Microsoft · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A large enterprise wants to enforce zero-trust conditional access policies that use real-time user risk, sign-in risk, and device compliance. Which combination of Microsoft Entra ID features should they use?
Microsoft Entra ID Identity Protection and Conditional Access
Correct. Identity Protection detects risks like leaked credentials and unusual sign-ins, and Conditional Access uses these risks to enforce adaptive policies for a zero-trust model.
Microsoft Entra ID Privileged Identity Management and Access Reviews
Microsoft Entra ID B2B and External Identities
Microsoft Entra ID Domain Services and Managed Identities
A company needs to monitor sign-in logs from multiple Microsoft Entra ID tenants and analyze user sign-in patterns across those tenants. Which Azure solution should they use?
Azure Sentinel with Microsoft Entra ID connectors
Correct. Azure Sentinel can connect to multiple Microsoft Entra ID tenants via connectors and perform advanced analytics across data sources, making it ideal for cross-tenant sign-in analysis.
Azure Log Analytics workspace with Microsoft Entra ID diagnostic settings
Microsoft Entra ID Reports and Monitoring
Azure Monitor Workbooks
A multinational company uses Microsoft Entra ID for identity. They need to grant external partners access to specific SharePoint Online sites. The access must be time-limited and require approval from a resource owner. Which Microsoft Entra ID feature should they use?
Microsoft Entra ID Entitlement Management.
Entitlement Management enables creation of access packages with approvals and time-limited access. It is designed for governing external user access to resources like SharePoint Online.
Microsoft Entra ID B2C.
Microsoft Entra ID Conditional Access.
Microsoft Entra ID Identity Protection.
A company has multiple Azure subscriptions and wants to enforce that all administrators must use multi-factor authentication (MFA) when accessing the Azure portal. They also want to monitor and report on any policy changes that affect this enforcement. Which combination of Azure services should they use?
Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.
Microsoft Entra ID Conditional Access policy to require MFA for Azure management and Azure Monitor with Log Analytics for monitoring.
Conditional Access policies are the appropriate way to enforce MFA for accessing Azure Portal (Azure Management cloud app). Azure Monitor can collect Activity Logs from Microsoft Entra ID and Azure subscriptions to track changes to Conditional Access policies or other critical resources, and Log Analytics can be used for querying and alerting.
Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.
Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.
A company uses Microsoft Entra ID for identity management. They need to automate the process of granting access to resources for employees and external partners, and require periodic access reviews to ensure compliance. Which Microsoft Entra ID feature should they use?
Microsoft Entra ID Privileged Identity Management (PIM)
Microsoft Entra ID Entitlement Management
Entitlement Management allows you to create access packages that define the resources and policies for access. It can automate the request workflow and integrate with access reviews for periodic recertification.
Microsoft Entra ID Conditional Access
Microsoft Entra ID Identity Protection
A company has Microsoft Entra ID Premium P2 licenses and wants to ensure that privileged roles (e.g., Global Administrator) are only activated when needed and with approval. They also need to regularly review who has access to these roles. Which combination of features should they use?
Privileged Identity Management (PIM) and Microsoft Entra ID Access Reviews
PIM enables time-bound, approved activation of privileged roles, and Access Reviews can be configured to recertify assignments regularly.
Identity Protection and Conditional Access
Entitlement Management and Conditional Access
Microsoft Entra ID Access Reviews and Identity Protection
Want more Design identity, governance, and monitoring solutions practice?
Practice this domainA multinational company stores large amounts of unstructured data (documents, images) that must be read with low latency from multiple global regions. Data is written primarily in one region but read globally. Cost optimization is a key requirement. Which Azure storage replication option should they use?
Azure Blob Storage with geo-redundant storage (GRS)
Azure Blob Storage with read-access geo-redundant storage (RA-GRS)
Correct. RA-GRS replicates data to a secondary region and provides a read-only endpoint, allowing low-latency reads from the secondary region without the cost of premium storage.
Azure Files with premium shares
Azure NetApp Files
A startup is building a social media analytics platform that processes streaming data. They need a data store for time-series events with high write throughput and fast timestamp-based range queries. Which Azure data store is most suitable for this workload?
Azure Cosmos DB with SQL API
Azure SQL Database with columnstore index
Azure Table Storage
Correct. Azure Table Storage is designed for high-volume structured data and supports efficient point queries and range scans on PartitionKey and RowKey, making it ideal for time-series data at low cost.
Azure Data Lake Storage Gen2
A company ingests millions of IoT events per second from sensors around the world. Each event is a JSON message with timestamp, device ID, and readings. They need to support real-time analytics dashboards and also store all raw data for long-term historical analysis. They want to minimize operational overhead. Which Azure data storage solution should they recommend?
