WGU E033 | AZ-305 AZURE SOLUTIONS ARCHITECTURE | 2026–2027
WGU E033 AZ-305 Practice Exam
2026–2027 | 110 Original Architecture Scenario Questions & Rationales
Study Focus
Identity and governance: Entra, RBAC, PIM, Conditional Access, Policy, and resource hierarchy.
Network design: Hybrid connectivity, private endpoints, WAF, load balancing, and global routing.
Compute and applications: App Service, Functions, AKS, Container Apps, VM resilience, and IaC.
Data platforms: Blob, Files, Azure SQL, Cosmos DB, data integration, and redundancy.
Security and business continuity: Defender, Sentinel, backup, Site Recovery, encryption, RPO and RTO.
Monitoring and cost: Azure Monitor, Application Insights, Advisor, budgets, and purchasing models.
Instructions: Choose the single best architecture option. For every answer, explain why the service meets
the design constraint and why the alternatives do not.
Independent practice material • Page 1
,WGU E033 | AZ-305 AZURE SOLUTIONS ARCHITECTURE | 2026–2027
Identity & governance
Question 1. An Azure solution architect must grant an app access to Azure resources without
storing client secrets. Which design is the BEST fit?
A. Embed a service principal secret in source code
B. Use a shared administrator account
C. Publish a storage account key
D. Use a managed identity
Correct Answer: D. Use a managed identity
Detailed Rationale: Managed identities obtain Entra-issued tokens without application-managed
secrets Validate the selected configuration against workload-specific requirements.
Why the Other Options Are Incorrect: A — Embed a service principal secret in source code does not
directly meet the stated design requirement or introduces avoidable risk or operational limitations.
B — Use a shared administrator account does not directly meet the stated design requirement or
introduces avoidable risk or operational limitations. C — Publish a storage account key does not
directly meet the stated design requirement or introduces avoidable risk or operational limitations.
Question 2. An Azure solution architect must allow a partner company to collaborate without
creating local employee identities. Which design is the BEST fit?
A. Use Microsoft Entra B2B collaboration
B. Create shared generic logins
C. Expose the tenant global administrator account
D. Disable authentication
Correct Answer: A. Use Microsoft Entra B2B collaboration
Detailed Rationale: B2B supports external guest identities and controlled access Validate the
selected configuration against workload-specific requirements.
Independent practice material • Page 2
,WGU E033 | AZ-305 AZURE SOLUTIONS ARCHITECTURE | 2026–2027
Why the Other Options Are Incorrect: B — Create shared generic logins does not directly meet the
stated design requirement or introduces avoidable risk or operational limitations. C — Expose the
tenant global administrator account does not directly meet the stated design requirement or
introduces avoidable risk or operational limitations. D — Disable authentication does not directly
meet the stated design requirement or introduces avoidable risk or operational limitations.
Question 3. An Azure solution architect must restrict privileged administration to approved time
windows. Which design is the BEST fit?
A. Configure only DNS records
B. Use Privileged Identity Management eligible assignments
C. Assign permanent Owner access to everyone
D. Use storage lifecycle rules
Correct Answer: B. Use Privileged Identity Management eligible assignments
Detailed Rationale: PIM supports just-in-time role activation and approval controls Validate the
selected configuration against workload-specific requirements.
Why the Other Options Are Incorrect: A — Configure only DNS records does not directly meet the
stated design requirement or introduces avoidable risk or operational limitations. C — Assign
permanent Owner access to everyone does not directly meet the stated design requirement or
introduces avoidable risk or operational limitations. D — Use storage lifecycle rules does not
directly meet the stated design requirement or introduces avoidable risk or operational limitations.
Question 4. An Azure solution architect must limit access based on device compliance and user
risk. Which design is the BEST fit?
A. Enable unrestricted anonymous access
B. Use only blob versioning
C. Use Conditional Access policies
D. Use Azure DNS alone
Correct Answer: C. Use Conditional Access policies
Detailed Rationale: Conditional Access evaluates identity and device conditions for access
decisions Validate the selected configuration against workload-specific requirements.
