Microsoft AZ-305 · Azure Solutions Architect · Updated 2026
Free AZ-305 Azure Solutions Architect Practice Exam (2026)
Full-length AZ-305 mock exams with a realistic number of questions and the real exam time. Design scenarios across identity, data, business continuity and infrastructure, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
50 questions · 1 hour 40 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 5
🏆
Question 1Infrastructure
Woodgrove Bank must run Windows Server VMs on physical servers that are not shared with any other Azure customer. The bank wants to control when platform maintenance is applied to those servers. It also wants to place several VMs of different sizes from the same VM series on each server. You need to recommend a compute solution. What should you recommend?
Correct answer: A. Azure Dedicated Host
Azure Dedicated Host provides single-tenant physical servers, lets you control host maintenance, and lets you place multiple VMs of different sizes from the host's VM series. A proximity placement group only keeps VMs physically close to reduce latency, and the hardware is still shared with other customers.
Azure Dedicated Host provides single-tenant physical servers, lets you control host maintenance, and lets you place multiple VMs of different sizes from the host's VM series. A proximity placement group only keeps VMs physically close to reduce latency, and the hardware is still shared with other customers.
Question 2Identity & Governance
Tailwind Traders uses a third-party security information and event management (SIEM) system that runs outside Azure. The SIEM must receive the Azure activity log and the resource logs from Azure Firewall and Key Vault in near real time. The company wants to use built-in Azure features and minimize custom code. What should you recommend?
Correct answer: C. Diagnostic settings that stream to an event hub
Diagnostic settings can stream platform logs to Azure Event Hubs, and most third-party SIEM tools can consume events from an event hub in near real time. A storage account destination is designed for low-cost archiving, and the SIEM would have to poll and parse blob files, which adds delay.
Diagnostic settings can stream platform logs to Azure Event Hubs, and most third-party SIEM tools can consume events from an event hub in near real time. A storage account destination is designed for low-cost archiving, and the SIEM would have to poll and parse blob files, which adds delay.
Question 3Data Storage
Coho Winery has a SQL Server 2022 database that stores product photos by using FILESTREAM. The company plans to move the database to Azure without redesigning how the photos are stored. The operations team also needs to install a third-party backup agent on the database server. What should you recommend?
Correct answer: D. SQL Server on Azure Virtual Machines
SQL Server on Azure Virtual Machines gives full control of the operating system and the SQL Server instance, so FILESTREAM and third-party agents work as they do on premises. Azure SQL Managed Instance is highly compatible, but it does not support FILESTREAM and you cannot install software on the host. Azure SQL Database does not support FILESTREAM either.
SQL Server on Azure Virtual Machines gives full control of the operating system and the SQL Server instance, so FILESTREAM and third-party agents work as they do on premises. Azure SQL Managed Instance is highly compatible, but it does not support FILESTREAM and you cannot install software on the host. Azure SQL Database does not support FILESTREAM either.
Question 4Business Continuity
Lamna Healthcare stores signed patient consent forms in Azure Blob Storage. The company must be able to recover the blobs even if the entire storage account is deleted or encrypted by ransomware. Recovery points must be kept for seven years, and the solution must minimize administrative effort. What should you recommend?
Correct answer: D. Vaulted backup for blobs
Vaulted backup copies blob data to a Backup vault that is isolated from the source storage account, and it supports retention of up to 10 years. Operational backup keeps its data inside the source storage account, so the backups are lost if that account is deleted.
Vaulted backup copies blob data to a Backup vault that is isolated from the source storage account, and it supports retention of up to 10 years. Operational backup keeps its data inside the source storage account, so the backups are lost if that account is deleted.
Question 5Infrastructure
Contoso is building a stateful application tier on Azure VMs. The tier must mix Spot and standard-priority VMs of different sizes in one group and spread instances across availability zones and fault domains. Administrators must be able to manage each instance with standard VM operations, and the group must scale automatically. What should you recommend?
Correct answer: B. Scale set, Flexible orchestration
Virtual Machine Scale Sets with Flexible orchestration support mixing Spot and standard VMs, multiple VM sizes, zone and fault domain spreading, standard VM operations, and autoscale. Uniform orchestration is built for large groups of identical instances, so it does not fit a mix of sizes managed as individual VMs.
Virtual Machine Scale Sets with Flexible orchestration support mixing Spot and standard VMs, multiple VM sizes, zone and fault domain spreading, standard VM operations, and autoscale. Uniform orchestration is built for large groups of identical instances, so it does not fit a mix of sizes managed as individual VMs.
Question 6Identity & Governance
Alpine Ski House runs a booking application as a set of microservices on Azure Kubernetes Service (AKS). Developers need to follow a single user request across all the services, see a map of service dependencies, and find which downstream call is slow. The team plans to instrument the code with OpenTelemetry. What should you recommend?
Correct answer: B. Application Insights
Application Insights collects distributed traces from OpenTelemetry instrumentation and provides end-to-end transaction views and an application map. Container insights monitors node, pod and container health and logs, but it does not trace individual requests across services.
Application Insights collects distributed traces from OpenTelemetry instrumentation and provides end-to-end transaction views and an application map. Container insights monitors node, pod and container health and logs, but it does not trace individual requests across services.
