1
Microsoft Azure AZ-305 Solutions Architect Expert
ACTUAL PRACTICE EXAM 2026/2027 | Verified
Questions and Answers | Aligned to Microsoft Exam
Objectives | Grade A Target | Pass Guaranteed
SECTION 1: DESIGN IDENTITY, GOVERNANCE, AND MONITORING SOLUTIONS
(Questions 1-10)
Q1: A multinational manufacturing corporation operates in 12 countries with 25,000 employees.
They have an on-premises Active Directory Domain Services (ADDS) environment and are
migrating to Azure. The security team requires:
• All privileged administrator accounts must require approval workflows and time-bound
access
• Regular users must authenticate using passwordless methods where possible
• Conditional access policies must enforce device compliance for accessing corporate data
• The solution must minimize operational overhead for the IT team
Which combination of Azure services and features should you recommend?
A. Azure AD Free tier with Password Hash Synchronization, Security Defaults enabled, and
manual administrator account management
B. Azure AD Premium P1 with Pass-through Authentication, Azure AD Privileged Identity
Management (PIM), and Conditional Access policies requiring hybrid Azure AD joined devices
C. Azure AD Premium P2 with Password Hash Synchronization, Azure AD Privileged Identity
Management (PIM), Conditional Access with device compliance policies, and passwordless
authentication methods [CORRECT]
D. Azure AD Premium P1 with Federation (AD FS), manual privileged account management,
and Multi-Factor Authentication for all users
Correct Answer: C
Rationale: The correct answer is C because it addresses all requirements comprehensively.
Azure AD Premium P2 is required for Identity Protection (risk-based policies) and advanced
Conditional Access features. Password Hash Synchronization provides seamless synchronization
,2
with on-premises AD while enabling passwordless authentication methods (Windows Hello,
FIDO2 security keys, Microsoft Authenticator) that satisfy the passwordless requirement with
minimal user friction. Azure AD PIM provides just-in-time privileged access with approval
workflows and time-bound activation, directly addressing the privileged account governance
requirement. Conditional Access with device compliance policies (requiring Intune enrollment)
ensures only managed, compliant devices access corporate data.
Option A fails because Azure AD Free tier lacks PIM, advanced Conditional Access, and
passwordless authentication features. Security Defaults provides only basic MFA, not the
granular device compliance and privileged access management required.
Option B uses P1 which lacks Identity Protection and advanced risk-based Conditional Access.
Pass-through Authentication creates dependency on on-premises infrastructure availability and
doesn't enable passwordless authentication as effectively as PHS with seamless SSO.
Option D relies on AD FS, which adds significant operational overhead (servers, certificates,
high availability requirements) contrary to the minimal overhead requirement. Manual privileged
account management violates the approval workflow and time-bound access requirements.
Q2: A financial services firm must comply with SEC regulations requiring immutable audit logs
of all administrative actions for 7 years. They need to detect anomalous administrative activities
across 50 Azure subscriptions and 5 Azure AD tenants. The solution must centralize log
collection and provide automated threat detection with minimal false positives.
Which architecture should you implement?
A. Azure Monitor Logs per subscription with Basic logs tier, Log Analytics workspace in each
region, and manual log analysis using KQL queries
B. Azure Sentinel with a Log Analytics workspace in a dedicated management subscription,
Azure Lighthouse for multi-tenant management, and Azure Storage account with immutability
policies for long-term retention [CORRECT]
C. Event Hubs for log streaming to an on-premises SIEM, Azure AD activity logs exported to
CSV files stored in Blob storage with soft delete enabled
D. Azure Monitor Logs with Capacity Reservations, retention policies set to 7 years in Log
Analytics, and Azure Workbooks for manual anomaly detection
Correct Answer: B
Rationale: The correct answer is B because it satisfies the multi-tenant governance, compliance,
and security requirements. Azure Sentinel provides cloud-native SIEM and SOAR capabilities
with built-in User and Entity Behavior Analytics (UEBA) for detecting anomalous administrative
activities with machine learning-reduced false positives. Azure Lighthouse enables centralized
management across multiple tenants without tenant switching. The Log Analytics workspace in a
,3
dedicated management subscription provides governance isolation. Azure Storage with time-
based immutability policies (WORM - Write Once Read Many) satisfies the SEC requirement
for immutable audit logs for 7 years at optimal cost.