Why the Other Options Are Incorrect: A — Enable unrestricted anonymous access does not directly
meet the stated design requirement or introduces avoidable risk or operational limitations. B — Use
Independent practice material • Page 3
, WGU E033 | AZ-305 AZURE SOLUTIONS ARCHITECTURE | 2026–2027
only blob versioning does not directly meet the stated design requirement or introduces avoidable
risk or operational limitations. D — Use Azure DNS alone does not directly meet the stated design
requirement or introduces avoidable risk or operational limitations.
Question 5. An Azure solution architect must assign permissions to a resource group with least
privilege. Which design is the BEST fit?
A. Grant tenant-wide Global Administrator
B. Use NSGs as identity roles
C. Share the subscription owner password
D. Use Azure RBAC at the resource-group scope
Correct Answer: D. Use Azure RBAC at the resource-group scope
Detailed Rationale: RBAC roles and scopes determine resource-management authorization
Validate the selected configuration against workload-specific requirements.
Why the Other Options Are Incorrect: A — Grant tenant-wide Global Administrator does not directly
meet the stated design requirement or introduces avoidable risk or operational limitations. B — Use
NSGs as identity roles does not directly meet the stated design requirement or introduces
avoidable risk or operational limitations. C — Share the subscription owner password does not
directly meet the stated design requirement or introduces avoidable risk or operational limitations.
Question 6. An Azure solution architect must prevent teams from deploying resources outside
approved regions. Which design is the BEST fit?
A. Use Azure Policy allowed-locations initiative
B. Use a resource lock only
C. Configure Azure Monitor alerts only
D. Use Microsoft Defender for Endpoint alone
Correct Answer: A. Use Azure Policy allowed-locations initiative
Detailed Rationale: Policy evaluates and enforces deployment standards Validate the selected
configuration against workload-specific requirements.
Why the Other Options Are Incorrect: B — Use a resource lock only does not directly meet the
stated design requirement or introduces avoidable risk or operational limitations. C — Configure
Azure Monitor alerts only does not directly meet the stated design requirement or introduces
Independent practice material • Page 4
WGU E033 AZ-305 Practice Exam
2026–2027 | 110 Original Architecture Scenario Questions & Rationales
Study Focus
Identity and governance: Entra, RBAC, PIM, Conditional Access, Policy, and resource hierarchy.
Network design: Hybrid connectivity, private endpoints, WAF, load balancing, and global routing.
Compute and applications: App Service, Functions, AKS, Container Apps, VM resilience, and IaC.
Data platforms: Blob, Files, Azure SQL, Cosmos DB, data integration, and redundancy.
Security and business continuity: Defender, Sentinel, backup, Site Recovery, encryption, RPO and RTO.
Monitoring and cost: Azure Monitor, Application Insights, Advisor, budgets, and purchasing models.
Instructions: Choose the single best architecture option. For every answer, explain why the service meets
the design constraint and why the alternatives do not.
Independent practice material • Page 1
,WGU E033 | AZ-305 AZURE SOLUTIONS ARCHITECTURE | 2026–2027
Identity & governance
Question 1. An Azure solution architect must grant an app access to Azure resources without
storing client secrets. Which design is the BEST fit?
A. Embed a service principal secret in source code
B. Use a shared administrator account
C. Publish a storage account key
D. Use a managed identity
Correct Answer: D. Use a managed identity
Detailed Rationale: Managed identities obtain Entra-issued tokens without application-managed
secrets Validate the selected configuration against workload-specific requirements.
Why the Other Options Are Incorrect: A — Embed a service principal secret in source code does not
directly meet the stated design requirement or introduces avoidable risk or operational limitations.
B — Use a shared administrator account does not directly meet the stated design requirement or
introduces avoidable risk or operational limitations. C — Publish a storage account key does not
directly meet the stated design requirement or introduces avoidable risk or operational limitations.
Question 2. An Azure solution architect must allow a partner company to collaborate without
creating local employee identities. Which design is the BEST fit?
