Azure Solutions Architect Expert (AZ-305) · 27% practice allocation

Azure AZ-305: Design identity, governance, and monitoring solutions Practice Questions

5 free sample questions from the Design identity, governance, and monitoring solutions domain, with answers and explanations. The full AZ-305 bank has 59 questions across 4 domains. Questions are scenario-based and written from the official Azure exam guide.

1.

An application needs to store and rotate TLS certificates and database connection secrets centrally, with access controlled by RBAC and auditing. Which Azure service should the design use?

  • A. Azure Key Vault✓ Correct
  • B. Azure Blob Storage
  • C. Azure Table Storage
  • D. A plain text file in a storage account
Explanation

Azure Key Vault centrally stores secrets, keys, and certificates with RBAC-controlled access, rotation, and audit logging. Blob (B) and Table storage (C) are general data stores without secret-management features, and a plain-text file (D) is an insecure anti-pattern.

2.

A company must periodically review who has access to sensitive resources and remove access that is no longer needed, with reviewers attesting to continued need. Which Microsoft Entra feature supports this identity-governance requirement?

  • A. Resource locks
  • B. Azure Monitor alerts
  • C. Access reviews✓ Correct
  • D. Availability zones
Explanation

Access reviews let designated reviewers periodically attest to or revoke users' access, keeping entitlements current — a core identity-governance control. Azure Monitor alerts (B) watch telemetry, resource locks (A) prevent deletion, and availability zones (D) are a resilience feature — none performs access recertification.

3.

A design needs application-level telemetry — request rates, dependency calls, exceptions, and end-to-end transaction traces — for a web app to diagnose performance issues. Which monitoring solution should the architect recommend?

  • A. Azure Policy
  • B. Azure Key Vault
  • C. Azure Site Recovery
  • D. Application Insights (part of Azure Monitor)✓ Correct
Explanation

Application Insights instruments application code to capture requests, dependencies, exceptions, and distributed traces for performance diagnosis. Azure Policy (A) governs configuration, Key Vault (B) stores secrets, and Site Recovery (C) is disaster recovery — none provides application performance telemetry.

4.

An organization needs to apply a policy that all resources must be deployed only to approved regions, enforced across 30 subscriptions with inheritance, without configuring each subscription individually. What should the architect design?

  • A. Use a resource lock on each resource group
  • B. Assign an Azure Policy (allowed locations) at a management group that contains the subscriptions✓ Correct
  • C. Manually add a policy to each of the 30 subscriptions
  • D. Rely on RBAC role assignments to block regions
Explanation

Assigning Azure Policy at the management-group scope enforces the rule across all contained subscriptions via inheritance — one assignment. Per-subscription assignment (C) is 30× effort and drifts. Resource locks (A) prevent deletion/change, not region choice. RBAC (D) governs who can act, not which regions are allowed.

5.

The architecture team wants a governance hierarchy that separates production and non-production workloads for billing and access, while applying common security policy above both. Which design is appropriate?

  • A. A management group containing separate 'prod' and 'non-prod' subscriptions, with policy assigned at the management group✓ Correct
  • B. A single subscription with everything mixed together
  • C. One resource group spanning multiple subscriptions
  • D. Assigning policy only at individual resource scope
Explanation

A management group over separate prod/non-prod subscriptions gives billing/access separation per subscription while common policy assigned at the management group inherits to both. A single mixed subscription (B) loses separation, a resource group can't span subscriptions (C), and resource-level-only policy (D) doesn't scale or enforce consistently.

Test yourself across every AZ-305 domain

The free AZ-305 practice test mixes about 20 questions weighted like the exam. The full 59-question bank adds instant grading, flashcards and a timed mock exam.

Take the free AZ-305 practice testPractice the full bank

Study this domain

Design identity, governance, and monitoring solutions study guide (AZ-305) →

Other AZ-305 domains

← All Azure Solutions Architect Expert study resources