AZ-305 — Designing Microsoft Azure Infrastructure Solutions
Microsoft

Designing Microsoft Azure Infrastructure Solutions (AZ-305) Practice Questions

★★★★★★ 4.6 534 verified reviews
95 questions
June 11, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Design Infrastructure Solutions
  • Design Identity, Governance, and Monitoring Solutions
  • Design Data Storage Solutions
  • Design Business Continuity Solutions

Sample Questions (10 of 95 shown)

Q1 Design Identity, Governance, and Monitoring Solutions (25-30%)
You have an Azure subscription that contains a custom application named Application1. Application1 is developed by an external company named Fabrikam, Ltd. Developers at Fabrikam are assigned role-based access control (RBAC) permissions to components of Application1. All users are licensed for the Microsoft 365 E5 plan. You need to recommend a solution to verify that the Fabrikam developers still require permissions to Application1. The solution must meet the following requirements:
  • Send a monthly email to the developers' managers that lists the access to Application1.
  • Automatically revoke access if a manager does not verify the access.
  • Minimize development effort.
What should you recommend?
  1. In Microsoft Entra ID, create an access review for Application1.
  2. Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.
  3. In Microsoft Entra ID Privileged Identity Management, create a custom role assignment for the Application1 resource.
  4. Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.
✓ Correct Answer: A
Microsoft Entra ID access reviews are designed for periodic review of user access permissions. They support automatic notification emails to managers and can automatically revoke access when managers fail to verify. This approach requires no custom development. PIM is for just-in-time privileged access, not periodic access review of regular RBAC assignments. Automation runbooks require significant development effort.
Q2 Design Identity, Governance, and Monitoring Solutions (25-30%)
You have an Azure subscription. The subscription has a blob container that contains several blobs. Ten users from your company's finance department plan to access the blobs during the month of April. You need to recommend a solution to enable access to the blobs for the finance department users ONLY during the month of April. Which security solution should you include in the recommendation?
  1. Shared access signatures (SAS)
  2. Conditional Access policies
  3. Certificates
  4. Access keys
✓ Correct Answer: A
Shared Access Signatures (SAS) provide delegated access to Azure Storage resources with a specified time window. You can generate a SAS token with a start and expiry time that covers only the month of April. Access keys provide permanent access, Conditional Access policies control user authentication rather than storage-level access, and certificates are for authentication, not time-bound access delegation.
Q3 Design Identity, Governance, and Monitoring Solutions (25-30%)
You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain. You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication. Some users work remotely and do NOT have VPN access to the on-premises network. You need to provide the remote users with single sign-on (SSO) access to WebApp1. Which two features should you include in the solution? Each correct answer presents part of the solution.
  1. Azure AD Application Proxy
  2. Azure AD Privileged Identity Management (PIM)
  3. Conditional Access policies
  4. Azure Arc
  5. Azure AD enterprise applications
  6. Azure Application Gateway
✓ Correct Answer: A, E
Azure AD Application Proxy provides secure remote access to on-premises web applications without requiring a VPN. It supports Integrated Windows Authentication for SSO. The application needs to be registered as an Azure AD enterprise application to be published through Application Proxy. PIM is for privileged access management, Azure Arc manages hybrid resources, and Application Gateway is for application delivery and load balancing.
Q4 Design Identity, Governance, and Monitoring Solutions (25-30%)
You have an Azure AD tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned memberships. Group1 has 50 members, including 20 guest users. You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements:
  • The evaluation must be repeated automatically every three months.
  • Every member must be able to report whether they need to be in Group1.
  • Users who report that they do not need to be in Group1 must be removed from Group1 automatically.
  • Users who do not report whether they need to be in Group1 must be removed from Group1 automatically.
What should you include in the recommendation?
  1. Implement Microsoft Entra ID Protection.
  2. Change the Membership type of Group1 to Dynamic User.
  3. Create an access review.
  4. Implement Microsoft Entra Privileged Identity Management (PIM).
✓ Correct Answer: C
Microsoft Entra ID access reviews support recurring schedules (e.g., every three months), self-attestation by group members, and automatic removal of users who either report they don't need access or fail to respond. Dynamic User groups automate membership based on rules but don't support self-reporting. ID Protection detects risk-based events. PIM manages privileged role assignments, not regular group memberships.
Q5 Design Identity, Governance, and Monitoring Solutions (25-30%)
