Microsoft certification practice
Practise Microsoft Azure Solutions Architect Expert AZ-305 practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Microsoft certification exams often test whether you can choose the right Azure, Microsoft 365, identity, security or monitoring action for a realistic administrative scenario. Courseiva helps you practise with structured questions and explanations.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 4 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Microsoft Azure Solutions Architect Expert AZ-305 exam.
Exam cost
$165 USD / ~£135
Duration
120 minutes
Question count
40–60 questions
Passing score
700 / 1000
Validity
Annual renewal (free online assessment on Microsoft Learn)
Delivered by
Pearson VUE
Online proctored
Yes — available
Retake policy
100% free — no account required
Everything on Courseiva for AZ-305 is free — no subscription, no trial, no email wall.
Courseiva provides free Microsoft Azure Solutions Architect Expert AZ-305 (AZ-305) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with Microsoft.
24 hours after first failure; 14 days after second
Question formats
Microsoft Azure Solutions Architect Expert (AZ-305) validates expertise in designing Azure infrastructure solutions including identity, governance, data storage, business continuity, and network infrastructure. It is an Expert-level certification requiring AZ-104 as a prerequisite.
Official prerequisite
AZ-104 (Azure Administrator Associate) or equivalent
Recommended experience
2+ years of Azure architecture experience
2+ years designing and implementing Azure solutions. AZ-104 level skills are a prerequisite. Should understand Azure networking, identity, and security deeply.
Should you skip this exam?
Do not attempt AZ-305 without passing AZ-104 first. The difficulty jump is significant and AZ-104 is an official prerequisite.
Courseiva study tip
AZ-305 tests design decisions, not just configuration knowledge. Questions present a business scenario and ask which Azure service or architecture pattern is most appropriate. There are often two plausible answers — focus on understanding trade-offs.
UK salary range
£65,000–£100,000
US salary range
$110,000–$160,000
Job roles that cite AZ-305
$165 USD.
700 out of 1000.
Yes. AZ-104 (or equivalent knowledge validated by Microsoft) is an official prerequisite for AZ-305.
AZ-305 is a hard exam. It focuses on architectural decision-making under business constraints, not just knowing what Azure services do. Candidates with AZ-104 and real-world Azure design experience typically need 150–250 additional hours of study.
Solutions Architect roles with AZ-305 pay £65,000–£100,000 in the UK and $110,000–$160,000 in the US.
AZ-104 is an Associate-level administrator exam. AZ-305 is an Expert-level architect exam. AZ-104 tests management skills; AZ-305 tests design skills. AZ-104 is the prerequisite for AZ-305.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All AZ-305 Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Cloud concepts questions usually test the service model (IaaS/PaaS/SaaS) and deployment model (public/private/hybrid/community) appropriate for a given scenario.
IaaS, PaaS and SaaS responsibilities and examples.
Public, private, hybrid and community cloud deployment models.
On-premises vs cloud trade-offs: cost, control, scalability.
How cloud connectivity options (VPN, Direct Connect, ExpressRoute) work.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise AZ-305 questions linked to Design identity, governance, and monitoring solutions.
Practise AZ-305 questions linked to Design data storage solutions.
Practise AZ-305 questions linked to Design business continuity solutions.
Practise AZ-305 questions linked to Design infrastructure solutions.
Practise AZ-305 questions linked to SAA-C03 VPC.
Practise AZ-305 questions linked to SAA-C03 S3 lifecycle policy questions.
Practise AZ-305 questions linked to SAA-C03 RDS Multi-AZ questions.
Practise AZ-305 questions linked to SAA-C03 IAM policy.
Practise AZ-305 questions linked to SAA-C03 Route 53 failover questions.
Practise AZ-305 questions linked to SAA-C03 CloudFront.
Practise AZ-305 questions linked to SAA-C03 NAT gateway questions.
Practise AZ-305 questions linked to SAA-C03 VPC endpoint questions.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 64 tests. See all 64 AZ-305 practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise AZ-305 questions in this domain →
Practise AZ-305 questions in this domain →
Practise AZ-305 questions in this domain →
Practise AZ-305 questions in this domain →
Term reference
These terms appear frequently in AZ-305 questions. Understanding them precisely reduces guessing and improves scores.
Subscription Design
Subscription Design is the structured approach to organizing and managing Azure subscriptions to align with business requirements, governance policies, and cost management.
Azure Backup Design
Azure Backup Design is the process of planning and configuring a reliable, cost-effective, and secure backup and recovery solution for workloads hosted in Microsoft Azure.
