Microsoft Azure Architect Design (AZ-304) — Questions and Answers

Question 1: An architect needs to design cost optimization for Azure VMs running predictable 24/7 production workloads that will be needed for at least 3 years. Which pricing model minimizes cost?

Azure Hybrid Benefit with pay-as-you-go
Azure Dev/Test pricing
Pay-as-you-go with Azure Spot Instances
Reserved Virtual Machine Instances (3-year term) (Correct answer)

Correct answer: Reserved Virtual Machine Instances (3-year term)

3-year Reserved Instances provide up to 72% savings compared to pay-as-you-go pricing and are ideal for predictable, long-running production workloads.

Question 2: Which Azure storage redundancy option provides the highest availability by replicating data across two regions and three availability zones in the primary region?

Geo-zone-redundant storage (GZRS) (Correct answer)
Read-access geo-redundant storage (RA-GRS)
Geo-redundant storage (GRS)
Zone-redundant storage (ZRS)

Correct answer: Geo-zone-redundant storage (GZRS)

GZRS combines zone-redundant replication in the primary region with geo-replication to a secondary region for maximum durability.

Question 3: When designing an Azure landing zone, which construct provides the highest level of scope for applying governance policies that affect all subscriptions in an organization?

Management Group (Root) (Correct answer)
Azure Policy Initiative
Subscription
Resource Group

Correct answer: Management Group (Root)

The Root Management Group sits at the top of the hierarchy and any policy assigned there inherits down to all management groups and subscriptions.

Question 4: An organization must protect Azure File Shares from ransomware by maintaining file snapshots that cannot be deleted by a compromised admin account. Which feature addresses this?

WORM policy on file shares
Azure Backup soft delete for Azure Files
Immutable Blob Storage
Multi-User Authorization with Resource Guard (Correct answer)

Correct answer: Multi-User Authorization with Resource Guard

Multi-User Authorization with Resource Guard requires approval from an independent Resource Guard resource to delete backup data, preventing a single compromised admin from destroying backups.

Question 5: What is the purpose of Azure Management Groups in a large enterprise?

To group VMs into availability sets
To apply policies and access controls hierarchically across multiple subscriptions (Correct answer)
To organize storage accounts by region
To manage virtual network peering

Correct answer: To apply policies and access controls hierarchically across multiple subscriptions

Management Groups provide a hierarchy above subscriptions where Azure Policy and RBAC assignments can be applied once and inherited by all subscriptions and resources in the hierarchy.

Question 6: A design requires that an Azure SQL Database secondary replica be readable for reporting queries without impacting the primary workload. Which feature enables this?

Read Scale-Out on Business Critical tier
SQL Database Hyperscale named replicas
Geo-Replication readable secondary (Correct answer)
Elastic Pools

Correct answer: Geo-Replication readable secondary

Active Geo-Replication creates up to four readable secondary replicas in different regions, allowing reporting workloads to be offloaded without affecting the primary replica.

Question 7: Which authentication method in Azure AD provides passwordless sign-in using a private key stored on a hardware device?

SMS verification
OATH software tokens
FIDO2 security keys (Correct answer)
App passwords

Correct answer: FIDO2 security keys

FIDO2 security keys enable passwordless authentication by using cryptographic credentials stored on a physical hardware device, eliminating password-based attacks.

Question 8: A security architect wants to detect when Azure AD accounts are used from anonymous IP addresses or unfamiliar locations. Which feature provides this capability?

Azure AD Identity Protection risk detections (Correct answer)
Azure Monitor Alerts
Conditional Access named locations only
Azure Sentinel only

Correct answer: Azure AD Identity Protection risk detections

Azure AD Identity Protection automatically generates risk detections for suspicious sign-in patterns including anonymous proxies, atypical travel, and unfamiliar sign-in properties.

Question 9: Which Azure Private DNS Zone feature allows VMs in a VNet to automatically register their DNS records without manual configuration?

DNS delegation
DNS forwarder
Auto-registration (Correct answer)
Conditional forwarding

Correct answer: Auto-registration

Auto-registration in Azure Private DNS Zones automatically creates and removes DNS A records when VMs in a linked VNet are created or deleted.

