What's Actually Tested on AZ-305
A practitioner breakdown of what the AZ-305 exam tests and how to prepare.
By NerdExam Editorial Team · Published June 13, 2026
What Is on the AZ-305 Exam, and How Should You Prepare?
The AZ-305 Designing Microsoft Azure Infrastructure Solutions exam is not a knowledge quiz. It is a scenario-based assessment that asks you to make architectural decisions under constraint - balancing cost, security, performance, and operational maturity across four core domains. Candidates who pass are not just familiar with Azure services; they can reason through trade-offs and justify a design choice against competing options. If you want to calibrate where your gaps actually are before diving into study, practice with free AZ-305 questions on NerdExam and see how you perform against real scenario formats.
The exam targets architects and senior engineers who are expected to translate business requirements into technical designs. The four domains - design infrastructure solutions, design identity, governance, and monitoring solutions, design data storage solutions, and design business continuity solutions - map directly to the decisions a cloud architect makes every day. Here is what each domain tests, and more importantly, how you need to think to answer correctly.
Domain 1: Design Infrastructure Solutions
This domain covers compute, networking, and migration architecture. The core skill is not knowing which Azure services exist - it is knowing when to use one over another, and why.
The decision framework: Every infrastructure question puts a constraint in front of you: lift-and-shift urgency, a specific SLA requirement, a team with no containerization experience, a workload with unpredictable traffic spikes. Your job is to match those constraints to the right architecture tier.
Consider the compute layer. Azure has at minimum four distinct ways to run application code - Virtual Machines, Azure Kubernetes Service, App Service, and Azure Container Apps - and the exam tests your ability to distinguish them by fit, not by definition. The question is never "what is AKS?" The question is "given a team that already manages Helm charts and needs node-level GPU access, which compute option is correct?" That is a different cognitive task.
Worked example: A company needs to migrate a monolithic .NET application with stateful Windows services and a dependency on a third-party COM component. The team wants minimal rearchitecting and a six-week timeline. The answer is Azure Virtual Machines, probably with Azure Migrate to lift the existing workload. App Service would require rearchitecting the COM dependency. AKS would require containerization. The constraint - COM dependency and zero rearchitect budget - makes VM the defensible choice even if containers are the cleaner long-term path.
Networking architecture within this domain is equally scenario-heavy. Hub-and-spoke topology, Azure Virtual WAN, peering versus VPN Gateway, private endpoints versus service endpoints - these all appear in scenarios that require you to reason about traffic flow, latency, and cost at scale, not just recite definitions.
Domain 2: Design Identity, Governance, and Monitoring Solutions
This domain is where many candidates underestimate the complexity. It tests three distinct skill sets that share a single domain bucket: identity and access design, policy and governance architecture, and observability strategy.
The decision framework for identity: Microsoft Entra ID scenarios require you to understand federation, B2B versus B2C, Conditional Access, and Privileged Identity Management at an architectural level. The key discriminator is usually trust boundary - where does the identity originate, and how much control does your tenant have over it?
For governance, the exam consistently tests management group hierarchy design and Azure Policy versus RBAC as enforcement mechanisms. The distinction matters: RBAC controls what a principal can do with a resource after it exists; Azure Policy controls what resources can exist in the first place. An exam scenario that says "the company needs to ensure no storage accounts are created without private endpoints" is testing Policy, not RBAC.
Worked example: A financial services company with three subsidiaries needs each subsidiary to manage its own resources while a central security team enforces encryption-at-rest and approved regions. The correct architecture uses a management group hierarchy with the company root at the top, one management group per subsidiary below it, and policy assignments at the root level for compliance requirements. Subscription-level RBAC then grants each subsidiary team Contributor rights within their own subscriptions. RBAC alone cannot prevent a subsidiary from creating non-compliant resources; only Policy at a parent scope achieves that.
For monitoring, the exam tests the integration between Azure Monitor, Log Analytics workspaces, Diagnostic Settings, and Microsoft Defender for Cloud. The architectural question is typically about workspace design - centralized versus distributed - and the trade-offs between cost (ingestion, egress) and operational simplicity.