Option A fails because Basic logs tier doesn't support advanced analytics or long retention, and
per-subscription workspaces create management fragmentation without centralized threat
detection.
Option C creates security gaps with on-premises SIEM dependency (latency, connectivity
requirements) and CSV exports lack tamper-proof immutability guarantees; soft delete is not
compliance-grade immutability.
Option D's 7-year retention in Log Analytics would be prohibitively expensive (interactive
retention costs vs. archive tier), and manual detection via Workbooks doesn't provide the
automated threat detection requirement.
Q3: A healthcare organization is implementing Azure Policy to enforce compliance with HIPAA
requirements. They need to:
• Prevent the deployment of non-compliant resources (unencrypted storage, open NSGs)
• Automatically remediate specific policy violations (enable diagnostic logs)
• Generate compliance reports for auditors without administrative access to Azure
• Ensure new subscriptions automatically inherit compliance policies
Which combination of Azure features accomplishes these objectives?
A. Management groups with Azure Policy assignments using Audit effect, manual remediation
tasks, and Reader role assignments for auditors
B. Azure Blueprints with Policy artifacts using Deny and DeployIfNotExists effects, Blueprint
assignments at management group level, and Azure Policy compliance reports accessible through
Azure Resource Graph queries delegated to auditors [CORRECT]
C. Subscription-level Policy assignments with AuditIfNotExists effects only, Azure Advisor
recommendations for remediation, and Owner role for auditors
D. Resource group-level Policy definitions with Append effects, manual policy assignment to
each subscription, and Azure Monitor Workbooks for compliance visualization
Correct Answer: B
Rationale: The correct answer is B because Azure Blueprints provides subscription orchestration
capabilities that ensure new subscriptions automatically receive policy, RBAC, and resource
configurations. Using Deny effects prevents non-compliant resource deployment at the ARM
template validation stage. DeployIfNotExists (DINE) effects enable automatic remediation by
, 4
deploying required configurations (diagnostic settings) when non-compliant resources are
detected. Management group-level Blueprint assignment ensures inheritance across all
subscriptions. Azure Policy's built-in compliance dashboard accessed via Azure Resource Graph
(with delegated permissions) provides auditors read-only compliance visibility without
administrative access.
Option A uses Audit effect which doesn't prevent deployment, failing the prevention requirement.
Manual remediation doesn't satisfy automatic remediation needs.
Option C uses AuditIfNotExists only, which doesn't prevent non-compliant deployments.
Granting Owner role to auditors violates security principles of least privilege.
Option D's Append effect doesn't block non-compliant configurations, resource group scope
creates management overhead, and manual assignment per subscription violates the automatic
inheritance requirement.
CASE STUDY 1: Fabrikam Retail Solutions
Scenario: Fabrikam Retail Solutions operates 200 retail stores across North America with 5,000
employees. They are migrating their e-commerce platform and store management systems to
Azure. Key requirements:
• Identity: Employees use on-premises Active Directory. Store associates share
workstations and need fast authentication without passwords. Corporate users need MFA
with phishing-resistant methods. External suppliers require limited, time-bound access to
procurement systems.
• Governance: The company has 15 Azure subscriptions across Development, Testing, and
Production environments. Cost overruns have occurred due to unapproved resource types
and lack of spending controls. They need to enforce tagging for cost allocation and
prevent deployment of high-cost VMs without approval.
• Monitoring: They need unified visibility across all environments with separate access for
operations teams (full access) and finance teams (cost data only). Alert fatigue from noisy
monitoring has been a problem.
Q4: Based on the case study, which identity architecture should you recommend for Fabrikam's
workforce authentication requirements?
