Free AZ-305 practice test: 20 questions
Twenty design scenarios across the four AZ-305 skill areas, weighted roughly as the real exam is: five on identity, governance and monitoring, four on data storage, four on business continuity and seven on infrastructure. These are original scenario questions. Find the deciding requirement in each scenario before you look at the options.
Design identity, governance, and monitoring solutions
Question 1. A web app on App Service must read database credentials from Key Vault. Security forbids secrets in app settings and wants no credential rotation by the team. What should you recommend?
- A. A service principal whose client secret is kept in app settings
- B. A connection string stored in app settings
- C. A system-assigned managed identity with a Key Vault role assignment
- D. A storage account key kept in a configuration file
Show answer
Answer: C
Enabling a managed identity on the app and granting it access to the vault removes any stored credential. A service principal with a secret needs storage and rotation. A connection string in app settings is the secret the policy forbids. A storage key does not authenticate to Key Vault.
Want more questions like this? Full AZ-305 practice tests →
Question 2. A consumer app must let customers sign up and sign in with their own social accounts and email, with no accounts created by your helpdesk. Which identity approach should you recommend?
- A. Create a workforce Entra ID account for each customer
- B. Use the Microsoft Entra external identity service for customers
- C. Invite each customer as a B2B guest from a partner tenant
- D. Synchronise customer accounts with Entra Connect
Show answer
Answer: B
The customer-facing external identity service supports self-service sign-up and social providers for customers. Workforce Entra ID accounts for every customer would need helpdesk creation and licensing. B2B guests are for partner staff. Entra Connect synchronises on-premises accounts, which customers do not have.
Want more questions like this? Full AZ-305 practice tests →
Question 3. A company must guarantee that no team in any of its 30 subscriptions can deploy resources outside West Europe and North Europe, and must stay compliant as subscriptions are added. What should you recommend?
- A. Assign an allowed-locations policy with Deny at a management group above all subscriptions
- B. Assign an allowed-locations policy with Audit at each subscription
- C. Tag each subscription with its approved regions
- D. Ask team leads to avoid other regions
Show answer
Answer: A
An allowed-locations policy with Deny effect assigned at a management group inherited by all subscriptions blocks deployments elsewhere and covers new subscriptions. Per-subscription assignment needs repeat work. Audit only reports. Tags do not restrict region.
Want more questions like this? Full AZ-305 practice tests →
Question 4. Employees need access from the internet to an internal web application hosted on-premises. The company will not open inbound firewall ports or build a VPN for it, and wants Entra authentication in front. What should you recommend?
- A. A point-to-site VPN for every user
- B. Place the server on a public IP address
- C. Azure Bastion
- D. Microsoft Entra application proxy with a connector
Show answer
Answer: D
Microsoft Entra application proxy publishes an internal web app through an outbound connector, so no inbound ports are opened, and enforces Entra sign-in and Conditional Access. Point-to-site VPN gives network access, which was ruled out. A public IP on the server exposes it. Bastion is for admin access to VMs.
Want more questions like this? Full AZ-305 practice tests →
Question 5. Resource logs from Azure services must be sent continuously to a third-party SIEM that reads from Event Hubs. What should you configure?
- A. A Log Analytics workspace with a long retention period
- B. A diagnostic setting that streams logs to an event hub
- C. A storage account that receives the logs
- D. An action group that emails the SIEM team
Show answer
Answer: B
A diagnostic setting can stream resource logs to an event hub, which the SIEM consumes. A Log Analytics workspace alone does not push data to an external tool. A storage account archives logs but does not stream. An action group notifies people or runs actions on alerts, not log forwarding.
Want more questions like this? Full AZ-305 practice tests →
Design data storage solutions
Question 6. An existing SQL Server application uses SQL Agent jobs and cross-database queries. The company wants a managed service with minimal code changes and no VM administration. What should you recommend?
- A. Azure SQL Managed Instance
- B. A single Azure SQL database
- C. SQL Server on an Azure VM
- D. Azure Cosmos DB
Show answer
Answer: A
SQL Managed Instance offers near-complete SQL Server compatibility, including SQL Agent and cross-database queries, as a managed service. A single Azure SQL database lacks those instance-level features. SQL Server on a VM is not minimal administration. Cosmos DB would require rewriting the application.
Want more questions like this? Full AZ-305 practice tests →
Question 7. A new SaaS product has 500 small databases, each with a different, unpredictable peak. The team wants to avoid paying for every database's peak. What should you recommend?
