Microsoft · Free Practice Questions · Last reviewed May 2026

AZ-305 Exam Questions and Answers

24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.

60 exam questions
120 min time limit
Pass at 700 / 1000
4 exam domains
1

Domain 1: Design identity, governance, and monitoring solutions

All Design identity, governance, and monitoring solutions questions

A large enterprise wants to enforce zero-trust conditional access policies that use real-time user risk, sign-in risk, and device compliance. Which combination of Microsoft Entra ID features should they use?

A

Microsoft Entra ID Identity Protection and Conditional Access

Correct. Identity Protection detects risks like leaked credentials and unusual sign-ins, and Conditional Access uses these risks to enforce adaptive policies for a zero-trust model.

B

Microsoft Entra ID Privileged Identity Management and Access Reviews

C

Microsoft Entra ID B2B and External Identities

D

Microsoft Entra ID Domain Services and Managed Identities

Why: Microsoft Entra ID Identity Protection provides real-time risk detection (user risk, sign-in risk), and Conditional Access can use those signals to enforce policies, such as requiring MFA or blocking access. Other options focus on privileged access or external identities.

A company needs to monitor sign-in logs from multiple Microsoft Entra ID tenants and analyze user sign-in patterns across those tenants. Which Azure solution should they use?

A

Azure Sentinel with Microsoft Entra ID connectors

Correct. Azure Sentinel can connect to multiple Microsoft Entra ID tenants via connectors and perform advanced analytics across data sources, making it ideal for cross-tenant sign-in analysis.

B

Azure Log Analytics workspace with Microsoft Entra ID diagnostic settings

C

Microsoft Entra ID Reports and Monitoring

D

Azure Monitor Workbooks

Why: Azure Sentinel can ingest sign-in logs from multiple Microsoft Entra ID tenants using connectors and provides advanced analytics (e.g., anomaly detection, custom queries) to analyze patterns across tenants. While Log Analytics can also collect logs, Sentinel offers built-in SIEM capabilities for cross-tenant analysis.

A multinational company uses Microsoft Entra ID for identity. They need to grant external partners access to specific SharePoint Online sites. The access must be time-limited and require approval from a resource owner. Which Microsoft Entra ID feature should they use?

A

Microsoft Entra ID Entitlement Management.

Entitlement Management enables creation of access packages with approvals and time-limited access. It is designed for governing external user access to resources like SharePoint Online.

B

Microsoft Entra ID B2C.

C

Microsoft Entra ID Conditional Access.

D

Microsoft Entra ID Identity Protection.

Why: Microsoft Entra ID Entitlement Management, part of Identity Governance, allows you to create access packages that include SharePoint sites, groups, or apps. External users can request access, and the package can require approvals and set an expiration date. This automates the lifecycle of external access. Microsoft Entra ID B2C is for customer-facing applications. Conditional Access and Identity Protection enforce policies but do not provide governed access requests.

A company has multiple Azure subscriptions and wants to enforce that all administrators must use multi-factor authentication (MFA) when accessing the Azure portal. They also want to monitor and report on any policy changes that affect this enforcement. Which combination of Azure services should they use?

A

Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.

B

Microsoft Entra ID Conditional Access policy to require MFA for Azure management and Azure Monitor with Log Analytics for monitoring.

Conditional Access policies are the appropriate way to enforce MFA for accessing Azure Portal (Azure Management cloud app). Azure Monitor can collect Activity Logs from Microsoft Entra ID and Azure subscriptions to track changes to Conditional Access policies or other critical resources, and Log Analytics can be used for querying and alerting.

C

Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.

D

Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.

Why: Microsoft Entra ID Conditional Access allows you to create policies that require MFA for specific cloud apps, such as Azure Management. This ensures MFA is enforced for Azure portal access. To monitor policy changes, you should use Azure Monitor to collect Activity Logs and create alerts for changes to Conditional Access policies. Alternatively, Azure Policy can audit MFA status, but it cannot enforce MFA for Azure portal access. Microsoft Entra ID Identity Protection is about risk-based policies, not basic MFA enforcement. Azure Sentinel is a SIEM that can ingest logs but is not necessary for basic monitoring.

