AZ-304 Microsoft Azure Solutions Architect Expert — Questions and Answers

Question 1: A company needs to ensure that Azure VMs in a production subscription cannot be created without a specific tag. Which Azure feature enforces this?

Azure RBAC deny assignment
Azure Policy with deny effect (Correct answer)
Azure Blueprints lock
Management group access control

Correct answer: Azure Policy with deny effect

Azure Policy with a 'deny' effect blocks resource creation that doesn't meet defined tag requirements.

Question 2: Which Azure storage redundancy option provides the highest availability by replicating data across two regions and three availability zones in the primary region?

Zone-redundant storage (ZRS)
Geo-redundant storage (GRS)
Geo-zone-redundant storage (GZRS) (Correct answer)
Read-access geo-redundant storage (RA-GRS)

Correct answer: Geo-zone-redundant storage (GZRS)

GZRS combines zone-redundant replication in the primary region with geo-replication to a secondary region for maximum durability.

Question 3: An architect must design a solution where Azure Functions can securely access Azure Key Vault without storing credentials in code. What is the recommended approach?

Store the Key Vault URL in application settings
Use a system-assigned managed identity (Correct answer)
Use a service principal with a client secret
Embed the access key in the function code

Correct answer: Use a system-assigned managed identity

A system-assigned managed identity allows Azure Functions to authenticate to Key Vault without any stored credentials.

Question 4: A solution requires a globally distributed NoSQL database with multi-region writes and automatic failover. Which Azure service best fits this requirement?

Azure SQL Database Hyperscale
Azure Table Storage
Azure Cosmos DB (Correct answer)
Azure Database for PostgreSQL Flexible Server

Correct answer: Azure Cosmos DB

Azure Cosmos DB supports multi-region writes with configurable consistency levels and automatic failover.

Question 5: When designing an Azure Virtual Network, which component is used to control inbound and outbound traffic at the subnet level?

Azure Firewall
Network Security Group (NSG) (Correct answer)
Application Security Group (ASG)
User-Defined Route (UDR)

Correct answer: Network Security Group (NSG)

Network Security Groups are applied at the subnet or NIC level to filter traffic using allow/deny rules.

Question 6: A company wants to migrate 200 on-premises VMs to Azure with minimal downtime. Which Azure service replicates VMs continuously and enables a cutover with minimal data loss?

Azure Backup
Azure Database Migration Service
Azure Site Recovery (Correct answer)
Azure Migrate Assessment

Correct answer: Azure Site Recovery

Azure Site Recovery provides continuous replication and orchestrated failover, minimizing downtime during migration.

Question 7: Which Azure Active Directory feature allows an architect to require MFA only when a sign-in is flagged as risky?

Azure AD Privileged Identity Management
Azure AD Conditional Access with risk-based policies
Azure AD Identity Protection sign-in risk policy (Correct answer)
Azure AD Multi-Factor Authentication per-user enforcement

Correct answer: Azure AD Identity Protection sign-in risk policy

Azure AD Identity Protection's sign-in risk policy evaluates risk signals and can require MFA for risky sign-ins automatically.

Question 8: An architect needs to design a hybrid network connection between on-premises and Azure that provides consistent low latency with guaranteed bandwidth. Which service should be used?

Azure VPN Gateway (Site-to-Site)
Azure ExpressRoute (Correct answer)
Azure Virtual WAN
Azure Bastion

Correct answer: Azure ExpressRoute

Azure ExpressRoute provides a private, dedicated connection with predictable latency and guaranteed bandwidth SLAs.

Question 9: Which Azure service should an architect choose to cache frequently read data and reduce load on an Azure SQL Database backend?

Azure CDN
Azure Cache for Redis (Correct answer)
Azure Service Bus
Azure Blob Storage

Correct answer: Azure Cache for Redis

Azure Cache for Redis provides an in-memory data store that dramatically reduces database query load for frequently accessed data.

Question 10: A multi-tier application needs to scale its web tier independently from its business logic tier. Which design pattern best addresses this in Azure?

Deploy all tiers in a single App Service Plan
Use Azure Service Bus to decouple tiers and scale independently (Correct answer)
Run all tiers in a single Azure VM Scale Set
Use Azure Front Door to distribute traffic across tiers

Correct answer: Use Azure Service Bus to decouple tiers and scale independently

Using Azure Service Bus decouples tiers so each can be scaled independently based on its own demand.

Question 11: An organization must ensure that Azure resources are deployed only to approved regions. Which governance tool enforces this at scale across all subscriptions?

Azure Blueprints
Azure Policy assigned at the Management Group level (Correct answer)
Azure RBAC with custom roles
Azure Cost Management budgets

Correct answer: Azure Policy assigned at the Management Group level

Azure Policy assigned at the Management Group level propagates the allowed-locations policy to all child subscriptions automatically.

Question 12: A company runs a stateless web application that must handle unpredictable traffic spikes automatically. Which Azure compute option provides the best auto-scaling without managing infrastructure?

