The AZ-305 (Designing Microsoft Azure Infrastructure Solutions) is the Expert-level exam for Azure Solutions Architects. It tests your ability to design complex Azure solutions — not just know what services exist, but recommend the RIGHT service for a given set of requirements, trade-offs, and constraints. Expect architecture decision scenarios, not configuration details.
These 25 questions represent the hardest question style on the exam: multi-requirement scenarios where you must weigh cost, scalability, SLA, compliance, and simplicity simultaneously. You need AZ-104 (or equivalent experience) before taking AZ-305.
What You'll Get:
- ✓25 scenario-based architecture questions across all exam domains
- ✓Multi-requirement trade-off questions — real Expert-level format
- ✓Detailed explanations covering why each option is right or wrong
- ✓Scoring guide to assess your readiness
What These Questions Cover
📝 Practice Test Instructions
- • Each question has ONE best answer — architecture questions require choosing the BEST fit
- • Focus on requirements: cost, SLA, RPO/RTO, scalability, compliance
- • Note your answers before scrolling to the answer key
- • Aim to complete all 25 questions in 30 minutes
Identity, Governance & Monitoring
Questions 1–6
Management Groups and Policy
Your organization has 8 Azure subscriptions across 3 business units. Each business unit must have its own set of Azure Policies enforced consistently. Corporate security policies must apply to ALL subscriptions. New subscriptions should automatically inherit corporate policies.
What is the BEST governance design?
Azure AD B2B vs B2C
Contoso is building two applications: (1) An internal collaboration portal for partner company employees who need to access Contoso's SharePoint using their own company credentials. (2) A public e-commerce website where millions of external customers can sign up with email, Google, or Facebook.
Which identity solution should be used for each application?
Managed Identity
An Azure Function needs to retrieve secrets from Azure Key Vault to connect to a database. The current approach hard-codes a service principal client ID and secret in application settings. The security team wants to eliminate stored credentials entirely.
What is the recommended approach?
Azure Monitor and Log Analytics
You are designing a centralized monitoring solution for 12 Azure subscriptions across 4 regions. The security team needs all security events in one place for SIEM integration. The operations team needs application performance metrics. Both teams need data from all subscriptions.
What is the BEST monitoring architecture?
Azure RBAC Design
Your organization needs to ensure: (1) The DevOps team can deploy resources to production but cannot change RBAC assignments. (2) The security team can view all resources across all subscriptions for auditing but cannot modify anything. (3) Only two senior architects can manage role assignments.
Which RBAC role assignments satisfy ALL three requirements?
Azure Cost Management
Your organization wants to: (1) Prevent any single team from spending more than $10,000/month in their subscription. (2) Get an alert when spending reaches 80% of the budget. (3) Automatically shut down non-production VMs when the budget is exceeded.
Which Azure Cost Management features address all three requirements?
Data Storage Solutions
Questions 7–12
Storage Account Redundancy
A financial services company stores transaction audit logs in Azure Blob Storage. Requirements: (1) Data must survive a complete Azure region failure. (2) Read access to the secondary region must be available even when the primary region is degraded. (3) Cost should be optimized.
Which Azure Storage redundancy option meets ALL requirements?
Azure SQL vs Cosmos DB
You need to design a data store for an e-commerce product catalog. Requirements: (1) Globally distributed across 5 regions with < 10ms read latency everywhere. (2) Schema-flexible — product attributes vary significantly by category. (3) Automatic scaling with no capacity planning. (4) 99.999% availability SLA.
Which Azure database service BEST meets all requirements?
Azure SQL Tiers
A healthcare application uses Azure SQL Database. Requirements: (1) < 1ms I/O latency for OLTP workloads. (2) Built-in high availability with 99.99% SLA. (3) In-memory read replica for reporting queries without impacting the primary. (4) Supports up to 4 TB database size.
Which Azure SQL Database service tier meets ALL requirements?
Azure Data Lake vs Blob Storage
A data engineering team needs to store 500 TB of raw log files from IoT devices, run Apache Spark analytics jobs on the data, apply hierarchical security (folder-level ACLs per team), and integrate with Azure Synapse Analytics.