Your company has an Azure AD tenant integrated with Microsoft 365 and an Azure subscription. The company has an on-premises identity infrastructure including AD DS and Azure AD Connect. The company has a partnership with Fabrikam, which has its own Active Directory forest and Microsoft 365 tenant. A team of 10 developers from Fabrikam will work on an Azure solution hosted in your Azure subscription. The developers must be added to the Contributor role for a resource group. You need to recommend a solution to assign the role to the Fabrikam developers, ensuring they use their existing credentials. What should you recommend?
  1. In your Azure AD tenant, create cloud-only user accounts for the Fabrikam developers.
  2. Configure a forest trust between the on-premises Active Directory forests.
  3. Configure an organization relationship between the Microsoft 365 tenants.
  4. In your Azure AD tenant, create guest accounts for the Fabrikam developers.
✓ Correct Answer: D
Azure AD B2B collaboration allows you to invite external users as guest accounts. Guest users authenticate using their home tenant credentials and can be assigned RBAC roles (such as Contributor) in your subscription. A forest trust is for internal Active Directory security, not cross-organization Azure access. Creating cloud-only accounts would require separate credentials.
Q6 Design Identity, Governance, and Monitoring Solutions (25-30%)
You are developing an app that will read activity logs for an Azure subscription by using Azure Functions. You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative effort. What should you include in the recommendation?
  1. An enterprise application in Azure AD
  2. System-assigned managed identities
  3. Shared access signatures (SAS)
  4. Application registration in Azure AD
✓ Correct Answer: B
System-assigned managed identities provide an automatically managed identity in Azure AD for Azure resources. The Azure Functions app can use this identity to authenticate to Azure services without managing credentials. Managed identities eliminate the need for developers to handle credentials, keys, or secrets. Enterprise applications and app registrations require manual credential management.
Q7 Design Identity, Governance, and Monitoring Solutions (25-30%)
You need to recommend a solution to generate a monthly report of all new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation?
  1. Azure Log Analytics
  2. Azure Arc
  3. Azure Analysis Services
  4. Application Insights
✓ Correct Answer: A
The Azure Activity Log captures all subscription-level events including resource creation, modification, and deletion. By creating a diagnostic setting to send Activity Log data to a Log Analytics workspace, you can query and generate reports on new ARM deployments over any time period. Log Analytics provides rich KQL query capabilities for custom reporting. Activity Log data is retained for 90 days by default; Log Analytics extends retention to up to 2 years.
Q8 Design Identity, Governance, and Monitoring Solutions (25-30%)
Your company has multiple divisions. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend?
  1. Configure the Azure AD provisioning service.
  2. Enable Azure AD pass-through authentication and update the sign-in endpoint.
  3. Use Azure AD entitlement management to govern external users.
  4. Configure Azure AD join.
✓ Correct Answer: C
Entitlement management is an identity governance feature that enables organizations to manage identity and access lifecycle at scale. It allows delegated non-admins to create access packages that external users from other organizations can request. Multi-stage approval workflows, time-limited access, and recurring reviews can be configured. For multi-tenant scenarios where you want Fabrikam users to access App1, entitlement management with access packages provides the most governance-friendly approach. Simply changing the app registration to multi-tenant (another valid approach) or provisioning service are alternatives but don't provide the governance controls.
Q9 Design Identity, Governance, and Monitoring Solutions (25-30%)
A company needs to implement multi-factor authentication (MFA) for all administrator accounts while exempting emergency access accounts. What should you configure in Microsoft Entra ID?
  1. Enable Security Defaults for the tenant
  2. Create a Conditional Access policy targeting directory roles with emergency account exclusions
  3. Enforce MFA at the user settings level for each administrator
  4. Deploy Microsoft Entra ID Protection with user risk policies
✓ Correct Answer: B
Conditional Access policies provide granular control over authentication requirements. By creating a policy that targets directory roles (such as Global Administrator) and explicitly excluding emergency access (break-glass) accounts, you enforce MFA for administrators while preserving emergency access. Security Defaults enforce MFA for all users indiscriminately. User-level MFA settings are difficult to manage at scale and don't support exclusions easily.
Q10 Design Identity, Governance, and Monitoring Solutions (25-30%)
You need to provide temporary privileged access to contractors for specific Azure resources, with automatic revocation after 30 days. Which solution should you implement?
  1. Microsoft Entra Privileged Identity Management (PIM) with time-bound assignments
  2. Custom role definitions with expiration dates
  3. Azure Policy to audit privileged access
  4. Azure AD Access Reviews with quarterly reviews
✓ Correct Answer: A
Microsoft Entra PIM provides just-in-time privileged access with time-bound assignments. Eligible assignments can be configured to expire automatically after a specified duration (e.g., 30 days). When the assignment expires, access is automatically revoked. Custom roles do not natively support time-bound access. Azure Policy only audits, it cannot control access. Access Reviews require manual action for revocation.

