AZ-305 exam pathFree assessment

AZ-305 Practice Tests That Find and Fix Your Weak Spots

6 practice tests, a 50-question timed simulation, and a free assessment.

Microsoft Certified: Azure Solutions Architect Expert

Find your AZ-305 gaps in 15 minutes.

Learner actions will appear after the current account is confirmed.

Official exam objectives effective Apr 17, 2026
Sample report preview

Preview the output before you study

Take a free assessment, see the decisions costing you points, or confirm where to validate breadth next instead of browsing a generic study list.

Sample readiness result620 / 1000

Know where you stand before another full practice test.

Sample top gapMulti-region resilience design

Targeted repair: Fix a focused gap around failover routing, replicated data, and recovery tradeoffs.

ReportTop gapsPass PlanTargeted repairsUnlocksPractice + Timed Exam
01Answer exam-style questions
02Work your Pass Plan
03Complete the final simulation
Try it

Answer one AZ-305 question

If you miss it, CramHQ identifies the decision you misunderstood, helps you fix it, then checks whether you can apply it in a different scenario.

CramHQ stores satellite telemetry as block blobs. Mission analysts rarely touch data after seven days, but during anomaly reviews they must load any 30-day window from the preceding year into analytics before the next shift. Older data is kept only for audit sampling. Accidental overwrites have occurred. Which recommendation best balances protection, cost, and restore timing?

  1. Use Azure Blob Storage lifecycle management: keep new block blobs in Hot for seven days, move them to Archive after day 90, and use high-priority rehydration; enable blob versioning and soft delete.
  2. Use Azure Blob Storage lifecycle management: keep new block blobs in Hot for seven days, move them to Cool through day 365, then to Archive; enable blob versioning and soft delete.
  3. Use Azure Blob Storage lifecycle management: keep new block blobs in Hot for seven days, move them to Cold through day 365, then to Archive; enable blob versioning and soft delete.
  4. Use Azure Blob Storage lifecycle management: keep new block blobs in Hot for seven days, move them to Cold through day 180, then to Archive; enable blob versioning and soft delete.
Show the explanation

Cold is an online access tier with millisecond access while lowering storage cost for rarely used data. Archive is appropriate only after the one-year review horizon, and versioning plus soft delete protects against overwrite and deletion mistakes.

Try it now

Free AZ-305 practice questions

Eight practice questions from the CramHQ AZ-305 bank, with answers and explanations. No signup needed. When you are ready, start the free assessment. CramHQ ranks your weak spots across the whole exam by the points they cost, and your Pass Plan starts with the costliest.

Question 1 of 8Design Identity, Governance, and Monitoring Solutions

CramHQ's AI lab stores model artifacts in Azure Storage and a database connection value used by batch jobs. Security wants the jobs to read the value without embedding credentials, while storage encryption must use customer-controlled material that is never returned to application code. Which recommendation is best?

  1. Use Azure Key Vault secrets for both the connection value and the storage encryption material; grant access with managed identities.
  2. Use Azure Key Vault secrets for the connection value and Azure Key Vault keys as customer-managed keys for Azure Storage; grant access with managed identities.
  3. Use Azure App Configuration key-values for the connection value and Azure Key Vault secrets as customer-managed keys for Azure Storage; grant access with managed identities.
  4. Use Azure Managed HSM keys for both the connection value and the storage encryption material; grant access with managed identities.
Show answer and explanation

Answer: B

This uses the documented object boundary correctly: the job can retrieve the stored application value, while Azure Storage references a key for encryption operations without returning key material to the job.

If you picked A

Why it is tempting: Key Vault secrets and managed identities sound secure, so using them everywhere can look consistent.

Why it is wrong: Use a Key Vault key, not a Key Vault secret, when Azure Storage needs a customer-managed key for encryption operations.

If you picked C

Why it is tempting: App Configuration can centralize settings, and Key Vault secrets can protect sensitive values, so the pairing can sound like a complete configuration strategy.

