AZ-305 Exam Flashcards

Q: What is the AZ-305 passing score?

AZ-305 requires a scaled score of 700 out of 1000. Microsoft converts your raw number of correct answers onto this 1-1000 scale, so the exact count of questions you must get right varies slightly by exam form. The exam typically includes 40-60 questions to complete in 120 minutes.

Q: Do I need AZ-104 before taking AZ-305?

You can schedule AZ-305 without holding AZ-104, but Microsoft will not award the Azure Solutions Architect Expert certification until you also pass AZ-104 (Azure Administrator Associate). Most candidates earn AZ-104 first, since AZ-305's design questions assume the hands-on implementation knowledge AZ-104 tests.

Q: What is the AZ-305 pass rate?

Microsoft does not publish official pass-rate statistics for AZ-305 or any of its certification exams. Community estimates for well-prepared candidates with hands-on Azure experience run roughly 60-70%, but treat these as informal estimates rather than official figures.

Q: What is the AZ-305 retake policy?

After a first failed attempt, you must wait 24 hours before retaking AZ-305. A second failure requires a 14-day wait, and that 14-day wait applies to each attempt after that as well. Microsoft caps candidates at 5 attempts within any rolling 12-month period.

Q: How is the AZ-305 exam weighted across domains?

Following the April 2026 update, AZ-305 measures four domains: Design Identity, Governance, and Monitoring Solutions (25-30%), Design Data Storage Solutions (20-25%), Design Business Continuity Solutions (15-20%), and Design Infrastructure Solutions (30-35%). Infrastructure design carries the single largest weight on the exam.

Q: How long should I study for AZ-305?

Most candidates spend 60-100 hours over 7-12 weeks, building on prior hands-on Azure administration experience at roughly the AZ-104 level. Because AZ-305 tests design trade-offs rather than step-by-step configuration, hands-on labs across networking, storage, and identity matter more than memorizing service lists.

Question 1

Management Groups vs. Subscriptions

Accepted Answer

Management groups sit above subscriptions in the hierarchy and let you apply Azure Policy and RBAC consistently across many subscriptions at once. Subscriptions remain the billing and resource boundary. Use management groups when governance rules must span multiple subscriptions the same way.

Question 2

Azure Policy vs. RBAC

Accepted Answer

RBAC controls WHO can perform WHAT actions on resources (access control). Azure Policy controls WHAT configurations are allowed regardless of who is acting (e.g., enforcing allowed regions or SKUs). A complete governance design uses both together, not one instead of the other.

Question 3

Azure Policy 'Deny' vs 'Audit' effect

Accepted Answer

Deny blocks a non-compliant resource from being created or updated at all. Audit lets the action proceed but flags it as non-compliant in reporting. Use Audit first to see impact, then switch to Deny once you're confident it won't break legitimate deployments.

Question 4

Privileged Identity Management (PIM)

Accepted Answer

Grants just-in-time, time-bound activation of privileged roles instead of standing (always-on) access, with approval workflows and periodic access reviews. This shrinks the attack surface of admin accounts compared to permanently assigned roles.

Question 5

Conditional Access vs. Identity Protection

Accepted Answer

Conditional Access enforces policies (require MFA, block by location, require compliant device) based on defined conditions. Identity Protection detects risk signals (leaked credentials, atypical travel) and can feed that risk score into Conditional Access to trigger an automatic response.

Question 6

Hybrid identity: Password Hash Sync vs. Pass-through Authentication vs. Federation

Accepted Answer

Password Hash Sync (PHS) syncs a hash of the on-prem password hash to Microsoft Entra ID for the simplest cloud sign-in. Pass-through Authentication validates the password against on-prem AD in real time without storing hashes in the cloud. Federation (AD FS) delegates authentication entirely to an on-prem identity provider. Complexity and control both increase down that list.