- A. Provision each database for its own peak
- B. Move every database to Hyperscale
- C. Place the databases in an elastic pool
- D. Merge all tenants into one database
Show answer
Answer: C
An elastic pool shares a set of resources across many databases whose peaks do not coincide, which costs less than sizing each separately. Sizing each for peak wastes money. Hyperscale is for very large single databases. A single large database cannot isolate tenants as cleanly.
Want more questions like this? Full AZ-305 practice tests →
Question 8. Several on-premises and cloud sources must be copied into a data lake every night, with transformations, scheduling and monitoring, using a managed service with connectors. What should you recommend?
- A. Azure Event Hubs
- B. Azure Cache for Redis
- C. Azure Files
- D. Azure Data Factory
Show answer
Answer: D
Azure Data Factory orchestrates scheduled data movement and transformation with many connectors and monitoring. Event Hubs ingests streaming events rather than scheduled copies. Azure Cache for Redis is a cache. Azure Files stores files and does not orchestrate pipelines.
Want more questions like this? Full AZ-305 practice tests →
Question 9. A company is replacing a Windows file server. Branch offices need fast local access to frequently used files while all data is stored centrally in Azure. What should you recommend?
- A. Blob Storage with the hot tier
- B. Azure Files with Azure File Sync
- C. A managed disk on a VM in each branch
- D. An Azure Data Box at each branch
Show answer
Answer: B
Azure Files with Azure File Sync keeps the full share in Azure and caches hot files on local Windows servers. Blob Storage alone has no SMB cache at the branch. A managed disk is attached to one VM. A Data Box is for one-off transfer, not ongoing access.
Want more questions like this? Full AZ-305 practice tests →
Design business continuity solutions
Question 10. Azure VMs in West Europe must be recoverable in another region with an RPO of 5 minutes and an RTO of 1 hour after a regional outage. What should you recommend?
- A. Azure Site Recovery with replication to a paired region
- B. Azure Backup with a daily schedule
- C. Manual disk snapshots stored in the same region
- D. An availability set
Show answer
Answer: A
Site Recovery replicates VMs continuously to another region and fails them over with recovery plans, meeting a short RPO and RTO. Daily backup gives an RPO of up to a day. Snapshots on local disks vanish with the region. Availability sets protect within a datacenter only.
Want more questions like this? Full AZ-305 practice tests →
Question 11. An Azure SQL database must keep working through the loss of one datacenter in its region, with no application changes and no failover to another region. What should you recommend?
- A. Active geo-replication to another region
- B. Long-term backup retention
- C. The zone-redundant configuration of the database
- D. The serverless compute tier
Show answer
Answer: C
A zone-redundant configuration places replicas in several availability zones and fails over automatically inside the region. A geo-secondary protects against regional loss and needs failover. Long-term retention is a backup feature. Serverless compute affects cost, not resilience.
Want more questions like this? Full AZ-305 practice tests →
Question 12. A storage account holds blobs that users sometimes overwrite or delete by mistake. The business wants to restore earlier versions without restoring the entire account. What should you recommend?
- A. Change redundancy to GRS
- B. Change redundancy to ZRS
- C. Enable the archive tier for all blobs
- D. Enable blob versioning and soft delete
Show answer
Answer: D
Blob versioning keeps earlier versions of overwritten or deleted blobs, together with soft delete, so individual items can be restored. GRS replicates mistakes to the secondary. Moving to ZRS adds datacenter resilience, not recovery from mistakes. A larger account does not protect data.
Want more questions like this? Full AZ-305 practice tests →
Question 13. SQL Server runs inside an Azure VM. The business needs application-consistent backups with transaction log backups for point-in-time restore. Which solution should you recommend?
- A. A Backup vault with a disk backup policy
- B. Azure Backup for SQL Server in the VM, using a Recovery Services vault
- C. A scheduled snapshot of the OS disk
- D. Azure Site Recovery replication only
Show answer
Answer: B
Azure Backup for SQL Server in an Azure VM, using a Recovery Services vault, takes full, differential and log backups for point-in-time restore. A Backup vault is not used for SQL in VMs. Disk snapshots alone are crash-consistent. Site Recovery replicates VMs but does not provide database log backups.
Want more questions like this? Full AZ-305 practice tests →
Design infrastructure solutions
Question 14. A single-region web app inside a virtual network needs layer 7 load balancing, URL-path routing and a web application firewall. What should you recommend?
