Free study guide · Azure
How to pass the Exam AZ-305: Designing Microsoft Azure Infrastructure Solutions
What the exam covers, how to plan your study, and how to read its questions. From the CertLumen course for this exam, kept up to date with the official exam guide.
- Questions
- 50
- Time
- 100 minutes
- Passing score
- 700 on a scale of 1 to 1000
- Exam fee
- USD 165 for associate and expert exams in the US (price varies by country or region; plus applicable taxes)
- Valid for
- 1 year (renew free every year with an online assessment on Microsoft Learn, opening 6 months before expiry)
- Delivery
- Online proctored or test center, through Pearson VUE
What the exam covers
Design identity, governance, and monitoring solutions28%
Design data storage solutions22%
Design business continuity solutions17%
Design infrastructure solutions33%
A study plan that works
The default path for Azure administrators who know the portal and the CLI (AZ-104 level) but have not yet designed solutions against requirements. It covers all 21 lessons and all 8 labs in order, with a section drill after each of the four sections and daily flashcards. The four mock exams come on the last four days. Section 4 (infrastructure) carries the most questions on the real exam and gets the most days. Light days are deliberately light so you can move a task to a catch-up day. Plan on about 1.5–2.5 hours a day.
| Day | Focus | Time |
|---|---|---|
| 1 | Logging, routing logs and monitoring | 95 min |
| 2 | Authentication, identity and authorization | 100 min |
| 3 | Secrets, certificates and keys, then the first lab | 100 min |
| 4 | Governance, compliance and identity governance, then the second lab | 115 min |
| 5 | Section 1 drill | 75 min |
| 6 | Relational data: service, tier, scale and protection | 85 min |
| 7 | Semi-structured and unstructured data, then the storage lab | 95 min |
| 8 | Data integration and analysis, then the database lab | 100 min |
| 9 | Section 2 drill and recovery objectives | 100 min |
| 10 | Azure Backup and high availability for compute | 100 min |
| 11 | High availability for data, then the continuity lab | 115 min |
| 12 | Data DR lab and Section 3 drill | 100 min |
| 13 | Compute, containers and serverless | 95 min |
| 14 | Messaging, events, APIs, caching and deployment | 100 min |
| 15 | Migration and connectivity | 110 min |
| 16 | Network performance, security and load balancing, then the event lab | 120 min |
| 17 | Network lab and the Section 4 drill | 150 min |
| 18 | Mock Exam 1 | 160 min |
| 19 | Mock Exam 2 | 160 min |
| 20 | Mock Exam 3 | 160 min |
| 21 | Mock Exam 4 and final review | 160 min |
Exam strategy
How the exam works
Exam AZ-305: Designing Microsoft Azure Infrastructure Solutions is the single exam for the Microsoft Certified: Azure Solutions Architect Expert certification. It does not ask you to click through a portal wizard. It gives you business and technical requirements and asks which Azure service, tier or design meets all of them at the lowest cost and effort. The English version was last updated on April 17, 2026; localized versions follow about eight weeks later.
| Fact | Detail (from the exam page, study guide and exam policy pages) |
|---|---|
| Questions | Not published. Most Microsoft exams have 40 to 60; this course's mock exams use 50 |
| Time | 100 minutes. 120 minutes if the exam includes labs; you are told when you register. Allow 120 minutes of seat time (140 with labs) for instructions, the agreement and comments |
| Question types | Not announced in advance. Expect multiple choice, multiple select, drag and drop, build list, hot area and case studies. Labs are possible. Some items are unscored and you cannot tell which |
| Passing score | 700 on a scaled range of 1 to 1000. It is not 70 percent of the points |
| Scoring | No penalty for guessing. Most multi-part questions give one point per correct component, so partial credit exists |
| Skills measured | As of April 17, 2026: identity, governance and monitoring 25 to 30%; data storage 20 to 25%; business continuity 15 to 20%; infrastructure 30 to 35% |
| Delivery | Pearson VUE, either online proctored (OnVUE) or at a test centre |
| Price | Typically US$165 for associate and expert exams in the US. It varies by country or region and taxes may apply |
| Languages | English, Japanese, Chinese (Simplified), Korean, German, French, Spanish, Portuguese (Brazil), Chinese (Traditional), Italian. If the exam is not in your language you can request 30 extra minutes |
| Microsoft Learn | Available during the exam: everything on learn.microsoft.com except Q&A, practice assessments and your profile. The timer keeps running |
| Prerequisite | The certification requires Azure Administrator Associate (AZ-104). The exam page does not make AZ-104 a precondition for registering, but check your Learn profile before you book |
| Validity | One year. Renew free every year with an unproctored, open-book online assessment on Microsoft Learn during the six months before expiry |
| Retake | Wait 24 hours after the first fail, then 14 days between later attempts. At most five attempts in 12 months. You pay for each attempt |
This course's questions are not graded like the real exam
The mock exams and drills here score a question as right only when every correct option is selected and nothing else. The real exam can give partial credit on multi-part items. Practise as if you had to find every correct option. That habit costs nothing on the real exam and wins points on the multiple-select items.