Question 7

Emergency access (break-glass) accounts

Accepted Answer

Cloud-only admin accounts kept explicitly excluded from every Conditional Access and MFA policy, so the organization is never locked out of Microsoft Entra ID if MFA or on-prem federation fails. Their credentials and sign-ins must be monitored closely since they bypass normal controls.

Question 8

Key Vault access model: vault access policies vs. Azure RBAC

Accepted Answer

Vault access policies grant permissions at the whole-vault level with limited granularity. Azure RBAC on Key Vault allows scoped permissions down to individual keys, secrets, or certificates and integrates with the standard Entra ID role model. Microsoft recommends RBAC for new designs.

Question 9

Enforced tagging strategy at scale

Accepted Answer

Consistent tags (cost center, environment, owner) enable chargeback, automation, and Policy targeting. Without an Azure Policy that enforces required tags, tagging discipline erodes as the estate grows, breaking cost reports and automated governance that depend on those tags.

Question 10

Azure Monitor Metrics vs. Logs

Accepted Answer

Metrics are lightweight, near-real-time numeric time series, best for threshold alerting (e.g., CPU%). Logs, queried in Log Analytics with KQL, are structured event data better suited to deep diagnostics and correlating activity across many resources. Design alerting on metrics and root-cause investigation on logs.

Question 11

Log Analytics workspace design: centralized vs. per-team

Accepted Answer

One centralized workspace simplifies cross-resource KQL queries and alerting but mixes data-ownership and access boundaries. Separate per-team or per-subscription workspaces isolate access and cost but complicate cross-cutting queries. Choose based on RBAC and data-residency needs, not convenience alone.

Question 12

Application Insights vs. platform-level Azure Monitor

Accepted Answer

Application Insights instruments application code for distributed tracing, dependency maps, and exception telemetry. Platform-level Azure Monitor metrics and logs cover the infrastructure the app runs on. A complete design needs both to tell whether a problem is in the code or the platform.

Question 13

Azure Service Health vs. Azure Monitor alerts

Accepted Answer

Service Health reports Microsoft-side incidents, planned maintenance, and health advisories affecting the Azure services in your subscriptions. Monitor alerts fire on your own resource metrics and logs. Wire both into the same action group so you can distinguish 'my app broke' from 'Azure broke'.

Question 14

Blob storage access tiers: Hot vs. Cool vs. Cold vs. Archive

Accepted Answer

Tiers trade storage cost against access/retrieval cost and latency: Hot for frequent access, Cool/Cold for infrequent access with minimum-duration charges, Archive for rarely accessed data with retrieval taking hours. Lifecycle management policies can automate tier transitions based on last-access age.

Question 15

LRS vs. ZRS vs. GRS vs. RA-GRS

Accepted Answer

LRS keeps 3 copies in one datacenter (cheapest, no datacenter-failure protection). ZRS spreads copies across availability zones in one region (survives a datacenter outage). GRS asynchronously replicates to a paired region (survives a regional outage, secondary not readable until failover). RA-GRS adds read access to that secondary at any time.

Question 16

Azure Files vs. Blob Storage for shared access

Accepted Answer

Azure Files exposes SMB/NFS file shares that can be mounted like a traditional file server, which is friendly to lift-and-shift apps. Blob Storage is object storage accessed via REST/SDK and isn't natively mountable as a drive without extra tooling. Pick Files whenever an app expects a real file system.

Question 17

Storage redundancy and data-residency requirements

Accepted Answer

GRS and GZRS replicate to a Microsoft-paired region that can sit in a different jurisdiction. When regulation requires data to stay in-country, restrict the account to LRS or ZRS within that single region rather than defaulting to geo-redundant options for 'extra safety'.

Question 18

Managed disks: Standard SSD vs. Premium SSD vs. Ultra Disk

Accepted Answer

Standard SSD suits general-purpose or dev/test workloads. Premium SSD targets production VMs needing consistent low latency. Ultra Disk offers independently configurable IOPS and throughput for the most demanding workloads (e.g., SAP HANA) but has tighter region and VM-size availability constraints.

