CertifyDeckCargando contenido…
AZ-305 · Sample questions
10 real questions from the CertifyDeck AZ-305 bank, spread across the domains of the official Microsoft Certified: Azure Solutions Architect Expert skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.
Correct answer: A. Online migration with the migration service, then a cutover
The migration service in Azure Database for PostgreSQL offers an online mode that copies the data, keeps replicating changes and needs only a short outage at cutover, which suits large databases with strict downtime limits (primary keys are required on all tables). Offline migration stops the applications for the whole copy. The Managed Instance link and BACPAC belong to the SQL Server family and do not apply to PostgreSQL.
Correct answer: C. Azure SQL Managed Instance
Azure SQL Managed Instance is the fully managed target recommended for workloads that need to move with minimal changes, and it supports instance-level objects such as SQL Agent jobs and logins. Azure SQL Database does not directly support SQL Agent jobs (elastic jobs replace them) and is scoped per database. SQL Server on Azure VMs leaves the operating system to you, and PostgreSQL is a different engine.
Correct answer: C. Azure SQL Managed Instance, which supports these instance-scoped features with near-complete SQL Server compatibility.
SQL Managed Instance offers near 100% compatibility with the SQL Server engine and supports SQL Server Agent, cross-database queries, linked servers and CLR, which makes it the best PaaS target for migrations with minimal changes. Azure SQL Database lacks some of these features, for example CLR is not supported, and the PostgreSQL and Cosmos DB options would require rewriting the applications.
Correct answer: A. Archive tier
The archive tier is an offline tier with the lowest storage cost, intended for compliance and archival data that is hardly ever accessed and tolerates retrieval latency on the order of hours. The hot, cool and cold tiers are online tiers with higher storage costs, which only pay off when faster access is needed.
Correct answer: A. HDD file shares combined with Azure File Sync
HDD (standard) file shares are the cost-effective media tier for general-purpose shares, and the guidance says low latency matters less when shares are cached on-premises through Azure File Sync. SSD shares add consistent low latency that the team does not need, whether zone-redundant or provisioned for peak I/O. A premium block blob account is an object store with an NFS 3.0 option, not a replacement for SMB team shares.
Correct answer: A. Zone-redundant storage
Microsoft recommends zone-redundant storage for Azure Files workloads: if a zone becomes unavailable, no remounting of the file shares is required on the connected clients. Locally redundant storage keeps every copy in one datacenter. The two read-access geo-redundant options are not supported by Azure Files at all, so they cannot be chosen for a file share.
Correct answer: C. Azure Backup for Azure Files, using the snapshot tier
Azure Files backup uses file share snapshots, so individual files can be restored instantly; it also enables soft delete on the storage account and puts a lease on the snapshots, which protects the share and its snapshots from accidental deletion, and it needs no infrastructure. Geo-redundant storage replicates deletions too and gives no restore points. Disk Backup applies to managed disks, and blob point-in-time restore applies to block blobs, not file shares.
Correct answer: B. Key Vault Secrets User
Key Vault Secrets User reads secret contents, which is exactly the data-plane access required. Key Vault Reader reads only metadata and cannot read secret values, Key Vault Contributor is a control-plane role that does not allow access to secrets, keys or certificates, and Key Vault Administrator performs all data-plane operations, which is more than needed.
Correct answer: A. Key Vault Crypto User
Key Vault Crypto User allows cryptographic operations with keys, which is exactly what the service needs. Crypto Officer can perform any action on keys, so it exceeds least privilege, Key Vault Contributor only manages the vault on the control plane, and Key Vault Reader reads metadata only and cannot use the key.
Correct answer: C. Create Key Vault certificates that use a DigiCert issuer object, with lifetime actions to auto-renew and to email contacts.
Key Vault integrates with partner CAs such as DigiCert, and a certificate policy can hold lifetime actions to auto-renew or email contacts. Non-partnered CAs are allowed but do not support automatic renewal, self-signed certificates are not publicly trusted, and storing certificates as secrets forgoes the built-in lifecycle management and forces custom code.
Answer each question before opening the explanation, and write down why you discarded the other options. On AZ-305, most mistakes come from choosing an option that is technically possible but does not meet every requirement in the scenario.
These 10 questions are a taste of the format, not a diagnostic. To know which domains you fail, practice by domain for free and take a timed mock exam that mirrors the official weights and duration.
Start for free, no sign-up or card. Every question includes an explanation like the ones above, and the mock exam reproduces the official AZ-305 format.