You've viewed 3 of 95 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

Designing cloud infrastructure is a fundamentally different skill than implementing it. AZ-305, the Azure Solutions Architect Expert exam, measures your ability to make design tradeoffs across compute, networking, storage, identity, governance, monitoring, and business continuity — all from the perspective of cost, performance, reliability, and security. The exam does not ask you to write deployment scripts or configure individual resources; instead, it presents multi-service case studies where you must justify why one architectural pattern is superior to another.

Before you can earn the Solutions Architect Expert badge, you must hold an active AZ-104 (Azure Administrator Associate) certification. While the two exams can be taken in any order, the Expert credential only unlocks once both are passed. Microsoft recommends at least several years of enterprise IT experience spanning networking, virtualization, security, governance, and database systems — the exam expects you to reason about tradeoffs at the architecture level, not just recite service features. The official preparation course is AZ-305T00-A, a four-day instructor-led curriculum mapped directly to the exam blueprint.

Four domains define what this exam measures. Design Infrastructure Solutions (30–35%) is the heaviest, covering VM sizing and families, container orchestration (ACI, ACA, AKS), serverless compute (Functions, Logic Apps), network topology design (hub-and-spoke VNet peering, hybrid VPN/ExpressRoute connectivity), load balancing (Azure Load Balancer, Application Gateway, Front Door, Traffic Manager), and migration planning via the Cloud Adoption Framework. Design Identity, Governance, and Monitoring Solutions (25–30%) tests Microsoft Entra ID architecture, Conditional Access, Management Group hierarchies, Azure Policy, Azure Blueprints, and Log Analytics workspace routing. Design Data Storage Solutions (20–25%) covers relational tier selection (Azure SQL Database vs. Managed Instance vs. open-source engines), Cosmos DB consistency level tradeoffs and API selection, Blob Storage lifecycle management, and Azure Files. Design Business Continuity Solutions (15–20%) focuses on RTO/RPO target setting, Availability Zone vs. paired region architectures, Azure Backup, and Azure Site Recovery replication patterns.

Walk into your AZ-305 exam having already worked through full-length case studies that reproduce the real test's focus on multi-service architecture alignment. Each practice question includes a detailed explanation that walks through the design rationale — why a specific load balancing topology fits a multi-region scenario, how to choose a Cosmos DB consistency model based on latency and data integrity requirements, and when to recommend Azure SQL Managed Instance over Azure SQL Database for lift-and-shift migrations. The downloadable PDF packages the same question bank for offline review, so you can study hub-and-spoke peering topologies, ExpressRoute gateway SKU sizing, and Azure Policy initiative design patterns during commutes or in environments without stable internet. Because the Expert-level exam grants access to Microsoft Learn documentation during the test, our practice questions are designed to be attempted without documentation access first, so you build the mental model before relying on the searchable reference.

Official Exam Domains & Weighting

To successfully pass the AZ-305 exam, candidates must master the following core domains:
  • Domain 1: Design Infrastructure Solutions — 30–35%
Tests your ability to design compute solutions by sizing VMs for specialized workloads, selecting container orchestration (ACI, ACA, AKS), and choosing serverless compute patterns (Functions, Logic Apps). Network design covers software-defined topologies including VNet peering, hub-and-spoke architectures, and hybrid connectivity via VPN Gateway or ExpressRoute. Load balancing selection spans Azure Load Balancer, Application Gateway, Azure Front Door, and Traffic Manager. Migration planning uses the Cloud Adoption Framework and Azure Migrate.
  • Domain 2: Design Identity, Governance, and Monitoring Solutions — 25–30%
Covers enterprise identity architecture using Microsoft Entra ID, Entra B2B/B2C, and Hybrid Identity with Conditional Access policies. Governance includes Management Group hierarchies, Subscriptions, Resource Groups, Azure Policy, and Azure Blueprints for compliance enforcement. Monitoring design focuses on Azure Monitor, Log Analytics workspaces, Application Insights, and centralized log routing strategies.
  • Domain 3: Design Data Storage Solutions — 20–25%
Focuses on relational data tier selection (Azure SQL Database, Azure SQL Managed Instance, PostgreSQL, MySQL), semi-structured storage with Azure Cosmos DB (multi-region consistency models, API selection, partition indexing), and unstructured storage (Azure Blob Storage lifecycle tiers, Azure Files, Azure Data Lake Storage Gen2). Durability and cost optimization against regulatory requirements are also tested.
  • Domain 4: Design Business Continuity Solutions — 15–20%
Tests high availability and disaster recovery architectures with RTO and RPO targets across Availability Zones and paired regions. Covers Azure Backup operational patterns for compute, database, and infrastructure states, as well as Azure Site Recovery replication models for structured, unstructured, and compute storage.