Domain 3: Design Data Storage Solutions
This domain covers relational databases, NoSQL, object storage, caching, and data integration. The surface area is large, but the exam focuses tightly on selection criteria and architecture patterns rather than service internals.
The decision framework: Every data storage question has at least one constraint that rules out most options. Query pattern, consistency requirement, data volume, geographic distribution, and team SQL familiarity are the most common discriminators. Learn these as filters, not as a memorization list.
Azure SQL Database, Azure SQL Managed Instance, and SQL Server on VMs form a spectrum. SQL Database is PaaS with the highest abstraction and lowest operational overhead. Managed Instance adds near-full SQL Server compatibility, including SQL Agent, linked servers, and cross-database queries. SQL on VMs is for scenarios where OS-level access, specific SQL Server versions, or third-party integrations require control that PaaS tiers cannot provide.
Worked example: A legacy application uses SQL Server's cross-database queries and SQL Agent jobs extensively. The team wants to reduce patching overhead and move to Azure. Azure SQL Database does not support cross-database queries or SQL Agent. SQL on VMs removes the patching benefit. Azure SQL Managed Instance supports both features and provides managed patching. This is exactly the Managed Instance design sweet spot the exam targets repeatedly.
For NoSQL storage, Cosmos DB questions test partition key selection strategy - the architectural decision with the largest downstream consequence in Cosmos designs. An exam scenario will describe an access pattern and ask you to identify the correct partition key; the right answer minimizes cross-partition queries for the hot path. The AZ-305 study guide on NerdExam covers data storage decision trees in depth and is worth working through alongside official Microsoft documentation.
Domain 4: Design Business Continuity Solutions
This domain is deceptively specific. It does not test general availability concepts - it tests Azure's concrete mechanisms for backup, disaster recovery, and high availability, and when to use which one.
The decision framework: Every business continuity question begins with two numbers: the Recovery Time Objective (RTO) and the Recovery Point Objective (RPO). RTO is how long you can be down; RPO is how much data you can afford to lose. These two constraints drive the entire architecture. A workload with a 4-hour RTO and 1-hour RPO has completely different design requirements than one with a 15-minute RTO and near-zero RPO.
Azure Site Recovery, Azure Backup, geo-redundant storage with failover, and Always On availability groups for SQL are the primary mechanisms. The exam tests your ability to match RTO/RPO requirements to the right mechanism and configuration - not just to name the service, but to defend why it fits while the alternatives do not.
Worked example: A company runs a Tier-1 ERP application on SQL Server in Azure VMs. The business requires a 30-minute RTO and a 5-minute RPO after a regional failure. Azure Backup alone cannot meet either target - restore times for VMs typically exceed 30 minutes, and backup frequency cannot achieve a 5-minute RPO. The correct design uses Azure Site Recovery for VM replication (enabling near-zero RPO and sub-30-minute failover) combined with SQL Always On availability groups with a replica in the secondary region for the database layer specifically. Azure Backup remains appropriate for long-term retention, but it is not the DR mechanism here.
Availability Zones versus regional redundancy is another recurring decision in this domain. Availability Zones protect against datacenter-level failure within a region; they do not protect against regional outages. Exam scenarios that describe a legal requirement to maintain data within a single geography while surviving a datacenter fire are testing Availability Zone design, not geo-redundancy.
Pulling It Together
The AZ-305 rewards architects who think in constraints rather than catalogs. Memorizing Azure services is insufficient - the exam presents realistic scenarios where three different services could all technically work, and your job is to identify which one fits the specific combination of requirements in front of you.
Practical preparation involves working through scenario-based questions that reflect actual exam depth. The full AZ-305 exam catalog on NerdExam gives you a structured view of coverage alongside practice resources aligned to each domain. Study the decision frameworks above, practice applying them under timed conditions, and pay particular attention to scenarios where two options seem equally valid - those are the questions where understanding the trade-offs separates passing candidates from repeaters.