Question 10: You have a storage account in your Azure subscription. Duplicate files can occasionally be written to the storage account by an application. You have a PowerShell script that locates duplicate files in the storage account and removes them. The script is currently executed manually upon operations manager approval. You must suggest a serverless solution that carries out the following tasks: ‥ Checks for duplicate files every hour by executing the script once. ‥ Notifies the operations manager through email and asks for permission to delete the duplicate files. ‥ Handles the Operations Manager's email answer, processing it to determine whether the deletion was authorized. ‥ If the deletion was authorized, runs the script. What should the recommendation contain?

Azure Functions and Azure Batch
Azure Logic Apps and Azure Functions (Correct answer)
Azure Pipelines and Azure Service Fabric
Azure Logic Apps and Azure Event Grid

Correct answer: Azure Logic Apps and Azure Functions

This scenario requires workflow orchestration, scheduled execution, conditional logic for approval, and script execution. Azure Logic Apps are ideal for orchestrating complex workflows, handling scheduling, integrating with email for approvals, and managing conditional branching based on responses. Azure Functions are perfect for executing the PowerShell script in a serverless manner, as they can be triggered by Logic Apps and provide a cost-effective way to run code on demand.

Question 11: An architect must ensure that a new Azure resource group deployment complies with corporate standards including specific VM SKUs, allowed regions, and required tags. Which Azure service enforces these standards at deployment time?

Azure Resource Manager template validation
Azure Blueprints with resource group artifact
Azure Cost Management budgets with alerts
Azure Policy with 'deny' and 'append' effects (Correct answer)

Correct answer: Azure Policy with 'deny' and 'append' effects

Azure Policy with 'deny' effects blocks non-compliant SKUs and regions, while 'append' effects automatically add required tags, enforcing all three standards at deployment time.

Question 12: Which Azure AD feature allows you to enforce multi-factor authentication based on user risk and sign-in risk signals?

Azure AD B2C
Azure AD DS
Conditional Access
Identity Protection (Correct answer)

Correct answer: Identity Protection

Azure AD Identity Protection uses risk-based policies to automatically enforce MFA or block access when suspicious sign-in signals are detected.

Question 13: A workload requires low-latency SQL queries and automatic scaling of both compute and storage independently. Which Azure database service best fits this requirement?

Azure SQL Database Hyperscale (Correct answer)
Azure Cosmos DB SQL API
Azure SQL Managed Instance
Azure Database for PostgreSQL Single Server

Correct answer: Azure SQL Database Hyperscale

Azure SQL Database Hyperscale decouples compute and storage scaling, supports databases up to 100 TB, and provides near-instant backups and rapid scale-out.

Question 14: An architect must ensure that Azure Cosmos DB can survive a complete region failure with automatic failover and zero data loss. What must be configured?

Multi-region writes with automatic failover enabled (Correct answer)
Read replicas with strong consistency
Geo-redundant backup only
Manual failover with a single write region

Correct answer: Multi-region writes with automatic failover enabled

Enabling multi-region writes with automatic failover allows Cosmos DB to continue accepting writes from another region automatically if the primary write region fails, with near-zero data loss.

Question 15: Which Microsoft Defender for Cloud feature provides a security posture score and prioritized recommendations based on the Azure Security Benchmark?

Just-in-Time VM Access
Workload Protection Plans
Cloud Security Posture Management (CSPM) (Correct answer)
Adaptive Application Controls

Correct answer: Cloud Security Posture Management (CSPM)

CSPM in Microsoft Defender for Cloud continuously assesses your Azure resources against the Azure Security Benchmark and provides a Secure Score reflecting your overall security posture.

Question 16: You need to enforce that all data written to an Azure Storage account is encrypted with customer-managed keys stored in Azure Key Vault. What must you configure?

Double encryption infrastructure layer
Storage Service Encryption with Microsoft-managed keys
Azure Defender for Storage
Customer-Managed Keys (CMK) with Key Vault integration (Correct answer)

Correct answer: Customer-Managed Keys (CMK) with Key Vault integration

Customer-Managed Keys (CMK) allow you to control the encryption key lifecycle in Azure Key Vault, satisfying compliance requirements for bring-your-own-key (BYOK) encryption.