Why it is wrong: App Configuration is for application configuration distribution; Azure Storage customer-managed encryption uses a Key Vault key or supported HSM key.

If you picked D

Why it is tempting: Managed HSM keys fit high-control encryption requirements, so using them for both needs can look like stronger security.

Why it is wrong: Use cryptographic key services for key operations, and use secrets for values that application code must retrieve.

Question 2 of 8Design Identity, Governance, and Monitoring Solutions

CramHQ monitors Azure and Azure Arc-enabled plant servers in one Log Analytics workspace. An audit found that regulated production cells need detailed Windows security events, while other cells need only basic health counters. Several plants have metered links, and operations must avoid sending nonrequired guest OS data without losing central analytics. Which recommendation best meets the requirement?

  1. Use Azure Monitor Agent with one workspace transformation data collection rule, collect all guest OS logs from every plant, and drop nonregulated records before table storage.
  2. Use diagnostic settings on each server resource with the audit category group, send logs to the central workspace, and configure workspace retention by plant group.
  3. Use Azure Monitor Agent with separate data collection rules for regulated and standard machine groups, collect only required event logs/counters in each rule, and assign them using Azure Policy.
  4. Use Azure Monitor Agent with one data collection rule assigned to all machines, collect all Windows events and counters, and filter irrelevant records in saved queries.
Show answer and explanation

Answer: C

This applies collection instructions to the actual machines. Because each machine group receives only the event log or counter streams it needs, unnecessary guest OS records are not sent from plants, while analytics remains centralized.

If you picked A

Why it is tempting: Dropping records before table storage sounds like it controls storage cost and compliance exposure.

Why it is wrong: Use source-scoped collection rules when the requirement is to avoid sending nonrequired guest OS data across the network.

If you picked B

Why it is tempting: Diagnostic settings can send Azure resource logs to a Log Analytics workspace, so they can look like a universal logging control.

Why it is wrong: Use Azure Monitor Agent and data collection rules to shape Windows event and performance counter collection from Azure and Arc-enabled servers.

If you picked D

Why it is tempting: Saved queries can hide irrelevant records during analysis, so the workspace may appear cleaner to users.

Why it is wrong: Query filtering changes what you see after ingestion; it does not reduce what was collected or sent from the source.

Question 3 of 8Design Data Storage Solutions

CramHQ runs its collaboration platform on Azure SQL Database. Agency reviewers accept that stored data is protected, but new authorization terms require after-the-fact evidence of which principals touched sensitive datasets and near-real-time escalation when database access behavior becomes unusual. The platform already uses private endpoints and managed identities. Which recommendation best addresses the remaining database protection gap?

  1. Use Always Encrypted with secure enclaves for sensitive columns and store column master keys in Azure Key Vault.
  2. Enable Azure SQL auditing to Log Analytics and Microsoft Defender for SQL alerts integrated with Microsoft Sentinel.
  3. Use Azure SQL Database transparent data encryption with customer-managed keys in Azure Key Vault and enable key rotation.
  4. Restrict Azure SQL Database access to Azure Private Link and require Microsoft Entra authentication with managed identities.
Show answer and explanation

Answer: B

This records database activity for investigation and sends security alerts into operational monitoring. It directly addresses evidence of principal activity and escalation for unusual access behavior.

If you picked A

Why it is tempting: Always Encrypted with secure enclaves sounds strong because it reduces exposure of sensitive values during processing.

Why it is wrong: Use encryption controls to reduce data exposure; use SQL auditing, threat detection, and security-operations integration to prove activity and escalate suspicious behavior.

If you picked C

Why it is tempting: Customer-managed keys and rotation are common compliance controls for stronger control over encryption at rest.

Why it is wrong: Choose customer-managed keys when key ownership or encryption governance is the gap; choose auditing and detection when the gap is access evidence and alerting.

If you picked D

Why it is tempting: Private Link and managed identities are strong Azure SQL access controls and often appear in secure database designs.

