10 beginner questions on the AZ-305 skills measured: designing identity, governance and monitoring (managed identities, Log Analytics, management groups), data storage (Azure SQL Database, Azure Cosmos DB, Azure Data Factory), business continuity (RPO, Azure Site Recovery) and infrastructure (messaging services, ExpressRoute).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. An application running on an Azure virtual machine must read secrets from Azure Key Vault. The company does not want any credentials stored in code or configuration files. What should the architect recommend?

    • A. A storage account access key saved in the app settings
    • B. A shared user account protected with multifactor authentication
    • C. A managed identity for the virtual machine ✔ correct
    • D. A client secret embedded in the application code

    Answer: C. A managed identity gives the VM an automatically managed identity in Microsoft Entra ID, which it uses to get tokens for Key Vault. No secret is stored or rotated by the developers.

    Source: learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/over · Domain: Design identity, governance, and monitoring solutions

  2. A company wants to collect logs from many Azure resources in one place and analyze them with Kusto Query Language (KQL). What should the architect recommend as the log store?

    • A. An Azure Monitor Log Analytics workspace ✔ correct
    • B. Azure Advisor recommendations
    • C. An Azure App Configuration store
    • D. A Recovery Services vault

    Answer: A. A Log Analytics workspace is the data store for Azure Monitor Logs. Resources send logs there through diagnostic settings, and you query them with KQL. Advisor only provides recommendations.

    Source: learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overv · Domain: Design identity, governance, and monitoring solutions

  3. A policy assigned to a management group applies by inheritance to all subscriptions under that management group.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Governance conditions applied to a management group cascade by inheritance to all its child management groups and subscriptions, which is why architects place shared policies high in the hierarchy.

    Source: learn.microsoft.com/en-us/azure/governance/management-groups/overview · Domain: Design identity, governance, and monitoring solutions

  4. A company is moving a relational database to Azure and wants a fully managed service where Microsoft handles patching, backups and high availability. Which service should the architect recommend?

    • A. SQL Server on an Azure virtual machine
    • B. Azure SQL Database ✔ correct
    • C. Azure Files
    • D. Azure Blob Storage

    Answer: B. Azure SQL Database is a platform as a service (PaaS) database engine that handles upgrades, patching, backups and monitoring. SQL Server on a VM is IaaS, so the customer manages the operating system and SQL Server.

    Source: learn.microsoft.com/en-us/azure/azure-sql/database/sql-database-paas-overview · Domain: Design data storage solutions

  5. A global app stores flexible JSON documents and needs low-latency reads and writes in several Azure regions, with multi-region writes. Which data service fits best?

    • A. Azure Database for PostgreSQL
    • B. Azure Files
    • C. Azure Table Storage
    • D. Azure Cosmos DB ✔ correct

    Answer: D. Azure Cosmos DB is a NoSQL database with flexible JSON data models, turnkey global distribution and multi-region writes. The other options do not offer multi-region writes for JSON documents.

    Source: learn.microsoft.com/en-us/azure/cosmos-db/overview · Domain: Design data storage solutions

  6. Which Azure service should an architect recommend to build and schedule pipelines that move and transform data between on-premises and cloud data stores?

    • A. Azure Data Factory ✔ correct
    • B. Azure Front Door
    • C. Azure Event Grid
    • D. Azure Bastion

    Answer: A. Azure Data Factory is a cloud data integration service for creating, scheduling and orchestrating data movement and transformation pipelines (ETL and ELT). Event Grid routes events; Front Door routes web traffic.

    Source: learn.microsoft.com/en-us/azure/data-factory/introduction · Domain: Design data storage solutions

  7. A business states that after a disaster it can lose at most 15 minutes of data. Which recovery metric does this requirement define?

    • A. Recovery time objective (RTO)
    • B. Mean time between failures (MTBF)
    • C. Recovery point objective (RPO) ✔ correct
    • D. Service-level agreement (SLA)

    Answer: C. RPO is the maximum acceptable duration of data loss during an incident. RTO is different: it is the maximum acceptable time the application can be unavailable after an incident.

    Source: learn.microsoft.com/en-us/azure/well-architected/reliability/metrics · Domain: Design business continuity solutions

  8. A company wants its Azure virtual machines replicated continuously to a secondary region so it can fail over if the primary region goes down. Which service should the architect recommend?

    • A. Azure Migrate
    • B. Azure Site Recovery ✔ correct
    • C. Azure Advisor
    • D. Azure Storage Explorer

    Answer: B. Azure Site Recovery replicates workloads such as Azure VMs to a secondary location and orchestrates failover and failback. Azure Migrate is for assessing and migrating workloads into Azure, not ongoing disaster recovery.

    Source: learn.microsoft.com/en-us/azure/site-recovery/site-recovery-overview · Domain: Design business continuity solutions

  9. An architect wants application components to communicate asynchronously through messages or events instead of direct calls. Which two Azure services are designed for this? (Select TWO)

    • A. Azure Service Bus ✔ correct
    • B. Azure Event Grid ✔ correct
    • C. Azure Bastion
    • D. Azure DNS
    • E. Azure Policy

    Answer: A, B. Service Bus is an enterprise message broker with queues and topics, and Event Grid is an event routing service; both decouple producers from consumers. Bastion, DNS and Policy are access, naming and governance services.

    Source: learn.microsoft.com/en-us/azure/service-bus-messaging/compare-messaging-services · Domain: Design infrastructure solutions

  10. A company needs a private connection between its on-premises datacenter and Azure that does not travel over the public internet. What should the architect recommend?

    • A. A site-to-site VPN through Azure VPN Gateway
    • B. Virtual network peering
    • C. Azure Front Door
    • D. Azure ExpressRoute ✔ correct

    Answer: D. ExpressRoute connections use a private connection through a connectivity provider and do not go over the public internet. A site-to-site VPN is encrypted but still travels across the internet.

    Source: learn.microsoft.com/en-us/azure/expressroute/expressroute-introduction · Domain: Design infrastructure solutions

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public Microsoft exam objectives (Skills measured as of 2026-04-17), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by Microsoft; exam names are trademarks of their owners. Official exam page: learn.microsoft.com/en-us/credentials/certifications/resources/study-g.

Last modified: Sunday, 25 October 2026, 9:57 PM