Question 7Data Storage
Lucerne Publishing runs an OLTP database in Azure SQL Database that is 3 TB today and is expected to grow to 40 TB within two years. Backups and restores must complete quickly regardless of database size. The company also wants the option to scale out read workloads later. Which service tier should you recommend?
Correct answer: D. Hyperscale
Hyperscale supports databases up to 128 TB and uses storage snapshots, so backups are nearly instant and restore time does not depend on database size. It also supports high-availability and named replicas for read scale-out. Business Critical, General Purpose and Premium have a maximum data size of 4 TB, so they cannot hold a 40 TB database.
Hyperscale supports databases up to 128 TB and uses storage snapshots, so backups are nearly instant and restore time does not depend on database size. It also supports high-availability and named replicas for read scale-out. Business Critical, General Purpose and Premium have a maximum data size of 4 TB, so they cannot hold a 40 TB database.
Question 8Infrastructure
Fabrikam is containerizing several microservices that process messages from Azure Service Bus. Each service must scale based on queue length and scale to zero when idle. The team has no Kubernetes experience and does not need access to the Kubernetes API. You need to recommend a hosting platform that minimizes administrative effort. What should you recommend?
Correct answer: C. Azure Container Apps
Azure Container Apps is a serverless container platform with built-in KEDA scaling rules, including Service Bus queue length, and it can scale to zero. AKS can run KEDA too, but the team would have to manage the cluster, node pools, and upgrades.
Azure Container Apps is a serverless container platform with built-in KEDA scaling rules, including Service Bus queue length, and it can scale to zero. AKS can run KEDA too, but the team would have to manage the cluster, node pools, and upgrades.
Question 9Business Continuity
Humongous Insurance backs up its Azure virtual machines to a Recovery Services vault. The security team requires that no one, including subscription owners, can reduce backup retention or delete recovery points before they expire. Once configured, this protection must not be able to be turned off. What should you recommend?
Correct answer: B. Immutability in the locked state
A locked immutable vault blocks operations that could cause the loss of recovery points, such as reducing retention, and the lock cannot be reversed. An unlocked immutable vault blocks the same operations, but an administrator can disable immutability later.
A locked immutable vault blocks operations that could cause the loss of recovery points, such as reducing retention, and the lock cannot be reversed. An unlocked immutable vault blocks the same operations, but an administrator can disable immutability later.
Question 10Identity & Governance
Contoso, Ltd. collects Windows Security event logs from 2,000 Azure virtual machines by using the Azure Monitor Agent. The security team only needs event IDs 4624, 4625 and 4740 and must not lose any of those events. You need to reduce the volume of data ingested into Log Analytics. What should you recommend?
Correct answer: C. A data collection rule with XPath queries
A data collection rule can use XPath queries to collect only the specific event IDs, so far less data is ingested and billed. A daily cap stops collection once the limit is reached, which could drop the required security events for the rest of the day.
A data collection rule can use XPath queries to collect only the specific event IDs, so far less data is ingested and billed. A daily cap stops collection once the limit is reached, which could drop the required security events for the rest of the day.
Question 11Infrastructure
Litware needs to run a Windows container that generates a report once a day. The task runs for about 15 minutes and then exits. The company wants to pay only while the container runs, and it does not need orchestration, scaling, or service discovery. You need to recommend a solution that minimizes costs and administrative effort. What should you recommend?
Correct answer: A. Azure Container Instances
Azure Container Instances runs single Windows or Linux containers on demand with per-second billing and no infrastructure to manage. Azure Container Apps jobs would suit a short task, but Container Apps supports only Linux containers.
Azure Container Instances runs single Windows or Linux containers on demand with per-second billing and no infrastructure to manage. Azure Container Apps jobs would suit a short task, but Container Apps supports only Linux containers.
Question 12Data Storage
Humongous Insurance has an Azure SQL Database that stores policyholder email addresses and phone numbers. Call center agents query the data through a reporting tool and must see only partially hidden values, such as the last four digits of a phone number. Claims managers must see the full values. The solution must not require changes to the application or the reporting tool. What should you recommend?
Correct answer: B. Dynamic data masking
Dynamic data masking applies masking rules in the database engine, so non-privileged users see partial values without any application changes, and you grant the UNMASK permission to claims managers. Always Encrypted hides the entire value, requires client driver configuration, and cannot show partial values. Row-level security filters which rows a user can see, not how column values appear.
Dynamic data masking applies masking rules in the database engine, so non-privileged users see partial values without any application changes, and you grant the UNMASK permission to claims managers. Always Encrypted hides the entire value, requires client driver configuration, and cannot show partial values. Row-level security filters which rows a user can see, not how column values appear.
Question 13Identity & Governance
Wingtip Toys is launching a consumer web store and mobile app for millions of customers. Customers must be able to sign up with an email one-time passcode or their Google or Facebook accounts, on branded sign-up pages. Customer accounts must be kept separate from the employee directory. You need to minimize development effort. What should you recommend?