A. Use Microsoft Entra B2B collaboration
B. Create shared generic logins
C. Expose the tenant global administrator account
D. Disable authentication
Correct Answer: A. Use Microsoft Entra B2B collaboration
Detailed Rationale: B2B supports external guest identities and controlled access Validate the
selected configuration against workload-specific requirements.
Independent practice material • Page 2
,WGU E033 | AZ-305 AZURE SOLUTIONS ARCHITECTURE | 2026–2027
Why the Other Options Are Incorrect: B — Create shared generic logins does not directly meet the
stated design requirement or introduces avoidable risk or operational limitations. C — Expose the
tenant global administrator account does not directly meet the stated design requirement or
introduces avoidable risk or operational limitations. D — Disable authentication does not directly
meet the stated design requirement or introduces avoidable risk or operational limitations.
Question 3. An Azure solution architect must restrict privileged administration to approved time
windows. Which design is the BEST fit?
A. Configure only DNS records
B. Use Privileged Identity Management eligible assignments
C. Assign permanent Owner access to everyone
D. Use storage lifecycle rules
Correct Answer: B. Use Privileged Identity Management eligible assignments
Detailed Rationale: PIM supports just-in-time role activation and approval controls Validate the
selected configuration against workload-specific requirements.
Why the Other Options Are Incorrect: A — Configure only DNS records does not directly meet the
stated design requirement or introduces avoidable risk or operational limitations. C — Assign
permanent Owner access to everyone does not directly meet the stated design requirement or
introduces avoidable risk or operational limitations. D — Use storage lifecycle rules does not
directly meet the stated design requirement or introduces avoidable risk or operational limitations.
Question 4. An Azure solution architect must limit access based on device compliance and user
risk. Which design is the BEST fit?
A. Enable unrestricted anonymous access
B. Use only blob versioning
C. Use Conditional Access policies
D. Use Azure DNS alone
Correct Answer: C. Use Conditional Access policies
Detailed Rationale: Conditional Access evaluates identity and device conditions for access
decisions Validate the selected configuration against workload-specific requirements.
Why the Other Options Are Incorrect: A — Enable unrestricted anonymous access does not directly
meet the stated design requirement or introduces avoidable risk or operational limitations. B — Use
Independent practice material • Page 3
, WGU E033 | AZ-305 AZURE SOLUTIONS ARCHITECTURE | 2026–2027
only blob versioning does not directly meet the stated design requirement or introduces avoidable
risk or operational limitations. D — Use Azure DNS alone does not directly meet the stated design
requirement or introduces avoidable risk or operational limitations.
Question 5. An Azure solution architect must assign permissions to a resource group with least
privilege. Which design is the BEST fit?
A. Grant tenant-wide Global Administrator
B. Use NSGs as identity roles
C. Share the subscription owner password
D. Use Azure RBAC at the resource-group scope
Correct Answer: D. Use Azure RBAC at the resource-group scope
Detailed Rationale: RBAC roles and scopes determine resource-management authorization
Validate the selected configuration against workload-specific requirements.
Why the Other Options Are Incorrect: A — Grant tenant-wide Global Administrator does not directly
meet the stated design requirement or introduces avoidable risk or operational limitations. B — Use
NSGs as identity roles does not directly meet the stated design requirement or introduces
avoidable risk or operational limitations. C — Share the subscription owner password does not
directly meet the stated design requirement or introduces avoidable risk or operational limitations.
Question 6. An Azure solution architect must prevent teams from deploying resources outside
approved regions. Which design is the BEST fit?
A. Use Azure Policy allowed-locations initiative
B. Use a resource lock only
C. Configure Azure Monitor alerts only
D. Use Microsoft Defender for Endpoint alone
Correct Answer: A. Use Azure Policy allowed-locations initiative
Detailed Rationale: Policy evaluates and enforces deployment standards Validate the selected
configuration against workload-specific requirements.
Why the Other Options Are Incorrect: B — Use a resource lock only does not directly meet the
stated design requirement or introduces avoidable risk or operational limitations. C — Configure
Azure Monitor alerts only does not directly meet the stated design requirement or introduces
Independent practice material • Page 4