How this course maps to the exam
| Course section | Real skill area | Exam weight (range) | Course weight | Lessons |
|---|---|---|---|---|
| r1 | Design identity, governance, and monitoring solutions | 25–30% | 28 | 6 |
| r2 | Design data storage solutions | 20–25% | 22 | 4 |
| r3 | Design business continuity solutions | 15–20% | 17 | 4 |
| r4 | Design infrastructure solutions | 30–35% | 33 | 7 |
The course weights are the midpoints of Microsoft's ranges, rounded to sum to 100. A 50-question mock exam draws 14, 11, 8 and 17 questions from the four sections.
What the exam really tests
Almost every question is a filter exercise. The stem lists constraints such as *minimal administration*, *lowest cost*, *RPO of five minutes*, *no inbound firewall ports*, *must stay in one region* or *existing SQL Server Agent jobs*. Usually one option satisfies all the constraints and the others break one. The skill is to find the constraint that eliminates options, not to know every feature of every service.
- Requirements first. Underline numbers (RTO, RPO, TB, Gbps, days), protocols (HTTP, TCP, SMB, Kerberos), scope words (global, regional, zone) and verbs (minimize, ensure, prevent, audit).
- Least effort that meets every requirement. If two options both work, the exam wants the one with less operational overhead, then the lower cost.
- Newest recommended service. Where Microsoft has a replacement (Entra External ID for B2C, Azure Managed Redis for Azure Cache for Redis, Fabric for a new analytics build), the current one is the answer unless the stem describes an existing estate.
- Do not over-engineer. Zone redundancy beats a second region when the stem only says datacenter failure. A second region is for regional disasters or residency in two geographies.
Pacing
| Moment | Plan | Why |
|---|---|---|
| Start | Read the introduction screen: number of case studies, questions and labs, and the exam time | It tells you whether labs are present and how many case studies you must budget for |
| Standalone questions | About 1.5 minutes each on average. Answer, mark for review if unsure, move on | 50 questions at 1.5 minutes leaves about 25 minutes for case studies, lookups and review |
| Case studies | Read the requirements and constraints once, then answer. The scenario stays open for every question, so do not memorise it | Case studies are not timed separately; the clock is shared |
| Learn lookups | Use them only for a number or a limit you cannot recall, for a few questions in total | Extra time is not added and lookups are not meant for every question |
| Breaks | Five minutes are built into the exam time. Taking one stops you from going back to questions seen before it | The clock keeps running during a break; answer and review first |
| Last 10 minutes | Review marked questions, then any multiple-select where you chose fewer options than the stem asks for | Check the count in the stem: (Choose two.) or (Choose three.) |
You cannot go back after leaving a case study or a section
Once you leave a case study or move to the next section you cannot return to it. A break also closes access to everything seen before it. Use the review screen at the end of each case study, because that is the last chance to change answers there.
How to read a question
- Read the last sentence first. It says what to recommend and how many answers to select.
- List the hard constraints (numbers, protocols, scope words, compliance words) and the soft ones (cost, effort).
- Name the category before you look at the options: logging or monitoring, authentication or authorization, relational or non-relational data, backup or disaster recovery, compute, messaging, network.
- Eliminate by constraint. Strike every option that breaks a hard constraint; most questions are decided here.
- Check for the lookalike. Options often differ by one word: activity log versus resource log, backup versus replication, Front Door versus Traffic Manager, Event Hubs versus Event Grid, geo-restore versus failover group.
- Check completeness for multiple-select. Judge every option on its own as true or false for the stem, then count.
Traps that repeat across the exam
Section 1: identity, governance and monitoring
- The activity log records control-plane operations and is kept 90 days. Reading a secret or a blob is a resource log and needs a diagnostic setting.
- Contributor cannot read blob data or assign roles. Data access needs a data-plane role such as Storage Blob Data Reader; assigning roles needs Owner, User Access Administrator or Role Based Access Control Administrator.
- NotActions is not a deny. Deny assignments are created by Azure for features such as deployment stacks, not by you.
- Password hash synchronization is the default hybrid sign-in recommendation. Federation is right only when the stem requires something it uniquely provides.
- Conditional Access needs P1, Identity Protection and PIM need P2 (or ID Governance), and security defaults are the free option. Always exclude break-glass accounts and test in report-only mode.
- Azure AD B2C is closed to new customers: the new customer-identity answer is Microsoft Entra External ID.
