Microsoft Azure Architect Design (AZ-304) — Questions and Answers

Question 1: A hybrid organization wants to sync on-premises Active Directory users to Azure AD. Which tool should you deploy?

Azure AD B2B
Azure AD Connect Cloud Sync
ADFS only
Azure AD Connect (Correct answer)

Correct answer: Azure AD Connect

Azure AD Connect is the primary tool for synchronizing on-premises AD identities, groups, and attributes to Azure AD in a hybrid identity scenario.

Question 2: What is the maximum backup retention period for Azure VM backups using Azure Backup with Enhanced Policy?

30 days
1 year
99 years (Correct answer)
5 years

Correct answer: 99 years

Azure Backup Enhanced Policy supports backup retention for up to 99 years, enabling organizations to meet long-term data retention regulatory requirements for VM backups.

Question 3: Which Azure AD feature allows you to enforce multi-factor authentication based on user risk and sign-in risk signals?

Conditional Access
Azure AD B2C
Identity Protection (Correct answer)
Azure AD DS

Correct answer: Identity Protection

Azure AD Identity Protection uses risk-based policies to automatically enforce MFA or block access when suspicious sign-in signals are detected.

Question 4: What is the maximum number of objects that can be synchronized from on-premises AD to Azure AD Connect with a single Azure AD tenant?

100,000
No hard limit — scales to millions (Correct answer)
50,000
300,000

Correct answer: No hard limit — scales to millions

Azure AD Connect has no fixed upper limit for the number of synchronized objects; the Azure AD tenant itself can hold up to 500,000 objects by default, expandable on request.

Question 5: Which Azure AD feature enables employees to request access packages containing multiple resource access rights (groups, apps, SharePoint) through a self-service portal?

Conditional Access
Access Reviews
Entitlement Management (Correct answer)
Privileged Identity Management

Correct answer: Entitlement Management

Entitlement Management lets you bundle access to multiple resources into access packages that users can request through a governed, approval-based self-service portal.

Question 6: What is the purpose of Azure SQL Elastic Pools?

To automatically shard a single database horizontally
To provide serverless compute scaling
To replicate databases across multiple regions
To share compute resources across multiple databases with variable workloads (Correct answer)

Correct answer: To share compute resources across multiple databases with variable workloads

Elastic Pools allow multiple databases to share a common pool of eDTUs or vCores, optimizing cost when individual databases have unpredictable or varying usage patterns.

Question 7: You need to store relational data that requires multi-region writes with low latency. Which Azure service should you choose?

Azure SQL Database with geo-replication
Azure Synapse Analytics
Azure Database for MySQL Flexible Server
Azure Cosmos DB with multi-region writes (Correct answer)

Correct answer: Azure Cosmos DB with multi-region writes

Azure Cosmos DB natively supports multi-region writes, enabling active-active architectures with configurable consistency levels and guaranteed low latency globally.

Question 8: What is the recommended approach to assign Azure built-in roles to groups rather than individual users at scale?

Direct user assignment
Azure Policy assignment
Dynamic group membership with RBAC assignment (Correct answer)
Attribute-based access control only

Correct answer: Dynamic group membership with RBAC assignment

Using dynamic groups based on user attributes combined with RBAC role assignments to those groups enables scalable, automated access management without manual per-user assignments.

Question 9: Which identity model allows users to sign in to Azure resources using the same credentials as their on-premises AD without password hash sync to Azure AD?

Pass-through Authentication
Federation with ADFS (Correct answer)
Password Hash Synchronization
Azure AD Seamless SSO

Correct answer: Federation with ADFS

Federation with ADFS redirects authentication to on-premises ADFS servers so credentials are validated locally and never sent to Azure AD, which is the model that avoids password hash sync.

Question 10: A solution architect needs to design archival storage for compliance data that will not be accessed for at least one year but must be retrievable within hours. Which storage tier should be used?

Cold
Cool
Archive with High Priority rehydration
Archive with Standard Priority rehydration (Correct answer)

Correct answer: Archive with Standard Priority rehydration

Archive tier with Standard priority rehydration is appropriate for data that is rarely accessed; Standard rehydration can take 1–15 hours, suitable when same-day retrieval is acceptable.

Question 11: An application needs read access to a specific Azure Storage container. Which principle should guide the scope of the role assignment?

Assign Owner role at resource group level
Principle of least privilege — assign at the container level (Correct answer)
Use storage account key instead of RBAC
Assign at subscription level for simplicity

Correct answer: Principle of least privilege — assign at the container level

The principle of least privilege requires granting only the minimum permissions needed at the narrowest scope, so the role should be assigned at the specific container level.

