AZ-305: Designing Microsoft Azure Infrastructure Solutions

AZ-305 exam objectives and study guide

The skills measured on the AZ-305 exam, by objective domain. Percentages are the share of the exam each domain carries.

AZ-305 practice questions and answers

11 free sample questions from the AZ-305 bank, with the correct answer and a full explanation for each. These are original questions written to the Microsoft objective domains — not real exam content.

1. Question 1Design infrastructure solutions

   Ibrahim, a platform architect, must review readiness before application teams start migrating workloads. The requirements are to provide governed subscriptions, private connectivity to on-premises systems, and centralized identity and access control. Which two landing-zone components should be completed before the migration wave starts?

   • AManagement group and subscription organization with baseline Azure Policy and RBAC assignments.
   • BA network topology and connectivity design that includes routing, DNS, and ExpressRoute or VPN requirements.
   • CA completed test migration for every source VM before landing-zone signoff is started.
   • DAzure Site Recovery protection from Azure back to on-premises for every migrated VM.
   • EPostponed governance decisions until the first production invoice is available in Cost Management.

   Show answer and explanation

   Correct answers

   • Management group and subscription organization with baseline Azure Policy and RBAC assignments.
   • A network topology and connectivity design that includes routing, DNS, and ExpressRoute or VPN requirements.

   Explanation

   These are CAF Ready activities that prepare the Azure environment for migrated workloads.

   • Management group and subscription organization... is correct because landing zones define how subscriptions inherit policy and role assignments.
   • A network topology and connectivity design... is correct because migrated applications often require DNS, routing, and private connectivity to on-premises dependencies.
   • Test migration is part of migration execution; it should occur after the target landing zone for the wave is ready.
   • Azure Site Recovery back to on-premises can be part of a DR strategy in some designs, but it is not a prerequisite landing-zone component for every CAF migration.
   • Delaying governance until after costs appear conflicts with the CAF approach of establishing guardrails before workload adoption.

   References:

   • Azure identity and access management design area
   • Overview of network topology and connectivity for Azure
   • Resource organization design area overview
   • Plan your migration
2. Question 2Design infrastructure solutions

   The cloud strategy has already been approved. The migration team now needs to inventory the digital estate, create an actionable migration plan, and prepare an Azure environment for the first workloads. Which two Cloud Adoption Framework methodologies address these activities?

   • APlan
   • BReady
   • CGovern
   • DManage
   • ESecure

   Show answer and explanation

   Correct answers

   • Plan
   • Ready

   Explanation

   After Strategy is approved, the next relevant CAF methodologies for this requirement are Plan and Ready.

   • Plan is correct because it covers rationalizing the digital estate, building the adoption plan, and preparing migration backlog items.
   • Ready is correct because it prepares the Azure environment, including landing zones, before workloads are adopted.
   • Govern, Manage, and Secure are important ongoing methodologies, but they do not replace the planning and environment-readiness activities described in the stem.

   References:

   • Prepare your organization for the cloud
   • What is an Azure landing zone?
   • Cloud Adoption Framework for Microsoft
3. Question 3Design infrastructure solutions

   Nadia, a solution architect, must choose a messaging service for industrial sensor telemetry. The service must ingest a high-throughput append-only event stream, retain events so analytics jobs can replay from their own positions, and allow multiple independent analytics applications to read the same stream. The workload does not require per-message command settlement by competing workers. Which service should Nadia recommend?

   • AAzure Event Hubs with an event hub and separate consumer groups for the analytics applications
   • BAzure Service Bus with a session-enabled queue and multiple competing receivers
   • CAzure Event Grid with a custom topic and webhook event subscriptions
   • DAzure Queue Storage with one storage queue for each analytics application

   Show answer and explanation

   Correct answer

   • Azure Event Hubs with an event hub and separate consumer groups for the analytics applications

   Explanation

   Azure Event Hubs is the best fit for high-throughput event streaming. It uses partitions for scalable ingestion, retains events for a configured period, and supports independent readers through consumer groups.

   • Azure Service Bus queues with sessions are intended for enterprise messaging and command processing scenarios that need features such as ordered sessions and message settlement, not append-only stream replay by consumer group.
   • Azure Event Grid is optimized for event notification and push delivery to handlers, not for consumers replaying a retained telemetry stream from offsets.
   • Azure Queue Storage is a simple work queue and does not provide the partitioned event-stream and consumer-group model required here.