- Key Vault soft delete is always on; purge protection is optional and required for customer-managed keys. Managed HSM is single-tenant; Azure Dedicated HSM takes no new customers.
- Do not assign policy or access at the tenant root management group. Use an intermediate organization group.
- A resource group is not a quota or billing boundary; a subscription is. Tags are not inherited unless you enforce inheritance, and management groups cannot be tagged.
Section 2: data storage
- SQL Managed Instance is chosen for compatibility (SQL Agent, cross-database queries, linked servers), not for scale. A database above 4 TB is a Hyperscale clue.
- Serverless exists only in General Purpose and Hyperscale on standard-series hardware; Hyperscale serverless auto-pause is in preview. Business Critical is provisioned only.
- Dynamic data masking is not encryption and TDE is not protection from administrators. Keeping plaintext from the engine and its administrators is Always Encrypted.
- Archive tier needs an LRS, GRS or RA-GRS account, is offline, and takes up to 15 hours to rehydrate. A lifecycle policy cannot rehydrate.
- Redundancy is not backup. LRS to GZRS copy deletions and corruption to every replica.
- Cosmos DB Strong consistency is not allowed with multiple write regions. Free tier can be chosen only at account creation. Session is the default.
Section 3: business continuity
- Site Recovery is not backup and Azure Backup is not disaster recovery. A stem with a region failure and two short numbers is Site Recovery; a stem with deleted files or a seven-year retention is Azure Backup.
- For Azure-to-Azure replication the Recovery Services vault goes in the target region.
- An availability set protects against rack failure in one datacenter (99.95%); availability zones protect against datacenter failure (99.99%). A VM is in one or the other.
- Zone redundancy for Azure SQL gives RPO 0 and an RTO of seconds with no application change. Failover groups are for regions; geo-restore is hours and loses data.
- A vault's storage redundancy is fixed once the first item is protected. GRS gives no read access to the secondary; RA-GRS or RA-GZRS do (not for Azure Files).
Section 4: infrastructure
- Service Bus for commands (order, sessions, duplicate detection, dead-letter queue); Event Grid for discrete events and no backlog; Event Hubs for streams, replay and Kafka.
- Container Apps has no Kubernetes API. If the stem needs kubectl, CRDs or a custom mesh, the answer is AKS.
- Spot VMs never hold state or carry a required SLA. Azure Batch is free; you pay for the pool.
- Azure Managed Redis replaces Azure Cache for Redis. Basic, Standard and Premium retire on 30 September 2028; Enterprise tiers on 31 March 2027.
- Right-size from performance data, not from as-is configuration. Use Data Box when the transfer time exceeds the window.
- VNet peering is not transitive. Spoke-to-spoke traffic needs a firewall or NVA with user-defined routes, or Virtual WAN.
- ExpressRoute is not encrypted by default. Add MACsec on ExpressRoute Direct or an IPsec VPN over private peering.
- Traffic Manager fails over slowly because of DNS caching. Front Door fails over fast and adds WAF and caching.
- Retired or retiring: Application Gateway v1 (28 April 2026), Basic Load Balancer (30 September 2025), Front Door (classic) (31 March 2027), NSG flow logs (30 September 2027, use virtual network flow logs).
Words that point to the answer
Phrases in a question that usually point to one answer. The course has the full list.
| When the question says | Think of |
|---|---|
| Which log shows who created or deleted a resource? | Activity log (90 days, free) |
| Audit logs must be kept 7 years, rarely queried, lowest cost | Log Analytics Auxiliary plan with long-term retention (up to 12 years) or a storage account with an immutability policy |
| Send Azure resource logs to a third-party SIEM in near real time | Event Hubs in a diagnostic setting |
| Security operations centre correlating logs from many sources, incidents, playbooks | Microsoft Sentinel |
| Force MFA for admins and a trusted location for apps, different rules per group | Conditional Access (Entra ID P1), with security defaults turned off |
| Hybrid users, simplest sign-in that works if on-premises is down | Password hash synchronization |
| Legacy app needs LDAP, Kerberos, NTLM and domain join, no domain controllers to patch | Microsoft Entra Domain Services |
| Customer-facing app, social sign-in, new design | Microsoft Entra External ID |
| Admins need temporary elevation with approval and MFA | Privileged Identity Management (eligible assignments) |
| Publish an internal web app to remote users, no inbound firewall ports, pre-authenticate | Microsoft Entra application proxy |
Revise from the cheat sheet
The course's cheat sheet has a page for each of these:
- Identity, governance and monitoring: sources, roles, keys and policy
- Data storage: relational, NoSQL, blobs, integration and analysis
- Business continuity: recovery, backup and high availability
- Infrastructure: compute, application architecture, migration and networking
Practise with the real exam's mix
331 exam-style questions, 4 timed practice exams, flashcards and an AI tutor.