Question 19

Immutable blob storage (WORM policies)

Accepted Answer

Time-based retention or legal-hold policies make blobs Write-Once-Read-Many, so data can't be modified or deleted by anyone, including the account owner, until the retention period expires. This is a regulatory/compliance-archiving control, distinct from ordinary backup.

Question 20

Private endpoints vs. service endpoints for storage

Accepted Answer

A private endpoint gives the storage account a private IP inside your VNet, removing it from the public internet path entirely. A service endpoint keeps the account's public IP but routes traffic over the Azure backbone and restricts access by VNet/subnet. Private endpoints give the stronger isolation and support on-prem access over VPN/ExpressRoute.

Question 21

Azure SQL Database vs. SQL Managed Instance

Accepted Answer

SQL Database is a PaaS single-database/elastic-pool service without full SQL Server instance surface area (no cross-database queries, no SQL Agent). Managed Instance offers near-complete SQL Server compatibility (cross-db queries, linked servers, SQL Agent), which lift-and-shift migrations needing instance-scoped features require.

Question 22

Failover groups vs. active geo-replication (Azure SQL)

Accepted Answer

Failover groups add automatic failover behind a listener endpoint, so the application's connection string doesn't change after failover. Active geo-replication gives up to 4 readable secondaries but requires manual failover and updating the app's endpoint yourself. Prefer failover groups when failover must be automatic.

Question 23

Cosmos DB consistency levels

Accepted Answer

Five levels trade consistency for latency/throughput, from strongest to weakest: Strong, Bounded Staleness, Session (default, consistent within one client session), Consistent Prefix, and Eventual. Pick the weakest level the application can tolerate to maximize performance and reduce cost.

Question 24

Cosmos DB partition key design

Accepted Answer

A well-chosen partition key spreads reads and writes evenly and keeps related data together to avoid cross-partition queries. A poorly chosen key (low cardinality or 'hot' values) causes throttling on specific partitions no matter how much throughput (RU/s) is provisioned overall.

Question 25

Transparent Data Encryption (TDE) vs. Always Encrypted

Accepted Answer

TDE encrypts the database at rest, so storage and backup files are unreadable outside SQL Server, but data is decrypted for any authorized query. Always Encrypted keeps sensitive columns encrypted even in memory and query results, so not even a DBA with full server access sees plaintext.

Question 26

RTO vs. RPO

Accepted Answer

RPO is the maximum acceptable data loss, measured in time — how far back your last good backup or replica sits. RTO is the maximum acceptable downtime to restore service. A design can have a good RPO (frequent backups) but a bad RTO (slow restore process), so size each independently.

Question 27

Availability Zones vs. Availability Sets

Accepted Answer

Availability Zones spread VMs across physically separate datacenters within a region, protecting against datacenter-level failure with a 99.99% SLA. Availability Sets spread VMs across fault/update domains inside a single datacenter, protecting only against rack or host failure with a 99.95% SLA.

Question 28

Azure Site Recovery (ASR) replication

Accepted Answer

ASR continuously replicates VM disk writes to a target region or on-prem site asynchronously, giving a regional failover a small RPO (seconds to minutes) without running duplicate compute in the target region until failover is actually triggered — far cheaper than an always-on active-active design.

Question 29

Azure Backup vs. Azure Site Recovery

Accepted Answer

Azure Backup protects against DATA loss, corruption, or ransomware by retaining point-in-time recoverable copies. Azure Site Recovery protects against SITE or region unavailability by keeping a replicated, failover-ready copy of the whole VM. A complete BC/DR design typically needs both, not one instead of the other.

Question 30

Load Balancer SKU for HA: Basic vs. Standard

Accepted Answer

Standard Load Balancer supports Availability Zones (zone-redundant or zonal frontends) and is secure-by-default, blocking traffic unless an NSG explicitly allows it. Basic Load Balancer has no zone awareness or SLA and is being retired, so new HA designs should always specify Standard.