Question 17: A company needs to provide external partners with access to Azure resources without managing their identities in Azure AD. Which solution should you recommend?

Azure AD Connect
Azure AD DS
Azure AD B2C
Azure AD B2B (Correct answer)

Correct answer: Azure AD B2B

Azure AD B2B allows external users to sign in with their own organizational identities, eliminating the need to manage their credentials in your tenant.

Question 18: Which role-based access control scope is the HIGHEST level in the Azure RBAC hierarchy?

Resource Group
Management Group (Correct answer)
Resource
Subscription

Correct answer: Management Group

Management Groups sit at the top of the Azure RBAC hierarchy, allowing policy and access assignments that cascade down to subscriptions, resource groups, and resources.

Question 19: You need to store relational data that requires multi-region writes with low latency. Which Azure service should you choose?

Azure Database for MySQL Flexible Server
Azure Cosmos DB with multi-region writes (Correct answer)
Azure SQL Database with geo-replication
Azure Synapse Analytics

Correct answer: Azure Cosmos DB with multi-region writes

Azure Cosmos DB natively supports multi-region writes, enabling active-active architectures with configurable consistency levels and guaranteed low latency globally.

Question 20: Which Azure AD feature enables employees to request access packages containing multiple resource access rights (groups, apps, SharePoint) through a self-service portal?

Access Reviews
Entitlement Management (Correct answer)
Privileged Identity Management
Conditional Access

Correct answer: Entitlement Management

Entitlement Management lets you bundle access to multiple resources into access packages that users can request through a governed, approval-based self-service portal.

Question 21: An organization needs to back up on-premises servers and Azure VMs to a centralized vault. Which Azure service manages this?

Azure Blob Storage with LRS
Azure Site Recovery only
Azure Storage Archive tier
Azure Backup with Recovery Services Vault (Correct answer)

Correct answer: Azure Backup with Recovery Services Vault

Azure Backup with Recovery Services Vault provides centralized backup management for Azure VMs, on-premises servers, SQL Server, SAP HANA, and Azure Files.

Question 22: You need to grant an application access to Azure Key Vault secrets without storing credentials in code. What should you use?

Managed Identity (Correct answer)
Shared Access Signature
Service Principal with client secret
Azure AD Application Proxy

Correct answer: Managed Identity

Managed Identities provide Azure services with an automatically managed identity in Azure AD, eliminating the need to store credentials in application code.

Question 23: What is the purpose of diagnostic settings in Azure Monitor?

To route resource logs and metrics to a Log Analytics Workspace, Event Hub, or Storage Account (Correct answer)
To enable Azure Policy compliance evaluation
To configure alerting thresholds on VMs
To enable Azure Advisor recommendations

Correct answer: To route resource logs and metrics to a Log Analytics Workspace, Event Hub, or Storage Account

Diagnostic settings configure where Azure resource platform logs and metrics are sent — to a Log Analytics Workspace for querying, an Event Hub for streaming, or a Storage Account for archival.

Question 24: An application needs read access to a specific Azure Storage container. Which principle should guide the scope of the role assignment?

Principle of least privilege — assign at the container level (Correct answer)
Assign at subscription level for simplicity
Assign Owner role at resource group level
Use storage account key instead of RBAC

Correct answer: Principle of least privilege — assign at the container level

The principle of least privilege requires granting only the minimum permissions needed at the narrowest scope, so the role should be assigned at the specific container level.

Question 25: What is the purpose of Privileged Identity Management (PIM) in Azure AD?

To enforce password complexity policies
To synchronize on-premises AD with Azure AD
To audit all sign-in events
To provide just-in-time privileged access to Azure resources (Correct answer)

Correct answer: To provide just-in-time privileged access to Azure resources

PIM enables just-in-time activation of privileged roles, reducing standing access and requiring justification and approval for elevated permissions.