   References:

   • What is Azure Event Hubs
   • Event Hubs features and terminology
   • Compare Messaging Services
4. Question 4Design infrastructure solutions

   Wingtip Toys publishes product images to Azure Blob Storage. Two serverless handlers must react when new blobs are created: one generates thumbnails and another extracts metadata. The design must use push-based event delivery with filtering by blob path and must not require either handler to poll storage. Which messaging architecture should you recommend?

   • ACreate an Azure Event Grid system topic for the storage account and add event subscriptions that deliver matching blob-created events to the two Azure Functions.
   • BSend image-upload records to Azure Event Hubs and enable Event Hubs Capture before invoking the two Azure Functions.
   • CWrite one message per upload to an Azure Service Bus queue and have the two Azure Functions compete for messages.
   • DCreate an Azure Queue Storage queue and run both Azure Functions on timer triggers that poll for blob names.

   Show answer and explanation

   Correct answer

   • Create an Azure Event Grid system topic for the storage account and add event subscriptions that deliver matching blob-created events to the two Azure Functions.

   Explanation

   Azure Event Grid is designed for event-based routing from Azure services such as Azure Storage. A system topic for the storage account can publish blob-created events to event subscriptions, and subscribers such as Azure Functions can receive only events that match configured filters.

   • Azure Event Hubs with Capture is suited to streaming ingestion and archiving event streams, not directly reacting to Azure resource events without polling.
   • A single Azure Service Bus queue would use competing consumers, so one handler would receive a message rather than both handlers receiving independent notifications.
   • Azure Queue Storage plus timer-based polling violates the push-delivery requirement.

   References:

   • Introduction to Azure Event Grid
   • Reacting to Azure Blob storage events
   • Compare Messaging Services
5. Question 5Design infrastructure solutions

   A web application must hand off thumbnail-resize work to background workers. The design needs the simplest low-cost Azure-managed queue where one worker processes each work item. No publish/subscribe fan-out, transactions, ordering guarantee, or broker-side duplicate detection is required. Which service should you recommend?

   • AAzure Queue Storage
   • BAzure Service Bus Premium with a session-enabled queue
   • CAzure Event Hubs
   • DAzure Event Grid with a custom topic

   Show answer and explanation

   Correct answer

   • Azure Queue Storage

   Explanation

   Azure Queue Storage is appropriate for simple, low-cost asynchronous work queues backed by an Azure Storage account.

   • Azure Service Bus Premium with sessions provides advanced enterprise messaging capabilities that are unnecessary for this simple work queue.
   • Azure Event Hubs is intended for high-throughput event streaming and replay, not simple worker task handoff.
   • Azure Event Grid is intended for event notification and push delivery, not a queue where one worker claims each work item.

   References:

   • Introduction to Azure Queue Storage
   • Compare Messaging Services
   • Azure Service Bus Queues, Topics, and Subscriptions
6. Question 6Design infrastructure solutions

   Best For You Organics is designing an integration bus for order events and must decide when Azure Service Bus topics and subscriptions are a better fit than Azure Event Hubs, Azure Event Grid, or Azure Queue Storage. Which two requirements indicate that Service Bus topics and subscriptions should be recommended?

   • AEach published order message must be delivered as an independent durable copy to billing, fulfillment, and audit processors.
   • BSubscribers must use SQL or correlation filters on message properties to receive only the order events for their business function.
   • CAnalytics consumers must replay a retained append-only telemetry stream from their own offsets.
   • DApplications must receive notifications when Azure resources such as storage blobs change state, without implementing polling.
   • EA single simple queue backed by a storage account is sufficient, and no publish/subscribe fan-out is required.

   Show answer and explanation

   Correct answers

   • Each published order message must be delivered as an independent durable copy to billing, fulfillment, and audit processors.
   • Subscribers must use SQL or correlation filters on message properties to receive only the order events for their business function.

   Explanation

   Azure Service Bus topics and subscriptions are designed for durable publish/subscribe enterprise messaging. Each subscription acts like an independent queue for a subscriber, and rules can filter messages by SQL or correlation filters.

   • Independent durable copies for billing, fulfillment, and audit are a Service Bus topic/subscription fit because slow processing in one subscription does not consume messages from another subscription.
   • Filtering by message properties with SQL or correlation filters is a Service Bus topic subscription feature.
   • Replaying an append-only telemetry stream from offsets is an Azure Event Hubs scenario.
   • Receiving Azure resource state-change notifications without polling is an Azure Event Grid scenario.
   • A simple storage-backed queue without pub/sub points to Azure Queue Storage, not Service Bus topics.