Correct answer: A. An external tenant in Microsoft Entra External ID
An external tenant in Microsoft Entra External ID is built for customer apps, supports social and email sign-up with custom branding, and keeps customers apart from the workforce directory. Self-service sign-up in the workforce tenant is meant for business guests and would place customer accounts in the same directory as employees.
An external tenant in Microsoft Entra External ID is built for customer apps, supports social and email sign-up with custom branding, and keeps customers apart from the workforce directory. Self-service sign-up in the workforce tenant is meant for business guests and would place customer accounts in the same directory as employees.
Question 14Business Continuity
Margie's Travel runs 40 VMware vSphere virtual machines in its on-premises datacenter. The company wants to replicate the VMs to Azure for disaster recovery with an RPO of minutes. Administrators must be able to run test failovers without affecting production. Which component should you deploy on-premises?
Correct answer: C. A Site Recovery replication appliance
Disaster recovery of VMware VMs to Azure uses the Azure Site Recovery replication appliance, which discovers the VMs and manages continuous replication and test failovers. The Azure Migrate appliance discovers and assesses servers for migration, but it does not provide ongoing disaster recovery replication.
Disaster recovery of VMware VMs to Azure uses the Azure Site Recovery replication appliance, which discovers the VMs and manages continuous replication and test failovers. The Azure Migrate appliance discovers and assesses servers for migration, but it does not provide ongoing disaster recovery replication.
Question 15Infrastructure
Trey Research must render 50,000 independent video frames each night. Each frame takes about 10 minutes of CPU time, the rendering engine runs on Linux virtual machines, and the company wants the platform to schedule the jobs, scale the pool automatically and use low-priority capacity to cut costs. What should you recommend?
Correct answer: D. Azure Batch
Azure Batch is built for large-scale parallel and HPC-style jobs: it manages the VM pool, schedules tasks and supports low-priority VMs for cost savings. Functions has execution duration and scale patterns suited to event-driven code, not 10-minute rendering tasks across thousands of nodes.
Azure Batch is built for large-scale parallel and HPC-style jobs: it manages the VM pool, schedules tasks and supports low-priority VMs for cost savings. Functions has execution duration and scale patterns suited to event-driven code, not 10-minute rendering tasks across thousands of nodes.
Question 16Data Storage
Alpine Ski House runs a booking application on an open-source PostgreSQL 16 database. The company wants to move the database to a managed Azure service with minimal code changes. The database must survive the loss of an availability zone with automatic failover. You need to minimize administrative effort. What should you recommend?
Correct answer: D. PostgreSQL flexible server with zone-redundant HA
Azure Database for PostgreSQL flexible server is a managed service that runs community PostgreSQL, and zone-redundant high availability keeps a standby in another zone with automatic failover. Same-zone high availability keeps the standby in the same zone, so it does not survive a zone outage. Virtual machines add patching and failover work, and Azure SQL Database would require code changes.
Azure Database for PostgreSQL flexible server is a managed service that runs community PostgreSQL, and zone-redundant high availability keeps a standby in another zone with automatic failover. Same-zone high availability keeps the standby in the same zone, so it does not survive a zone outage. Virtual machines add patching and failover work, and Azure SQL Database would require code changes.
Question 17Identity & Governance
Trey Research wants users who hold the Global Administrator or Privileged Role Administrator role to use phishing-resistant MFA, such as passkeys, when they sign in. Other users must be able to keep using Microsoft Authenticator push notifications. The company has Microsoft Entra ID P1 licenses. What should you recommend?
Correct answer: A. Conditional Access authentication strength
A Conditional Access policy that targets the admin directory roles can require the built-in phishing-resistant MFA authentication strength, while other users keep their current methods. Security defaults apply the same basic MFA settings to everyone and cannot require a specific method such as passkeys.
A Conditional Access policy that targets the admin directory roles can require the built-in phishing-resistant MFA authentication strength, while other users keep their current methods. Security defaults apply the same basic MFA settings to everyone and cannot require a specific method such as passkeys.
Question 18Infrastructure
Tailspin has a background job that processes image resize requests from a web app. The messages are small and do not need ordering, duplicate detection, or publish-subscribe. During peak sales events, the queue backlog can grow to several terabytes. You need to recommend a messaging service that minimizes costs. What should you recommend?
Correct answer: B. Azure Queue Storage
Azure Queue Storage is a low-cost queue that can grow up to the capacity of the storage account, which easily holds a multi-terabyte backlog. Service Bus queues add features the job does not need and have maximum sizes measured in gigabytes.
Azure Queue Storage is a low-cost queue that can grow up to the capacity of the storage account, which easily holds a multi-terabyte backlog. Service Bus queues add features the job does not need and have maximum sizes measured in gigabytes.
Question 19Business Continuity
Coho Winery stores order data in Azure Cosmos DB for NoSQL. A developer recently deleted a container by mistake, and restoring it required a support request. The company now wants administrators to restore an account or container to any point in time within the last 30 days without opening a support request. What should you configure?
Correct answer: D. Continuous backup with the 30-day tier
Continuous backup mode with the 30-day tier lets administrators restore to any point in the last 30 days by using the portal, CLI or PowerShell. Periodic backup mode takes backups at fixed intervals, and restoring from it requires a support request.