Question 12: Which role-based access control scope is the HIGHEST level in the Azure RBAC hierarchy?

Subscription
Resource
Resource Group
Management Group (Correct answer)

Correct answer: Management Group

Management Groups sit at the top of the Azure RBAC hierarchy, allowing policy and access assignments that cascade down to subscriptions, resource groups, and resources.

Question 13: Which Azure Monitor feature should an architect configure to automatically notify the operations team when CPU utilization exceeds 90% for more than 5 minutes?

Azure Monitor Diagnostic Settings
Log Analytics workspace query
Azure Monitor Metric Alert (Correct answer)
Azure Monitor Activity Log Alert

Correct answer: Azure Monitor Metric Alert

Azure Monitor Metric Alerts evaluate metric values on defined frequency and fire when thresholds are breached for the configured window.

Question 14: Which Azure service provides a managed runbook-style orchestration engine that automates complex DR workflows including sequencing, dependencies, and custom scripts?

Azure DevOps Pipelines
Azure Automation Runbooks
Azure Logic Apps
Azure Site Recovery Recovery Plans (Correct answer)

Correct answer: Azure Site Recovery Recovery Plans

ASR Recovery Plans allow you to define failover sequences, add manual actions, and inject Azure Automation runbooks into the failover workflow for automated DR orchestration.

Question 15: A design requires that an Azure SQL Database secondary replica be readable for reporting queries without impacting the primary workload. Which feature enables this?

SQL Database Hyperscale named replicas
Read Scale-Out on Business Critical tier
Elastic Pools
Geo-Replication readable secondary (Correct answer)

Correct answer: Geo-Replication readable secondary

Active Geo-Replication creates up to four readable secondary replicas in different regions, allowing reporting workloads to be offloaded without affecting the primary replica.

Question 16: Which Azure feature protects Azure Blob Storage data from accidental deletion by retaining deleted data for a configurable retention period?

Lifecycle Management
Soft Delete for Blobs (Correct answer)
Immutable Storage
Blob Versioning

Correct answer: Soft Delete for Blobs

Soft Delete for Blobs retains deleted blobs and snapshots for a configurable period (1–365 days), allowing recovery from accidental or malicious deletions.

Question 17: An architect needs to enforce that all Azure resources in a subscription are deployed only in approved regions. Which Azure service enforces this policy?

Azure Blueprints
Azure RBAC
Azure Policy (Correct answer)
Management Groups only

Correct answer: Azure Policy

Azure Policy allows you to define and enforce rules like allowed resource locations, automatically denying or auditing non-compliant deployments across your subscriptions.

Question 18: An architect must design a solution where Azure Functions can securely access Azure Key Vault without storing credentials in code. What is the recommended approach?

Store the Key Vault URL in application settings
Use a system-assigned managed identity (Correct answer)
Embed the access key in the function code
Use a service principal with a client secret

Correct answer: Use a system-assigned managed identity

A system-assigned managed identity allows Azure Functions to authenticate to Key Vault without any stored credentials.

Question 19: A company needs to expose internal REST APIs to external partners with rate limiting, authentication policies, and a developer portal. Which Azure service should be used?

Azure App Service
Azure Logic Apps
Azure Functions
Azure API Management (Correct answer)

Correct answer: Azure API Management

Azure API Management provides a unified gateway with rate limiting, authentication policies, caching, and a built-in developer portal for exposing APIs to external consumers.

Question 20: Which Azure SQL Database feature allows you to restore a database to any point in time within the configured retention period?

Long-Term Retention (LTR)
Auto-failover groups
Point-in-Time Restore (PITR) (Correct answer)
Active Geo-Replication

Correct answer: Point-in-Time Restore (PITR)

Point-in-Time Restore (PITR) uses continuous transaction log backups to allow restoration of an Azure SQL Database to any second within the 1–35 day retention window.

Question 21: You need to design a solution to automatically remediate non-compliant Azure resources without manual intervention. Which feature should you enable?

Azure Resource Manager templates with conditional deployment
Azure Blueprints with locked assignments
Azure Automation runbooks triggered by alerts
Azure Policy remediation tasks with DeployIfNotExists effect (Correct answer)

Correct answer: Azure Policy remediation tasks with DeployIfNotExists effect

Azure Policy with DeployIfNotExists effect and remediation tasks automatically brings non-compliant resources into compliance.

Question 22: Which Azure Cosmos DB partition key selection principle is most important for achieving optimal throughput distribution?