   References:

   • Azure Service Bus Queues, Topics, and Subscriptions
   • Azure Service Bus Topic Filters Overview
   • What is Azure Event Hubs
   • Introduction to Azure Event Grid
7. Question 7Design infrastructure solutions

   A regulated database modernization effort includes 35 on-premises SQL Server databases. Before a six-hour cutover window is designed, the DBA team must identify blocking compatibility issues and feature parity gaps for Azure SQL Database or Azure SQL Managed Instance. No data movement should occur during this evaluation. Which tool should be used first?

   • ACreate an Assessment project in Data Migration Assistant with SQL Server as the source and the Azure SQL target selected.
   • BCreate an Azure Database Migration Service project and start an online migration to the selected Azure SQL target.
   • CCreate an Azure Migrate Azure VM assessment for the database servers and review the recommended VM sizes.
   • DRun SQL Server Migration Assistant for Oracle and review the converted schema report for the application databases.

   Show answer and explanation

   Correct answer

   • Create an Assessment project in Data Migration Assistant with SQL Server as the source and the Azure SQL target selected.

   Explanation

   Use Data Migration Assistant (DMA) to create an assessment project for a SQL Server source and an Azure SQL target. DMA is designed to find compatibility issues and feature parity concerns before migration.

   • Azure Database Migration Service is used to perform migrations after assessment and planning; starting a migration project would violate the requirement to avoid data movement.
   • Azure Migrate Azure VM assessment sizes server infrastructure for Azure VMs, but it does not provide database schema compatibility and feature parity assessment for Azure SQL Database or Azure SQL Managed Instance.
   • SQL Server Migration Assistant for Oracle is a real migration tool, but it is for Oracle-to-SQL migration scenarios, not SQL Server-to-Azure SQL assessment.

   References:

   • Overview of Data Migration Assistant (SQL Server)
   • Perform a SQL Server migration assessment
   • What Is Azure Database Migration Service?
8. Question 8Design infrastructure solutions

   Lamna Healthcare is reviewing line-of-business applications before a phased migration. Twenty-two legacy apps must remain on-premises for 12 months because they need low-latency access to medical devices, but remote clinicians must access them with Microsoft Entra sign-in and MFA. User accounts are currently in Active Directory Domain Services. Which recommendation should be included in the migration assessment?

   • AUse Microsoft Entra Connect for the AD DS accounts, Microsoft Entra application proxy for the retained apps, and Conditional Access for MFA.
   • BUse cloud-only Microsoft Entra accounts, public DNS records for the retained apps, and per-user MFA for internet access.
   • CUse Azure Migrate software inventory, Azure VM sizing for the app servers, and postpone authentication changes.
   • DUse Azure Arc-enabled servers, Defender for Servers recommendations, and direct VPN access to each retained app.

   Show answer and explanation

   Correct answer

   • Use Microsoft Entra Connect for the AD DS accounts, Microsoft Entra application proxy for the retained apps, and Conditional Access for MFA.

   Explanation

   The assessment should identify the hybrid identity and app publishing dependencies: Microsoft Entra Connect for synchronizing AD DS identities, Microsoft Entra application proxy for publishing eligible on-premises legacy apps, and Conditional Access policies to require MFA.

   • Cloud-only accounts with per-user MFA would create a separate identity model and does not meet the hybrid identity requirement for existing AD DS accounts.
   • Azure Migrate software inventory and VM sizing help evaluate servers and applications for migration, but they do not publish retained on-premises apps or enforce MFA.
   • Azure Arc and Defender for Servers help manage and protect servers, but they are not an application access and identity publishing design.

   References:

   • Deployment considerations for Microsoft Entra multifactor authentication
   • What is hybrid identity with Microsoft Entra ID?
   • Plan a Microsoft Entra application proxy deployment
   • Microsoft Entra Conditional Access: Zero Trust Policy Engine
9. Question 9Design infrastructure solutions

   Current-state architecture includes 50 Hyper-V VMs, 12 SQL Server instances, and 18 IIS web applications. The architecture team needs a central Azure hub to discover and assess the on-premises estate before selecting migration targets. Which service should be recommended?

   • AAzure Migrate
   • BAzure Site Recovery
   • CAzure Resource Mover
   • DMicrosoft Defender for Cloud

   Show answer and explanation

   Correct answer

   • Azure Migrate

   Explanation

   Azure Migrate is the central service for discovering, assessing, and planning migration of servers, databases, and web applications to Azure.