What Our Customers Say 534 verified reviews

4.6 ★★★★★★ Based on 534 reviews
★★★★★
I passed AZ-305 on my first try thanks to these practice questions. The unlimited retakes were essential for building confidence.
— Nicole K.
★★★★★★
I studied for AZ-305 with this bank and passed comfortably. The questions are well-organized and the UI is clean.
— Lauren C.
★★★★★★
I was nervous about the AZ-305 exam because it had been years since my last cert. These questions got me back on track fast.
— Aurora C.
★★★★★★
I travel a lot for work, so the mobile-friendly AZ-305 practice was a lifesaver. Did questions on flights and during commute.
— Lily B.
★★★★★★
The review mode for AZ-305 is awesome. Being able to see all questions and explanations at once really helps with last-minute cramming.
— Ezra J.
★★★★★
Just passed the AZ-305 certification. These questions were more challenging than the real exam, which is exactly how prep should be.
— Liam H.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

Unlike implementation-focused exams, AZ-305 focuses heavily on cost vs. feature tradeoffs. Candidates frequently struggle with choosing the right consistency level in Azure Cosmos DB (Session vs. Bounded Staleness) based on latency constraints. Another major pitfall is identifying the exact load-balancing solution needed for multi-region vs. regional workloads — for example, combining Azure Front Door with Application Gateway — or missing structural requirements in complex, multi-company case studies. Our practice questions reproduce these exact design tradeoffs with detailed explanations that walk through each decision path.

Once earned, your Azure Solutions Architect Expert certification is valid for exactly 12 months. Within the final 6 months of that validity window, you can extend your certificate for an additional 12 months completely for free by passing a non-proctored, open-book online renewal assessment via Microsoft Learn. The renewal assessment tests you exclusively on technical updates made over the past year.

If you do not pass on your first attempt, you must wait a mandatory 24-hour cooling-off period before your second attempt. For any subsequent attempts (up to a maximum of 5 attempts within a rolling 12-month period), a mandatory 14-day window is enforced between each attempt. Every retake requires the standard $165 USD exam fee unless protected by an Exam Replay promotional voucher.

Yes. Unlike Fundamentals-level exams, the AZ-305 exam provides access to the live Microsoft Learn documentation via a split-screen interface embedded inside the Pearson VUE secure delivery environment. You can search and read official documentation during the exam, but external forums, GitHub, and sandbox environments are not accessible. Our practice tests are designed to be attempted without documentation first, building the mental architecture knowledge you will need to navigate the docs efficiently under time pressure.

The mock exam includes full-length case studies where you must align compute, networking, storage, and identity decisions across a single business scenario — reproducing the multi-company case study format used in the real exam. Each case study presents a design constraint matrix with cost, latency, compliance, and availability requirements. Topics covered include Azure Front Door and Application Gateway multi-region load balancing, hub-and-spoke VNet peering with forced tunneling, Azure Policy Management Group inheritance chains for enterprise governance, Azure Cosmos DB consistency level selection with latency SLAs, and Azure Site Recovery paired region failover with RTO/RPO targets. Every practice question includes a detailed walkthrough of the design rationale.

Yes, our complete AZ-305 practice test is available as a downloadable PDF package that includes all scenario-based questions, case studies, and detailed answer explanations. The PDF covers every domain: Design Infrastructure Solutions (Azure Front Door multi-region routing, ExpressRoute gateway sizing, AKS cluster topology), Design Identity, Governance, and Monitoring Solutions (Management Group subscription hierarchy, Azure Policy initiative design, Log Analytics centralized logging), Design Data Storage Solutions (Cosmos DB consistency model tradeoffs, Azure SQL Managed Instance vs. SQL Database tier selection, Blob Storage lifecycle policy), and Design Business Continuity Solutions (Azure Site Recovery paired region replication, Azure Backup vault design). Download the PDF for offline review during commutes or in restricted network environments.

To earn the full Microsoft Certified: Azure Solutions Architect Expert credential, you must pass AZ-305 AND hold an active Microsoft Certified: Azure Administrator Associate (AZ-104) certification. The two exams can be completed in any order, but the Expert badge only unlocks once both conditions are satisfied. If you have not yet passed AZ-104, our AZ-104 practice test covers the administrator-level skills you will need before tackling the architect-level design decisions in AZ-305. The Solutions Architect Expert certification is valid for 12 months and can be renewed for free via Microsoft Learn within the final 6 months of the validity period.