Continuous backup mode with the 30-day tier lets administrators restore to any point in the last 30 days by using the portal, CLI or PowerShell. Periodic backup mode takes backups at fixed intervals, and restoring from it requires a support request.
Question 20Identity & Governance
Fabrikam, Inc. runs a virtual machine scale set and two Azure Functions apps that all need access to the same storage account and key vault. The deployment pipeline often deletes and recreates these resources. The security team wants to grant the permissions once, before the resources are deployed, and keep them across redeployments. No credentials may be stored or rotated. What should you recommend?
Correct answer: C. One user-assigned managed identity for all resources
A user-assigned managed identity is a standalone Azure resource, so you can grant its roles before deployment, attach it to many resources, and keep it when those resources are deleted. A system-assigned identity is deleted with its resource, so every redeployment creates a new identity that needs new role assignments.
A user-assigned managed identity is a standalone Azure resource, so you can grant its roles before deployment, attach it to many resources, and keep it when those resources are deleted. A system-assigned identity is deleted with its resource, so every redeployment creates a new identity that needs new role assignments.
Question 21Infrastructure
Proseware runs an e-commerce site on eight App Service instances that use Azure SQL Database. Product catalog queries cause most of the database load, and the catalog changes only a few times per hour. The site also needs a shared store for user session state across all instances. You need to recommend a solution that reduces database load and response times. What should you recommend?
Correct answer: A. Azure Cache for Redis
Azure Cache for Redis is an in-memory store that can cache catalog query results with the cache-aside pattern and hold session state shared by all instances. Front Door caching serves static content at the edge, but it cannot store session state or cache data queried by the app.
Azure Cache for Redis is an in-memory store that can cache catalog query results with the cache-aside pattern and hold session state shared by all instances. Front Door caching serves static content at the edge, but it cannot store session state or cache data queried by the app.
Question 22Data Storage
VanArsdel, Ltd. has a Node.js application that uses MongoDB drivers and MongoDB query syntax. The company wants to move the database to a fully managed Azure service that supports multi-region writes. Developers must keep their existing drivers and queries with minimal code changes. Which Azure Cosmos DB API should you recommend?
Correct answer: C. Azure Cosmos DB for MongoDB
Azure Cosmos DB for MongoDB implements the MongoDB wire protocol, so existing drivers and queries work with minimal changes, and the request unit (RU) based model supports multi-region writes. Azure Cosmos DB for NoSQL is the native API, but it would require rewriting the data access code with a different SDK. The Table and Cassandra APIs use different protocols and query languages.
Azure Cosmos DB for MongoDB implements the MongoDB wire protocol, so existing drivers and queries work with minimal changes, and the request unit (RU) based model supports multi-region writes. Azure Cosmos DB for NoSQL is the native API, but it would require rewriting the data access code with a different SDK. The Table and Cassandra APIs use different protocols and query languages.
Question 23Identity & Governance
Lucerne Publishing has 12 engineers who occasionally need the Owner role on production subscriptions. The engineers must not have standing access. Each activation must require a justification and approval from the security lead, and it must expire after four hours. What should you recommend?
Correct answer: A. Privileged Identity Management
Privileged Identity Management provides eligible role assignments that users activate just in time, with required justification, approval and a maximum activation duration. Access reviews only recertify existing assignments on a schedule, so the engineers would keep standing Owner access between reviews.
Privileged Identity Management provides eligible role assignments that users activate just in time, with required justification, approval and a maximum activation duration. Access reviews only recertify existing assignments on a schedule, so the engineers would keep standing Owner access between reviews.
Question 24Infrastructure
Wide World Importers needs to deploy identical Azure environments for development, test, and production. Deployments must be declarative, kept in source control, and run from Azure Pipelines. Each deployment must show a preview of resource changes before they are applied. You need to recommend a deployment approach that minimizes administrative effort. What should you recommend?
Correct answer: B. Bicep files with what-if
Bicep is a declarative infrastructure as code language, and the what-if operation previews the changes a deployment will make. Azure CLI scripts are imperative, so the team would have to write its own logic to handle existing resources and to preview changes.
Bicep is a declarative infrastructure as code language, and the what-if operation previews the changes a deployment will make. Azure CLI scripts are imperative, so the team would have to write its own logic to handle existing resources and to preview changes.
Question 25Data Storage
Fourth Coffee is designing an Azure Cosmos DB for NoSQL container to store telemetry from 50,000 espresso machines. Each machine sends a reading every 10 seconds. Most queries retrieve the recent readings for a single machine. You need to avoid hot partitions and minimize cross-partition queries. Which property should you use as the partition key?
Correct answer: A. /machineId
The machine ID has high cardinality, spreads writes evenly across 50,000 values, and matches the filter in most queries, so those queries stay within one partition. A date key sends all current writes to the same logical partition, which creates a hot partition. Country and model have few distinct values, so they distribute the load poorly.
The machine ID has high cardinality, spreads writes evenly across 50,000 values, and matches the filter in most queries, so those queries stay within one partition. A date key sends all current writes to the same logical partition, which creates a hot partition. Country and model have few distinct values, so they distribute the load poorly.