- A. Azure Application Gateway with WAF
- B. Azure Front Door
- C. Azure Traffic Manager
- D. Azure Load Balancer
Show answer
Answer: A
Application Gateway is a regional layer 7 load balancer with path-based routing and WAF. Front Door is global, which is unnecessary for one region. Traffic Manager is DNS-only. A standard Load Balancer is layer 4 and cannot route by URL path.
Want more questions like this? Full AZ-305 practice tests →
Question 15. A company has 60 branch offices and three Azure regions. It wants automated any-to-any connectivity between branches and virtual networks with minimal routing administration. What should you recommend?
- A. A full mesh of virtual network peerings
- B. One VPN Gateway per branch connected by hand
- C. Azure Virtual WAN
- D. Azure Traffic Manager
Show answer
Answer: C
Azure Virtual WAN provides managed hub connectivity with transitive routing between branches and virtual networks. Manual peerings are not transitive and do not scale. Individual VPN gateways add administration. Traffic Manager does not connect networks.
Want more questions like this? Full AZ-305 practice tests →
Question 16. An application in a virtual network must reach a storage account over a private IP address, with public network access disabled on the account. What should you recommend?
- A. A service endpoint on the subnet
- B. A private endpoint for the storage account
- C. A public IP address on the VM
- D. A NAT gateway on the subnet
Show answer
Answer: B
A private endpoint gives the storage account a private IP in your virtual network, so traffic stays private and public access can be disabled. A service endpoint still uses the public endpoint. A public IP on the VM does not secure access. A NAT gateway handles outbound internet traffic.
Want more questions like this? Full AZ-305 practice tests →
Question 17. A company wants to give partners access to its internal APIs with subscription keys, rate limits and a developer portal, without changing the backend services. What should you recommend?
- A. Azure Event Grid
- B. Azure Service Bus
- C. Azure Cache for Redis
- D. Azure API Management
Show answer
Answer: D
API Management sits in front of backend APIs and supplies subscription keys, throttling policies and a developer portal. Event Grid routes events. Service Bus is for messaging. Azure Cache for Redis stores data in memory.
Want more questions like this? Full AZ-305 practice tests →
Question 18. A catalogue service repeatedly reads the same product data from a database, causing high load and latency. The data changes a few times an hour. What should you recommend?
- A. Azure Cache for Redis in front of the database
- B. Increase the database storage size
- C. Azure Service Bus topics
- D. Azure Site Recovery
Show answer
Answer: A
Azure Cache for Redis keeps hot data in memory, cutting latency and database load, with expiry controlling staleness. Larger storage does not reduce read load. Service Bus delivers messages and does not cache. Site Recovery is a DR service.
Want more questions like this? Full AZ-305 practice tests →
Question 19. A company must move an on-premises SQL Server database to Azure SQL Managed Instance with minimal downtime, keeping the source online until cutover. What should you recommend?
- A. Stop the source and restore a backup
- B. Use Azure Data Box to ship the data files
- C. Azure Database Migration Service in online mode
- D. Copy the data files over the network by hand
Show answer
Answer: C
Azure Database Migration Service in online mode continuously syncs changes so cutover downtime is brief. A backup and restore with the source stopped means longer downtime. Data Box moves bulk files, not live database sync. Copying data files manually is not a supported online method.
Want more questions like this? Full AZ-305 practice tests →
Question 20. An image-processing step runs for a few seconds whenever a blob is uploaded. Volume is low and unpredictable, and the team wants to pay per execution with no servers to manage. What should you recommend?
- A. A virtual machine running a polling script
- B. Azure Functions with a blob trigger
- C. A permanently running AKS cluster
- D. An App Service plan with a continuous WebJob
Show answer
Answer: B
Azure Functions with a blob trigger runs code only when a file arrives and bills per execution on a consumption-style plan. A dedicated VM bills all the time. A permanently running AKS cluster adds cost and administration. An always-on App Service plan bills continuously.
Want more questions like this? Full AZ-305 practice tests →
How did you do?
Sixteen or more correct suggests you are close. Below fourteen, the domain guides in this section are the fastest way to find the gaps. Questions 14 to 20 cover infrastructure, the largest domain: if you missed more than two, work through the infrastructure guide next. Questions 1 to 5 cover the second largest, so weak results there point to the identity, governance and monitoring guide.
Look at the wrong answers by type. If you chose a real service for the wrong requirement, you need the comparison tables in the cheat sheet. If you ran out of time, practise reading for the constraint first, as described in the exam tips.
Repeat the free Microsoft practice assessment afterwards. If both results point at the same domain, you know where your remaining time should go.