Use a partition key with high cardinality that evenly distributes data (Correct answer)
Use a partition key that matches the primary sort order
Use the creation timestamp as the partition key
Use a partition key with few unique values

Correct answer: Use a partition key with high cardinality that evenly distributes data

A high-cardinality partition key that distributes requests and data evenly across logical partitions prevents hot partitions and maximizes provisioned throughput utilization.

Question 23: A solution requires a globally distributed NoSQL database with multi-region writes and automatic failover. Which Azure service best fits this requirement?

Azure SQL Database Hyperscale
Azure Cosmos DB (Correct answer)
Azure Database for PostgreSQL Flexible Server
Azure Table Storage

Correct answer: Azure Cosmos DB

Azure Cosmos DB supports multi-region writes with configurable consistency levels and automatic failover.

Question 24: Which Azure governance feature bundles Azure Policy assignments, RBAC assignments, and ARM templates into a repeatable, version-controlled package for deploying compliant environments?

Management Groups
Azure Resource Manager templates only
Azure Blueprints (Correct answer)
Azure Policy Initiative

Correct answer: Azure Blueprints

Azure Blueprints compose policy assignments, role assignments, resource groups, and ARM templates into a tracked package that can be deployed and updated across multiple subscriptions.

Question 25: Which Azure feature integrates security signals from multiple Azure services into a single pane, enabling security analysts to detect, investigate, and respond to threats?

Microsoft Sentinel (Correct answer)
Microsoft Defender for Cloud only
Azure Monitor Alerts only
Azure Security Benchmark

Correct answer: Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM/SOAR platform that ingests security signals from Azure, on-premises, and third-party sources for unified threat detection and automated response.

Question 26: You need to design a solution that allows Azure Virtual Machines in different virtual networks to communicate privately without traversing the internet. Which feature should you use?

VPN Gateway with site-to-site connection
Azure ExpressRoute
VNet peering (Correct answer)
Azure Bastion

Correct answer: VNet peering

VNet peering allows VMs in different virtual networks to communicate using private IP addresses without internet traversal.

Question 27: A business has a software as a service (SaaS)-based hybrid ASP.NET Web API application. Users complain that the data generally has problems. You suggest that the business deploy live monitoring and utilize ad hoc queries on JSON data that has been stored. You also suggest that the business set up intelligent alerts to find data irregularities. <br> You must include a suggestion for how to set up smart alerting. <br> What would you suggest?

Azure Security Center and Azure Data Lake Store
Azure Data Lake Analytics and Azure Monitor Logs
Azure Site Recovery and Azure Monitor Logs
Azure Application Insights and Azure Monitor Logs (Correct answer)

Correct answer: Azure Application Insights and Azure Monitor Logs

Azure Application Insights is excellent for live monitoring of web applications, collecting performance data, usage patterns, and exceptions, and supports intelligent alerts for anomalies. Azure Monitor Logs (formerly Log Analytics) allows for storing and performing ad hoc queries on various log data, including JSON, making it suitable for analyzing stored data and detecting irregularities. Together, they provide a comprehensive solution for monitoring, querying, and intelligent alerting for the described SaaS application.

Question 28: A solution requires that in a regional outage, the application automatically fails over to a secondary region with no manual intervention. Which design pattern achieves this?

Passive cold standby with manual runbook
Active-passive with Azure Traffic Manager health probes
Cross-region backup restore only
Active-active with Azure Front Door and auto-failover groups (Correct answer)

Correct answer: Active-active with Azure Front Door and auto-failover groups

Active-active with Azure Front Door and SQL auto-failover groups enables automatic traffic redirection and database failover without human intervention when a region becomes unavailable.

Question 29: An architect needs to design a serverless event-driven architecture where an image uploaded to Blob Storage triggers downstream processing. Which service combination is most appropriate?

Azure Blob Storage → Azure Event Grid → Azure Functions (Correct answer)
Azure Blob Storage → Azure Event Hubs → Azure Stream Analytics
Azure Blob Storage → Azure Service Bus → Azure Logic Apps
Azure Blob Storage → Azure Queue Storage → Azure WebJobs

Correct answer: Azure Blob Storage → Azure Event Grid → Azure Functions

Event Grid reacts to Blob Storage events near-instantly and triggers Azure Functions, providing the ideal serverless event-driven pattern.

Question 30: Which Azure service provides proactive recommendations to improve cost, security, reliability, and performance based on analysis of your Azure resources?

Azure Advisor (Correct answer)
Microsoft Defender for Cloud
Azure Service Health
Azure Monitor

Correct answer: Azure Advisor

Azure Advisor analyzes your Azure resource configurations and usage patterns to provide personalized, actionable recommendations across cost, security, reliability, performance, and operational excellence pillars.

Question 31: A solution requires that API calls from external clients are throttled, authenticated, and cached before reaching backend services. Which Azure service addresses all three requirements?

Azure Front Door with rules engine
Azure Application Gateway with WAF
Azure API Management (Correct answer)
Azure Load Balancer with session persistence

Correct answer: Azure API Management

Azure API Management provides built-in policies for rate limiting/throttling, OAuth/subscription key authentication, and response caching.

Question 32: Which Azure Monitor feature captures a complete picture of an application's performance including request rates, failures, and dependencies across distributed microservices?

Azure Metrics Explorer
Log Analytics Workspace queries
Application Insights (Correct answer)
Azure Monitor Workbooks

Correct answer: Application Insights

Application Insights provides distributed tracing, live metrics, dependency tracking, and performance analytics for application code running on Azure or on-premises.

Question 33: An architect is implementing the Strangler Fig pattern to incrementally migrate a monolithic application to microservices. Which Azure service can act as the routing facade during migration?

Azure Service Bus
Azure API Management (Correct answer)
Azure Logic Apps
Azure Functions

Correct answer: Azure API Management

Azure API Management can proxy and route requests to either the legacy monolith or new microservices, enabling incremental migration without disrupting clients.

Question 34: Your organization needs to allow customers to sign in using their social identities (Google, Facebook) to access a consumer app. Which Azure AD service should you use?

Conditional Access
Azure AD B2C (Correct answer)
Azure AD Domain Services
Azure AD B2B

Correct answer: Azure AD B2C

Azure AD B2C is a customer identity and access management (CIAM) service that supports social identity providers like Google and Facebook for consumer-facing applications.

Question 35: An architect needs a fully managed, serverless SQL data warehouse service for analytical workloads. Which Azure service is most appropriate?

Azure Database for PostgreSQL Hyperscale
Azure Synapse Analytics (serverless SQL pool) (Correct answer)
Azure SQL Database
Azure SQL Managed Instance

Correct answer: Azure Synapse Analytics (serverless SQL pool)

Azure Synapse Analytics serverless SQL pool allows querying data in Azure Data Lake using T-SQL without provisioning infrastructure, paying only per TB processed.

Question 36: Which Azure SQL Database feature automatically tunes query performance by identifying and applying index recommendations?

Query Store
Active Geo-Replication
Automatic Tuning (Correct answer)
Elastic Pools

Correct answer: Automatic Tuning

Automatic Tuning in Azure SQL Database uses AI to monitor query performance, create or drop indexes, and force good query plans without manual intervention.

Question 37: Which Azure service provides centralized, scalable management of routing and security for a large number of branch offices connecting to Azure?

Hub-and-spoke with Azure Firewall
Azure Virtual WAN (Correct answer)
Azure VPN Gateway with multiple connections
Azure Route Server

Correct answer: Azure Virtual WAN

Azure Virtual WAN is a networking service that provides optimized, automated branch-to-branch and branch-to-Azure connectivity with integrated routing, security, and SD-WAN integration.

Question 38: You need to grant an application access to Azure Key Vault secrets without storing credentials in code. What should you use?

Service Principal with client secret
Shared Access Signature
Managed Identity (Correct answer)
Azure AD Application Proxy

Correct answer: Managed Identity

Managed Identities provide Azure services with an automatically managed identity in Azure AD, eliminating the need to store credentials in application code.

Question 39: Which Azure networking feature allows you to route traffic between VNets and on-premises networks through a central hub VNet?

Azure Private Link
Azure NAT Gateway
Hub-and-spoke topology with Azure Firewall or NVA (Correct answer)
VNet Peering

Correct answer: Hub-and-spoke topology with Azure Firewall or NVA

A hub-and-spoke topology centralizes shared services (firewall, VPN gateway) in the hub and connects spoke VNets via peering.

Question 40: You need to design a solution that aggregates security logs from multiple Azure subscriptions into a central workspace for analysis. Which service should you use?

Azure Log Analytics workspace with resource-level RBAC
Microsoft Sentinel with multi-workspace configuration (Correct answer)
Azure Monitor with cross-subscription alerts
Azure Security Center with policy initiatives

Correct answer: Microsoft Sentinel with multi-workspace configuration

Microsoft Sentinel's multi-workspace architecture enables centralized security log collection and SIEM/SOAR capabilities across multiple subscriptions.

Question 41: Azure Site Recovery replicates Azure VMs to a secondary region. What is the typical RPO target achievable with ASR for Azure VM replication?

