Microsoft Azure Solutions Architect AZ-305 2026
Latest Comprehensive Study Guide with Practice
Questions, Cloud Architecture Review, Verified
Answers, Detailed Explanations & Success Workbook
INTRODUCTION
This comprehensive study guide contains 100 practice questions of the Microsoft
AZ-305: Designing Microsoft Azure Infrastructure Solutions certification
examination — updated for the April 17, 2026 exam changes.
Exam Overview
What's New in the April 17, 2026 Update
The AZ-305 exam was updated on April 17, 2026 with the following key changes:
• Expanded Entra ID coverage — More focus on identity protection,
privileged identity management, and external identities
• Container services — Increased emphasis on Azure Container Apps and
AKS architecture decisions
• Storage tiers — Enhanced coverage of storage tier selection and lifecycle
management
• Monitoring — Expanded focus on Azure Monitor Insights, Log Analytics,
and application monitoring
• Cost optimization — New emphasis on cost management and optimization
strategies
DOMAIN 1: DESIGN IDENTITY, GOVERNANCE, AND MONITORING
SOLUTIONS (25–30%)
Questions 1–28
,Question 1
You are designing an identity solution for a large enterprise that has 15,000 on-
premises Active Directory users. The company wants to migrate to Microsoft
Entra ID while maintaining the ability to authenticate users when the internet
connection is unavailable. Users should have a single sign-on experience for both
cloud and on-premises applications. Which identity solution should you
recommend?
A) Microsoft Entra ID with cloud-only identities
B) Microsoft Entra ID with Passthrough Authentication and Seamless SSO
C) Microsoft Entra ID with Password Hash Synchronization only
D) Microsoft Entra ID Connect with Active Directory Federation Services (AD
FS)
Answer: B) Microsoft Entra ID with Passthrough Authentication and
Seamless SSO
Rationale: Passthrough Authentication validates user passwords against on-
premises Active Directory, allowing authentication when the internet is available.
Seamless SSO provides a single sign-on experience. This solution meets the
requirement for maintaining on-premises authentication while providing SSO.
Cloud-only identities (A) would not work with on-premises AD. Password Hash
Synchronization (C) would allow authentication even when internet is unavailable
but requires password hashes to be synced to the cloud, which may not meet
security requirements. AD FS (D) provides SSO but adds complexity and requires
additional infrastructure.
Question 2
Your company has multiple Azure subscriptions. You need to centrally manage
Azure Policy assignments across all subscriptions and ensure that new
subscriptions automatically inherit the policies. What should you configure?
A) Assign policies to each subscription individually
B) Create a management group hierarchy and assign policies at the root
management group level
C) Use Azure Blueprints with policy assignments
D) Use Azure Resource Manager templates to deploy policies to each subscription
,Answer: B) Create a management group hierarchy and assign policies at the
root management group level
Rationale: Management groups provide hierarchical organization for
subscriptions. Policies assigned at a management group level are inherited by all
child subscriptions and management groups. This ensures consistency and
automatic application to new subscriptions. Individual assignments (A) are not
scalable. Azure Blueprints (C) can package policies but don't provide inheritance.
ARM templates (D) would require manual execution for each subscription.
Question 3
Your organization needs to monitor all Azure resources across multiple
subscriptions. The solution must provide a single pane of glass for viewing
metrics, logs, and alerts. Which Azure service should you recommend?
A) Azure Monitor with Log Analytics workspaces and Application Insights
B) Azure Service Health
C) Azure Advisor
D) Azure Security Center
Answer: A) Azure Monitor with Log Analytics workspaces and Application
Insights
Rationale: Azure Monitor provides centralized monitoring across subscriptions,
with Log Analytics for log data and Application Insights for application
performance monitoring. This provides a single pane of glass for metrics, logs, and
alerts. Service Health (B) only shows service status. Advisor (C) provides
recommendations. Security Center (D) focuses on security, not comprehensive
monitoring.
Question 4
Your company is designing a hybrid identity solution that must support self-
service password reset (SSPR) for users who are working remotely. Users must
be able to reset their passwords without IT intervention. What is the minimum
license requirement for all users who need SSPR?
, A) Microsoft 365 Business Basic
B) Microsoft Entra ID Free
C) Microsoft Entra ID Premium P1
D) Microsoft Entra ID Premium P2
Answer: C) Microsoft Entra ID Premium P1
Rationale: Microsoft Entra ID Premium P1 is the minimum license required for
SSPR. Entra ID Free (B) does not include SSPR. Microsoft 365 Business Basic (A)
does not include Entra ID Premium features. Premium P2 (D) includes additional
features like identity protection but is not required for SSPR.
Question 5
You are designing a governance solution for a company with 500 Azure
subscriptions. The company needs to restrict the creation of resources to
specific Azure regions and enforce tagging on all resources. What is the most
efficient approach?
A) Create an Azure Policy for region restrictions and tag enforcement at
the management group level
B) Assign Azure Policies to each subscription individually
C) Use Azure Blueprints with region restrictions
D) Use Azure Resource Graph to monitor resources
Answer: A) Create an Azure Policy for region restrictions and tag
enforcement at the management group level
Rationale: Management groups provide hierarchical organization for
subscriptions. Policies assigned at the management group level are inherited by all
child subscriptions, providing the most efficient governance at scale. Individual
assignments (B) would be inefficient for 500 subscriptions. Blueprints (C) are for
packaging artifacts, not policy enforcement. Resource Graph (D) is for querying,
not enforcement.
