer 7 service that routes users to the closest healthy backend, caches content at edge locations, includes WAF, and fails over quickly. Traffic Manager uses DNS, so failover depends on DNS caching, and it offers no caching or WAF.
Azure Front Door is a global layer 7 service that routes users to the closest healthy backend, caches content at edge locations, includes WAF, and fails over quickly. Traffic Manager uses DNS, so failover depends on DNS caching, and it offers no caching or WAF.
Question 47Business Continuity
Northwind Traders stores invoice files in Azure Blob Storage in the Switzerland North region. Regulations require that the data is never replicated outside Switzerland North. The data must remain readable and writable if a single datacenter in the region fails, and costs must be minimized. Which redundancy option should you recommend?
Correct answer: D. Zone-redundant storage (ZRS)
ZRS synchronously copies data across three availability zones in the primary region, so the data stays available during a datacenter failure and never leaves the region. GZRS also protects against zone failures, but it replicates data to the paired region, which violates the regulation and costs more.
ZRS synchronously copies data across three availability zones in the primary region, so the data stays available during a datacenter failure and never leaves the region. GZRS also protects against zone failures, but it replicates data to the paired region, which violates the regulation and costs more.
Question 48Data Storage
Wide World Importers collects GPS telemetry from 20,000 trucks through Azure Event Hubs. Dispatchers need a dashboard that shows the average speed per region over rolling five-minute windows, updated in near real time. The team knows SQL and does not want to write or manage custom code. What should you recommend to process the stream?
Correct answer: A. Azure Stream Analytics job
Azure Stream Analytics reads directly from Event Hubs and uses a SQL-like query language with built-in windowing functions for rolling aggregates. It is fully managed and can send results to Power BI for a live dashboard. Azure Functions could process the events, but you would have to write and maintain custom code for the windowed aggregation.
Azure Stream Analytics reads directly from Event Hubs and uses a SQL-like query language with built-in windowing functions for rolling aggregates. It is fully managed and can send results to Power BI for a live dashboard. Azure Functions could process the events, but you would have to write and maintain custom code for the windowed aggregation.
Question 49Identity & Governance
Margie's Travel processes card payments on Azure and must show auditors how its Azure resources measure against PCI DSS controls. The auditors want a continuously updated view of passed and failed controls and downloadable compliance reports. The solution must use built-in capabilities and minimize custom development. What should you recommend?
Correct answer: B. Defender for Cloud regulatory compliance
The regulatory compliance dashboard in Microsoft Defender for Cloud maps resource assessments to standards such as PCI DSS and lets you download compliance reports. A custom Azure Monitor workbook could display similar data, but it requires custom development and has no built-in control mappings.
The regulatory compliance dashboard in Microsoft Defender for Cloud maps resource assessments to standards such as PCI DSS and lets you download compliance reports. A custom Azure Monitor workbook could display similar data, but it requires custom development and has no built-in control mappings.
Question 50Infrastructure
Fabrikam has two public IP addresses that front a customer-facing application in one virtual network. The company needs DDoS mitigation that is tuned to these addresses and provides attack metrics and alerts. It does not need DDoS Rapid Response support or cost protection. You need to recommend a solution that minimizes costs. What should you recommend?
Correct answer: D. Azure DDoS IP Protection
DDoS IP Protection gives the same adaptive tuning, metrics, and alerts as DDoS Network Protection, but it is billed per protected public IP address, which is cheaper for two addresses. DDoS Network Protection has a much higher fixed monthly price and adds Rapid Response and cost protection, which the company does not need.
DDoS IP Protection gives the same adaptive tuning, metrics, and alerts as DDoS Network Protection, but it is billed per protected public IP address, which is cheaper for two addresses. DDoS Network Protection has a much higher fixed monthly price and adds Rapid Response and cost protection, which the company does not need.
The real AZ-305 exam at a glance
50questions
1h 40mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Microsoft Azure & Power BI practice tests
AZ-900 Practice Test50 questions · Azure FundamentalsAZ-104 Practice Test50 questions · Azure AdministratorAZ-400 Practice Test50 questions · Azure DevOps EngineerPL-300 Practice Test50 questions · Power BI Data Analyst
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AZ-305 exam. They are not real exam questions. AZ-305 and Microsoft are trademarks of their owners. Real exam format: usually 40-60 questions · 100 minutes · passing score 700 on a 1-1000 scale · the real exam can include case studies.