A. Azure AD Free with Security Defaults, shared user accounts for store associates, and external
supplier accounts created directly in Azure AD
B. Azure AD Premium P2 with Temporary Access Pass for store associates (shared devices),
FIDO2 security keys for corporate users, Azure AD B2B with PIM for external suppliers, and
Password Hash Synchronization [CORRECT]
Microsoft Azure AZ-305 Solutions Architect Expert
ACTUAL PRACTICE EXAM 2026/2027 | Verified
Questions and Answers | Aligned to Microsoft Exam
Objectives | Grade A Target | Pass Guaranteed
SECTION 1: DESIGN IDENTITY, GOVERNANCE, AND MONITORING SOLUTIONS
(Questions 1-10)
Q1: A multinational manufacturing corporation operates in 12 countries with 25,000 employees.
They have an on-premises Active Directory Domain Services (ADDS) environment and are
migrating to Azure. The security team requires:
• All privileged administrator accounts must require approval workflows and time-bound
access
• Regular users must authenticate using passwordless methods where possible
• Conditional access policies must enforce device compliance for accessing corporate data
• The solution must minimize operational overhead for the IT team
Which combination of Azure services and features should you recommend?
A. Azure AD Free tier with Password Hash Synchronization, Security Defaults enabled, and
manual administrator account management
B. Azure AD Premium P1 with Pass-through Authentication, Azure AD Privileged Identity
Management (PIM), and Conditional Access policies requiring hybrid Azure AD joined devices
C. Azure AD Premium P2 with Password Hash Synchronization, Azure AD Privileged Identity
Management (PIM), Conditional Access with device compliance policies, and passwordless
authentication methods [CORRECT]
D. Azure AD Premium P1 with Federation (AD FS), manual privileged account management,
and Multi-Factor Authentication for all users
Correct Answer: C
Rationale: The correct answer is C because it addresses all requirements comprehensively.
Azure AD Premium P2 is required for Identity Protection (risk-based policies) and advanced
Conditional Access features. Password Hash Synchronization provides seamless synchronization
,2
with on-premises AD while enabling passwordless authentication methods (Windows Hello,
FIDO2 security keys, Microsoft Authenticator) that satisfy the passwordless requirement with
minimal user friction. Azure AD PIM provides just-in-time privileged access with approval
workflows and time-bound activation, directly addressing the privileged account governance
requirement. Conditional Access with device compliance policies (requiring Intune enrollment)
ensures only managed, compliant devices access corporate data.
Option A fails because Azure AD Free tier lacks PIM, advanced Conditional Access, and
passwordless authentication features. Security Defaults provides only basic MFA, not the
granular device compliance and privileged access management required.
Option B uses P1 which lacks Identity Protection and advanced risk-based Conditional Access.
Pass-through Authentication creates dependency on on-premises infrastructure availability and
doesn't enable passwordless authentication as effectively as PHS with seamless SSO.
Option D relies on AD FS, which adds significant operational overhead (servers, certificates,
high availability requirements) contrary to the minimal overhead requirement. Manual privileged
account management violates the approval workflow and time-bound access requirements.
Q2: A financial services firm must comply with SEC regulations requiring immutable audit logs
of all administrative actions for 7 years. They need to detect anomalous administrative activities
across 50 Azure subscriptions and 5 Azure AD tenants. The solution must centralize log
collection and provide automated threat detection with minimal false positives.
Which architecture should you implement?
A. Azure Monitor Logs per subscription with Basic logs tier, Log Analytics workspace in each
region, and manual log analysis using KQL queries
B. Azure Sentinel with a Log Analytics workspace in a dedicated management subscription,
Azure Lighthouse for multi-tenant management, and Azure Storage account with immutability
policies for long-term retention [CORRECT]
C. Event Hubs for log streaming to an on-premises SIEM, Azure AD activity logs exported to
CSV files stored in Blob storage with soft delete enabled
D. Azure Monitor Logs with Capacity Reservations, retention policies set to 7 years in Log
Analytics, and Azure Workbooks for manual anomaly detection
Correct Answer: B
Rationale: The correct answer is B because it satisfies the multi-tenant governance, compliance,
and security requirements. Azure Sentinel provides cloud-native SIEM and SOAR capabilities
with built-in User and Entity Behavior Analytics (UEBA) for detecting anomalous administrative
activities with machine learning-reduced false positives. Azure Lighthouse enables centralized
management across multiple tenants without tenant switching. The Log Analytics workspace in a
,3
dedicated management subscription provides governance isolation. Azure Storage with time-
based immutability policies (WORM - Write Once Read Many) satisfies the SEC requirement
for immutable audit logs for 7 years at optimal cost.
