Microsoft Azure Architect Design (AZ-304) — Questions and Answers

Question 1: Which Azure AD feature allows you to enforce multi-factor authentication based on user risk and sign-in risk signals?

Identity Protection (Correct answer)
Azure AD DS
Conditional Access
Azure AD B2C

Correct answer: Identity Protection

Azure AD Identity Protection uses risk-based policies to automatically enforce MFA or block access when suspicious sign-in signals are detected.

Question 2: A solution architect needs to design archival storage for compliance data that will not be accessed for at least one year but must be retrievable within hours. Which storage tier should be used?

Archive with Standard Priority rehydration (Correct answer)
Cool
Cold
Archive with High Priority rehydration

Correct answer: Archive with Standard Priority rehydration

Archive tier with Standard priority rehydration is appropriate for data that is rarely accessed; Standard rehydration can take 1–15 hours, suitable when same-day retrieval is acceptable.

Question 3: You need to enforce that all administrator accounts in your organization use phishing-resistant MFA. Which Azure AD policy type should you configure?

Security Defaults
Per-user MFA settings
Azure Policy
Conditional Access policy with authentication strength (Correct answer)

Correct answer: Conditional Access policy with authentication strength

Conditional Access with Authentication Strength allows you to require specific MFA methods (e.g., FIDO2, Certificate-based) for privileged roles, enforcing phishing-resistant authentication.

Question 4: Which identity model allows users to sign in to Azure resources using the same credentials as their on-premises AD without password hash sync to Azure AD?

Pass-through Authentication
Password Hash Synchronization
Federation with ADFS (Correct answer)
Azure AD Seamless SSO

Correct answer: Federation with ADFS

Federation with ADFS redirects authentication to on-premises ADFS servers so credentials are validated locally and never sent to Azure AD, which is the model that avoids password hash sync.

Question 5: What Azure Storage feature prevents accidental or malicious deletion of blobs by requiring a delete lock to be held for a defined retention period?

Immutable Storage with WORM policy (Correct answer)
Object Replication
Soft Delete
Blob Versioning

Correct answer: Immutable Storage with WORM policy

Immutable Blob Storage with WORM (Write Once, Read Many) policies prevents deletion or modification of data for a configured interval, satisfying regulatory retention requirements.

Question 6: Which Azure Backup feature prevents backup data from being deleted even if the vault is accidentally deleted by an unauthorized user?

Soft Delete for Azure Backup
Resource Lock on vault
Geo-Redundant Storage backup
Multi-User Authorization (MUA) (Correct answer)

Correct answer: Multi-User Authorization (MUA)

Multi-User Authorization (MUA) for Azure Backup requires a second approver from a designated Resource Guard to perform destructive backup operations, protecting against insider threats.

Question 7: Your organization needs to allow customers to sign in using their social identities (Google, Facebook) to access a consumer app. Which Azure AD service should you use?

Azure AD B2B
Azure AD Domain Services
Conditional Access
Azure AD B2C (Correct answer)

Correct answer: Azure AD B2C

Azure AD B2C is a customer identity and access management (CIAM) service that supports social identity providers like Google and Facebook for consumer-facing applications.

Question 8: You have a tenant called contoso.com in Azure Active Directory (Azure AD). Group1 is one of the tenants' groups. All of the administrative user accounts are in Group1. You find many attempts to enter into the Azure portal coming from nations where administrative users are NOT employed. You must make sure that Azure Multi-Factor Authentication (MFA) is required for all attempts to enter into the Azure portal from certain nations. Solution: Construct a Group1 Access Review. Is the goal achieved by this solution?

No (Correct answer)
Yes
Maybe

Correct answer: No

An Azure AD Access Review is used to manage group membership and ensure only authorized users have access to resources, not to enforce Multi-Factor Authentication (MFA) based on location. To require MFA for sign-ins from specific nations, you would need to implement Azure AD Conditional Access policies. Conditional Access allows you to define conditions (like user location) and grant controls (like requiring MFA) for access to cloud apps.

Question 9: An organization wants to prevent resource deployments that violate compliance policies at the time of deployment. Which Azure Policy effect should be used?

AuditIfNotExists
DeployIfNotExists
Audit
Deny (Correct answer)

Correct answer: Deny

The Deny effect in Azure Policy prevents the deployment of non-compliant resources at the ARM layer, stopping policy violations before resources are created or modified.

Question 10: An architect needs a fully managed, serverless SQL data warehouse service for analytical workloads. Which Azure service is most appropriate?

Azure SQL Managed Instance
Azure Synapse Analytics (serverless SQL pool) (Correct answer)
Azure SQL Database
Azure Database for PostgreSQL Hyperscale

Correct answer: Azure Synapse Analytics (serverless SQL pool)

Azure Synapse Analytics serverless SQL pool allows querying data in Azure Data Lake using T-SQL without provisioning infrastructure, paying only per TB processed.

Question 11: Which Azure service provides centralized, scalable management of routing and security for a large number of branch offices connecting to Azure?