Question 26Business Continuity
Trey Research stores application data in a geo-redundant storage (GRS) account in the East US 2 region. During a prolonged regional outage, the operations team must be able to make the secondary region writable on its own schedule. The solution must minimize costs and application changes. What should you recommend?
Correct answer: C. Customer-managed account failover
Customer-managed account failover lets the team promote the secondary region to primary, so the account becomes writable there and the application keeps using the same endpoints. RA-GRS only adds read access to the secondary endpoint, so the application still cannot write during the outage.
Customer-managed account failover lets the team promote the secondary region to primary, so the account becomes writable there and the application keeps using the same endpoints. RA-GRS only adds read access to the secondary endpoint, so the application still cannot write during the outage.
Question 27Infrastructure
Contoso runs an ASP.NET web application on Windows Server VMs with IIS in its data center. The company wants to move the application to Azure, stop managing operating system patches, and avoid changing the application code. You need to recommend a target platform. What should you recommend?
Correct answer: B. Azure App Service
Azure App Service is a managed platform that patches the operating system and runs ASP.NET apps with little or no code change, and Azure Migrate can assess and migrate IIS web apps to it. Rehosting to Azure VMs is simpler to start, but the company would still manage operating system patches.
Azure App Service is a managed platform that patches the operating system and runs ASP.NET apps with little or no code change, and Azure Migrate can assess and migrate IIS web apps to it. Rehosting to Azure VMs is simpler to start, but the company would still manage operating system patches.
Question 28Identity & Governance
Litware, Inc. is running a nine-month project with a partner organization. Internal and partner users must request access to a bundle that includes a Microsoft 365 group, a SharePoint site and two enterprise apps. Requests require sponsor approval, partner users from the approved domain must be able to request access themselves, and all access must end automatically when the project ends. What should you recommend?
Correct answer: D. Entitlement management access packages
An access package bundles groups, sites and apps, supports approval workflows and requests from connected organizations, and can end assignments on a set date. Bulk B2B invitations create guest accounts, but they do not provide approvals, a resource bundle or automatic expiration.
An access package bundles groups, sites and apps, supports approval workflows and requests from connected organizations, and can end assignments on a set date. Bulk B2B invitations create guest accounts, but they do not provide approvals, a resource bundle or automatic expiration.
Question 29Data Storage
Lamna Healthcare must store patient billing records in Azure Blob Storage for 10 years. Regulations require that no user, including administrators, can modify or delete the records during that period. Auditors must be able to verify that the retention setting itself cannot be shortened or removed. What should you configure on the container?
Correct answer: A. A locked time-based retention policy
A time-based retention policy keeps blobs in a write once, read many (WORM) state for the set period, and locking the policy means the interval can only be extended, never shortened or deleted. An unlocked policy can still be shortened or removed, so it is intended for testing. A legal hold has no fixed retention period and can be cleared by an authorized user.
A time-based retention policy keeps blobs in a write once, read many (WORM) state for the set period, and locking the policy means the interval can only be extended, never shortened or deleted. An unlocked policy can still be shortened or removed, so it is intended for testing. A legal hold has no fixed retention period and can be cleared by an authorized user.
Question 30Infrastructure
Fabrikam must migrate a 2 TB SQL Server 2019 database to Azure SQL Managed Instance. The application can tolerate only a few minutes of downtime during cutover. The team wants a managed Azure service that keeps applying changes from the source until cutover. What should you recommend?
Correct answer: B. Database Migration Service, online mode
In online mode, Azure Database Migration Service restores a full backup and keeps applying log backups until you start the cutover, so downtime is only a few minutes. Offline mode and BACPAC import require the application to stay down for the entire data transfer.
In online mode, Azure Database Migration Service restores a full backup and keeps applying log backups until you start the cutover, so downtime is only a few minutes. Offline mode and BACPAC import require the application to stay down for the entire data transfer.
Question 31Identity & Governance
Woodgrove Bank needs to store the encryption keys used for Azure SQL transparent data encryption and Azure Storage customer-managed keys. The keys must be held in single-tenant HSMs. The bank must control the security domain so that Microsoft cannot access the key material. The solution must integrate with Azure services that support customer-managed keys. What should you recommend?
Correct answer: A. Azure Key Vault Managed HSM
Managed HSM is a fully managed, single-tenant HSM pool where the customer owns the security domain, and it works with Azure services that support customer-managed keys. Key Vault Premium protects keys in HSMs, but those HSMs are multitenant, so it fails the single-tenant requirement.
Managed HSM is a fully managed, single-tenant HSM pool where the customer owns the security domain, and it works with Azure services that support customer-managed keys. Key Vault Premium protects keys in HSMs, but those HSMs are multitenant, so it fails the single-tenant requirement.
Question 32Business Continuity
Alpine Ski House runs its booking website on custom VM images. Demand changes so much that the site needs between 3 and 30 VM instances during the day. The site must survive the failure of an availability zone, and the solution must minimize administrative effort. What should you recommend?
Correct answer: D. A zone-spanning scale set with autoscale
A Virtual Machine Scale Set that spans availability zones distributes instances across zones and scales them automatically based on metrics. An availability set does not span zones and has no built-in autoscale, so it fails both the resiliency and the administrative effort requirements.