A company uses Microsoft Entra ID for identity management. They need to automate the process of granting access to resources for employees and external partners, and require periodic access reviews to ensure compliance. Which Microsoft Entra ID feature should they use?

A

Microsoft Entra ID Privileged Identity Management (PIM)

B

Microsoft Entra ID Entitlement Management

Entitlement Management allows you to create access packages that define the resources and policies for access. It can automate the request workflow and integrate with access reviews for periodic recertification.

C

Microsoft Entra ID Conditional Access

D

Microsoft Entra ID Identity Protection

Why: Microsoft Entra ID Entitlement Management enables the creation of access packages that can be used to automate access assignments for both internal and external users. It integrates with Microsoft Entra ID Access Reviews to periodically recertify access, ensuring compliance. Privileged Identity Management (PIM) focuses on privileged role activation and review, not general access. Conditional Access controls sign-in conditions, and Identity Protection detects risk. Therefore, Entitlement Management is the correct feature.

A company has Microsoft Entra ID Premium P2 licenses and wants to ensure that privileged roles (e.g., Global Administrator) are only activated when needed and with approval. They also need to regularly review who has access to these roles. Which combination of features should they use?

A

Privileged Identity Management (PIM) and Microsoft Entra ID Access Reviews

PIM enables time-bound, approved activation of privileged roles, and Access Reviews can be configured to recertify assignments regularly.

B

Identity Protection and Conditional Access

C

Entitlement Management and Conditional Access

D

Microsoft Entra ID Access Reviews and Identity Protection

Why: Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time role activation with approval workflows and integrates with Microsoft Entra ID Access Reviews to periodically review privileged role assignments. This combination satisfies both requirements. Identity Protection, Entitlement Management, and Conditional Access do not offer the specific functionality for privileged role activation with approval and review.

Want more Design identity, governance, and monitoring solutions practice?

Practice this domain
2

Domain 2: Design data storage solutions

All Design data storage solutions questions

A multinational company stores large amounts of unstructured data (documents, images) that must be read with low latency from multiple global regions. Data is written primarily in one region but read globally. Cost optimization is a key requirement. Which Azure storage replication option should they use?

A

Azure Blob Storage with geo-redundant storage (GRS)

B

Azure Blob Storage with read-access geo-redundant storage (RA-GRS)

Correct. RA-GRS replicates data to a secondary region and provides a read-only endpoint, allowing low-latency reads from the secondary region without the cost of premium storage.

C

Azure Files with premium shares

D

Azure NetApp Files

Why: Read-access geo-redundant storage (RA-GRS) provides a secondary read-only endpoint, allowing global readers to access data with low latency from the secondary region while minimizing write costs. Geo-redundant storage (GRS) does not permit reads from the secondary without failover, and premium options are more expensive.

A startup is building a social media analytics platform that processes streaming data. They need a data store for time-series events with high write throughput and fast timestamp-based range queries. Which Azure data store is most suitable for this workload?

A

Azure Cosmos DB with SQL API

B

Azure SQL Database with columnstore index

C

Azure Table Storage

Correct. Azure Table Storage is designed for high-volume structured data and supports efficient point queries and range scans on PartitionKey and RowKey, making it ideal for time-series data at low cost.

D

Azure Data Lake Storage Gen2

Why: Azure Table Storage is a NoSQL key-value store that can handle high write throughput and supports range scans on the RowKey (often timestamp) when combined with a suitable PartitionKey. It is cost-effective and efficient for time-series data with simple queries.

A company ingests millions of IoT events per second from sensors around the world. Each event is a JSON message with timestamp, device ID, and readings. They need to support real-time analytics dashboards and also store all raw data for long-term historical analysis. They want to minimize operational overhead. Which Azure data storage solution should they recommend?

A

Azure Data Lake Storage Gen2 for all data.