Azure Policy Design
Azure Policy Design is the practice of creating and organizing rules that enforce compliance and governance across resources in Microsoft Azure.
Data Lake Design
Data Lake Design is the process of planning a centralized storage repository that holds raw data in its native format until it is needed, enabling scalable analytics and machine learning across an organization.
Hybrid Identity Design
Hybrid Identity Design is the process of creating a system that lets users access resources both on their company's local network and in the cloud using a single set of credentials.
Cosmos DB Design
Cosmos DB Design is the process of structuring data and choosing configuration settings in Azure Cosmos DB to ensure fast performance, low cost, and scalability for applications.
Management Group Design
A logical hierarchy of Azure management groups that organizes subscriptions and applies governance policies consistently across an organization.
Data Replication Strategy
A data replication strategy is a plan for copying and synchronizing data across multiple locations to ensure availability, durability, and performance.
Free study guide
The Courseiva AZ-305 study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Trap 1: Use VNet peering with user-defined routes (UDRs) in each spoke and…
While this is possible, it requires manual configuration and maintenance of UDRs in each spoke and managing BGP with Route Server, increasing administrative overhead.
Trap 2: Create a single large VNet and use network security groups (NSGs)…
A single VNet does not scale well for cross-region connectivity and does not provide the necessary routing through NVAs without complex configuration.
Trap 3: Use Azure Firewall in the hub VNet and configure forced tunneling…
Forced tunneling requires manual route configuration and does not automatically handle transitive routing between spoke VNets; it also requires careful management of routes.
Use Azure Virtual WAN with a secured virtual hub.
Azure Virtual WAN provides a managed hub-and-spoke architecture with automatic routing. A secured virtual hub can integrate NVAs or Azure Firewall, and it handles transitive routing between spokes and on-premises without manual route tables or UDRs.
Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.
Why wrong: While this is possible, it requires manual configuration and maintenance of UDRs in each spoke and managing BGP with Route Server, increasing administrative overhead.
Create a single large VNet and use network security groups (NSGs) to isolate traffic.
Why wrong: A single VNet does not scale well for cross-region connectivity and does not provide the necessary routing through NVAs without complex configuration.
Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.
Why wrong: Forced tunneling requires manual route configuration and does not automatically handle transitive routing between spoke VNets; it also requires careful management of routes.
Trap 1: Enable public IP addresses on all workload VMs
Public IPs increase exposure and are not needed for forced-tunnel outbound inspection.
Trap 2: Deploy a NAT gateway in every spoke subnet
NAT gateways would bypass the central firewall design for outbound traffic.
Enable public IP addresses on all workload VMs
Why wrong: Public IPs increase exposure and are not needed for forced-tunnel outbound inspection.
Peer each spoke VNet with the hub VNet
VNet peering provides private connectivity between hub and spokes.
Associate a route table to spoke subnets with a default route to the firewall private IP
A UDR forces outbound traffic from spokes through the firewall.
Deploy a NAT gateway in every spoke subnet
Why wrong: NAT gateways would bypass the central firewall design for outbound traffic.
Trap 1: Availability Zone
Availability Zones provide redundancy across separate physical locations, offering higher SLA but not required for simple within-datacenter HA.
Trap 2: Virtual Machine Scale Set with manual scaling
Scale Sets are for auto-scaling and can use availability zones or sets, but the primary HA feature within a region is the Availability Set.
Trap 3: Azure Site Recovery
Site Recovery is for disaster recovery across regions, not for high availability within a single region.
Availability Zone
Why wrong: Availability Zones provide redundancy across separate physical locations, offering higher SLA but not required for simple within-datacenter HA.
Availability Set
Availability Sets ensure VMs are placed in different fault and update domains within a single datacenter, meeting the requirement.
Virtual Machine Scale Set with manual scaling
Why wrong: Scale Sets are for auto-scaling and can use availability zones or sets, but the primary HA feature within a region is the Availability Set.
Azure Site Recovery
Why wrong: Site Recovery is for disaster recovery across regions, not for high availability within a single region.
Trap 1: Microsoft Entra ID Password Hash Sync
Incorrect. Password Hash Sync synchronizes password hashes to Microsoft Entra ID, which does not meet the requirement of avoiding hash sync.
Trap 2: Microsoft Entra ID Federation Services (AD FS)
Incorrect. AD FS can avoid password hash sync but adds complexity and is typically used for federated identity, not the simplest solution for this requirement.
