AZ-305 sample questions with answers
The other 155 questions are in the practice tool, with answers revealed as you go.
Start 20 questionsDesign identity, governance and monitoring solutions
- A platform team wants to stop engineers from creating oversized virtual machines in the production subscriptions, no matter which deployment tool they use. Which mechanism should the team apply?
- A security team must receive a notification whenever an administrator activates an eligible Microsoft Entra directory role, so the activation can be reviewed promptly. Which capability should the team configure?
- A company wants administrators to face a second verification step only when they sign in to the Azure portal from networks outside the head office. Sign-ins from the office should not be challenged. Which Conditional Access setting should be scoped to the office addresses?
- A governance team must confirm that every VM in the production subscriptions has a required endpoint protection extension and an encrypted OS disk. Non-compliant VMs should be surfaced automatically, and the missing extension should be installable through a remediation task. Which mechanism is correct?
Design data storage solutions
- A utility company collects several million meter readings a day from smart devices. Analysts query the data each morning, and anything older than a month should move to a cheaper class of storage. Which platform is the best fit?
- A public-records portal must keep serving read requests from a second region while the primary region is down, without first performing a failover. Which replication option meets this?
- A design firm runs Linux render nodes and Windows workstations in Azure, and both must mount the same project volume. The volume must support NFS and SMB on the same data, and Windows users must authenticate against the corporate Active Directory. Which service fits?
- A social app runs in two Azure regions and keeps user session tokens in a cache. If one region fails, users must keep their sessions without signing in again. Which service should hold the session state?
- A research institute must move about 400 TB of microscope images into Azure Blob Storage. Its office uplink is 100 Mbps, and the project cannot wait months for the transfer. Which approach is most practical?
- A SaaS vendor hosts several customer databases on one Azure SQL Managed Instance. One business operation must update an order in one database and an inventory row in another as a single transaction, rolling back fully if either write fails. What should the architect rely on?
- An analytics team needs a warehouse holding several petabytes of history that many concurrent BI users query. Compute must be pausable and resizable without moving the data. Which service should the team use?
Design business continuity solutions
- A retail site must serve users worldwide from edge locations, terminate TLS close to the user, block common web attacks and malicious bots, and fail over between two backend regions within seconds. Which service should you deploy?
- A bank runs an OLTP workload on a managed SQL instance and needs regional disaster recovery. Data loss of up to one hour is acceptable, recovery within four hours is required, and the application should reconnect through a stable listener name without changing connection strings after a failover. What should you configure?
- A healthcare provider must prove each quarter that its replicated application tier can start in the secondary region. The drill must leave production replication running and must not change the public name the clinics use to reach the application. Which option satisfies both requirements?
- A dental group runs Windows and Linux VMs in Azure. It needs backups that capture a consistent state of the databases inside those VMs, allow restoring individual files without rebuilding a machine, and keep recovery points available in a paired region. Which service should you configure?
- A video platform serves viewers on several continents. It must send each request to the closest healthy backend, terminate TLS at the edge, and fail over within seconds when a region becomes unhealthy. Which service fits?
- A public web application on App Service must reach a 99.95 percent SLA and keep running if one datacenter inside its region fails, without a manual switch. Which configuration satisfies this?
Design infrastructure solutions
- A payments platform must process each account's transactions strictly in arrival order, prevent a publisher's retries from creating duplicate charges, and sustain several million messages a day with predictable throughput. Which messaging service fits?
- A governance team wants a workflow that starts whenever a resource is created or deleted anywhere in a subscription, and also fans out one custom business event to three separate handler services, each retried on failure. Which combination of services should you use?
- A payments team's application servers sit in a spoke network and must reach an Azure SQL logical server while keeping every packet on private addressing and off Microsoft's public endpoints. Which feature gives the database an address inside the team's own subnet?
- A logistics platform has order-service microservices that publish status updates. Updates for the same order must be processed strictly in the sequence they were sent, and no update may be lost if a consumer crashes mid-processing. Which Azure messaging capability should you choose?
- A regulated bank wants every packet that leaves a workload subnet for the internet to pass through a central inspection point that logs flows and applies threat rules. Which configuration achieves this?
- Two manufacturing plants each have a private ExpressRoute circuit to Microsoft. They want their plant networks to exchange data directly across Microsoft's private backbone, with no internet path and no extra VPN appliances. Which feature enables this?
- A public API handles bursts of short requests that go quiet for hours at a time. The team wants new instances to appear within seconds during a spike, capacity to drop to zero when idle, and billing only for the executions and resources actually used. Which compute option is the most cost-effective?
- A software vendor hosts one internal service inside its virtual network and must let a handful of customer networks reach that service over private addresses. Customers must not see the rest of the vendor's network, and the service must stay off the public internet. Which approach fits these constraints?