A Virtual Machine Scale Set that spans availability zones distributes instances across zones and scales them automatically based on metrics. An availability set does not span zones and has no built-in autoscale, so it fails both the resiliency and the administrative effort requirements.
Question 33Infrastructure
Northwind has file servers in 15 branch offices. Users need fast local access to frequently used files, while rarely used files should be kept only in Azure. All branches must work with the same set of files, and the company wants to keep its existing Windows Server file servers. What should you recommend?
Correct answer: A. Azure File Sync
Azure File Sync syncs Windows Server file servers with a shared Azure file share, and cloud tiering keeps hot files local while cold files live only in Azure. Azure Storage Mover is built for migrating data to Azure, not for ongoing multi-site sync and local caching.
Azure File Sync syncs Windows Server file servers with a shared Azure file share, and cloud tiering keeps hot files local while cold files live only in Azure. Azure Storage Mover is built for migrating data to Azure, not for ongoing multi-site sync and local caching.
Question 34Identity & Governance
Adatum Corporation encrypts its storage accounts with customer-managed keys in Azure Key Vault. Compliance requires that the keys rotate automatically every 12 months. The storage accounts must start using each new key version without anyone updating their configuration. You need to minimize administrative effort. What should you recommend?
Correct answer: C. A rotation policy and a versionless key URI
A Key Vault rotation policy creates new key versions on a schedule, and a storage account configured with a key URI that omits the version automatically switches to the latest version. An Automation runbook adds custom code to build and maintain when a built-in rotation policy already does the job.
A Key Vault rotation policy creates new key versions on a schedule, and a storage account configured with a key URI that omits the version automatically switches to the latest version. An Automation runbook adds custom code to build and maintain when a built-in rotation policy already does the job.
Question 35Data Storage
Graphic Design Institute runs a Linux rendering farm on Azure virtual machines. The render nodes need a shared file system that they mount by using the NFS 4.1 protocol. The workload requires consistent low latency and high IOPS. You need to recommend a fully managed storage solution. What should you recommend?
Correct answer: A. Azure Files premium (SSD) shares
Azure Files supports NFS 4.1 only on premium SSD file shares, which also provide low latency and high IOPS. The transaction optimized and hot tiers use HDD-based standard storage and support SMB and REST access but not NFS. Blob Storage supports NFS 3.0, not NFS 4.1.
Azure Files supports NFS 4.1 only on premium SSD file shares, which also provide low latency and high IOPS. The transaction optimized and hot tiers use HDD-based standard storage and support SMB and REST access but not NFS. Blob Storage supports NFS 3.0, not NFS 4.1.
Question 36Infrastructure
Litware has data centers in Chicago and Frankfurt. Each data center connects to Azure through its own ExpressRoute circuit. The company wants traffic between the two data centers to travel over the Microsoft global network instead of its current MPLS link. What should you recommend?
Correct answer: D. ExpressRoute Global Reach
ExpressRoute Global Reach links two ExpressRoute circuits so on-premises sites can exchange traffic over the Microsoft backbone. FastPath improves performance between on-premises and Azure VNets by bypassing the gateway in the data path, but it does not connect sites to each other.
ExpressRoute Global Reach links two ExpressRoute circuits so on-premises sites can exchange traffic over the Microsoft backbone. FastPath improves performance between on-premises and Azure VNets by bypassing the gateway in the data path, but it does not connect sites to each other.
Question 37Business Continuity
Fourth Coffee hosts its customer portal in Azure App Service in a single region that supports availability zones. The portal must remain available if a datacenter in the region fails. The company does not need regional failover and wants to minimize costs. What should you recommend?
Correct answer: B. Premium v3 plan with zone redundancy
A Premium v3 plan with zone redundancy spreads instances across availability zones, which protects against a datacenter failure at the lowest cost. The Standard tier does not support zone redundancy, so its instances are not guaranteed to run in different zones.
A Premium v3 plan with zone redundancy spreads instances across availability zones, which protects against a datacenter failure at the lowest cost. The Standard tier does not support zone redundancy, so its instances are not guaranteed to run in different zones.
Question 38Identity & Governance
Blue Yonder Airlines has 15 applications, each deployed to development, test and production environments. Some applications read many secrets at startup and can generate large bursts of requests. A burst from one application must not cause throttling for other applications. A compromise of one application's secret access must not expose secrets for other applications or environments. What should you recommend?
Correct answer: C. One key vault per application and environment
Key Vault throttling limits apply per vault, so separate vaults for each application and environment isolate request bursts and limit the impact of a compromise. A shared vault with secret-level RBAC isolates access, but all the applications still share the same throttling limits.
Key Vault throttling limits apply per vault, so separate vaults for each application and environment isolate request bursts and limit the impact of a compromise. A shared vault with secret-level RBAC isolates access, but all the applications still share the same throttling limits.
Question 39Data Storage
Blue Yonder Airlines has applications that publish flight sensor events by using Apache Kafka client libraries. The company wants to replace its self-managed Kafka cluster with a fully managed Azure service that can ingest millions of events per second. Developers must keep their existing Kafka producers and change only configuration settings. What should you recommend?