Azure Data Lake Storage Gen2 for all data.
Azure Event Hubs with Capture to Azure Data Lake Storage.
Event Hubs can handle millions of events per second. The Capture feature automatically writes ingested events to Data Lake Storage in Avro format (or JSON). For real-time dashboards, you can use Stream Analytics to query the Event Hubs stream. This provides a seamless, low-operational-overhead solution.
Azure Cosmos DB for both real-time and historical data.
Azure Time Series Insights (TSI) Standard.
A company runs a legacy application on Azure Virtual Machines. The application uses a SQL Server database that requires 50,000 IOPS consistently. It also uses a shared file system for storing documents. They plan to migrate from on-premises where they used a SAN for block storage and NAS for file shares. Which combination of Azure storage should they use to meet performance requirements?
Premium SSD v2 disks for the database and Azure Files premium tier for the file share.
Premium SSD v2 can achieve 50,000 IOPS with a 320 GiB disk (which gives 4,000 IOPS per GiB, 320*4000=1,280,000? No, let's check: Premium SSD v2 IOPS scales linearly to 80,000 at 1 TiB, but smaller disks can still achieve high IOPS. It is designed for high-performance databases. Azure Files Premium offers low latency and high throughput for file sharing, suitable for a shared file system.
Premium SSD (non-v2) for the database and Azure NetApp Files for the file share.
Ultra Disk for the database and Azure Files standard tier for the file share.
Standard SSD for the database and Azure Blob Storage for the file share.
A company needs a fully managed NoSQL database for a JSON document-oriented application that requires low latency (single-digit milliseconds) for reads and writes at any scale. The application will run globally and needs multi-region writes with automatic failover. Which Azure data store should they use?
Azure Cosmos DB
Cosmos DB offers multi-region writes, elastic scalability, and guarantees single-digit millisecond latency at the 99th percentile. It supports document models natively.
Azure Table Storage
Azure SQL Database
Azure Cache for Redis
A company needs to store and analyze petabytes of semi-structured data from IoT devices. The data is append-only and written in time order. They need to support fast queries on time ranges and also aggregate data in real-time. Which Azure data service should they use?
Azure Data Explorer
ADX (Kusto) is built for real-time analysis on large volumes of streaming data. It supports efficient time-series queries, ingestion from IoT sources, and real-time aggregations.
Azure Cosmos DB
Azure SQL Database
Azure Table Storage
Want more Design data storage solutions practice?
Practice this domainA financial services company runs a critical SQL Server database on Azure Virtual Machines. They require a disaster recovery solution with an RPO of less than 15 seconds and an RTO of less than 1 hour. Which technology should they implement?
Azure Site Recovery
SQL Server Always On Availability Groups
Correct. Always On Availability Groups with synchronous replication can provide an RPO of zero and an RTO of seconds to minutes, satisfying the disaster recovery requirements.
Azure Backup for SQL Server
Geo-redundant backups
A company runs a critical web application on Azure App Service in a single region. They need to achieve high availability across regions with automatic failover in the event of a regional outage. Which approach should they recommend?
Deploy multiple App Service instances in the same region with Traffic Manager
Deploy to multiple regions with Azure Front Door
Correct. Azure Front Door can route traffic across regions and automatically fail over to a healthy region if the primary goes down.
Use App Service auto-scaling rules to handle increased load
Enable Azure Site Recovery for the App Service
A company runs a critical SQL Server database on Azure Virtual Machines in a single region. They need a disaster recovery solution across regions with a recovery point objective (RPO) of zero. The database is update-intensive with frequent writes. Which configuration should they implement?
SQL Server Always On Availability Group with asynchronous commit.
SQL Server Always On Availability Group with synchronous commit across regions.
Synchronous commit ensures all transactions are committed on both the primary and secondary replicas before acknowledging the commit to the application. If configured across regions, this provides zero data loss (RPO=0). But network latency can affect write performance.
Azure Site Recovery to another region.
Deploy the VMs in a different availability zone within the same region.
A company runs a critical application on Azure Virtual Machines in a single availability set. They want to protect against an entire Azure region failure. They need a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes. Which solution should they use?
Azure Backup for VMs with geo-redundant backup storage.
Azure Site Recovery to another region.
Azure Site Recovery replicates VMs continuously to a secondary region. It can achieve RPO as low as 15 seconds (with app-consistent snapshots) and RTO of minutes (30 minutes is typical). It supports planned and unplanned failover.
Deploy VMs in an availability zone within the same region.
Use Azure managed disks with geo-replication (LRS to GRS).