Question 31

Backup soft-delete and immutability for ransomware resilience

Accepted Answer

Soft-delete retains deleted backup data for a recovery window even if an attacker or admin deletes it. Combined with immutable vault settings that block disabling soft-delete or shortening retention, this stops backups from being wiped out as part of a ransomware attack on the account.

Question 32

Paired regions and platform maintenance

Accepted Answer

Azure sequences platform updates so paired regions are never updated at the same time, and prioritizes recovery of one region in a pair during a broad outage. That's a reason to target a paired region for GRS or ASR rather than an arbitrary secondary region.

Question 33

Active-active vs. active-passive multi-region DR

Accepted Answer

Active-active runs full production capacity in two regions simultaneously for near-zero RTO/RPO, at roughly double the cost and with data-sync/conflict handling to design for. Active-passive keeps a scaled-down or cold standby region to cut cost, accepting a longer RTO while it scales up during failover.

Question 34

VNet peering vs. VPN Gateway (Azure-to-Azure)

Accepted Answer

VNet peering connects two VNets over the Microsoft backbone with low latency and no gateway charge, but no built-in encryption and no transitive routing by default. A VPN Gateway (or Virtual WAN) encrypts traffic and can support hub-spoke transitive routing, at added cost and latency.

Question 35

Site-to-Site VPN vs. ExpressRoute

Accepted Answer

A VPN Gateway connects over the public internet with IPsec encryption at lower, variable-latency cost. ExpressRoute is a private, dedicated connection through a connectivity provider offering higher, more predictable bandwidth and latency without traversing the public internet — the standard for enterprise hybrid connectivity at scale.

Question 36

Network Security Group (NSG) vs. Azure Firewall

Accepted Answer

NSGs are stateless 5-tuple packet filters applied at the subnet or NIC level — cheap, basic segmentation. Azure Firewall is a stateful, managed service supporting FQDN filtering, threat intelligence, and centralized logging from a hub VNet. Use NSGs for baseline micro-segmentation and Firewall for centralized, application-aware egress control.

Question 37

Hub-and-spoke topology

Accepted Answer

A central hub VNet hosts shared services (firewall, VPN/ExpressRoute gateway, DNS) that spoke VNets peer into, so individual spokes don't each need their own gateway. This centralizes cost, security policy, and connectivity management as the number of workloads grows.

Question 38

Azure Front Door vs. Application Gateway

Accepted Answer

Front Door is a global, Anycast-based Layer 7 load balancer and CDN that routes users to the closest healthy regional backend, suited to multi-region web apps. Application Gateway is a regional Layer 7 load balancer with a Web Application Firewall for traffic within one region. Use Front Door for global routing, App Gateway for regional ingress and WAF.

Question 39

Load Balancer (Layer 4) vs. Application Gateway (Layer 7)

Accepted Answer

Azure Load Balancer distributes TCP/UDP traffic based on IP and port with no awareness of HTTP content. Application Gateway inspects HTTP(S) requests, can route by URL path or host header, terminates SSL, and adds a WAF. Choose Layer 7 whenever routing decisions depend on request content, not just the port.

Question 40

Traffic Manager vs. Front Door

Accepted Answer

Traffic Manager is DNS-based global routing — the client resolves directly to an endpoint IP, so it works for non-HTTP protocols and Microsoft never sees the data path. Front Door proxies actual HTTP(S) traffic through Microsoft's edge, enabling SSL offload, WAF, and caching that DNS-only routing can't provide.

Question 41

Private Link/Private Endpoint vs. public endpoint with IP-firewall rules

Accepted Answer

A private endpoint gives a PaaS service (SQL, Storage, Key Vault, etc.) a private IP inside your VNet so traffic never leaves the Microsoft backbone, and the public endpoint can be disabled entirely. IP-firewall rules on a public endpoint still expose the service to the internet, just restricted by source IP — weaker isolation than Private Link.

