EN简体繁體
Sign in
Home / Microsoft / AZ-305
Microsoft · AZ-305

AZ-305 Exam Practice Questions

Designing Microsoft Azure Infrastructure Solutions

AZ-305 English PDF practice questions: 286 questions in source order, with options supported by the source format, answers and available explanations. Access covers this exam only. One-time payment; no automatic renewal.

Exam overview

For architects designing Azure identity, governance, monitoring, storage, continuity and infrastructure solutions.

Exam code
AZ-305
Official exam / credential
Designing Microsoft Azure Infrastructure Solutions
Exam format
Proctored assessment; interactive items may be included
Official exam languages
English, Japanese, Simplified Chinese, Korean, German, French, Spanish, Portuguese (Brazil), Traditional Chinese, Italian

Official exam languages and practice-question file languages are listed separately. Confirm the exam version and available languages when booking with the provider.

Official sources: Provider reference
Information checked: 2026-10-20

Supported languages

  • English
  • Simplified Chinese
Try before you buy

First 20 practice questions

286 total questions

Questions follow the source order. Expand each answer to see its explanation.

Disclaimer: All questions on ExamPico are compiled from internet sources and are provided for study reference only.

Question 11

Question#11Topic1

You are designing a large Azure environment that will contain many subscriptions.
You plan to use Azure Policy as part of a governance solution.
To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

  1. A. Azure Active Directory (Azure AD) administrative units
  2. B. Azure Active Directory (Azure AD) tenants
  3. C. subscriptions
  4. D. compute resources
  5. E. resource groups
  6. F. management groups
Show answer and explanation

Answer

CEF

Explanation

Azure Policy evaluates resources in Azure by comparing the properties of those resources to business rules. Once your business rules have been formed, the policy definition or initiative is assigned to any scope of resources that Azure supports, such as management groups, subscriptions, resource groups, or individual resources.
Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/overview

Question 12

Question#12Topic1

DRAG DROP -
Your on-premises network contains a server named Server1 that runs an ASP.NET application named App1.
You have a hybrid deployment of Azure Active Directory (Azure AD).
You need to recommend a solution to ensure that users sign in by using their Azure AD account and Azure Multi-Factor Authentication (MFA) when they connect to App1 from the internet.
Which three features should you recommend be deployed and configured in sequence? To answer, move the appropriate features from the list of features to the answer area and arrange them in the correct order.
Select and Place:
Question illustration

Show answer and explanation

Answer

FGD

Explanation

Step 1: Azure AD Application Proxy
Start by enabling communication to Azure data centers to prepare your environment for Azure AD Application Proxy.
Step 2: an Azure AD enterprise application
Add an on-premises app to Azure AD.
Now that you've prepared your environment and installed a connector, you're ready to add on-premises applications to Azure AD.
1. Sign in as an administrator in the Azure portal.
2. In the left navigation panel, select Azure Active Directory.
3. Select Enterprise applications, and then select New application.
4. Etc.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-application

Question 13

Question#13Topic1

You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?

  1. A. Azure Activity Log
  2. B. Azure Advisor
  3. C. Azure Analysis Services
  4. D. Azure Monitor action groups
Show answer and explanation

Answer

A

Explanation

Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't more than 90 days in the past.
Through activity logs, you can determine:
✑ what operations were taken on the resources in your subscription
✑ who started the operation
✑ when the operation occurred
✑ the status of the operation
✑ the values of other properties that might help you research the operation
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs

Question 14

Question#14Topic1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.
Several virtual machines exhibit network connectivity issues.
You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.
Solution: Install and configure the Azure Monitoring agent and the Dependency Agent on all the virtual machines. Use VM insights in Azure Monitor to analyze the network traffic.
Does this meet the goal?

  1. A. Yes
  2. B. No
Show answer and explanation

Answer

B

Explanation

Use the Azure Monitor agent if you need to:
Collect guest logs and metrics from any machine in Azure, in other clouds, or on-premises.
Use the Dependency agent if you need to:
Use the Map feature VM insights or the Service Map solution.
Note: Instead use Azure Network Watcher IP Flow Verify allows you to detect traffic filtering issues at a VM level.
IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen,
IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.
Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#dependency-agent

Question 15

Question#15Topic1

DRAG DROP -
You need to design an architecture to capture the creation of users and the assignment of roles. The captured data must be stored in Azure Cosmos DB.
Which services should you include in the design? To answer, drag the appropriate services to the correct targets. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
Question illustration

Show answer and explanation

Answer

Question illustration

Explanation

Box 1: Azure Event Hubs -
You can route Azure Active Directory (Azure AD) activity logs to several endpoints for long term retention and data insights.
The Event Hub is used for streaming.

Box 2: Azure Function -
Use an Azure Function along with a cosmos DB change feed, and store the data in Cosmos DB.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor

Downloads and personal use

  • Purchase this exam question set separately with 1, 3, 6 or 12 months of download access.
  • After payment confirmation, your library shows the download link and exact expiry time.
  • Download again during your term. Purchase a new term after expiry.
  • PDFs are licensed for personal study only and must not be resold or shared publicly.
  • Files already saved to your device are not remotely deleted when access expires.
How to choose your certification