Which storage service is BEST suited for this big data analytics scenario?
Storage Lifecycle Management
Your organization stores documents in Azure Blob Storage. Access patterns: frequent access for 30 days, occasional access for 31-90 days, rarely accessed after 90 days, must be retained for 7 years but never accessed after 1 year.
Which storage configuration minimizes cost while meeting all access and retention requirements?
Database Migration Strategy
A company needs to migrate a 10 TB SQL Server 2016 database to Azure with: (1) Minimal downtime (< 4 hours cutover window). (2) No application code changes. (3) Automatic patching and backups managed by Azure. (4) The same SQL Server feature set the app relies on (SQL Agent, CLR, linked servers).
Which Azure SQL migration target is the BEST fit?
Business Continuity Solutions
Questions 13–18
RTO vs RPO
A business-critical payment processing system has these requirements: "We can tolerate losing at most 5 minutes of transaction data. The system must be back online within 30 minutes of a failure."
How do these requirements translate into DR metrics?
Azure Site Recovery
Your organization runs 50 on-premises VMware VMs hosting critical business applications. You need a disaster recovery solution that: (1) Replicates VMs to Azure continuously. (2) Allows test failovers without impacting production. (3) Achieves RPO of < 15 minutes and RTO of < 1 hour.
Which Azure service is purpose-built for this use case?
Azure VM High Availability
You are deploying a 3-tier application (web, app, database) on Azure VMs. Each tier must tolerate a single VM failure without any downtime. The app tier specifically must survive an Azure datacenter failure within the same region.
What should you use for the app tier VMs to survive datacenter failure within the same region?
Azure Backup Strategy
Your organization needs to back up: 100 Azure VMs, 20 SQL databases on Azure VMs, and file shares on Azure Files. The backup policy requires: 30-day daily retention, 12-month monthly retention, and backups stored in a vault that protects against accidental deletion by admins.
Which Azure Backup features meet ALL requirements?
Multi-Region Architecture
A global SaaS application must achieve 99.99% availability. The architecture runs in Azure East US. You need to design a multi-region failover. Traffic must automatically route to the secondary region (West US) if East US becomes unavailable. RTO < 5 minutes.
Which traffic routing solution achieves automatic failover with < 5 minute RTO?
Azure SQL Business Continuity
A mission-critical Azure SQL Database needs: (1) RPO of 0 seconds (zero data loss) for planned maintenance. (2) RTO < 30 seconds for regional failover. (3) The secondary database must be readable for reporting. (4) Automatic failover without manual intervention.
Which Azure SQL Business Continuity feature meets ALL requirements?
Infrastructure Solutions
Questions 19–25
Compute Selection
A startup is building a new web API. Requirements: (1) Auto-scales from 0 to 1000 requests/second. (2) No infrastructure management. (3) Pay only when code executes (cost-effective for unpredictable traffic). (4) Stateless request handling. (5) Maximum execution time of 5 minutes per request.
Which Azure compute service BEST meets all requirements?
Container Strategy
A development team has containerized a microservices application with 15 services. Requirements: (1) Services must auto-scale independently. (2) Service-to-service networking with internal DNS. (3) No Kubernetes expertise in the team. (4) KEDA-based event-driven scaling for queue processors. (5) Managed infrastructure.
Which Azure service is the BEST fit?
Migration Strategy
A company wants to migrate 200 on-premises VMs to Azure. They need to: (1) Assess VM dependencies before migration. (2) Estimate Azure costs for each VM. (3) Test migrate VMs before final cutover. (4) Replicate VMs with minimal disruption to production.
Which Azure service provides this end-to-end VM migration capability?
App Service vs AKS
You need to choose between Azure App Service and Azure Kubernetes Service for a web application. The application: (1) Is a single .NET web app (no microservices). (2) Needs auto-scale and SSL termination. (3) The team has no container or Kubernetes experience. (4) Must deploy in < 30 minutes from scratch.
Which service is the BEST fit and why?
Landing Zone Design
Your organization is establishing an Azure landing zone for enterprise adoption. You need: connectivity hub, identity services, policy enforcement, and isolation between workloads. The design must scale to 50+ subscriptions over 3 years.