Question 42

Azure Bastion

Accepted Answer

Provides browser-based RDP/SSH to VMs over TLS through the Azure portal, without exposing VMs' RDP/SSH ports to the public internet or requiring a jump-box VM you must patch yourself. Removes a common attack surface from VNet design.

Question 43

Dedicated subnets for PaaS integration

Accepted Answer

Services like Azure Firewall, Application Gateway, and VPN/ExpressRoute Gateway each require their own dedicated subnet, some with mandated names (e.g., AzureFirewallSubnet, GatewaySubnet). Subnet design must reserve these upfront since they can't share space with VM subnets or be renamed easily after deployment.

Question 44

App Service Plan tiers and scaling

Accepted Answer

The App Service Plan tier (Basic/Standard/Premium/Isolated) determines available features — custom domains, staging slots, VNet integration, autoscale — and is the compute SKU shared by every app hosted on that plan. Scaling out adds instances behind a built-in load balancer; scaling up changes the SKU for more CPU/RAM per instance.

Question 45

AKS node pools: system vs. user

Accepted Answer

The system node pool runs required Kubernetes system pods (CoreDNS, metrics-server, etc.) and should be kept isolated from application workloads. User node pools run application pods and can use different VM sizes, such as GPU nodes, or scale independently — separating them protects cluster stability from noisy applications.

Question 46

Azure Functions hosting: Consumption vs. Premium vs. Dedicated

Accepted Answer

Consumption scales to zero and bills per execution, but has cold-start latency and a default 5-10 minute timeout. Premium keeps pre-warmed instances (no cold start) and allows VNet integration with longer timeouts. Dedicated runs on an App Service plan's always-on VMs you already pay for. Choose based on latency sensitivity and spare capacity.

Question 47

Virtual Machine Scale Sets (VMSS) vs. manually load-balanced VMs

Accepted Answer

VMSS manages a group of identical VMs as one unit with built-in autoscale rules and safely-orchestrated OS-image rollouts. Manually provisioned VMs behind a load balancer require you to build your own scaling and update orchestration. VMSS is the standard choice whenever a workload needs elastic scale.

Question 48

Service Bus vs. Event Grid vs. Event Hubs

Accepted Answer

Service Bus is a message broker for reliable, ordered, transactional enterprise messaging with queues/topics and dead-lettering. Event Grid is a lightweight, reactive pub/sub service for discrete event notifications (e.g., 'blob created') fanned out to many subscribers. Event Hubs is a high-throughput streaming pipeline for telemetry-scale event ingestion. Match the service to guaranteed delivery, reactive notification, or firehose streaming.

Question 49

Azure Cache for Redis in application architecture

Accepted Answer

Placing a managed Redis cache in front of a database offloads repeated read queries and session-state storage to sub-millisecond in-memory access, cutting database load and latency. It also introduces a cache-invalidation problem — stale data — that the architecture must explicitly handle.

Question 50

Container Apps vs. AKS

Accepted Answer

Container Apps is a serverless container platform (built on Kubernetes and KEDA under the hood) for microservices and event-driven apps without managing cluster infrastructure or the Kubernetes API. AKS gives full Kubernetes control — custom controllers, node-level configuration, CNI choice — at the cost of operating the cluster yourself. Pick Container Apps for Kubernetes-style scaling without the operational burden.

Free AZ-305 Exam Flashcards

Filter by Topic

Jump to Card

About These AZ-305 Flashcards

Topics Covered

Frequently Asked Questions

Azure AZ-305

Explore More Microsoft Azure Certifications

Azure AZ-104

Azure AZ-900

Azure AI-900

Azure DP-700

Microsoft Azure AI App and Agent Developer (AI-103)

Azure AI-102

More From This Family