Question 26: What Azure Storage feature prevents accidental or malicious deletion of blobs by requiring a delete lock to be held for a defined retention period?

Immutable Storage with WORM policy (Correct answer)
Blob Versioning
Object Replication
Soft Delete

Correct answer: Immutable Storage with WORM policy

Immutable Blob Storage with WORM (Write Once, Read Many) policies prevents deletion or modification of data for a configured interval, satisfying regulatory retention requirements.

Question 27: Your organization needs to allow customers to sign in using their social identities (Google, Facebook) to access a consumer app. Which Azure AD service should you use?

Azure AD Domain Services
Azure AD B2C (Correct answer)
Azure AD B2B
Conditional Access

Correct answer: Azure AD B2C

Azure AD B2C is a customer identity and access management (CIAM) service that supports social identity providers like Google and Facebook for consumer-facing applications.

Question 28: Which Azure service provides centralized, scalable management of routing and security for a large number of branch offices connecting to Azure?

Hub-and-spoke with Azure Firewall
Azure VPN Gateway with multiple connections
Azure Virtual WAN (Correct answer)
Azure Route Server

Correct answer: Azure Virtual WAN

Azure Virtual WAN is a networking service that provides optimized, automated branch-to-branch and branch-to-Azure connectivity with integrated routing, security, and SD-WAN integration.

Question 29: An organization must ensure that Azure resources are deployed only to approved regions. Which governance tool enforces this at scale across all subscriptions?

Azure Cost Management budgets
Azure Blueprints
Azure RBAC with custom roles
Azure Policy assigned at the Management Group level (Correct answer)

Correct answer: Azure Policy assigned at the Management Group level

Azure Policy assigned at the Management Group level propagates the allowed-locations policy to all child subscriptions automatically.

Question 30: An application uses Azure Cosmos DB and requires guaranteed single-digit millisecond reads globally. Which consistency level should you choose?

Eventual consistency (Correct answer)
Strong consistency
Bounded staleness
Session consistency

Correct answer: Eventual consistency

Eventual consistency offers the lowest latency and highest throughput globally, appropriate when the application tolerates temporarily stale reads.

Question 31: Which Azure data service is best suited for ingesting millions of events per second from IoT devices for real-time stream processing?

Azure Queue Storage
Azure Event Hubs (Correct answer)
Azure Notification Hubs
Azure Service Bus

Correct answer: Azure Event Hubs

Azure Event Hubs is a highly scalable event streaming platform capable of ingesting millions of events per second, designed for big data telemetry and IoT scenarios.

Question 32: Which Azure cost management feature allows you to set spending limits and receive alerts when costs approach or exceed a threshold?

Azure Spend Advisor
Azure Budgets (Correct answer)
Azure Reservations
Azure Cost Analysis

Correct answer: Azure Budgets

Azure Budgets allow you to set spending thresholds and configure email alerts when actual or forecasted costs reach defined percentages, helping prevent unexpected overspending.

Question 33: An application needs to store semi-structured JSON documents and query them using a flexible schema without predefined table structures. Which Azure service is best suited?

Azure SQL Database
Azure Database for PostgreSQL
Azure Table Storage
Azure Cosmos DB for NoSQL (Correct answer)

Correct answer: Azure Cosmos DB for NoSQL

Azure Cosmos DB for NoSQL (formerly Core SQL API) is designed for semi-structured JSON documents and supports flexible schemas with rich SQL-like querying capabilities.

Question 34: What is the maximum number of objects that can be synchronized from on-premises AD to Azure AD Connect with a single Azure AD tenant?

100,000
300,000
50,000
No hard limit — scales to millions (Correct answer)

Correct answer: No hard limit — scales to millions

Azure AD Connect has no fixed upper limit for the number of synchronized objects; the Azure AD tenant itself can hold up to 500,000 objects by default, expandable on request.