Approximately 15 minutes crash-consistent
Less than 15 seconds (Correct answer)
Zero (synchronous replication)
Less than 1 minute

Correct answer: Less than 15 seconds

ASR for Azure VMs targets an RPO of less than 15 seconds for app-consistent recovery points, using continuous replication with very frequent checkpoint intervals.

Question 42: Which Azure Blob Storage access tier is most cost-effective for data that is accessed less than once per month and requires a 30-day minimum storage duration?

Cool
Hot
Cold (Correct answer)
Archive

Correct answer: Cold

The Cold tier offers lower storage costs than Cool with a 90-day minimum retention, but Cool (30-day minimum) is more cost-effective for data accessed less than once a month versus Hot.

Question 43: Which Azure Service Health feature provides personalized alerts about service outages that specifically impact your Azure resources and subscriptions?

Service Health Alerts (Correct answer)
Azure Status Page
Resource Health
Azure Monitor Service Map

Correct answer: Service Health Alerts

Service Health Alerts send notifications about Azure service incidents, planned maintenance, and health advisories that affect the specific subscriptions and regions your resources use.

Question 44: A company is designing a microservices architecture requiring built-in service discovery, load balancing, and automated rollouts. Which Azure service best meets these requirements?

Azure App Service
Azure Container Instances
Azure Kubernetes Service (AKS) (Correct answer)
Azure Virtual Machine Scale Sets

Correct answer: Azure Kubernetes Service (AKS)

AKS provides built-in service discovery, load balancing, automated rollouts, and self-healing capabilities essential for microservices architectures.

Question 45: A company needs to provide external partners with access to Azure resources without managing their identities in Azure AD. Which solution should you recommend?

Azure AD DS
Azure AD Connect
Azure AD B2C
Azure AD B2B (Correct answer)

Correct answer: Azure AD B2B

Azure AD B2B allows external users to sign in with their own organizational identities, eliminating the need to manage their credentials in your tenant.

Question 46: You need to enforce that all administrator accounts in your organization use phishing-resistant MFA. Which Azure AD policy type should you configure?

Conditional Access policy with authentication strength (Correct answer)
Per-user MFA settings
Security Defaults
Azure Policy

Correct answer: Conditional Access policy with authentication strength

Conditional Access with Authentication Strength allows you to require specific MFA methods (e.g., FIDO2, Certificate-based) for privileged roles, enforcing phishing-resistant authentication.

Question 47: What is the purpose of Privileged Identity Management (PIM) in Azure AD?

To enforce password complexity policies
To audit all sign-in events
To synchronize on-premises AD with Azure AD
To provide just-in-time privileged access to Azure resources (Correct answer)

Correct answer: To provide just-in-time privileged access to Azure resources

PIM enables just-in-time activation of privileged roles, reducing standing access and requiring justification and approval for elevated permissions.

Question 48: When designing an Azure solution, you need to ensure that a resource group and all its resources cannot be accidentally deleted. What should you apply?

CanNotDelete resource lock (Correct answer)
Azure Policy deny assignment
ReadOnly resource lock
Azure Blueprints assignment lock

Correct answer: CanNotDelete resource lock

A CanNotDelete resource lock prevents deletion of resources while still allowing modifications, protecting against accidental removal.

Question 49: Which Azure AD feature enables you to define and enforce organizational policies for application access based on conditions like device compliance?

Conditional Access (Correct answer)
Application Proxy
Identity Governance
Access Reviews

Correct answer: Conditional Access

Conditional Access policies evaluate signals like user location, device compliance, and application sensitivity to grant, block, or require additional verification for access.

Question 50: An organization needs to back up on-premises servers and Azure VMs to a centralized vault. Which Azure service manages this?

Azure Storage Archive tier
Azure Blob Storage with LRS
Azure Backup with Recovery Services Vault (Correct answer)
Azure Site Recovery only

Correct answer: Azure Backup with Recovery Services Vault

Azure Backup with Recovery Services Vault provides centralized backup management for Azure VMs, on-premises servers, SQL Server, SAP HANA, and Azure Files.

Microsoft Azure Architect Design (AZ-304)

The AZ-304 exam measures your ability to design monitoring, identity and security, data storage, business continuity, and infrastructure solutions on Microsoft Azure. It is one of two exams required for the Azure Solutions Architect Expert certification (retired March 2022, succeeded by AZ-305).

Questions

150 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Renewal, score validity, retake fee, exam format, time limit, fees, passing score, eligibility, exam information · verified Nov 2026
home.pearsonvue.com — Test delivery · verified Oct 2026