Microsoft AZ-305: Designing Microsoft Azure Infrastructure Solutions

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Design governance and security

   A company with 40 subscriptions needs every subscription to enforce the same allowed Azure regions and required tags, with new subscriptions inheriting these rules automatically. Which design achieves this?

   1. ATags applied manually to each resource at deployment, with tag values typed in by an operator
   2. BA policy assigned separately to each subscription by hand with custom settings
   3. CManagement group hierarchy with Azure Policy assignments at the management group level
   4. DA shared spreadsheet listing approved regions and required tags, which staff review each quarter
   Show answer and explanationHide answer

   Correct answer: C

   Policy assigned at a management group is inherited by all child subscriptions, including new ones, which enforces consistency at scale. Manual per-subscription assignments drift, manual tags are not enforced, and spreadsheets do not enforce anything.

2. Question 2Design infrastructure solutions

   An organization needs a private, high-bandwidth connection between its on-premises network and Azure, with a service-level commitment for availability. Which connectivity service should be recommended?

   1. AAzure ExpressRoute with redundant circuits
   2. BPublic internet with TLS 1.2 encryption
   3. CA single site-to-site VPN tunnel with BGP disabled
   4. DAzure Bastion for browser-based RDP and SSH access
   Show answer and explanationHide answer

   Correct answer: A

   ExpressRoute provides private, high-bandwidth connectivity with service-level commitments, and redundant circuits improve availability. A single VPN tunnel has lower bandwidth and availability, public internet paths are not private, and Bastion provides administrative access.

3. Question 3Design data storage solutions

   A database VM needs very low latency and high IOPS for its data disks. Which disk type is most appropriate?

   1. AAzure Files Cool tier
   2. BStandard HDD managed disk
   3. CPremium SSD v2 or Ultra Disk
   4. DAzure Blob Storage archive tier
   Show answer and explanationHide answer

   Correct answer: C

   Premium SSD v2 and Ultra Disks provide high IOPS and low latency for demanding database workloads. HDDs are slow, archive tiers are for rarely accessed blobs, and Cool file tiers are not VM data disks.

4. Question 4Design network solutions

   A company must allow its on-premises users to reach a private web application in Azure through an internal load balancer, without exposing the app to the internet. Which design achieves this?

   1. AA public load balancer with an open inbound firewall rule that permits sources from the internet
   2. BAn internal load balancer and private IP addresses reached over ExpressRoute or VPN
   3. CEmail-based access to the application through a shared mailbox relay gateway
   4. DPublic IP addresses assigned directly to each VM's network interface behind a permissive NSG
   Show answer and explanationHide answer

   Correct answer: B

   Internal load balancers and private addresses keep the application off the internet, and ExpressRoute or VPN provide the private path from on-premises. Public load balancers, public VMs and email access expose or fail to serve the application.

5. Question 5Design business continuity solutions

   An application must fail over to a second region within minutes if the primary region fails. Which pattern and service fit this requirement?

   1. AA cold backup stored in the same region and restored manually after an outage
   2. BActive-passive design with failover groups or Azure Site Recovery
   3. CA manual restore from tape in a week during business hours
   4. DA single region with no failover so data and compute stay within one region
   Show answer and explanationHide answer

   Correct answer: B

   An active-passive design with failover groups or Site Recovery can restore service in a secondary region within a short recovery time. Single-region deployments, tape restores and same-region backups cannot meet a fast regional failover target.