Azure Virtual WAN (Correct answer)
Hub-and-spoke with Azure Firewall
Azure Route Server
Azure VPN Gateway with multiple connections

Correct answer: Azure Virtual WAN

Azure Virtual WAN is a networking service that provides optimized, automated branch-to-branch and branch-to-Azure connectivity with integrated routing, security, and SD-WAN integration.

Question 12: A company requires a Recovery Point Objective (RPO) of near zero for a mission-critical Azure SQL Database. Which feature should be used?

Auto-failover groups with grace period
Point-in-Time Restore
Long-Term Retention backups
Active Geo-Replication (Correct answer)

Correct answer: Active Geo-Replication

Active Geo-Replication synchronously replicates transactions to up to four secondary replicas in real time, achieving near-zero RPO for Azure SQL Database.

Question 13: Which authentication method in Azure AD provides passwordless sign-in using a private key stored on a hardware device?

SMS verification
FIDO2 security keys (Correct answer)
App passwords
OATH software tokens

Correct answer: FIDO2 security keys

FIDO2 security keys enable passwordless authentication by using cryptographic credentials stored on a physical hardware device, eliminating password-based attacks.

Question 14: Which Azure Cosmos DB partition key selection principle is most important for achieving optimal throughput distribution?

Use a partition key with few unique values
Use a partition key with high cardinality that evenly distributes data (Correct answer)
Use the creation timestamp as the partition key
Use a partition key that matches the primary sort order

Correct answer: Use a partition key with high cardinality that evenly distributes data

A high-cardinality partition key that distributes requests and data evenly across logical partitions prevents hot partitions and maximizes provisioned throughput utilization.

Question 15: An architect needs to provide outbound internet connectivity for VMs in a subnet without assigning public IP addresses to each VM. Which service should be used?

Azure Bastion
Azure VPN Gateway
Azure NAT Gateway (Correct answer)
Azure Load Balancer outbound rules

Correct answer: Azure NAT Gateway

Azure NAT Gateway provides scalable, highly available outbound internet connectivity for VMs in a subnet using a managed set of public IP addresses without requiring per-VM public IPs.

Question 16: Which Azure service allows you to extend your on-premises Active Directory domain to Azure virtual machines without deploying domain controllers?

Azure AD B2B
Azure AD Domain Services (Correct answer)
Azure AD Connect
Managed Identity

Correct answer: Azure AD Domain Services

Azure AD Domain Services provides managed domain services (LDAP, Kerberos, NTLM) without requiring you to deploy, manage, or patch domain controllers.

Question 17: A front-end application calls dozens of backend microservices. The architect wants a single entry point that aggregates calls, transforms responses, and enforces authentication. Which pattern should be implemented?

Sidecar pattern
Service Mesh pattern
API Gateway pattern (Correct answer)
Ambassador pattern

Correct answer: API Gateway pattern

The API Gateway pattern provides a single entry point for all client requests, handling cross-cutting concerns such as authentication, aggregation, and response transformation.

Question 18: A solution requires caching frequently accessed data to reduce database load. The cache must support complex data structures and persistence. Which Azure service should you choose?

Azure Table Storage
Azure Cache for Redis (Correct answer)
Azure Memcached
Azure CDN

Correct answer: Azure Cache for Redis

Azure Cache for Redis supports complex data structures, data persistence, and pub/sub messaging, making it ideal for this use case.

Question 19: What is the purpose of diagnostic settings in Azure Monitor?

To configure alerting thresholds on VMs
To enable Azure Advisor recommendations
To enable Azure Policy compliance evaluation
To route resource logs and metrics to a Log Analytics Workspace, Event Hub, or Storage Account (Correct answer)

Correct answer: To route resource logs and metrics to a Log Analytics Workspace, Event Hub, or Storage Account

Diagnostic settings configure where Azure resource platform logs and metrics are sent — to a Log Analytics Workspace for querying, an Event Hub for streaming, or a Storage Account for archival.

Question 20: Which Azure SQL Database feature automatically tunes query performance by identifying and applying index recommendations?

Elastic Pools
Active Geo-Replication
Query Store
Automatic Tuning (Correct answer)

Correct answer: Automatic Tuning

Automatic Tuning in Azure SQL Database uses AI to monitor query performance, create or drop indexes, and force good query plans without manual intervention.

Question 21: You have a security group called Group1 in your Azure Active Directory (Azure AD) tenant contoso.com. In Group1, assigned membership is configured. 50 people make up Group1, including 20 visitors. You must offer a suggestion for how to assess Group1's membership. The answer must adhere to the following criteria: ‥ Every three months, the examination must be automatically redone. ‥ Each participant must be able to indicate whether they should belong in Group 1. ‥ Users who claim that Group1 is not something they should be in must be automatically removed from Group1. ‥ Users who fail to indicate whether they belong in Group 1 must be automatically removed from Group 1. What should the recommendation contain?

Implement Azure AD Privileged Identity Management (PIM).
Change the Membership type of Group1 to Dynamic User.
Create an access review. (Correct answer)
Implement Azure AD Identity Protection.

Correct answer: Create an access review.