Question 6
Latest Comprehensive Study Guide with Practice
Questions, Cloud Architecture Review, Verified
Answers, Detailed Explanations & Success Workbook
INTRODUCTION
This comprehensive study guide contains 100 practice questions of the Microsoft
AZ-305: Designing Microsoft Azure Infrastructure Solutions certification
examination — updated for the April 17, 2026 exam changes.
Exam Overview
What's New in the April 17, 2026 Update
The AZ-305 exam was updated on April 17, 2026 with the following key changes:
• Expanded Entra ID coverage — More focus on identity protection,
privileged identity management, and external identities
• Container services — Increased emphasis on Azure Container Apps and
AKS architecture decisions
• Storage tiers — Enhanced coverage of storage tier selection and lifecycle
management
• Monitoring — Expanded focus on Azure Monitor Insights, Log Analytics,
and application monitoring
• Cost optimization — New emphasis on cost management and optimization
strategies
DOMAIN 1: DESIGN IDENTITY, GOVERNANCE, AND MONITORING
SOLUTIONS (25–30%)
Questions 1–28
,Question 1
You are designing an identity solution for a large enterprise that has 15,000 on-
premises Active Directory users. The company wants to migrate to Microsoft
Entra ID while maintaining the ability to authenticate users when the internet
connection is unavailable. Users should have a single sign-on experience for both
cloud and on-premises applications. Which identity solution should you
recommend?
A) Microsoft Entra ID with cloud-only identities
B) Microsoft Entra ID with Passthrough Authentication and Seamless SSO
C) Microsoft Entra ID with Password Hash Synchronization only
D) Microsoft Entra ID Connect with Active Directory Federation Services (AD
FS)
Answer: B) Microsoft Entra ID with Passthrough Authentication and
Seamless SSO
Rationale: Passthrough Authentication validates user passwords against on-
premises Active Directory, allowing authentication when the internet is available.
Seamless SSO provides a single sign-on experience. This solution meets the
requirement for maintaining on-premises authentication while providing SSO.
Cloud-only identities (A) would not work with on-premises AD. Password Hash
Synchronization (C) would allow authentication even when internet is unavailable
but requires password hashes to be synced to the cloud, which may not meet
security requirements. AD FS (D) provides SSO but adds complexity and requires
additional infrastructure.
Question 2
Your company has multiple Azure subscriptions. You need to centrally manage
Azure Policy assignments across all subscriptions and ensure that new
subscriptions automatically inherit the policies. What should you configure?
A) Assign policies to each subscription individually
B) Create a management group hierarchy and assign policies at the root
management group level
C) Use Azure Blueprints with policy assignments
D) Use Azure Resource Manager templates to deploy policies to each subscription
,Answer: B) Create a management group hierarchy and assign policies at the
root management group level
Rationale: Management groups provide hierarchical organization for
subscriptions. Policies assigned at a management group level are inherited by all
child subscriptions and management groups. This ensures consistency and
automatic application to new subscriptions. Individual assignments (A) are not
scalable. Azure Blueprints (C) can package policies but don't provide inheritance.
ARM templates (D) would require manual execution for each subscription.
Question 3
Your organization needs to monitor all Azure resources across multiple
subscriptions. The solution must provide a single pane of glass for viewing
metrics, logs, and alerts. Which Azure service should you recommend?
A) Azure Monitor with Log Analytics workspaces and Application Insights
B) Azure Service Health
C) Azure Advisor
D) Azure Security Center
Answer: A) Azure Monitor with Log Analytics workspaces and Application
Insights
Rationale: Azure Monitor provides centralized monitoring across subscriptions,
with Log Analytics for log data and Application Insights for application
performance monitoring. This provides a single pane of glass for metrics, logs, and
alerts. Service Health (B) only shows service status. Advisor (C) provides
recommendations. Security Center (D) focuses on security, not comprehensive
monitoring.
Question 4
Your company is designing a hybrid identity solution that must support self-
service password reset (SSPR) for users who are working remotely. Users must
be able to reset their passwords without IT intervention. What is the minimum
license requirement for all users who need SSPR?
, A) Microsoft 365 Business Basic
B) Microsoft Entra ID Free
C) Microsoft Entra ID Premium P1
D) Microsoft Entra ID Premium P2
Answer: C) Microsoft Entra ID Premium P1
Rationale: Microsoft Entra ID Premium P1 is the minimum license required for
SSPR. Entra ID Free (B) does not include SSPR. Microsoft 365 Business Basic (A)
does not include Entra ID Premium features. Premium P2 (D) includes additional
features like identity protection but is not required for SSPR.
Question 5
You are designing a governance solution for a company with 500 Azure
subscriptions. The company needs to restrict the creation of resources to
specific Azure regions and enforce tagging on all resources. What is the most
efficient approach?
A) Create an Azure Policy for region restrictions and tag enforcement at
the management group level
B) Assign Azure Policies to each subscription individually
C) Use Azure Blueprints with region restrictions
D) Use Azure Resource Graph to monitor resources
Answer: A) Create an Azure Policy for region restrictions and tag
enforcement at the management group level
Rationale: Management groups provide hierarchical organization for
subscriptions. Policies assigned at the management group level are inherited by all
child subscriptions, providing the most efficient governance at scale. Individual
assignments (B) would be inefficient for 500 subscriptions. Blueprints (C) are for
packaging artifacts, not policy enforcement. Resource Graph (D) is for querying,
not enforcement.
Question 6
