Azure AZ-305 Practice Test

AZ-305 practice test: what's covered

Microsoft exam name: Designing Microsoft Azure Infrastructure Solutions.

• Azure Solutions Architect Expert

Free AZ-305 sample questions

1. A holding company owns 10 subsidiaries, each with its own Microsoft Entra ID tenant. Auditors must access resources across subsidiaries without creating duplicate accounts. Which design best centralizes external collaboration governance?

   • A. Merge all 10 tenants into a single Entra ID tenant and migrate every user object before granting any cross-company access
   • B. Configure cross-tenant access settings with inbound and outbound rules, invite users via B2B collaboration, and grant access through entitlement management access packages
   • C. Create one shared service account per subsidiary and distribute its password to auditors through an encrypted email channel
   • D. Enable security defaults in every tenant and rely on per-resource role assignments managed manually by each subsidiary
   Show answer

   Correct: B. Cross-tenant access settings govern inbound/outbound trust, B2B brings external identities in as guests, and entitlement management packages access with approval and expiry. Merging tenants is a disruptive migration not required for collaboration, shared accounts break per-user audit trails because actions cannot be attributed, and manual per-resource assignment does not scale and provides no lifecycle governance.

2. You are designing how containerized workloads on AKS and a GitHub Actions pipeline will authenticate to Azure resources without storing any long-lived secrets. Which approaches satisfy the secret-less requirement? (Choose TWO)

   • A. Use Microsoft Entra Workload ID with federated credentials so the AKS service account token is exchanged for an Entra token
   • B. Configure a GitHub Actions workflow with a federated identity credential on an Entra app registration so the OIDC token is trusted
   • C. Store a service principal client secret as a Kubernetes secret and mount it into every pod that needs Azure access
   • D. Embed a service principal certificate and password together in the container image so they ship with the workload
   • E. Generate a SAS token with a 10-year expiry and bake it into the pipeline environment variables
   Show answer

   Correct: A and B. Workload identity federation exchanges an external OIDC token (from AKS or GitHub) for an Entra token, so no secret is stored. Mounting a client secret as a Kubernetes secret is exactly the long-lived credential to avoid, embedding a certificate plus password in an image leaks credentials because anyone with the image can extract them, and a long-lived SAS token is itself a static secret that cannot be rotated safely.

3. An enterprise wants 200 project teams to each have an isolated billing and security boundary, while still enforcing a common set of policies and role assignments inherited from the top. Which governance hierarchy should you design?

   • A. Place every team into a single subscription and separate them only by resource group naming conventions and tags
   • B. Build a management group hierarchy, assign one subscription per team, and apply Azure Policy and RBAC at management group scope for inheritance
   • C. Create 200 separate Entra ID tenants so each team is fully isolated at the directory level
   • D. Use a single subscription with Azure Blueprints applied repeatedly to each resource group as teams onboard
   Show answer

   Correct: B. A subscription is the billing and security boundary, and management groups let policy and RBAC inherit down to all child subscriptions. A single subscription with naming conventions provides no real isolation because quotas and policy cannot be scoped per team, 200 tenants fragments identity and adds enormous overhead, and resource-group-level blueprints do not give per-team billing separation.

4. Across 50 subscriptions, you must ensure that every existing and future resource automatically sends diagnostic logs to one central Log Analytics workspace for Microsoft Sentinel. Which design automates onboarding for new resources?

   • A. Manually configure diagnostic settings on each resource and document a runbook for engineers to repeat on every new deployment
   • B. Assign a DeployIfNotExists Azure Policy at management group scope that configures diagnostic settings to the central workspace
   • C. Create a separate Log Analytics workspace in each subscription and federate queries with cross-workspace KQL at report time
   • D. Enable Microsoft Defender for Cloud free tier and rely on its default agent to forward all platform logs automatically
   Show answer

   Correct: B. DeployIfNotExists policy with a remediation task configures diagnostic settings on existing resources and any new ones, giving automatic onboarding at scale. Manual configuration does not cover future resources, per-subscription workspaces fragment Sentinel correlation because detections span workspaces, and Defender for Cloud does not auto-route arbitrary resource diagnostic logs to a chosen workspace.

5. A retail platform needs a database that supports low-latency writes from users in three continents simultaneously, with an SLA-backed throughput guarantee and tunable consistency. Which Azure data service best fits this requirement?

   • A. Azure SQL Database with active geo-replication to two readable secondary regions for global reads
   • B. Azure Cosmos DB configured with multi-region writes and a chosen consistency level such as session or bounded staleness
   • C. Azure Database for PostgreSQL flexible server with read replicas in each target region
   • D. Azure Table storage in a geo-redundant storage account replicated to the paired region
   Show answer

   Correct: B. Cosmos DB offers turnkey multi-region writes, single-digit-millisecond latency, throughput SLAs, and five tunable consistency levels. Azure SQL geo-replication and PostgreSQL read replicas provide readable secondaries but writes still funnel to one primary, so they are not true multi-master, and Table storage geo-redundancy gives a read-only secondary, not active multi-region writes.

Last updated: 2026-10-19

AZ-305 practice test FAQ

Related practice tests

• AZ-104 practice test
• AZ-700 practice test
• AZ-400 practice test
• AZ-500 practice test
• AZ-204 practice test
• SAP-C02 practice test