Question 35: You have a Hyper-V cluster installed locally. Hyper-V hosts running Windows Server 2016 Datacenter are part of the cluster. The hosts are authorized by a Software Assurance Enterprise Agreement for Microsoft. There are 30 virtual machines running Windows Server 2012 R2 in the Hyper-V cluster. The burden that each virtual machine executes varies. The workloads have consistent patterns of consumption. You intend to swap out the virtual machines with Windows Server 2016-powered Azure virtual machines. The size of the virtual machines will be determined by how much power each workload consumes. To reduce the computational costs of the Azure virtual machines, you must suggest a solution. Which two suggestions ought to be incorporated into the solution? Each right response offers a piece of the answer.

Activate Azure Hybrid Benefit for the Azure virtual machines. (Correct answer)
Purchase Azure Reserved Virtual Machine Instances for the Azure virtual machines. (Correct answer)
Configure a spending limit in the Azure account center.
Create a virtual machine scale set that uses autoscaling.

Correct answer: Activate Azure Hybrid Benefit for the Azure virtual machines.

Azure Hybrid Benefit allows customers with existing Windows Server licenses with Software Assurance to use them on Azure VMs, significantly reducing compute costs. Purchasing Azure Reserved Virtual Machine Instances provides substantial discounts (up to 72%) compared to pay-as-you-go pricing for VMs, in exchange for committing to a one-year or three-year term. Both strategies are highly effective for reducing computational costs for Azure virtual machines.

Question 36: What is the recommended approach to assign Azure built-in roles to groups rather than individual users at scale?

Attribute-based access control only
Azure Policy assignment
Dynamic group membership with RBAC assignment (Correct answer)
Direct user assignment

Correct answer: Dynamic group membership with RBAC assignment

Using dynamic groups based on user attributes combined with RBAC role assignments to those groups enables scalable, automated access management without manual per-user assignments.

Question 37: Which Azure Monitor feature allows you to create rich, interactive reports that combine multiple data sources including metrics, logs, and workbooks from different Azure services?

Azure Metrics Explorer
Azure Dashboard
Azure Monitor Workbooks (Correct answer)
Power BI only

Correct answer: Azure Monitor Workbooks

Azure Monitor Workbooks are interactive documents that combine text, queries, metrics, and parameters into rich visual reports, supporting multiple data sources and dynamic content.

Question 38: Which Azure Backup feature prevents backup data from being deleted even if the vault is accidentally deleted by an unauthorized user?

Geo-Redundant Storage backup
Resource Lock on vault
Multi-User Authorization (MUA) (Correct answer)
Soft Delete for Azure Backup

Correct answer: Multi-User Authorization (MUA)

Multi-User Authorization (MUA) for Azure Backup requires a second approver from a designated Resource Guard to perform destructive backup operations, protecting against insider threats.

Question 39: Which Azure service is best suited for implementing a serverless, event-driven architecture that responds to HTTP triggers without managing infrastructure?

Azure Logic Apps
Azure Functions (Correct answer)
Azure Event Grid
Azure Service Bus

Correct answer: Azure Functions

Azure Functions supports HTTP triggers and runs serverless code without managing infrastructure, making it ideal for event-driven architectures.

Question 40: An application needs to reduce SQL Database read latency by caching frequently accessed query results in memory. Which Azure service provides a fully managed, in-memory caching solution?

Azure Content Delivery Network
Azure Cache for Redis (Correct answer)
Azure Blob Storage
Azure Table Storage

Correct answer: Azure Cache for Redis

Azure Cache for Redis is a fully managed, in-memory data store based on Redis that dramatically reduces data retrieval latency for frequently accessed data.

Question 41: A solution requires that in a regional outage, the application automatically fails over to a secondary region with no manual intervention. Which design pattern achieves this?

Active-passive with Azure Traffic Manager health probes
Active-active with Azure Front Door and auto-failover groups (Correct answer)
Passive cold standby with manual runbook
Cross-region backup restore only

Correct answer: Active-active with Azure Front Door and auto-failover groups

Active-active with Azure Front Door and SQL auto-failover groups enables automatic traffic redirection and database failover without human intervention when a region becomes unavailable.

Question 42: An architect must design a solution where an Azure Function triggers whenever a blob is added to Azure Storage. The solution must handle millions of events daily with guaranteed delivery. Which approach is best?