Azure AD Access Reviews are designed precisely for this scenario. They allow you to review group memberships periodically (e.g., every three months), enable members to self-attest whether they still need access, and automatically remove users who either deny needing access or fail to respond within the review period. This automates the process of ensuring group memberships are current and appropriate, meeting all specified requirements.

Question 22: Which Azure feature allows you to test a disaster recovery failover of VMs without impacting the production environment or interrupting replication?

Planned failover
Test Failover in Azure Site Recovery (Correct answer)
Re-protect after failover
Unplanned failover

Correct answer: Test Failover in Azure Site Recovery

Test Failover in ASR spins up the replicated VM in an isolated network without stopping replication, validating the DR plan without affecting production workloads.

Question 23: An architect needs to provide secure, browser-based RDP and SSH access to Azure VMs without exposing public IP addresses. Which service should be used?

Azure VPN Gateway point-to-site
Azure Bastion (Correct answer)
Azure Firewall DNAT rules
Just-in-time VM access

Correct answer: Azure Bastion

Azure Bastion provides browser-based RDP/SSH directly in the Azure portal without requiring VMs to have public IPs.

Question 24: Which Azure tool allows you to visualize and query your entire Azure resource inventory and their relationships using a graph-based query language?

Azure Resource Graph (Correct answer)
Azure Service Map
Azure Inventory (Log Analytics)
Azure Monitor Workbooks

Correct answer: Azure Resource Graph

Azure Resource Graph enables fast, complex queries across all your Azure subscriptions using the Kusto Query Language (KQL) to explore resource properties and relationships at scale.

Question 25: Which role-based access control scope is the HIGHEST level in the Azure RBAC hierarchy?

Management Group (Correct answer)
Resource
Subscription
Resource Group

Correct answer: Management Group

Management Groups sit at the top of the Azure RBAC hierarchy, allowing policy and access assignments that cascade down to subscriptions, resource groups, and resources.

Question 26: A company needs to provide external partners with access to Azure resources without managing their identities in Azure AD. Which solution should you recommend?

Azure AD Connect
Azure AD DS
Azure AD B2C
Azure AD B2B (Correct answer)

Correct answer: Azure AD B2B

Azure AD B2B allows external users to sign in with their own organizational identities, eliminating the need to manage their credentials in your tenant.

Question 27: You have a bespoke application called Application1 in your Azure subscription. Application1 was created by Fabrikam, a third-party company. Ltd. Role-based access control (RBAC) permissions were given to Fabrikam developers for the Application1 components. All users are granted access to the E5 plan for Microsoft 365. You must provide a remedy to determine whether the Fabrikam developers still need access to Application1. The answer must adhere to the following criteria: ‥ Every month, send an email to the manager of the developers listing the access permissions for Application1. ‥ Automatically revoke access authorization if the manager doesn't check it. ‥ Reduce development work. What ought to you suggest?

Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.
In Azure Active Directory (Azure AD), create an access review of Application1. (Correct answer)
In Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources.
Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.

Correct answer: In Azure Active Directory (Azure AD), create an access review of Application1.

Azure AD access reviews are a built-in feature designed to manage access to resources like applications efficiently. They allow for scheduled reviews of user access, automatically sending email notifications to managers and revoking access if not approved. This solution directly addresses all the requirements—monthly email, automatic revocation, and minimal development work—by leveraging an existing Azure AD capability.

Question 28: Which Azure feature protects Azure Blob Storage data from accidental deletion by retaining deleted data for a configurable retention period?

Soft Delete for Blobs (Correct answer)
Blob Versioning
Lifecycle Management
Immutable Storage

Correct answer: Soft Delete for Blobs

Soft Delete for Blobs retains deleted blobs and snapshots for a configurable period (1–365 days), allowing recovery from accidental or malicious deletions.

Question 29: Which Azure service provides a centralized solution for collecting, analyzing, and acting on telemetry data from Azure and on-premises environments?

Azure Advisor
Azure Service Health
Azure Security Center
Azure Monitor (Correct answer)

Correct answer: Azure Monitor

Azure Monitor is the unified monitoring platform that collects metrics and logs from Azure resources, on-premises systems, and other clouds, enabling alerting and analytics.

Question 30: Which Azure service is best suited for implementing a serverless, event-driven architecture that responds to HTTP triggers without managing infrastructure?

Azure Service Bus
Azure Event Grid
Azure Logic Apps
Azure Functions (Correct answer)

Correct answer: Azure Functions

Azure Functions supports HTTP triggers and runs serverless code without managing infrastructure, making it ideal for event-driven architectures.

Microsoft Azure Architect Design (AZ-304)

The AZ-304 exam measures your ability to design monitoring, identity and security, data storage, business continuity, and infrastructure solutions on Microsoft Azure. It is one of two exams required for the Azure Solutions Architect Expert certification (retired March 2022, succeeded by AZ-305).

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Renewal, score validity, retake fee, exam format, time limit, fees, passing score, eligibility, exam information · verified Nov 2026
home.pearsonvue.com — Test delivery · verified Oct 2026