Why it is wrong: Network isolation and managed identity reduce who can connect and how credentials are handled; they do not replace audit logs and threat-detection alerts.

Show all 8 practice questions
Question 4 of 8Design Data Storage Solutions

CramHQ's Retail Innovation Lab is modernizing store telemetry. Registers, kiosks, and mobile apps will send millions of timestamped activity records per hour. Fraud detection, inventory forecasting, and experimentation teams must consume the same records independently, pause for code fixes, then reprocess a recent time window without asking producers to resend. Which recommendation best supports this design?

  1. Use Azure Queue Storage with Azure Functions consumers, poison queue handling, and separate queues per analytics team populated by the producers.
  2. Use Azure Service Bus Premium with a topic, one subscription per team, sessions enabled, and dead-letter queues configured for failed processing.
  3. Use Azure Event Grid with a custom topic, one event subscription per team, advanced filters, and retry policy configured for delivery failures.
  4. Use Azure Event Hubs Standard with an event hub partitioned for load, separate consumer groups, and retention covering the period analysts may rerun.
Show answer and explanation

Answer: D

Azure Event Hubs stores events durably for configured retention, and consumer groups let each analytics application maintain its own offset and checkpoint. Paused consumers can resume or reread within retention without producer resubmission.

If you picked A

Why it is tempting: Azure Functions, poison queues, and separate queues sound reliable and scalable for background processing.

Why it is wrong: Use a streaming ingestion service when every analytics team must read the same retained records with its own position.

If you picked B

Why it is tempting: Service Bus topics, sessions, and dead-letter queues provide durable delivery and ordered handling for related messages.

Why it is wrong: Use Service Bus topics for per-subscriber business-message handling; use Event Hubs for high-volume event ingestion with offset-based reading.

If you picked C

Why it is tempting: Event Grid supports custom topics, filtering, retries, and failure handling, which can sound like a complete event pipeline.

Why it is wrong: Use Event Grid to notify subscribers that something happened; use Event Hubs when consumers need to read and replay retained event records.

Question 5 of 8Design Business Continuity Solutions

CramHQ runs a global inference API on AKS and Azure VM Scale Sets. After a routing change, automatic failover appeared healthy, but engineers could not prove which injected disruption caused each metric dip or whether recovery completed before rollback. They need repeatable release-gate tests using Azure-native telemetry across subscriptions in one tenant, avoiding host agents where Azure can trigger the disruption itself. What should the architect recommend?

  1. Create Azure Load Testing tests that ramp traffic during deployment; export results to Log Analytics and correlate server-side metrics with Azure Monitor Application Insights data.
  2. Create Azure Chaos Studio experiments using service-direct faults where supported and AKS Chaos Mesh faults for pods; send Diagnostic settings to Log Analytics and correlate ChaosStudioExperimentEventLogs with Azure Monitor metrics.
  3. Create Azure Chaos Studio experiments using agent-based CPU and memory pressure on all nodes; send Diagnostic settings to Log Analytics and correlate guest performance counters with Azure Monitor metrics.
  4. Create Azure Site Recovery test failovers using recovery plans for each region pair; enable vault diagnostics to Log Analytics and correlate job events with Azure Monitor metrics.
Show answer and explanation

Answer: B

Azure Chaos Studio can run controlled experiments against resources across subscriptions in the same tenant. Its diagnostic logs record experiment, step, branch, action, and target timing, enabling correlation with Azure Monitor health signals.

If you picked A

Why it is tempting: Load tests produce measurable pressure and can export results to monitoring tools, so the telemetry can look like release-gate evidence.

Why it is wrong: For chaos release gates, correlate health metrics with a recorded fault action, target, and time interval.

If you picked C

Why it is tempting: Agent-based CPU and memory pressure are legitimate chaos faults and can create visible failure symptoms.

Why it is wrong: Select the least invasive fault mechanism that matches the target and safety boundary; use service-direct faults where Azure can trigger the disruption without installing an agent.