Correct answer: B. Azure Event Hubs
Azure Event Hubs exposes a Kafka-compatible endpoint, so existing Kafka producers connect by changing only connection settings, and the service is built for high-throughput event ingestion. Service Bus is a broker for enterprise messaging and does not support the Kafka protocol. Event Grid is designed for reactive event routing, not high-volume stream ingestion from Kafka clients.
Azure Event Hubs exposes a Kafka-compatible endpoint, so existing Kafka producers connect by changing only connection settings, and the service is built for high-throughput event ingestion. Service Bus is a broker for enterprise messaging and does not support the Kafka protocol. Event Grid is designed for reactive event routing, not high-volume stream ingestion from Kafka clients.
Question 40Infrastructure
Adatum has 60 branch offices, remote users who connect by point-to-site VPN, and multiple virtual networks in several Azure regions. The company needs any-to-any connectivity between branches, users, and virtual networks with automated routing. The solution must minimize administrative effort. What should you recommend?
Correct answer: D. Azure Virtual WAN Standard
Virtual WAN Standard provides Microsoft-managed hubs that combine site-to-site VPN, point-to-site VPN, ExpressRoute, and transit routing between virtual networks across regions. Self-managed hub VNets would require you to configure and maintain routing, peerings, and gateways in every region.
Virtual WAN Standard provides Microsoft-managed hubs that combine site-to-site VPN, point-to-site VPN, ExpressRoute, and transit routing between virtual networks across regions. Self-managed hub VNets would require you to configure and maintain routing, peerings, and gateways in every region.
Question 41Identity & Governance
Southridge Video requires every Azure resource to have a CostCenter tag that matches the CostCenter tag on its resource group. The tag must exist on the resources themselves, not only in cost reports. New resources must get the tag automatically, existing resources must be remediated, and deployments must not be blocked. What should you recommend?
Correct answer: B. Azure Policy with the modify effect
The modify effect can add a missing tag by copying it from the resource group during create or update, and remediation tasks fix existing resources. Cost Management tag inheritance only applies tags to usage records in cost data, so the resources themselves would still be missing the tag.
The modify effect can add a missing tag by copying it from the resource group during create or update, and remediation tasks fix existing resources. Cost Management tag inheritance only applies tags to usage records in cost data, so the resources themselves would still be missing the tag.
Question 42Business Continuity
Graphic Design Institute replicates its Azure virtual machines to a secondary region with Azure Site Recovery. An auditor requires proof each quarter that the application can actually run in the secondary region, and the demonstration must not interrupt production or break the ongoing replication. What should you recommend?
Correct answer: C. A test failover into an isolated virtual network
A Site Recovery test failover brings up copies of the VMs in an isolated network while production and replication continue untouched, which is exactly how DR drills are meant to be evidenced. A planned failover moves the real workload and interrupts production.
A Site Recovery test failover brings up copies of the VMs in an isolated network while production and replication continue untouched, which is exactly how DR drills are meant to be evidenced. A planned failover moves the real workload and interrupts production.
Question 43Infrastructure
Contoso has 25 spoke virtual networks peered to a hub. Security requires that outbound internet traffic from all spokes be inspected centrally and allowed only to an approved list of fully qualified domain names (FQDNs). All allowed and denied connections must be logged. What should you include in the solution?
Correct answer: A. Azure Firewall in the hub
Azure Firewall in the hub, with user-defined routes from the spokes, filters outbound traffic centrally with FQDN-based application rules and logs every decision. NSGs filter by IP address, port, and service tag, so they cannot allow traffic based on an FQDN list.
Azure Firewall in the hub, with user-defined routes from the spokes, filters outbound traffic centrally with FQDN-based application rules and logs every decision. NSGs filter by IP address, port, and service tag, so they cannot allow traffic based on an FQDN list.
Question 44Data Storage
Margie's Travel wants a single analytics platform for its data engineers, data analysts and business users. The company prefers a software as a service (SaaS) offering with one capacity-based license that covers data integration, data warehousing, real-time analytics and Power BI reporting. All workloads must work from one shared copy of the data in a single lake. What should you recommend?
Correct answer: D. Microsoft Fabric
Microsoft Fabric is a SaaS analytics platform in which all workloads share one capacity and store data in OneLake, a single logical data lake, and it includes Power BI. Azure Synapse Analytics is a platform as a service (PaaS) offering that requires you to provision and manage separate resources, and Power BI is licensed separately. Azure Data Factory covers only data integration.
Microsoft Fabric is a SaaS analytics platform in which all workloads share one capacity and store data in OneLake, a single logical data lake, and it includes Power BI. Azure Synapse Analytics is a platform as a service (PaaS) offering that requires you to provision and manage separate resources, and Power BI is licensed separately. Azure Data Factory covers only data integration.
Question 45Identity & Governance
City Power & Light has 18 built-in and custom Azure Policy definitions that cover encryption, networking and logging. The security team wants to assign them together to several management groups, set shared parameters once, and track a single compliance result for the whole group of policies. You need to minimize administrative effort. What should you recommend?
Correct answer: A. A policy initiative definition
An initiative groups many policy definitions so you can assign them as one unit, share parameters and see a combined compliance state. Separate assignments for each definition would work, but they multiply the number of assignments to manage and do not give one overall compliance result.
