How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the AZ-305 exam, each with detailed explanations and wrong-answer analysis.

How should I approach AZ-305 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft Azure Solutions Architect Expert AZ-305 questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Microsoft Azure Solutions Architect Expert AZ-305 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

AZ-305

exam code

Microsoft

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

A
Enable public IP addresses on all workload VMs
Why wrong: Public IPs increase exposure and are not needed for forced-tunnel outbound inspection.
B
Peer each spoke VNet with the hub VNet
VNet peering provides private connectivity between hub and spokes.
C
Associate a route table to spoke subnets with a default route to the firewall private IP
A UDR forces outbound traffic from spokes through the firewall.
D
Deploy a NAT gateway in every spoke subnet
Why wrong: NAT gateways would bypass the central firewall design for outbound traffic.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related AZ-305 topic practice pages

Design identity, governance, and monitoring solutions practice questions

Design data storage solutions practice questions

Design business continuity solutions practice questions

Design infrastructure solutions practice questions

SAA-C03 VPC practice questions

SAA-C03 S3 lifecycle policy questions

SAA-C03 RDS Multi-AZ questions

SAA-C03 IAM policy practice questions

SAA-C03 Route 53 failover questions

SAA-C03 CloudFront practice questions

SAA-C03 NAT gateway questions

SAA-C03 VPC endpoint questions

Practice scenarios

A company is designing hub-and-spoke networking. Spoke VNets must use a central Azure Firewall for outbound internet traffic. Which two configurations are required?

Which TWO are benefits of using Microsoft Entra ID Governance? (Choose two.)

Which THREE conditions should be met to implement a successful Azure landing zone for a new enterprise subscription? (Choose three.)

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to collect logs from on-premises firewalls and send them to Sentinel. Which TWO connectors can you use? (Choose two.)

Which THREE are valid Azure RBAC role types? (Choose three.)

Your organization uses Azure Monitor to collect metrics from Azure resources. You need to create a custom metric alert that triggers when the average CPU usage of a specific virtual machine exceeds 80% for 10 minutes. Which TWO components are required? (Choose two.)

Which TWO features of Microsoft Entra ID help protect against credential compromise? (Choose two.)

Which TWO features of Microsoft Entra ID can be used to secure hybrid identities?

Which THREE of the following are required to collect Windows security events into Microsoft Sentinel?

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that automatically blocks sign-ins from risky users and requires multi-factor authentication (MFA) when a sign-in risk is detected. Which TWO services should you use? (Choose two.)

Your company uses Microsoft Entra ID. You need to implement a privileged identity management (PIM) strategy to secure administrative roles. Which TWO capabilities does PIM provide? (Choose two.)

Which THREE Azure services or features should you use to design a comprehensive monitoring solution for a hybrid infrastructure spanning on-premises and Azure?

Which TWO Azure Policy effects can be used to prevent the creation of non-compliant resources?

Your company is planning to use Azure Monitor Workbooks to create custom dashboards for IT operations. You need to select the data sources that can be used in a workbook. Which TWO data sources are supported? (Choose two.)

Which THREE components are required to monitor and audit Azure resource changes using Azure Monitor?

Your company uses Microsoft Entra ID. You need to implement a governance strategy for guest users. Which TWO actions should you take? (Choose two.)

Which TWO features are part of Microsoft Entra ID Governance? (Choose two.)

Your company uses Microsoft Entra ID for identity management. You need to design a monitoring solution for sign-in logs to detect suspicious activity. Which TWO Azure services should you include in the design?

Which THREE of the following are best practices for designing a data storage solution using Azure Cosmos DB?