A company runs multiple on-premises workloads that are critical. They need a disaster recovery solution that can replicate workloads to Azure and enable failover in the event of an on-premises outage. The solution must support non-VMware and non-Hyper-V physical servers. Which Azure service should they use?
Azure Backup
Azure Site Recovery
Azure Site Recovery supports replication of physical servers (and virtual machines) to Azure. It provides failover and test failover capabilities for DR.
Azure Migrate
Azure Disaster Recovery
A company has several Azure Virtual Machines running Windows Server with critical applications. They need to back up these VMs to a secondary Azure region to protect against regional disasters. The backup must be application-consistent and support file-level restore. Which solution should they implement?
Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault
Azure Backup offers VM-level application-consistent backups, supports GRS for cross-region durability, and allows file-level restore from recovery points.
Azure Site Recovery
Azure Snapshot of managed disks stored in a different region
Azure Managed Disk with incremental snapshots and manual cross-region copy
Want more Design business continuity solutions practice?
Practice this domainA company is designing a hub-spoke network topology in Azure. The hub contains a third-party network virtual appliance (NVA) for inspection. Spokes need to communicate with each other, and all inter-spoke traffic must be routed through the NVA in the hub. Which configuration should they use?
Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet
Configure Azure Firewall in the hub with forced tunneling to on-premises
Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA
Correct. UDRs allow precise control of traffic routing; adding a route for the spoke address spaces with next hop as the NVA IP enforces inspection.
Use VNet peering with gateway transit enabled
A company is deploying a web application on Azure App Service. They need to guarantee that all traffic from the internet goes through a Web Application Firewall (WAF) before reaching the app. The solution must be cost-effective for a single application. Which Azure service should they place in front of the App Service?
Azure Application Gateway with WAF.
Application Gateway is a regional Layer 7 load balancer that integrates WAF. It can be placed directly in front of App Service to inspect all incoming traffic. This is a cost-effective solution for a single-region application.
Azure Front Door with WAF policy.
Azure Firewall with application rules.
Azure Traffic Manager.
A company has multiple Azure subscriptions and on-premises data centers connected via ExpressRoute. They want to centralize connectivity to the internet and enforce a single web filtering and security policy for all outbound internet traffic from Azure VMs. Which Azure networking architecture should they implement?
Use a hub-spoke topology with Azure Firewall in the hub for all outbound traffic.
In a hub-spoke topology, the hub VNet contains shared services like Azure Firewall. Spoke VNets are peered to the hub, and UDRs in each spoke subnet route default internet-bound traffic (0.0.0.0/0) to the firewall. This ensures all outbound traffic is inspected by the firewall, providing centralized filtering.
Use a single virtual network for all resources with a network virtual appliance.
Use an Azure Virtual WAN with security virtual WAN hub.
Use Azure Traffic Manager with Azure Firewall.
A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?
Azure Virtual Network
Azure Virtual WAN
Virtual WAN offers a scalable, managed hub that connects branch offices, Azure VNets, and on-premises resources with automatic routing and integration with ExpressRoute/S2S VPN.
Azure ExpressRoute
Azure VPN Gateway
A company runs a high-performance computing (HPC) workload on Azure that requires extremely low latency (under 10 microseconds) between multiple VMs for MPI communication. The VMs are part of a single job and must be placed together to minimize network latency. Which VM deployment option should they use?
Azure Virtual Machine Scale Sets with a Proximity Placement Group
Proximity Placement Groups (PPG) co-locate VMs in the same datacenter region, providing ultra-low latency required for MPI workloads. VMSS allows scaling out while staying in the PPG.
Azure Availability Sets
Azure Virtual Machine Scale Sets across Availability Zones
Azure Kubernetes Service (AKS)
A company is deploying an internal web application on Azure VMs. The application requires SSL offloading, session stickiness, and URL-based routing (e.g., /api/* to one backend, /app/* to another). The solution must operate within a single Azure region and must not be exposed to the public internet. Which Azure load balancing solution should they use?
A
B
C
Azure Application Gateway can be deployed internally (internal Application Gateway) and provides all required features: SSL offloading, session affinity, and URL path-based routing.
D
Want more Design infrastructure solutions practice?
Practice this domainThe AZ-305 exam has up to 60 questions and must be completed in 120 minutes. The passing score is 700/1000.
The AZ-305 exam uses multiple-choice, multiple-select, drag-and-drop, and exhibit-based questions. Exhibit questions show CLI output, network diagrams, or routing tables and ask you to interpret them — exactly the format Courseiva uses.
The exam covers 4 domains: Design identity, governance, and monitoring solutions, Design data storage solutions, Design business continuity solutions, Design infrastructure solutions. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft AZ-305 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.