Which reference architecture provides the recommended pattern for enterprise-scale Azure governance?
Key Vault Architecture
Your application stores secrets in Azure Key Vault. Requirements: (1) Secrets must be accessible even if a single Azure datacenter fails. (2) All secret access must be logged for compliance. (3) If a secret is accidentally deleted, it must be recoverable for 90 days. (4) The Key Vault itself must not be permanently deleted by mistake.
Which Key Vault configuration meets ALL requirements?
Well-Architected Framework
You are reviewing an architecture for a customer-facing application. You identify: VMs are over-provisioned by 70%, there is no health monitoring, deployments cause 20-minute downtime windows, there is no encryption for data at rest, and the architecture cannot scale beyond current capacity.
Which Microsoft Azure Well-Architected Framework pillars are violated by these issues, in order?
✋ Stop Here Before Scrolling!
Have you answered all 25 questions? Complete the test before checking the answers below.
Pro tip: AZ-305 is about choosing the BEST option given constraints — practice explaining WHY each option is wrong too
📝 Answer Key with Detailed Explanations
Review each explanation carefully, even for questions you answered correctly
Quick Answer Reference
Question 1: Management Groups and Policy
✓ Correct Answer: A) Management Group hierarchy with inherited policies
Why this is correct:
Management Groups create a hierarchical structure above subscriptions. Policies applied at a parent Management Group automatically inherit to all child groups and subscriptions. The Root MG is the parent of all MGs — apply corporate policies there. Business Unit MGs sit below Root and can have additional BU-specific policies. New subscriptions placed under a MG automatically inherit its policies.
Why other answers are incorrect:
💡 Key Concept:
Management Group hierarchy: Tenant Root Group → (optional intermediate MGs) → Subscriptions. Policy and RBAC assignments inherit downward. Can have up to 6 levels deep. Subscriptions can only be in ONE Management Group at a time.
Question 2: Azure AD B2B vs B2C
✓ Correct Answer: B) Application 1: Azure AD B2B. Application 2: Azure AD B2C
Why this is correct:
B2B (Business-to-Business) is for external partner/organization users who authenticate with their OWN organization's identity provider — they use their company credentials to access your resources as guests. B2C (Business-to-Consumer) is for consumer/customer identity management at massive scale, supporting social logins (Google, Facebook), email OTP, and custom branded sign-up flows.
Why other answers are incorrect:
💡 Key Concept:
B2B = federate partner identities (they bring their own IdP). B2C = consumer identity management (you manage sign-up, social login, MFA). Easy memory: B2B = partner employees, B2C = external customers/public.
Question 3: Managed Identity
✓ Correct Answer: C) System-Assigned Managed Identity with Key Vault Secrets User role
Why this is correct:
System-Assigned Managed Identity eliminates ALL stored credentials. Azure automatically manages the identity's lifecycle (creates it when the resource is created, deletes it when the resource is deleted). The function authenticates to Key Vault using its managed identity — no client ID, no secret, no rotation needed. Granting Key Vault Secrets User role (RBAC) allows reading secrets.
Why other answers are incorrect:
💡 Key Concept:
System-Assigned vs User-Assigned MI: System-Assigned = 1:1 with the Azure resource, auto-deleted with resource. User-Assigned = standalone resource, can be assigned to multiple resources, survives resource deletion. Use User-Assigned when you need the same identity on multiple resources.
Question 4: Centralized Monitoring
✓ Correct Answer: D) Centralized Log Analytics workspace with Sentinel
Why this is correct:
A single centralized Log Analytics workspace allows all subscriptions to send diagnostic data to one place. Queries run across all data in one workspace — no cross-workspace join complexity. Microsoft Sentinel connects to the Log Analytics workspace and provides SIEM/SOAR on top. Application Insights (for app performance) can also send to the same workspace.
Why other answers are incorrect:
💡 Key Concept:
Azure Monitor architecture: Azure Monitor collects → Metrics (numeric, 93-day retention, free) → Metrics Explorer. Logs (text, configurable retention) → Log Analytics Workspace → KQL queries. Sentinel sits on top of a Log Analytics workspace for SIEM.