B

Azure Event Hubs with Capture to Azure Data Lake Storage.

Event Hubs can handle millions of events per second. The Capture feature automatically writes ingested events to Data Lake Storage in Avro format (or JSON). For real-time dashboards, you can use Stream Analytics to query the Event Hubs stream. This provides a seamless, low-operational-overhead solution.

C

Azure Cosmos DB for both real-time and historical data.

D

Azure Time Series Insights (TSI) Standard.

Why: Azure Event Hubs is designed for high-throughput event ingestion and can capture all events to Azure Blob Storage or Azure Data Lake Storage in its native JSON format. This provides a cost-effective, durable storage for historical analysis. For real-time analytics, you can use Azure Stream Analytics to process the stream and feed a dashboard. This combination minimizes operational overhead by using serverless ingestion and storage. Time Series Insights is optimized for IoT time-series but may be more expensive for petabyte-scale historical data. Cosmos DB is not ideal for storing billions of raw events due to cost and performance limitations for write-heavy workloads.

A company runs a legacy application on Azure Virtual Machines. The application uses a SQL Server database that requires 50,000 IOPS consistently. It also uses a shared file system for storing documents. They plan to migrate from on-premises where they used a SAN for block storage and NAS for file shares. Which combination of Azure storage should they use to meet performance requirements?

A

Premium SSD v2 disks for the database and Azure Files premium tier for the file share.

Premium SSD v2 can achieve 50,000 IOPS with a 320 GiB disk (which gives 4,000 IOPS per GiB, 320*4000=1,280,000? No, let's check: Premium SSD v2 IOPS scales linearly to 80,000 at 1 TiB, but smaller disks can still achieve high IOPS. It is designed for high-performance databases. Azure Files Premium offers low latency and high throughput for file sharing, suitable for a shared file system.

B

Premium SSD (non-v2) for the database and Azure NetApp Files for the file share.

C

Ultra Disk for the database and Azure Files standard tier for the file share.

D

Standard SSD for the database and Azure Blob Storage for the file share.

Why: For the SQL Server database, Premium SSD v2 disks can deliver up to 80,000 IOPS per disk (with appropriate size) and offer consistent low latency. For the file share, Azure Files in the premium tier provides high performance and SMB protocol support for shared access, with low latency. Alternatively, Azure NetApp Files also provides high-performance file shares, but it is more expensive and complex. The combination of Premium SSD v2 and premium Azure Files is a straightforward, managed solution.

A company needs a fully managed NoSQL database for a JSON document-oriented application that requires low latency (single-digit milliseconds) for reads and writes at any scale. The application will run globally and needs multi-region writes with automatic failover. Which Azure data store should they use?

A

Azure Cosmos DB

Cosmos DB offers multi-region writes, elastic scalability, and guarantees single-digit millisecond latency at the 99th percentile. It supports document models natively.

B

Azure Table Storage

C

Azure SQL Database

D

Azure Cache for Redis

Why: Azure Cosmos DB is a globally distributed, multi-model database service designed for low-latency, high-availability, and multi-region writes. It supports automatic failover and provides turnkey global distribution with SLAs for latency, availability, and consistency. Azure Table Storage does not support multi-region writes. Azure SQL Database is a relational database, not a NoSQL document store. Azure Cache for Redis is a caching layer, not a primary data store.

A company needs to store and analyze petabytes of semi-structured data from IoT devices. The data is append-only and written in time order. They need to support fast queries on time ranges and also aggregate data in real-time. Which Azure data service should they use?

A

Azure Data Explorer

ADX (Kusto) is built for real-time analysis on large volumes of streaming data. It supports efficient time-series queries, ingestion from IoT sources, and real-time aggregations.

B

Azure Cosmos DB

C

Azure SQL Database

D

Azure Table Storage

Why: Azure Data Explorer (ADX) is optimized for interactive analytics on large volumes of streaming and time-series data. It handles petabytes of semi-structured data, provides fast time-range queries, and supports real-time aggregation with low latency. Cosmos DB is document-oriented and not designed for petabyte-scale append-only time-series with complex aggregations. SQL Database and Table Storage lack the scale and query performance for this workload.