Azure Virtual Machine Scale Sets
Azure App Service with auto-scale rules
Azure Kubernetes Service (AKS)
Azure Functions with Consumption plan (Correct answer)

Correct answer: Azure Functions with Consumption plan

Azure Functions on the Consumption plan automatically scales to zero and out based on events with no infrastructure management required.

Question 13: Which Azure networking feature allows you to route traffic between VNets and on-premises networks through a central hub VNet?

VNet Peering
Hub-and-spoke topology with Azure Firewall or NVA (Correct answer)
Azure Private Link
Azure NAT Gateway

Correct answer: Hub-and-spoke topology with Azure Firewall or NVA

A hub-and-spoke topology centralizes shared services (firewall, VPN gateway) in the hub and connects spoke VNets via peering.

Question 14: An architect needs to provide secure, browser-based RDP and SSH access to Azure VMs without exposing public IP addresses. Which service should be used?

Azure VPN Gateway point-to-site
Just-in-time VM access
Azure Bastion (Correct answer)
Azure Firewall DNAT rules

Correct answer: Azure Bastion

Azure Bastion provides browser-based RDP/SSH directly in the Azure portal without requiring VMs to have public IPs.

Question 15: A company needs a recovery point objective (RPO) of near-zero and a recovery time objective (RTO) of under 15 minutes for its Azure SQL Database. Which configuration meets these requirements?

Active geo-replication with auto-failover group (Correct answer)
Azure SQL Database automatic backups with LTR
Zone-redundant deployment without geo-replication
Azure Site Recovery for SQL workloads

Correct answer: Active geo-replication with auto-failover group

Auto-failover groups with active geo-replication provide near-zero RPO with asynchronous replication and sub-15-minute automated failover.

Question 16: Which Azure Monitor feature should an architect configure to automatically notify the operations team when CPU utilization exceeds 90% for more than 5 minutes?

Azure Monitor Diagnostic Settings
Azure Monitor Metric Alert (Correct answer)
Azure Monitor Activity Log Alert
Log Analytics workspace query

Correct answer: Azure Monitor Metric Alert

Azure Monitor Metric Alerts evaluate metric values on defined frequency and fire when thresholds are breached for the configured window.

Question 17: An architect needs to ensure that secrets stored in Azure Key Vault are rotated automatically. Which Azure feature supports automatic secret rotation?

Key Vault firewall rules
Key Vault soft-delete and purge protection
Key Vault Event Grid integration with Azure Functions (Correct answer)
Key Vault access policies with RBAC

Correct answer: Key Vault Event Grid integration with Azure Functions

Azure Key Vault emits events via Event Grid when secrets are near expiry, which can trigger an Azure Function to rotate and update the secret.

Question 18: A company wants to control egress traffic from Azure VMs to the internet, with full Layer 7 filtering and threat intelligence. Which Azure service provides this?

Network Security Groups
Azure Application Gateway WAF
Azure Firewall Premium (Correct answer)
Azure DDoS Protection Standard

Correct answer: Azure Firewall Premium

Azure Firewall Premium provides Layer 7 filtering with IDPS, TLS inspection, and threat intelligence for egress traffic control.

Question 19: Which Azure service allows an architect to run containerized workloads without managing Kubernetes control plane or nodes?

Azure Kubernetes Service (AKS)
Azure Container Instances (ACI) (Correct answer)
Azure App Service for Containers
Azure Service Fabric

Correct answer: Azure Container Instances (ACI)

Azure Container Instances runs containers on-demand without any cluster or node management, ideal for simple or burst workloads.

Question 20: An architect is designing a data pipeline where large amounts of IoT telemetry must be ingested and processed in real time. Which combination of Azure services is most appropriate?

Azure Blob Storage + Azure Data Factory
Azure Event Hubs + Azure Stream Analytics (Correct answer)
Azure Service Bus + Azure Logic Apps
Azure Queue Storage + Azure Batch

Correct answer: Azure Event Hubs + Azure Stream Analytics

Azure Event Hubs handles high-throughput telemetry ingestion while Azure Stream Analytics processes the stream in real time with SQL-like queries.

Question 21: A solution must allow users from partner organizations (external Azure AD tenants) to access internal Azure applications without creating accounts in the company's directory. Which Azure AD feature supports this?

Azure AD Domain Services
Azure AD B2C
Azure AD B2B Collaboration (Correct answer)
Azure AD Application Proxy

Correct answer: Azure AD B2B Collaboration

Azure AD B2B Collaboration lets external users sign in with their own organizational credentials and be granted access to your apps.

AZ-304 Microsoft Azure Solutions Architect Expert

A company needs to ensure that Azure VMs in a production subscription cannot be created without a specific tag.
Which Azure feature enforces this?

🃏 AZ 304 Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full AZ 304 Study Guide →

What Practice Test Geeks adds beyond an AI chat for AZ-304

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length AZ-304 mock exam — 50 questions in 150 minutes with a 70% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed AZ-304 question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable AZ-304 cheat sheet you can print or save as a PDF.
AZ-304 flashcards built from the same question bank.

Start the Timed AZ-304 Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Renewal, score validity, retake fee, exam format, time limit, fees, passing score, eligibility, exam information · verified Nov 2026
home.pearsonvue.com — Test delivery · verified Oct 2026