Poll the storage account on a timer trigger
Use Azure Storage trigger directly on the Function
Use Event Grid with Azure Functions as the subscriber (Correct answer)
Use Service Bus with a storage queue adapter

Correct answer: Use Event Grid with Azure Functions as the subscriber

Event Grid provides near-real-time event delivery with at-least-once delivery guarantees and scales to millions of events per second, making it ideal for large-scale blob event processing.

Question 43: A messaging solution requires guaranteed at-least-once delivery, dead-lettering of unprocessable messages, and message deferral. Which Azure service provides all these features?

Azure Notification Hubs
Azure Event Grid
Azure Event Hubs
Azure Service Bus (Correct answer)

Correct answer: Azure Service Bus

Azure Service Bus provides guaranteed delivery, dead-letter queues for messages that cannot be processed, and message deferral for out-of-order processing scenarios.

Question 44: Which Azure AD Access Review feature helps organizations ensure that users still need their current group memberships or application access over time?

Identity Protection
PIM role activation
Entitlement Management
Access Reviews (Correct answer)

Correct answer: Access Reviews

Access Reviews periodically prompt reviewers or users themselves to confirm whether access is still needed, helping remediate stale permissions and maintain compliance.

Question 45: Which Azure feature allows you to test a disaster recovery failover of VMs without impacting the production environment or interrupting replication?

Planned failover
Re-protect after failover
Test Failover in Azure Site Recovery (Correct answer)
Unplanned failover

Correct answer: Test Failover in Azure Site Recovery

Test Failover in ASR spins up the replicated VM in an isolated network without stopping replication, validating the DR plan without affecting production workloads.

Question 46: A hybrid organization wants to sync on-premises Active Directory users to Azure AD. Which tool should you deploy?

Azure AD B2B
Azure AD Connect (Correct answer)
ADFS only
Azure AD Connect Cloud Sync

Correct answer: Azure AD Connect

Azure AD Connect is the primary tool for synchronizing on-premises AD identities, groups, and attributes to Azure AD in a hybrid identity scenario.

Question 47: An architect needs to ensure that secrets stored in Azure Key Vault are rotated automatically. Which Azure feature supports automatic secret rotation?

Key Vault access policies with RBAC
Key Vault soft-delete and purge protection
Key Vault Event Grid integration with Azure Functions (Correct answer)
Key Vault firewall rules

Correct answer: Key Vault Event Grid integration with Azure Functions

Azure Key Vault emits events via Event Grid when secrets are near expiry, which can trigger an Azure Function to rotate and update the secret.

Question 48: Which Azure Monitor component stores structured log data and allows you to query it using Kusto Query Language (KQL)?

Azure Event Grid
Application Insights Live Metrics
Log Analytics Workspace (Correct answer)
Azure Metrics Store

Correct answer: Log Analytics Workspace

Log Analytics Workspace is the data repository within Azure Monitor that stores logs and enables powerful ad-hoc analysis using the Kusto Query Language.

Question 49: A solution architect needs to design archival storage for compliance data that will not be accessed for at least one year but must be retrievable within hours. Which storage tier should be used?

Archive with Standard Priority rehydration (Correct answer)
Archive with High Priority rehydration
Cold
Cool

Correct answer: Archive with Standard Priority rehydration

Archive tier with Standard priority rehydration is appropriate for data that is rarely accessed; Standard rehydration can take 1–15 hours, suitable when same-day retrieval is acceptable.

Question 50: Which Azure Cosmos DB consistency level provides the strongest consistency guarantee at the cost of higher read latency?

Session
Consistent Prefix
Strong (Correct answer)
Eventual

Correct answer: Strong

Strong consistency ensures that reads always return the most recent committed write, but it requires synchronous replication across all regions, increasing read latency.

Microsoft Azure Architect Design (AZ-304)

The AZ-304 exam measures your ability to design monitoring, identity and security, data storage, business continuity, and infrastructure solutions on Microsoft Azure. It is one of two exams required for the Azure Solutions Architect Expert certification (retired March 2022, succeeded by AZ-305).

Questions

150 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds