← cd ~/learn

This page isn't affiliated with Microsoft. The weights come from Microsoft's study guide; always check it for the current outline before you book.

Skills measured, and where to learn them

1. Design identity, governance, and monitoring solutions25–30%
   • Recommend logging, log routing and monitoring solutions
   • Recommend authentication and identity management solutions
   • Authorise access to Azure and on-premises resources
   • Manage secrets, certificates and keys
   • Structure management groups, subscriptions, resource groups and tags
   • Manage compliance and identity governance
   Study this on azureblog.co.uk

   • pathAzure landing zone guardrails
   • pathAutomating Entra and Azure safely
   • pathLocking down admin access
   • labSet up break-glass accounts with a sign-in alert
   • explainerHow Entra ID issues and refreshes tokens
   • cheat sheetazure policy cheat sheet
   • cheat sheetkql basics cheat sheet
   • cheat sheetpim cheat sheet
   • postAzure Policy guardrails every subscription should have
   • postResource locks: a cheap insurance policy against the wrong click
   • postStop surprise Azure bills with budgets and anomaly alerts
   • postTurning on Defender CSPM across a landing zone
   • postKey Vault: move from access policies to Azure RBAC
   • postManaged identities vs service principals: which should your workload use?
   • postDeploy from GitHub Actions to Azure without storing a single secret
   • postActivate PIM roles from PowerShell with Microsoft Graph
   • postSix KQL queries for Entra sign-in logs every admin should keep
   • postClean up guest accounts with access reviews
   • postEntra Connect Sync is on its way out. Start planning for Cloud Sync.
2. Design data storage solutions20–25%
   • Recommend relational storage, service tiers and compute tiers
   • Plan database scalability and data protection
   • Recommend storage for semi-structured and unstructured data
   • Balance features, performance and cost; plan durability
   • Recommend data integration and data analysis solutions
   Study this on azureblog.co.uk

   Not covered on this site yet. Use Microsoft Learn's training for this area.

3. Design business continuity solutions15–20%
   • Recommend recovery solutions that meet RPO and RTO for Azure and hybrid workloads
   • Back up and recover compute, databases and unstructured data
   • Design high availability for compute, relational data and other data
   Study this on azureblog.co.uk

   Not covered on this site yet. Use Microsoft Learn's training for this area.

4. Design infrastructure solutions30–35%
   • Recommend VM, container, serverless and batch compute
   • Design messaging, event-driven and API integration architectures
   • Recommend caching, app configuration and automated deployment
   • Plan migrations with the Cloud Adoption Framework and Azure Migrate
   • Migrate workloads, databases and unstructured data to IaaS and PaaS
   • Design internet and on-premises connectivity, network security and load balancing
   Study this on azureblog.co.uk

   • labLock a storage account behind a private endpoint
   • cheat sheetprivate endpoint dns cheat sheet
   • postPrivate endpoints and DNS: why your private endpoint isn't being used
   • postDeploy from GitHub Actions to Azure without storing a single secret

20 practice questions

Scenario questions in the style of the exam, written for this site. Get 16 or more right to earn the AZ-305 badge, and see which areas to revise.

1. Your security team uses a third-party SIEM. You must stream Azure activity logs and resource logs from several subscriptions to it in near real time. What should you recommend?

   Diagnostic settings that send the logs to an Azure Event Hubs namespaceDiagnostic settings that archive the logs to a storage accountAn Azure Monitor action group with a webhookAzure Advisor recommendations exported to CSV
2. A web app on Azure App Service must read connection strings from Azure Key Vault. The security team forbids storing any credential in app settings or code. What should you recommend?

   Enable a managed identity on the app and grant it the Key Vault Secrets User roleCreate a service principal and store its client secret in app settingsStore the connection strings in a Key Vault access policy for all usersUse a shared access signature for the key vault
3. A business unit creates new subscriptions every few months. Every subscription, including future ones, must only allow resources in UK South and UK West. What should you recommend?

   Assign an allowed locations Azure Policy to a management group that contains the business unit's subscriptionsApply a ReadOnly resource lock to each subscriptionAssign the policy to each resource group as it is createdCreate an Azure Blueprint per region
4. Contractors occasionally need Owner on a production subscription. Access must be time-limited, require approval and be audited. What should you recommend?

   Eligible assignments in Microsoft Entra Privileged Identity Management for Azure resourcesPermanent Owner assignments reviewed once a yearA custom role with a deny assignmentGuest accounts with a Conditional Access policy that requires MFA
5. Remote staff need access to an on-premises web application. You must apply Conditional Access and avoid opening inbound firewall ports. What should you recommend?

   Microsoft Entra application proxy with pre-authenticationA public IP on the web server with an NSG ruleA point-to-site VPN for every userAzure Bastion
6. You are migrating a SQL Server instance that uses SQL Server Agent jobs and cross-database queries. You want a PaaS service with near-100% compatibility and minimal code changes. What should you recommend?

   Azure SQL Managed InstanceAzure SQL Database single databaseAzure Cosmos DB for NoSQLAzure Database for PostgreSQL flexible server
7. An Azure SQL Database is expected to grow to 20 TB. Backups and restores must stay fast regardless of size. Which service tier should you recommend?

   HyperscaleBusiness CriticalGeneral PurposeStandard (DTU)
8. Scanned documents in Blob Storage are rarely read after 90 days but must be kept for seven years. Retrieval within 24 hours is acceptable. How should you minimise cost?

   Use a lifecycle management policy to move blobs to the Archive tier after 90 daysMove the storage account to premium block blob performanceEnable soft delete with a seven-year retention periodReplicate the account with RA-GZRS
9. A regulator requires that trade records in Blob Storage cannot be modified or deleted by anyone, including administrators, for five years. What should you recommend?

   Immutable storage with a locked time-based retention policySoft delete for blobs with a five-year retention periodA CanNotDelete resource lock on the storage accountAzure RBAC that removes the Storage Blob Data Contributor role
10. You need to copy data on a schedule from an on-premises SQL Server behind a firewall into Azure Data Lake Storage, as part of an orchestrated pipeline. What should you recommend?

    Azure Data Factory with a self-hosted integration runtimeAzure Data Factory with only the Azure integration runtimeAzCopy run from Azure Cloud ShellAzure File Sync
11. Line-of-business VMs in UK South must fail over to UK West after a regional outage, with an RPO measured in minutes. What should you recommend?

    Azure Site Recovery replication of the VMs to UK WestAzure Backup with daily backups and cross-region restorePlacing the VMs in an availability setZone-redundant managed disks
12. An app uses Azure SQL Database. If the primary region fails, the database must fail over to another region and the app's connection string must not change. What should you recommend?

    A failover group with its read-write listener endpointZone-redundant configuration in the primary regionLong-term backup retentionGeo-restore from geo-redundant backups
13. A storage account must survive a zone failure in the primary region and a full regional outage, and the app must be able to read data from the secondary region at any time. Which redundancy option should you recommend?

    Read-access geo-zone-redundant storage (RA-GZRS)Zone-redundant storage (ZRS)Geo-redundant storage (GRS)Locally redundant storage (LRS)
14. An order-processing system must process messages for each customer in strict first-in, first-out order and move failed messages to a dead-letter queue. What should you recommend?

    Azure Service Bus queues with message sessionsAzure Queue StorageAzure Event GridAzure Event Hubs with a single consumer group
15. Several services must react within seconds whenever a new blob is uploaded to a storage account, without polling. What should you recommend?

    Azure Event Grid subscriptions on the storage account's BlobCreated eventsA timer-triggered function that lists the container every minuteAzure Data Factory with a schedule triggerAzure Monitor metric alerts on transaction count
16. You must publish internal REST APIs to partners with subscription keys, per-partner rate limits and a developer portal. What should you recommend?

    Azure API ManagementAzure Front DoorAzure Application GatewayAzure Relay
17. A team wants to run containerised microservices that scale on queue length and scale to zero when idle, without managing a Kubernetes cluster. What should you recommend?

    Azure Container AppsAzure Kubernetes ServiceAzure Container InstancesAzure Virtual Machine Scale Sets
18. A web app runs in three Azure regions. You need global HTTP load balancing, path-based routing, a web application firewall and fast failover between regions. What should you recommend?

    Azure Front DoorAzure Application GatewayAzure Traffic ManagerAzure Load Balancer
19. A firm needs a private connection from its data centre to Azure that doesn't go over the public internet and offers predictable latency. What should you recommend?

    Azure ExpressRouteA site-to-site VPN gatewayA point-to-site VPNVirtual network peering
20. Before migrating 400 on-premises VMware VMs, you must find their dependencies, check Azure readiness and estimate monthly costs. What should you use?

    Azure Migrate discovery and assessment with the Azure Migrate applianceAzure Site Recovery test failoverAzure AdvisorThe Azure pricing calculator alone

check my answers