If you picked D

Why it is tempting: Test failovers and recovery plans produce job events and can appear to validate availability during regional failure scenarios.

Why it is wrong: Fault-injection experiments should validate a specific resiliency hypothesis against controlled disruptions in the running architecture.

Question 6 of 8Design Business Continuity Solutions

CramHQ stores route-camera clips as block blobs. Clips are rarely used after 30 days, but investigators must be able to open any clip immediately for the first 120 days. After that, retrieval within a business day is acceptable. Storage cost must be minimized by using automated movement between storage states. Which recommendation should you make?

  1. Configure Azure Blob Storage lifecycle management to move blobs to the Cold tier after 30 days and to the Archive tier after 120 days.
  2. Configure Azure Blob Storage lifecycle management to move blobs to the Cool tier after 30 days, enable automatic movement to Hot on access, and archive after 120 days.
  3. Configure Azure Blob Storage lifecycle management to move blobs to the Cold tier after 30 days and retain them in the Cold tier for the full retention period.
  4. Configure Azure Blob Storage lifecycle management to move blobs to the Archive tier after 30 days and rehydrate requested blobs with high priority.
Show answer and explanation

Answer: A

The Cold tier is an online tier, so clips remain readable immediately during days 31 through 120. Moving to Archive after 120 days fits the later tolerance for rehydration delay and reduces storage cost.

If you picked B

Why it is tempting: Cool is an online tier, and movement to Hot on access can sound like a performance safeguard.

Why it is wrong: When rare access still requires immediate reads, choose the lowest-cost online tier that satisfies that readiness requirement.

If you picked C

Why it is tempting: Keeping everything in Cold avoids Archive rehydration and seems operationally simpler.

Why it is wrong: After the stated immediate-access window ends, move eligible data to Archive when lower storage cost is the priority and delayed retrieval is allowed.

If you picked D

Why it is tempting: Archive has the lowest storage cost, and high-priority rehydration sounds like it can remove the access delay.

Why it is wrong: Archive is an offline tier; a blob must be rehydrated before it can be read or downloaded.

Question 7 of 8Design Infrastructure Solutions

CramHQ's retail lab runs a pricing-analysis SQL workload for short pilot events. Query latency matters during demonstrations, but the database is unused for several days between pilots; a brief first-request delay after inactivity is acceptable. The team wants to avoid paying for reserved database capacity while preserving predictable relational behavior during active demos. Which recommendation best fits?

  1. Use Azure SQL Database elastic pool in the General Purpose service tier with provisioned vCores shared across lab databases.
  2. Use Azure SQL Database single database in the General Purpose service tier with provisioned compute sized for the pilot-event peak.
  3. Use Azure SQL Database Hyperscale service tier with provisioned compute and scale replicas down between pilot events.
  4. Use Azure SQL Database single database in the General Purpose service tier with the serverless compute tier and auto-pause enabled.
Show answer and explanation

Answer: D

This matches intermittent use because compute can scale with demand and pause after inactivity, reducing charges during idle periods while retaining managed relational database behavior for active demos.

If you picked A

Why it is tempting: Elastic pools sound cost-aware because several databases can share allocated vCores.

Why it is wrong: Use an elastic pool when multiple databases have uneven demand and can share provisioned capacity; use serverless auto-pause when one database has long idle windows and can resume on demand.

If you picked B

Why it is tempting: Sizing provisioned compute for the event peak promises predictable performance while the demo is active.

Why it is wrong: When idle-cost reduction is a stated requirement and wake-up delay is acceptable, choose compute that can scale down or pause instead of fixed peak capacity.

If you picked C

Why it is tempting: Scaling replicas down sounds like reducing cost between events.

Why it is wrong: Select a higher database tier only when its specific capabilities, such as very large database support or read scale-out, match the workload requirement.