   • Azure Site Recovery provides disaster recovery and replication capabilities, but it is not the central assessment hub for the full on-premises estate.
   • Azure Resource Mover moves Azure resources between Azure regions, not on-premises workloads into Azure.
   • Microsoft Defender for Cloud provides cloud security posture management and workload protection, including hybrid scenarios, but it is not the migration discovery and assessment hub.

   References:

   • About Azure Migrate
   • About Azure Site Recovery
   • What is Azure Resource Mover?
   • Microsoft Defender for Cloud Overview
10. Question 10Design infrastructure solutions

    Before an appliance can be registered for a 60-server migration assessment pilot, the subscription must contain the assessment project in resource group rg-migrate-eval. Complete the Azure CLI sample.

    az extension add --name 1
    az 2 project create 3 rg-migrate-eval --name mig-eval-eastus --location eastus

    Blank 1

    • Amigrate
    • Bresource-mover
    • Cazure-devops
    • Dconnectedmachine

    Blank 2

    • Amigrate
    • Bresource-mover
    • Cdevops
    • Dconnectedmachine

    Blank 3

    • A--resource-group
    • B--subscription
    • C--tags
    • D--public-network-access

    Show answer and explanation

    Correct answers

    • Blank 1: migrate
    • Blank 2: migrate
    • Blank 3: --resource-group

    Explanation

    The Azure CLI uses the migrate extension and the az migrate project create command to create the assessment project. The project is created in the specified resource group by using the --resource-group parameter.

    • resource-mover is for moving existing Azure resources across regions, not creating migration assessment projects.
    • azure-devops/devops manages Azure DevOps resources and projects, not Azure Migrate projects.
    • connectedmachine is associated with Azure Arc-enabled servers and does not create Azure Migrate assessment projects.
    • --subscription, --tags, and --public-network-access are real CLI parameters in Azure contexts, but they do not supply the required resource group argument for this command.

    References:

    • az extension
    • About Azure Migrate
11. Question 11Design infrastructure solutions

    You are designing administrator access for 40 Windows and Linux virtual machines in spoke virtual networks. Auditors require that no VM has a public IP address and that RDP/SSH access does not require a self-managed jump-box VM. Administrators must connect from a browser after authenticating to Azure. The network already has a peered hub virtual network. What should you recommend?

    • ADeploy Azure Bastion in the hub virtual network and use the existing virtual network peering to reach the VMs in the spokes.
    • BEnable just-in-time VM access in Microsoft Defender for Cloud and open RDP/SSH only during approved maintenance windows.
    • CCreate a public load balancer with inbound NAT rules for each VM and restrict management access to administrator source IP ranges.
    • DAttach Azure NAT Gateway to the administrator subnet and allow outbound connections to the private IP addresses of the VMs.

    Show answer and explanation

    Correct answer

    • Deploy Azure Bastion in the hub virtual network and use the existing virtual network peering to reach the VMs in the spokes.

    Explanation

    Azure Bastion in the hub virtual network provides browser-based RDP and SSH to VMs without assigning public IP addresses to the VMs. In a hub-spoke design, Bastion can be centralized for access to VMs in peered virtual networks.

    • Just-in-time VM access helps restrict management ports but does not provide the browser-based managed jump service, and it is commonly used with NSGs or Azure Firewall rules rather than replacing the access path.
    • A public load balancer with inbound NAT rules exposes management paths through a public frontend, which violates the no-public-management-access requirement.
    • Azure NAT Gateway is for outbound internet connectivity from subnets. It does not provide inbound RDP/SSH administration.

    References:

    • What is Azure Bastion?
    • Hub-Spoke Network Topology in Azure
    • Azure Virtual Network Peering

Membership includes 173 questions and explanations aligned to the AZ-305 curriculum, including 9 case studies.

Other Microsoft certifications

Every one of these is included with the same membership as AZ-305.

AB-900Microsoft

Microsoft 365 Copilot and Agent Administration Fundamentals

This exam is intended for candidates who are familiar with Microsoft 365, including core services, security, identity and access, data…

161 practice questionsView

AI-900Microsoft

Microsoft Azure AI Fundamentals

This exam measures knowledge of machine learning and AI concepts and related Microsoft Azure services. It is intended for candidates…

193 practice questionsView

AZ-900Microsoft

Microsoft Azure Fundamentals

This exam is intended for technology professionals who want to demonstrate foundational knowledge of cloud concepts and Microsoft Azure.…

170 practice questionsView

AZ-305 exam FAQ