Trap 3: Microsoft Entra ID Connect with Seamless SSO
Incorrect. Seamless SSO is a feature that works on top of Password Hash Sync or Pass-through Authentication; by itself it does not solve the authentication method requirement.
Microsoft Entra ID Pass-through Authentication
Correct. Pass-through Authentication validates passwords on-premises, so no password hashes are stored in Microsoft Entra ID.
Microsoft Entra ID Password Hash Sync
Why wrong: Incorrect. Password Hash Sync synchronizes password hashes to Microsoft Entra ID, which does not meet the requirement of avoiding hash sync.
Microsoft Entra ID Federation Services (AD FS)
Why wrong: Incorrect. AD FS can avoid password hash sync but adds complexity and is typically used for federated identity, not the simplest solution for this requirement.
Microsoft Entra ID Connect with Seamless SSO
Why wrong: Incorrect. Seamless SSO is a feature that works on top of Password Hash Sync or Pass-through Authentication; by itself it does not solve the authentication method requirement.
Trap 1: Azure Policy with built-in policy to enforce MFA and Azure Activity…
Azure Policy can audit whether MFA is enabled on accounts, but it cannot enforce MFA during sign-in. It is not the correct tool for requiring MFA at authentication time. Activity Log can capture policy changes, but the enforcement method is wrong.
Trap 2: Microsoft Entra ID Identity Protection to enforce MFA and Azure…
Identity Protection offers risk-based conditional access (e.g., require MFA for risky sign-ins), but it is not designed to enforce MFA for all administrators regardless of risk. Azure Sentinel is a SIEM that could ingest logs, but it is unnecessary for the stated requirement for basic monitoring of policy changes; Azure Monitor is simpler and sufficient.
Trap 3: Azure Policy to assign built-in policy 'MFA should be enabled on…
This policy audits whether MFA is enabled, but again does not enforce MFA during authentication. Azure Security Center (now Defender for Cloud) focuses on security posture and workload protection, not on monitoring identity policy changes.
Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.
Why wrong: Azure Policy can audit whether MFA is enabled on accounts, but it cannot enforce MFA during sign-in. It is not the correct tool for requiring MFA at authentication time. Activity Log can capture policy changes, but the enforcement method is wrong.
Microsoft Entra ID Conditional Access policy to require MFA for Azure management and Azure Monitor with Log Analytics for monitoring.
Conditional Access policies are the appropriate way to enforce MFA for accessing Azure Portal (Azure Management cloud app). Azure Monitor can collect Activity Logs from Microsoft Entra ID and Azure subscriptions to track changes to Conditional Access policies or other critical resources, and Log Analytics can be used for querying and alerting.
Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.
Why wrong: Identity Protection offers risk-based conditional access (e.g., require MFA for risky sign-ins), but it is not designed to enforce MFA for all administrators regardless of risk. Azure Sentinel is a SIEM that could ingest logs, but it is unnecessary for the stated requirement for basic monitoring of policy changes; Azure Monitor is simpler and sufficient.
Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.
Why wrong: This policy audits whether MFA is enabled, but again does not enforce MFA during authentication. Azure Security Center (now Defender for Cloud) focuses on security posture and workload protection, not on monitoring identity policy changes.
Trap 1: B
Using site-to-site VPNs as primary connections may not provide the required high bandwidth and reliability. ExpressRoute circuits as backup would be expensive and not commonly used as a backup due to cost.
Trap 2: C
A single Azure VPN Gateway with active-passive configuration is not designed for primary connections from two data centers; it also does not provide the low latency or reliability of ExpressRoute.
Trap 3: D
Sharing a single ExpressRoute circuit and a single VPN connection between two data centers is not practical as each data center needs its own connection to Azure.
A
Deploy an ExpressRoute circuit for each data center as the primary connection, and a site-to-site VPN as the backup connection for each. This provides high bandwidth and reliability with a cost-effective failover.
B
Why wrong: Using site-to-site VPNs as primary connections may not provide the required high bandwidth and reliability. ExpressRoute circuits as backup would be expensive and not commonly used as a backup due to cost.
C
Why wrong: A single Azure VPN Gateway with active-passive configuration is not designed for primary connections from two data centers; it also does not provide the low latency or reliability of ExpressRoute.
D
Why wrong: Sharing a single ExpressRoute circuit and a single VPN connection between two data centers is not practical as each data center needs its own connection to Azure.
Official booking and top-rated study resources for the AZ-305.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.