Question 8 of 8Design Infrastructure Solutions

CramHQ's Cybersecurity Command Center is consolidating its alert-ingestion microservices. Most services are stateless, but each analytics host must start a telemetry collector before tenant analyzers run; the collector inspects host network and process signals, and analyzers must land only on hosts where that collector is active. The platform team wants the most managed Azure container platform that can enforce this placement reliably. Which recommendation is best?

  1. Use Azure Container Apps with Dedicated workload profiles; run the sensor as a sidecar and assign analyzers to the same workload profile.
  2. Use Azure App Service for Containers with Linux custom containers; package the sensor and analyzers into a multicontainer app and scale out the app.
  3. Use Azure Kubernetes Service with dedicated Linux node pools; deploy the sensor as a privileged DaemonSet and place analyzers by using node labels, taints, and tolerations.
  4. Use Azure Container Instances with a virtual network; run each tenant's sensor and analyzer in one container group and mount Azure Files.
Show answer and explanation

Answer: C

Azure Kubernetes Service exposes native Kubernetes scheduling and node constructs. DaemonSets run a pod on each matching node, and labels, taints, and tolerations can reserve placement for workloads that depend on those nodes.

If you picked A

Why it is tempting: Dedicated workload profiles and sidecars sound close because they provide isolated compute capacity and colocated supporting containers.

Why it is wrong: Use native node scheduling controls when a workload must land only on hosts that satisfy a per-host prerequisite.

If you picked B

Why it is tempting: A multicontainer app keeps related containers together during scale-out, which can look like a placement guarantee.

Why it is wrong: Container colocation inside an app instance is not the same as node-aware scheduling across a host fleet.

If you picked D

Why it is tempting: Container groups share lifecycle and networking, and Azure Files can make stateful support look stronger than a single container.

Why it is wrong: ACI container groups are useful for simple grouped containers, but they do not provide node-aware scheduling or per-host agent coverage.

CramHQ links wrong answers to the mistake behind them. Start with the free assessment, and CramHQ keeps finding your gaps as you practice and adds a repair for each to your Pass Plan.

Start the free AZ-305 assessment

Why study with CramHQ

Make stronger AZ-305 architecture calls.

Start with the free AZ-305 assessment. CramHQ uses your result to rank the next step, explain the decisions that matter, and check you again.

Learner actions will appear after the current account is confirmed.

  1. A clear next step, chosen for you

    The Pass Plan ranks gaps by the points they cost and opens the top repair.

  2. Understand why an answer works

    The reasoning behind the right answer and where the alternatives break.

  3. Prove it on a retest

    A fresh question on the same decision verifies the gap is closed.

  4. Track it on your readiness map

    Strengthened areas change colour; pick the next priority from what is left.

  • Flashcards saved from your repairs
  • Optional hints when you are stuck
  • Timed simulations at exam pace
Exam syllabus

Exam-weighted coverage.

Coverage follows the published AZ-305 skill areas measured as of Apr 17, 2026, so your practice stays aligned.

Design Identity, Governance, and Monitoring Solutions

28%

21 concepts

Design Data Storage Solutions

22%

17 concepts

Design Business Continuity Solutions

18%

11 concepts

Design Infrastructure Solutions

32%

22 concepts

Official Microsoft exam changes

Microsoft exam update history

Changes recorded from official Microsoft exam sources.

Effective Apr 17, 2026Minor updateMicrosoft made a minor update to the AZ-305 audience profile.Integrated by CramHQ

Compared with Skills measured prior to April 17, 2026

Changed

  • The audience profile was updated.
Reviewed. No CramHQ content change was required.

CramHQ completed the AZ-305 update review. The measured skills, objectives, and weights remained unchanged.

View official source
Effective Oct 18, 2024Minor updateMicrosoft updated authentication and authorization solution skills.Integrated by CramHQ

Compared with Skills measured prior to 2024-10-18

Changed

  • Microsoft updated authentication and authorization solution skills.
Updated

CramHQ integrated the AZ-305 update into this course.

View official source
Effective Jan 22, 2024Minor updateMicrosoft made a minor update to the AZ-305 audience profile.Integrated by CramHQ

Compared with Skills measured prior to 2024-01-22

Changed

  • Microsoft made a minor update to the AZ-305 audience profile.
Reviewed. No CramHQ content change was required.

CramHQ reviewed the AZ-305 update. The measured exam content did not require a course change.

View official source
Practice and validate

Build breadth before the timed simulation.

Use separate exam-style practice quizzes to validate breadth, review explanations and your answers, use hints when stuck, and build confidence before the timed simulation, with an optional timer.

6 Practice Quizzes

01Practice quiz

AZ-305 Practice Quiz 1

Questions
50
Timer
Optional
02Practice quiz

AZ-305 Practice Quiz 2

Questions
50
Timer
Optional
03Practice quiz

AZ-305 Practice Quiz 3

Questions
50
Timer
Optional
04Practice quiz

AZ-305 Practice Quiz 4

Questions
50
Timer
Optional
05Practice quiz

AZ-305 Practice Quiz 5

Questions
50
Timer
Optional
06Practice quiz

AZ-305 Practice Quiz 6

Questions
50
Timer
Optional
Timed readiness check

Check readiness under timed conditions.

Use this after practice when you want an exam-style pacing, stamina, and breadth check.

FinalReadiness simulation
CramHQ target700 / 1000

AZ-305 Final Readiness Simulation

Questions
50
Time
2 hr
Mode
Timed

Start with the free assessment; full Pass Plan access unlocks the timed exam simulation.

Question formats

Practice the formats this exam path supports.

CramHQ shows the interaction patterns available for AZ-305 from the active exam path inventory.

Single answer

Choose the best answer from exam-style options.

Multi-answer

Select every correct option when more than one applies.

Case study

Work through scenario context before answering.

Matching

Match services, tools, or concepts to the right category.

Sequencing

Sequence steps or decisions when the exam path calls for ordering.

Hotspot

Select the correct option in supported visual or row-based prompts.

Exam integrity

Original practice, aligned to public objectives.

CramHQ helps you practice the decisions behind AZ-305 without using copied or confidential exam content.

Practice contentOriginal questions

Original practice questions aligned to public exam objectives.

Coverage sourcePublic objectives

Coverage is checked against the published exam objectives.

Provider relationshipIndependent prep
Microsoft AZ-305 study guide

CramHQ is independent and is not affiliated with Microsoft.

Readiness guide

Not sure if you are ready for AZ-305?

Use the AZ-305 readiness checklist to interpret practice scores, spot gaps a score can hide, and decide whether to book the exam or keep repairing weak areas.

Read the AZ-305 readiness checklist before you book the exam
Quick answers

AZ-305 practice test questions, answered.

Do I need to sign up?

No. You can start the assessment and review your report before creating an account. Sign up when you want to save the report and continue the Pass Plan.

Is the report free?

Yes. The assessment, readiness report, and your first targeted repair are free.

Are these copied exam questions or dumps?

No. CramHQ uses original practice items designed to test the decisions and concepts behind the exam.

Is CramHQ affiliated with Microsoft?

No. CramHQ is independent and is not endorsed by Microsoft.

What do I get after the assessment?

Save your report to keep the Pass Plan, fix your first gap free, and unlock the full Pass Plan when you want every repair, practice quizzes, and timed simulation.

I have already studied a lot. Is this still worth it?

That is exactly who it is built for. CramHQ keeps tracking the last few gaps between you and a comfortable pass, the ones a raw score hides, and puts the one costing you the most points at the top of your Pass Plan.

How long do I get access?

12 months of full access from purchase, with room to come back after a break.

What is your refund policy?

Paid exam paths come with a 7-day money-back guarantee. Conditions apply; see the Refund Policy. You can also try the assessment and your first repair free before you buy. Refund Policy

More exam paths

Choose the next certification path that fits your current goal.