An initiative groups many policy definitions so you can assign them as one unit, share parameters and see a combined compliance state. Separate assignments for each definition would work, but they multiply the number of assignments to manage and do not give one overall compliance result.
Question 46Infrastructure
Fabrikam administrators must connect to Windows and Linux VMs in Azure by using RDP and SSH. The VMs must not have public IP addresses, and administrators must not need a VPN client. Connections must be made over TLS from the Azure portal. What should you recommend?
Correct answer: C. Azure Bastion
Azure Bastion is a managed service that provides RDP and SSH over TLS from the Azure portal to VMs that have only private IP addresses. Just-in-time VM access opens management ports for a limited time, but administrators still need a network path, such as a public IP address, to reach the VMs.
Azure Bastion is a managed service that provides RDP and SSH over TLS from the Azure portal to VMs that have only private IP addresses. Just-in-time VM access opens management ports for a limited time, but administrators still need a network path, such as a public IP address, to reach the VMs.
Question 47Business Continuity
Wide World Importers runs a licensing service that clients reach over a custom TCP protocol on port 7443. The service is deployed on virtual machines in two Azure regions. If the primary region fails, client traffic must be redirected to the secondary region by using DNS, with no change on the clients. What should you include in the design?
Correct answer: D. Azure Traffic Manager with priority routing
Traffic Manager is a DNS-based load balancer that works for any protocol, and priority routing sends all traffic to the primary endpoint until it fails its health checks. Front Door and Application Gateway only handle HTTP and HTTPS traffic, so they cannot route a custom TCP protocol.
Traffic Manager is a DNS-based load balancer that works for any protocol, and priority routing sends all traffic to the primary endpoint until it fails its health checks. Front Door and Application Gateway only handle HTTP and HTTPS traffic, so they cannot route a custom TCP protocol.
Question 48Data Storage
Trey Research stores several terabytes of Parquet files in Azure Data Lake Storage. Analysts want to run occasional ad hoc T-SQL queries directly against the files without loading them into a database. The company wants to pay only for the data that each query processes and to avoid provisioning any infrastructure. What should you recommend?
Correct answer: D. Azure Synapse serverless SQL pool
A serverless SQL pool in Azure Synapse Analytics queries files in the data lake by using T-SQL, bills by the amount of data processed, and has no infrastructure to provision. A dedicated SQL pool bills for provisioned compute whether or not queries are running. Azure SQL Database serverless bills for compute time, not for data processed, and is designed for operational workloads.
A serverless SQL pool in Azure Synapse Analytics queries files in the data lake by using T-SQL, bills by the amount of data processed, and has no infrastructure to provision. A dedicated SQL pool bills for provisioned compute whether or not queries are running. Azure SQL Database serverless bills for compute time, not for data processed, and is designed for operational workloads.
Question 49Identity & Governance
Consolidated Messenger plans to move 200 workloads to Azure over the next two years. It wants a foundation that follows Microsoft guidance, with a management group hierarchy that separates platform and application workloads and dedicated subscriptions for connectivity, identity and management. Governance must be policy-driven and deployed as infrastructure as code. You need to minimize design effort. What should you recommend?
Correct answer: B. The Azure landing zone accelerator
Azure landing zones from the Cloud Adoption Framework provide a ready-made management group hierarchy, platform subscriptions and policy assignments that you can deploy with Bicep or Terraform. A Well-Architected Review assesses individual workloads, but it does not build the shared platform foundation.
Azure landing zones from the Cloud Adoption Framework provide a ready-made management group hierarchy, platform subscriptions and policy assignments that you can deploy with Bicep or Terraform. A Well-Architected Review assesses individual workloads, but it does not build the shared platform foundation.
Question 50Infrastructure
Tailspin hosts an internal line-of-business web app in a single Azure region. Requests to the /api path must go to one backend pool, and requests to the /images path must go to another. The app must be protected by OWASP-based WAF rules, and users must reach it only through a private IP address in the virtual network. What should you recommend?
Correct answer: C. Application Gateway with WAF
Application Gateway v2 supports a private frontend IP address, path-based routing to separate backend pools, and WAF with OWASP-based managed rules. Azure Front Door also offers WAF and path routing, but it is a global, internet-facing service, so users cannot reach it through a private IP address in the VNet.
Application Gateway v2 supports a private frontend IP address, path-based routing to separate backend pools, and WAF with OWASP-based managed rules. Azure Front Door also offers WAF and path routing, but it is a global, internet-facing service, so users cannot reach it through a private IP address in the VNet.
The real AZ-305 exam at a glance
50questions
1h 40mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Microsoft Azure & Power BI practice tests
AZ-900 Practice Test50 questions · Azure FundamentalsAZ-104 Practice Test50 questions · Azure AdministratorAZ-400 Practice Test50 questions · Azure DevOps EngineerPL-300 Practice Test50 questions · Power BI Data Analyst
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AZ-305 exam. They are not real exam questions. AZ-305 and Microsoft are trademarks of their owners. Real exam format: usually 40-60 questions · 100 minutes · passing score 700 on a 1-1000 scale · the real exam can include case studies.