Question 5: Azure RBAC Design
✓ Correct Answer: A) DevOps: Contributor. Security: Reader at MG. Architects: User Access Administrator
Why this is correct:
Contributor grants create/delete/modify rights but NOT RBAC management rights — perfect for DevOps. Reader at Management Group inherits Reader to all subscriptions/resources — perfect for cross-subscription auditing without modify access. User Access Administrator specifically grants the ability to manage role assignments — only what architects need.
Why other answers are incorrect:
💡 Key Concept:
RBAC roles to memorize: Owner (everything + RBAC). Contributor (everything except RBAC). Reader (view only). User Access Administrator (RBAC only, no resource management). Assign minimum required privilege — never Owner unless RBAC management is needed.
Question 6: Azure Cost Management
✓ Correct Answer: B) Azure Budgets with alert thresholds and action groups triggering Automation runbooks
Why this is correct:
Azure Budgets allow you to: set a spending limit ($10,000/month), configure alert thresholds at percentages (80% alert + 100% action), and trigger action groups when thresholds are reached. Action groups can call webhooks, which can trigger Azure Automation runbooks to stop VMs programmatically.
Why other answers are incorrect:
💡 Key Concept:
Azure Budget automation: Budget threshold reached → triggers Action Group → Action Group calls Automation webhook → Runbook stops non-prod VMs. Budget alerts are near-real-time but have up to 12-hour latency. Cost analysis ≠ Budget — budgets enforce, analysis reports.
Question 7: Storage Redundancy
✓ Correct Answer: C) Read-Access Geo-Redundant Storage (RA-GRS)
Why this is correct:
RA-GRS replicates data to a secondary region (geo-redundant) AND provides read access to the secondary endpoint even while the primary region is healthy or degraded. This satisfies: survives regional failure (geo), readable secondary without waiting for failover (RA), and is cost-optimized compared to RA-GZRS.
Why other answers are incorrect:
💡 Key Concept:
Storage redundancy hierarchy: LRS (3 copies, 1 datacenter) < ZRS (3 zones, 1 region) < GRS (2 regions, secondary not readable) < RA-GRS (2 regions, secondary readable) < GZRS (ZRS primary + GRS) < RA-GZRS (highest durability + read access). Cost increases with each tier.
Question 8: Cosmos DB
✓ Correct Answer: D) Azure Cosmos DB with multi-region writes
Why this is correct:
Cosmos DB is designed for global distribution with < 10ms p99 reads/writes, schema-flexible (NoSQL — JSON documents perfect for variable product attributes), auto-scale serverless or autoscale provisioned throughput, and a 99.999% SLA with multi-region writes. No other Azure database service offers all four simultaneously.
Why other answers are incorrect:
💡 Key Concept:
Cosmos DB key metrics: 99.999% SLA (5 nines) with multi-region writes. < 10ms p99 latency. Multiple APIs: Core (SQL), MongoDB, Cassandra, Gremlin, Table. RU/s = throughput unit. Serverless vs Provisioned vs Autoscale.
Question 9: Azure SQL Tiers
✓ Correct Answer: A) Business Critical
Why this is correct:
Business Critical tier uses local SSD storage for < 1ms I/O latency, includes a built-in readable secondary replica for reporting workloads (at no extra cost), supports up to 4 TB, and provides 99.99% SLA with built-in HA using Always On Availability Groups internally.
Why other answers are incorrect:
💡 Key Concept:
Azure SQL tiers: General Purpose = balanced price/performance, remote storage. Business Critical = highest performance, local SSD, built-in read replica, highest HA. Hyperscale = massive scale (100 TB+), fast snapshots. Choose by: GP for most workloads, BC for low-latency OLTP, Hyperscale for very large databases.
Question 10: Azure Data Lake Storage Gen2
✓ Correct Answer: B) Azure Data Lake Storage Gen2 (ADLS Gen2)
Why this is correct:
ADLS Gen2 is built on Blob Storage but adds: hierarchical namespace (folders with true POSIX-compliant ACLs for folder-level security), optimized for big data analytics (columnar reads, Parquet support), native Spark connector, and direct integration with Azure Synapse Analytics. It's designed exactly for this scenario.