Option A fails because Basic logs tier doesn't support advanced analytics or long retention, and
per-subscription workspaces create management fragmentation without centralized threat
detection.
Option C creates security gaps with on-premises SIEM dependency (latency, connectivity
requirements) and CSV exports lack tamper-proof immutability guarantees; soft delete is not
compliance-grade immutability.
Option D's 7-year retention in Log Analytics would be prohibitively expensive (interactive
retention costs vs. archive tier), and manual detection via Workbooks doesn't provide the
automated threat detection requirement.
Q3: A healthcare organization is implementing Azure Policy to enforce compliance with HIPAA
requirements. They need to:
• Prevent the deployment of non-compliant resources (unencrypted storage, open NSGs)
• Automatically remediate specific policy violations (enable diagnostic logs)
• Generate compliance reports for auditors without administrative access to Azure
• Ensure new subscriptions automatically inherit compliance policies
Which combination of Azure features accomplishes these objectives?
A. Management groups with Azure Policy assignments using Audit effect, manual remediation
tasks, and Reader role assignments for auditors
B. Azure Blueprints with Policy artifacts using Deny and DeployIfNotExists effects, Blueprint
assignments at management group level, and Azure Policy compliance reports accessible through
Azure Resource Graph queries delegated to auditors [CORRECT]
C. Subscription-level Policy assignments with AuditIfNotExists effects only, Azure Advisor
recommendations for remediation, and Owner role for auditors
D. Resource group-level Policy definitions with Append effects, manual policy assignment to
each subscription, and Azure Monitor Workbooks for compliance visualization
Correct Answer: B
Rationale: The correct answer is B because Azure Blueprints provides subscription orchestration
capabilities that ensure new subscriptions automatically receive policy, RBAC, and resource
configurations. Using Deny effects prevents non-compliant resource deployment at the ARM
template validation stage. DeployIfNotExists (DINE) effects enable automatic remediation by
, 4
deploying required configurations (diagnostic settings) when non-compliant resources are
detected. Management group-level Blueprint assignment ensures inheritance across all
subscriptions. Azure Policy's built-in compliance dashboard accessed via Azure Resource Graph
(with delegated permissions) provides auditors read-only compliance visibility without
administrative access.
Option A uses Audit effect which doesn't prevent deployment, failing the prevention requirement.
Manual remediation doesn't satisfy automatic remediation needs.
Option C uses AuditIfNotExists only, which doesn't prevent non-compliant deployments.
Granting Owner role to auditors violates security principles of least privilege.
Option D's Append effect doesn't block non-compliant configurations, resource group scope
creates management overhead, and manual assignment per subscription violates the automatic
inheritance requirement.
CASE STUDY 1: Fabrikam Retail Solutions
Scenario: Fabrikam Retail Solutions operates 200 retail stores across North America with 5,000
employees. They are migrating their e-commerce platform and store management systems to
Azure. Key requirements:
• Identity: Employees use on-premises Active Directory. Store associates share
workstations and need fast authentication without passwords. Corporate users need MFA
with phishing-resistant methods. External suppliers require limited, time-bound access to
procurement systems.
• Governance: The company has 15 Azure subscriptions across Development, Testing, and
Production environments. Cost overruns have occurred due to unapproved resource types
and lack of spending controls. They need to enforce tagging for cost allocation and
prevent deployment of high-cost VMs without approval.
• Monitoring: They need unified visibility across all environments with separate access for
operations teams (full access) and finance teams (cost data only). Alert fatigue from noisy
monitoring has been a problem.
Q4: Based on the case study, which identity architecture should you recommend for Fabrikam's
workforce authentication requirements?
A. Azure AD Free with Security Defaults, shared user accounts for store associates, and external
supplier accounts created directly in Azure AD
B. Azure AD Premium P2 with Temporary Access Pass for store associates (shared devices),
FIDO2 security keys for corporate users, Azure AD B2B with PIM for external suppliers, and
Password Hash Synchronization [CORRECT]