Want more Design data storage solutions practice?

Practice this domain
3

Domain 3: Design business continuity solutions

All Design business continuity solutions questions

A financial services company runs a critical SQL Server database on Azure Virtual Machines. They require a disaster recovery solution with an RPO of less than 15 seconds and an RTO of less than 1 hour. Which technology should they implement?

A

Azure Site Recovery

B

SQL Server Always On Availability Groups

Correct. Always On Availability Groups with synchronous replication can provide an RPO of zero and an RTO of seconds to minutes, satisfying the disaster recovery requirements.

C

Azure Backup for SQL Server

D

Geo-redundant backups

Why: SQL Server Always On Availability Groups with synchronous commit mode can achieve very low RPO (near zero) and fast failover (RTO typically under a minute), meeting the stringent requirements. Other options like Azure Site Recovery or Azure Backup have higher RPO/RTO.

A company runs a critical web application on Azure App Service in a single region. They need to achieve high availability across regions with automatic failover in the event of a regional outage. Which approach should they recommend?

A

Deploy multiple App Service instances in the same region with Traffic Manager

B

Deploy to multiple regions with Azure Front Door

Correct. Azure Front Door can route traffic across regions and automatically fail over to a healthy region if the primary goes down.

C

Use App Service auto-scaling rules to handle increased load

D

Enable Azure Site Recovery for the App Service

Why: Deploying the web app to multiple regions and using Azure Front Door as a global load balancer provides automatic failover based on health probes, ensuring high availability across regions. Traffic Manager is DNS-based and slower to failover.

A company runs a critical SQL Server database on Azure Virtual Machines in a single region. They need a disaster recovery solution across regions with a recovery point objective (RPO) of zero. The database is update-intensive with frequent writes. Which configuration should they implement?

A

SQL Server Always On Availability Group with asynchronous commit.

B

SQL Server Always On Availability Group with synchronous commit across regions.

Synchronous commit ensures all transactions are committed on both the primary and secondary replicas before acknowledging the commit to the application. If configured across regions, this provides zero data loss (RPO=0). But network latency can affect write performance.

C

Azure Site Recovery to another region.

D

Deploy the VMs in a different availability zone within the same region.

Why: To achieve zero RPO across regions, you must use synchronous data replication. SQL Server Always On Availability Groups with synchronous commit can guarantee zero data loss if the secondary replica is in a different region. However, synchronous commit over long distances may impact performance due to network latency. Alternatives like Azure Site Recovery or asynchronous availability groups would have some data loss. Zone-redundant storage provides high availability within a region, not cross-region DR.

A company runs a critical application on Azure Virtual Machines in a single availability set. They want to protect against an entire Azure region failure. They need a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes. Which solution should they use?

A

Azure Backup for VMs with geo-redundant backup storage.

B

Azure Site Recovery to another region.

Azure Site Recovery replicates VMs continuously to a secondary region. It can achieve RPO as low as 15 seconds (with app-consistent snapshots) and RTO of minutes (30 minutes is typical). It supports planned and unplanned failover.

C

Deploy VMs in an availability zone within the same region.

D

Use Azure managed disks with geo-replication (LRS to GRS).

Why: Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs to a secondary region. It can meet RTO of 30 minutes and RPO of 15 minutes with continuous replication. Azure Backup offers backup, but restore RTO is typically hours (full VM restore). Availability zones protect against datacenter failures within a region, not a full region outage. Geo-replication for managed disks is for storage redundancy, not for VM state with application-consistent recovery points.

A company runs multiple on-premises workloads that are critical. They need a disaster recovery solution that can replicate workloads to Azure and enable failover in the event of an on-premises outage. The solution must support non-VMware and non-Hyper-V physical servers. Which Azure service should they use?

A

Azure Backup

B

Azure Site Recovery

Azure Site Recovery supports replication of physical servers (and virtual machines) to Azure. It provides failover and test failover capabilities for DR.