Why other answers are incorrect:
💡 Key Concept:
ADLS Gen2 key features over Blob Storage: Hierarchical namespace (HNS) enables folder-level ACLs and atomic directory operations. Better performance for analytics (optimized reads). Synapse native integration. Enable HNS when creating the storage account — cannot enable post-creation.
Question 11: Storage Lifecycle Management
✓ Correct Answer: C) Lifecycle management: Hot → Cool → Cold → Archive → Delete
Why this is correct:
Azure Blob Storage lifecycle management policies automatically move blobs between tiers based on age. The optimal tier progression minimizes cost: Hot (frequent access) → Cool (infrequent, 30-day minimum) → Cold (rare, 90-day minimum) → Archive (offline, very cheap, 180-day minimum). Delete after 7 years satisfies retention.
Why other answers are incorrect:
💡 Key Concept:
Blob tier costs (approximate): Hot = highest storage cost, lowest access cost. Cool = lower storage, higher access. Cold = even lower storage, higher access. Archive = lowest storage (60-70% cheaper than Hot), very high access cost + rehydration delay. Match tier to access frequency.
Question 12: SQL Managed Instance
✓ Correct Answer: D) Azure SQL Managed Instance
Why this is correct:
Azure SQL Managed Instance provides near 100% SQL Server compatibility — including SQL Agent, CLR, linked servers, cross-database queries, and DTC. It's fully PaaS (automated patching and backups). Migration uses Azure Database Migration Service with online migration for < 4 hour downtime. It supports up to 8 TB.
Why other answers are incorrect:
💡 Key Concept:
SQL migration target decision: Need SQL Agent/CLR/linked servers → SQL Managed Instance. Cloud-native, no compatibility concerns → Azure SQL Database. Need full SQL Server control/features → SQL on Azure VM. Data warehouse/analytics → Synapse Analytics.
Question 13: RTO vs RPO
✓ Correct Answer: A) RPO = 5 minutes (max data loss), RTO = 30 minutes (max downtime)
Why this is correct:
RPO (Recovery Point Objective) = maximum acceptable data loss, measured as time. "We can tolerate losing 5 minutes of data" = RPO of 5 minutes. RTO (Recovery Time Objective) = maximum acceptable downtime — how long the system can be unavailable. "Back online within 30 minutes" = RTO of 30 minutes.
Why other answers are incorrect:
💡 Key Concept:
Memory trick: RPO = "Point" of last good data (how far back do we go?). RTO = "Time" to recover (how long until we're back?). Lower RPO = more frequent backups/replication. Lower RTO = faster failover/recovery mechanisms.
Question 14: Azure Site Recovery
✓ Correct Answer: B) Azure Site Recovery (ASR)
Why this is correct:
Azure Site Recovery provides continuous replication of VMware/Hyper-V/physical VMs to Azure. It achieves RPO of seconds to minutes (not hours like backup) via continuous replication. Test failovers run in an isolated network without impacting production. RTO is typically 15-30 minutes for orchestrated failover.
Why other answers are incorrect:
💡 Key Concept:
ASR vs Azure Backup: ASR = continuous replication + DR orchestration + test failovers (for DR, low RPO/RTO). Backup = periodic snapshots for data protection and recovery (higher RPO, higher RTO). Use BOTH for comprehensive protection.
Question 15: Availability Zones
✓ Correct Answer: C) Distribute VMs across Availability Zones
Why this is correct:
Availability Zones are physically separate datacenters within a region with independent power, cooling, and networking. Distributing VMs across AZs (e.g., 1 VM in zone 1, 1 in zone 2, 1 in zone 3) means a complete datacenter failure only affects 1/3 of your VMs — the others continue serving traffic.
Why other answers are incorrect:
💡 Key Concept:
Availability Sets vs Availability Zones: Sets = multiple VMs spread across fault/update domains within a datacenter (protects against rack/host failure). Zones = multiple VMs in different datacenters within a region (protects against datacenter failure). Zones provide better SLA (99.99% vs 99.95%).
