AZ-305 practice questions

Q: Is this AZ-305 practice test free?

Yes. All 15 AZ-305 practice questions on this page are free, with instant scoring and a written explanation for each answer. You do not need an account and there is no time limit.

Q: How much does the real AZ-305 exam cost?

The official price is $165. Cyber VK sells the same official AZ-305 voucher for $44.99 — a saving of $120.01. The voucher is identical to one bought direct and is emailed within minutes of payment.

Q: Are these questions the same as the real AZ-305 exam?

No. These are original practice questions written to match the published exam objectives and difficulty. They are not real exam questions — sharing or reproducing live exam content breaches every certification body's candidate agreement and can void your certification.

Q: How should I use this practice test?

Use it as a readiness check rather than a study tool. Work through the questions without notes, read the explanation for every answer including the ones you got right, and treat any domain where you miss more than a third as the area to revise before booking your exam.

Question 1

A company wants to ensure that every resource deployed to its Azure subscriptions is tagged with a CostCenter value and that no virtual machine can be created outside of the West Europe and North Europe regions. Which Azure service should the architect recommend to enforce these standards and report on compliance?

Accepted Answer

Azure Policy evaluates resources against rules at creation time and on an ongoing basis, so it can both deny non-compliant deployments and report compliance state. RBAC controls who can act, not what properties a resource must have.

Question 2

An organization requires that administrators hold the Contributor role on production subscriptions only while working an approved change ticket, with approval and an audit trail for every activation. Which solution meets the requirement with the least administrative effort?

Accepted Answer

PIM provides just-in-time, time-bound role activation with approval workflows, MFA enforcement, and an activation audit log built in. Conditional Access strengthens sign-in but leaves the privileged role permanently assigned.

Question 3

A managed service provider must let its own engineers manage resources in 60 customer Microsoft Entra tenants from a single console, without creating guest accounts in each customer tenant and without customers granting standing access. What should the architect recommend?

Accepted Answer

Azure Lighthouse projects customer subscriptions and resource groups into the provider's tenant, so provider identities and PIM policies are used without guest accounts in the customer directories. B2B would require managing 60 sets of guest identities.

Question 4

Scanned invoice images must be retained in Azure Blob Storage for seven years. They are rarely read after the first month, but when auditors request one it must be retrievable within milliseconds. Which access tier minimizes storage cost while meeting the retrieval requirement?

Accepted Answer

Cool (and Cold) tiers lower storage cost for infrequently accessed data while keeping blobs online for immediate read access. Archive is offline and requires a rehydration operation that takes hours.

Question 5

A globally distributed Azure Cosmos DB for NoSQL account backs a shopping cart service. Each user must always read their own most recent writes, even when routed to a different region, but the design must keep write latency and RU cost as low as possible. Which consistency level should be selected?

Accepted Answer

Session consistency guarantees read-your-own-writes within a client session at far lower latency and RU cost than Strong or Bounded staleness. Consistent prefix only guarantees ordering, not that a user sees their own latest write.

Question 6

An OLTP database must grow to 40 TB, support up to 4 read-scale replicas, and be restorable to any point in the last 7 days within minutes regardless of database size. Which Azure SQL Database service tier should the architect choose?

Accepted Answer

Hyperscale supports databases up to 128 TB and uses snapshot-based backups, so restore time is largely independent of database size, plus it offers multiple named read replicas. Business Critical is capped at 4 TB, well below the requirement.

Question 7

A company runs line-of-business applications on Azure virtual machines in East US and needs the ability to fail those VMs over to West US during a regional outage. Which Azure service should be used?

Accepted Answer

Azure Site Recovery continuously replicates VM disks to a secondary region and orchestrates failover and failback with recovery plans. Azure Backup protects data for restore but is not a regional failover orchestration service.

Question 8

A reporting application stores files in a general-purpose v2 storage account. The design must survive the loss of a single datacenter in the primary region, survive a full regional outage, and allow the reporting tier to read the replicated copy directly during normal operation. Which redundancy option should be selected?

Accepted Answer

RA-GZRS writes three zone-redundant copies in the primary region and asynchronously replicates to a secondary region that is readable at any time. Plain GRS protects the region but keeps the secondary inaccessible until a failover.

Question 9

An application uses a single Azure SQL Database. The business requires that a regional outage trigger failover without changing the application's connection string, and that the secondary be usable for reporting queries beforehand. What should the architect design?

Accepted Answer

Auto-failover groups add listener endpoints that redirect automatically to whichever server is primary, so connection strings stay constant, and the read-only listener serves reporting from the secondary. Active geo-replication alone provides no stable listener endpoint.

Question 10

A solution must run a short piece of code each time a message lands on an Azure Service Bus queue, with billing based only on executions and resource consumption. Which compute option should the architect recommend?

Accepted Answer

The Consumption plan bills per execution and per GB-second and scales automatically from zero using the Service Bus trigger. The other options keep compute provisioned and billed even when no messages arrive.

Question 11

A data science team submits containerized jobs that run for 10 to 20 minutes, run a few times per day, and require no service discovery, ingress, or orchestration features. The team wants per-second billing and the least operational overhead. Which compute service fits best?

Accepted Answer

Azure Container Instances runs single containers on demand with per-second billing and no cluster to operate, which suits short, infrequent jobs. AKS and OpenShift add cluster management overhead that this workload does not justify.

Question 12

A regulated customer must host an ASP.NET application on a fully isolated, single-tenant PaaS platform deployed into its own virtual network subnet, with all inbound traffic arriving only from an internal load balancer and no public endpoint. Which design should the architect choose?

Accepted Answer

App Service Environment v3 deploys dedicated, single-tenant App Service infrastructure into a customer subnet and supports an internal VIP so the apps are reachable only from private networks. Premium v3 with private endpoints is still multitenant infrastructure.

Question 13

An architect must allow virtual machines in a virtual network to reach an Azure Storage account over a private IP address from the VNet's own address space, with no traffic traversing the public internet. What should be deployed?

Accepted Answer

A private endpoint places a NIC with a private IP from the VNet into the subnet and maps it to the storage account through Azure Private Link. Service endpoints keep the public IP of the service and only optimize routing and access control.

Question 14

A public web platform is deployed to App Service in three regions. The design must route users to the closest healthy region, terminate TLS and cache static content at the edge, route /api/* to a different backend pool than /*, and block OWASP Top 10 attacks. Which service should be placed in front of the backends?

Accepted Answer

Front Door Premium is a global layer 7 service that combines anycast latency-based routing, edge TLS termination and caching, path-based routing rules, and an integrated WAF. Traffic Manager is DNS-only and cannot inspect paths or cache content.

Question 15

In a hub-and-spoke topology, all spoke-to-spoke and spoke-to-internet traffic must pass through a third-party network virtual appliance in the hub. The NVA already advertises routes via BGP, and the team wants spokes to learn those routes dynamically instead of maintaining user-defined routes on every subnet. What should the architect add to the hub virtual network?

Accepted Answer

Azure Route Server exchanges BGP routes with the NVA and injects them into the VNet's route tables, and spokes configured with "use remote gateway" inherit those routes without manual UDRs. Static route tables would meet the routing goal but not the dynamic-learning requirement.

AZ-305 — AZ-305 Microsoft Azure Solutions Architect Expert Exam Voucher Practice Test

Free Practice Test

AZ-305 practice test — common questions