C

Azure Migrate

D

Azure Disaster Recovery

Why: Azure Site Recovery (ASR) orchestrates replication, failover, and recovery of on-premises machines to Azure. It supports physical servers through the use of a process server that handles replication. Azure Backup is for backup, not full DR replication with failover. Azure Migrate assists with migration, not ongoing DR. 'Azure Disaster Recovery' is not a distinct service; Azure Site Recovery is the correct service.

A company has several Azure Virtual Machines running Windows Server with critical applications. They need to back up these VMs to a secondary Azure region to protect against regional disasters. The backup must be application-consistent and support file-level restore. Which solution should they implement?

A

Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault

Azure Backup offers VM-level application-consistent backups, supports GRS for cross-region durability, and allows file-level restore from recovery points.

B

Azure Site Recovery

C

Azure Snapshot of managed disks stored in a different region

D

Azure Managed Disk with incremental snapshots and manual cross-region copy

Why: Azure Backup with a Recovery Services vault configured for geo-redundant storage (GRS) provides cross-region backup of Azure VMs. It uses VSS for application-consistent backups and supports file-level restore (e.g., browsing and recovering individual files from a VM backup). Azure Site Recovery is for disaster recovery replication, not backup. Snapshots are not inherently cross-region or application-consistent without additional tooling.

Want more Design business continuity solutions practice?

Practice this domain
4

Domain 4: Design infrastructure solutions

All Design infrastructure solutions questions

A company is designing a hub-spoke network topology in Azure. The hub contains a third-party network virtual appliance (NVA) for inspection. Spokes need to communicate with each other, and all inter-spoke traffic must be routed through the NVA in the hub. Which configuration should they use?

A

Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet

B

Configure Azure Firewall in the hub with forced tunneling to on-premises

C

Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA

Correct. UDRs allow precise control of traffic routing; adding a route for the spoke address spaces with next hop as the NVA IP enforces inspection.

D

Use VNet peering with gateway transit enabled

Why: User-defined routes (UDRs) on the spoke subnets can force traffic destined for other spokes to go through the NVA in the hub. The UDR sets the next hop to the private IP address of the NVA, ensuring inspection.

A company is deploying a web application on Azure App Service. They need to guarantee that all traffic from the internet goes through a Web Application Firewall (WAF) before reaching the app. The solution must be cost-effective for a single application. Which Azure service should they place in front of the App Service?

A

Azure Application Gateway with WAF.

Application Gateway is a regional Layer 7 load balancer that integrates WAF. It can be placed directly in front of App Service to inspect all incoming traffic. This is a cost-effective solution for a single-region application.

B

Azure Front Door with WAF policy.

C

Azure Firewall with application rules.

D

Azure Traffic Manager.

Why: Azure Application Gateway is a regional web traffic load balancer with built-in WAF capability. It is ideal for a single application in one region, providing Layer 7 routing, SSL termination, and WAF at a lower cost than a global solution. Azure Front Door is a global load balancer with WAF, but it is designed for multi-region deployments and comes with additional costs. Azure Firewall does not provide WAF features; it is a stateful firewall. Traffic Manager is a DNS-level load balancer without WAF.

A company has multiple Azure subscriptions and on-premises data centers connected via ExpressRoute. They want to centralize connectivity to the internet and enforce a single web filtering and security policy for all outbound internet traffic from Azure VMs. Which Azure networking architecture should they implement?

A

Use a hub-spoke topology with Azure Firewall in the hub for all outbound traffic.

In a hub-spoke topology, the hub VNet contains shared services like Azure Firewall. Spoke VNets are peered to the hub, and UDRs in each spoke subnet route default internet-bound traffic (0.0.0.0/0) to the firewall. This ensures all outbound traffic is inspected by the firewall, providing centralized filtering.

B

Use a single virtual network for all resources with a network virtual appliance.

C

Use an Azure Virtual WAN with security virtual WAN hub.