Question 16: Azure Backup Strategy
✓ Correct Answer: D) Recovery Services Vault with backup policies, soft-delete, and purge protection
Why this is correct:
Recovery Services Vault supports all required workloads: Azure VMs, SQL on Azure VMs, and Azure Files. You create separate backup policies for each workload with the required retention (30 daily, 12 monthly). Soft-delete protects against accidental deletion by retaining deleted backup data for 14+ days. Purge protection prevents permanent deletion even by admins for a configurable period.
Why other answers are incorrect:
💡 Key Concept:
Recovery Services Vault soft-delete: Deleted backup data retained for 14 days by default (configurable). Purge protection: once enabled, the vault and backup data cannot be permanently deleted for the configured retention period — even by global admins.
Question 17: Multi-Region Failover
✓ Correct Answer: A) Azure Front Door with origin groups and health probes
Why this is correct:
Azure Front Door uses anycast — traffic is directed to the nearest Front Door PoP globally, and health probes detect regional failures in seconds. Failover happens at the DNS + anycast routing level — when East US origins fail health checks, Front Door automatically routes to West US origins. Typical failover time is < 2 minutes.
Why other answers are incorrect:
💡 Key Concept:
Front Door vs Traffic Manager for failover: Front Door = anycast, PoP-level routing, WAF/CDN included, sub-minute failover typical, Layer 7. Traffic Manager = DNS-based, no edge processing, 1-5 minute failover typical, protocol-agnostic. For web apps, Front Door is preferred.
Question 18: SQL Auto-failover Groups
✓ Correct Answer: B) Auto-failover group with read-scale secondary
Why this is correct:
Auto-failover groups provide: automatic failover without manual intervention (the read/write listener endpoint automatically points to the primary), a readable secondary (fulfills reporting requirement), and the read-scale endpoint is separate from the write endpoint. With synchronous commit mode for planned failovers, you get zero data loss (RPO=0). RTO < 30 seconds is achievable with automatic failover.
Why other answers are incorrect:
💡 Key Concept:
Active geo-replication vs Auto-failover groups: Active geo-replication = manual failover, up to 4 secondaries, database-level. Auto-failover groups = automatic failover, server-level (all databases), listener endpoints that auto-redirect. Use failover groups when automatic failover is required.
Question 19: Azure Functions
✓ Correct Answer: C) Azure Functions (Consumption plan)
Why this is correct:
Azure Functions Consumption plan: scales from 0 to thousands of instances automatically (including scale-to-zero — cost-effective for unpredictable traffic), pay-only-when-executing billing, no server management, stateless execution, and supports up to 10-minute execution timeout (the 5-minute limit is well within this). It perfectly matches all 5 requirements.
Why other answers are incorrect:
💡 Key Concept:
Compute decision: Short-lived, event-driven, scale-to-zero → Functions. Web app, long-running, team knows .NET/Node → App Service. Containerized, microservices, no k8s expertise → Container Apps. Complex orchestration, full k8s control → AKS.
Question 20: Azure Container Apps
✓ Correct Answer: D) Azure Container Apps
Why this is correct:
Azure Container Apps is purpose-built for microservices: manages Kubernetes underneath without exposing k8s complexity, provides per-service auto-scaling, built-in service discovery with DNS, native KEDA (Kubernetes Event-Driven Autoscaling) support for queue/event-based scaling, and is fully managed. No Kubernetes expertise needed.
Why other answers are incorrect:
💡 Key Concept:
Container Apps vs AKS: Container Apps = managed Kubernetes, no k8s knowledge needed, built-in KEDA/Dapr, per-revision scaling, serverless. AKS = full k8s control, requires expertise, custom networking, any k8s add-on. Use Container Apps unless you need k8s-specific features.
Question 21: Azure Migrate
✓ Correct Answer: A) Azure Migrate
Why this is correct:
Azure Migrate is the hub for Azure migration that provides: dependency analysis (maps VM-to-VM communications to identify migration groups), Azure cost estimation (right-sizes based on actual utilization), test migration capability (migrates to an isolated network first), and replication with ASR integration. All four requirements are covered.
Why other answers are incorrect:
💡 Key Concept:
Azure Migrate components: Discovery and Assessment (inventories VMs, recommends Azure sizing), Business Case (ROI analysis), Migrate (orchestrates migration using ASR for VMs, DMS for databases). All in one hub at migrate.azure.com.
Question 22: App Service vs AKS
✓ Correct Answer: B) Azure App Service
Why this is correct:
Azure App Service is a fully managed PaaS designed specifically for web applications. It provides built-in auto-scale, SSL/TLS certificate management, deployment slots, CI/CD integration, and can deploy from code (no containers needed). A single .NET web app can be deployed in minutes. No container or Kubernetes knowledge required.
Why other answers are incorrect:
💡 Key Concept:
Right-size your compute choice: Don't use AKS for simple apps just because it's powerful. Azure App Service handles the vast majority of web app scenarios with zero infrastructure management. Reserve AKS for complex microservices with teams that know Kubernetes.
Question 23: Azure Landing Zone
✓ Correct Answer: C) Azure Landing Zone (ALZ) accelerator with Management Groups, hub-spoke networking, and centralized policy
Why this is correct:
Azure Landing Zone (Cloud Adoption Framework) provides reference architectures for enterprise Azure governance. It includes: Management Group hierarchy for policy inheritance, hub-spoke or Virtual WAN networking for connectivity, centralized Log Analytics, policy-as-code for compliance, and subscription vending for scale. Designed to scale to hundreds of subscriptions.
Why other answers are incorrect:
💡 Key Concept:
Azure Landing Zone pillars: Management Groups + Policy (governance), Hub-spoke/VWAN networking (connectivity), Identity (Entra ID, PIM), Security (Defender for Cloud, Sentinel), Platform subscriptions (Management, Identity, Connectivity), Workload subscriptions (application landing zones).
Question 24: Key Vault Architecture
✓ Correct Answer: D) Zone-redundant Key Vault with soft-delete, purge protection, and diagnostic logging
Why this is correct:
Zone-redundant Key Vault (Premium or Standard with ZRS) survives datacenter failure within a region. Soft-delete with 90-day retention allows recovery of accidentally deleted secrets. Purge protection prevents permanent deletion even by admins. Diagnostic logging to Log Analytics captures all access for compliance audit trails.
Why other answers are incorrect:
💡 Key Concept:
Key Vault best practices: Enable soft-delete (now ON by default, 7-90 days). Enable purge protection for production (prevents permanent deletion). Diagnostic logs to Log Analytics for every key/secret access. Separate Key Vaults per environment (dev/test/prod). Private endpoints for VNet access control.
Question 25: Well-Architected Framework
✓ Correct Answer: A) Cost Optimization, Reliability, Security, Performance Efficiency, Operational Excellence
Why this is correct:
Each issue maps to a WAF pillar: Over-provisioned VMs = Cost Optimization (paying for unused capacity). No health monitoring = Reliability (can't detect or respond to failures). No encryption at rest = Security (data exposure risk). Cannot scale = Performance Efficiency (system can't meet demand). Deployment downtime = Operational Excellence (need zero-downtime deployment practices).
Why other answers are incorrect:
💡 Key Concept:
Azure Well-Architected Framework: Reliability (HA, DR, monitoring), Security (identity, data protection, threat detection), Cost Optimization (right-sizing, reserved instances, lifecycle), Operational Excellence (CI/CD, monitoring, observability), Performance Efficiency (scaling, caching, latency optimization). Use Azure Advisor and the WAF assessment tool.
📊 How Did You Score?
Ready for More AZ-305 Practice?
These 25 questions are just a sample. The actual AZ-305 exam has 40–60 questions.
MSCertQuiz AZ-305 includes 500 questions covering:
- ✓ Identity, governance, and management group design scenarios
- ✓ All database and storage architecture decisions with trade-offs
- ✓ Business continuity — HA, DR, backup, ASR deep-dive
- ✓ Compute, migration, and networking architecture
- ✓ Well-Architected Framework applied to real scenarios
$14.99 One-Time Payment
Lifetime access • No subscription • 500 questions