D

Use Azure Traffic Manager with Azure Firewall.

Why: A hub-spoke network topology is the recommended pattern for centralizing connectivity and security. By deploying an Azure Firewall in the hub virtual network, all outbound internet traffic from spoke VMs can be forced through the firewall via user-defined routes (UDRs). The firewall can apply consistent web filtering and security policies. Virtual WAN also supports centralized security, but it is typically used when you have many branch sites and need a global mesh. For a single hub with multiple subscriptions, a standard hub-spoke is simpler and more cost-effective.

A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?

A

Azure Virtual Network

B

Azure Virtual WAN

Virtual WAN offers a scalable, managed hub that connects branch offices, Azure VNets, and on-premises resources with automatic routing and integration with ExpressRoute/S2S VPN.

C

Azure ExpressRoute

D

Azure VPN Gateway

Why: Azure Virtual WAN is a managed networking service that provides a hub-and-spoke architecture with built-in routing, connectivity, and security. It automatically handles routing between branch offices, Azure virtual networks, and on-premises networks via ExpressRoute or VPN, simplifying the overall network design.

A company runs a high-performance computing (HPC) workload on Azure that requires extremely low latency (under 10 microseconds) between multiple VMs for MPI communication. The VMs are part of a single job and must be placed together to minimize network latency. Which VM deployment option should they use?

A

Azure Virtual Machine Scale Sets with a Proximity Placement Group

Proximity Placement Groups (PPG) co-locate VMs in the same datacenter region, providing ultra-low latency required for MPI workloads. VMSS allows scaling out while staying in the PPG.

B

Azure Availability Sets

C

Azure Virtual Machine Scale Sets across Availability Zones

D

Azure Kubernetes Service (AKS)

Why: Proximity Placement Groups (PPGs) are used to ensure VMs are placed as close as possible within an Azure datacenter, reducing network latency for HPC workloads. By deploying VMs in a single PPG (e.g., using VMSS with PPG), inter-VM latency can be minimized to meet sub-10 microsecond requirements. Availability Sets ensure high availability by spreading VMs across fault domains, which does not guarantee low latency. Availability Zones place VMs in different physical locations, increasing latency. AKS adds orchestration overhead.

A company is deploying an internal web application on Azure VMs. The application requires SSL offloading, session stickiness, and URL-based routing (e.g., /api/* to one backend, /app/* to another). The solution must operate within a single Azure region and must not be exposed to the public internet. Which Azure load balancing solution should they use?

A

A

B

B

C

C

Azure Application Gateway can be deployed internally (internal Application Gateway) and provides all required features: SSL offloading, session affinity, and URL path-based routing.

D

D

Why: Azure Application Gateway is a Layer 7 load balancer that provides SSL offloading, session affinity (stickiness), and URL path-based routing. It can be deployed as an internal load balancer (internal Application Gateway) for private applications. Azure Front Door is global and public-facing. Traffic Manager is DNS-based and not suitable for internal URL routing. Azure Load Balancer operates at Layer 4 and cannot route based on URL paths.

Want more Design infrastructure solutions practice?

Practice this domain

Frequently asked questions

How many questions are on the AZ-305 exam?

The AZ-305 exam has up to 60 questions and must be completed in 120 minutes. The passing score is 700/1000.

What types of questions appear on the AZ-305 exam?

The AZ-305 exam uses multiple-choice, multiple-select, drag-and-drop, and exhibit-based questions. Exhibit questions show CLI output, network diagrams, or routing tables and ask you to interpret them — exactly the format Courseiva uses.

How are AZ-305 questions organised by domain?

The exam covers 4 domains: Design identity, governance, and monitoring solutions, Design data storage solutions, Design business continuity solutions, Design infrastructure solutions. Questions are weighted by domain — higher-weight domains appear more on your actual exam.

Are these the actual AZ-305 exam questions?

No. These are original exam-style practice questions written against the official Microsoft AZ-305 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.

Ready to practice all 60 AZ-305 questions?

Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.