CertiOverview
Exam format, the 700 passing score, domain weights, and a study plan.
Study guide · Core notes
Solutions Architect Notes: recommend the fit
Reference notes for AZ-305: which identity and monitor design fits, which store and continuity path meet the targets, and which compute, app, migration, and network pattern you should recommend.
How to read these notes: Items tagged Extra sit outside the April 17, 2026 skill list emphasis, such as day-2 portal click paths covered on AZ-104 notes and deep application coding. Learn the unmarked items first. New to the exam? Start with the overview for the format and domain weights. Shared cloud vocabulary is on the Azure Fundamentals notes.
Domain 1: Identity, governance, and monitoring
Recommend how the estate is observed, who may sign in and act, and which control plane rules outlive a single resource. AZ-104 implements these pieces. AZ-305 asks which design fits the constraint.
Logging and monitoring
Recommend Azure Monitor as the hub for metrics, logs, alerts, and insights. Send resource logs and metrics with diagnostic settings to a Log Analytics workspace when you need queries, retention, and cross-resource investigation. Application Insights fits application performance and dependency maps. For hybrid or on-premises sources, recommend agents or Azure Arc patterns so the same workspace can see them.
Paired choice: metrics for near-real-time numeric series; log queries for forensic and multi-condition investigation; alerts and action groups for notification and automation. Do not recommend a storage account dump as the only monitoring design when the stem needs KQL and alerting.
Extra Writing every KQL operator by hand is operational depth. Knowing when to recommend Log Analytics versus metrics-only is in scope.
Authentication and authorization
Microsoft Entra ID is the cloud directory for authentication. Recommend single sign-on, Conditional Access, and hybrid identity (cloud identities, sync, or federation) when on-premises users must reach Azure and SaaS apps. Authorization to Azure resources is RBAC: assign a role at management group, subscription, resource group, or resource scope. Prefer built-in roles and group assignments over piles of direct user assignments.
For on-premises access to Azure resources, recommend the identity model the stem needs (hybrid Entra, managed identities for workloads, or private connectivity plus identity) rather than long-lived passwords in config. Azure Key Vault holds secrets, keys, and certificates. Recommend managed identity for apps and services to retrieve secrets. Customer-managed keys in Key Vault are a design choice when the stem requires control of encryption keys.
Paired choice: Entra authenticates; RBAC authorizes Azure control-plane and data-plane roles; Key Vault stores secrets. App Configuration is for non-secret settings. Extra Creating a single user in the portal is AZ-104. Choosing Conditional Access versus a broader identity governance design is AZ-305.
Governance
Management groups organize subscriptions. Subscriptions are billing and quota boundaries. Resource groups are lifecycle containers. Tags organize cost and ownership; they do not grant permission. Recommend Azure Policy (and initiatives) to enforce allowed regions, required tags, or SKU restrictions. Locks block delete or change; they are not a substitute for Policy. Identity governance (access reviews, entitlement management, privileged access) belongs when the stem is about who keeps standing access over time.
Compliance designs often combine Policy, Defender for Cloud recommendations, and landing-zone structure from the Cloud Adoption Framework. Recommend the lightest control that meets the stated compliance need.
Domain 2: Data storage solutions
Pick the store from the access pattern, then the tier, scale, and protection that balance cost and features.
Relational data
Recommend Azure SQL Database, Azure SQL Managed Instance, or Azure Database for PostgreSQL/MySQL when the workload needs relational schemas, transactions, and SQL. Match the tier to performance, HA features, and cost. Scale up for larger compute; scale out or read replicas when the stem allows read splitting. Protection includes backups, geo-replication or failover groups, and encryption. Prefer PaaS when the stem does not require OS control; recommend SQL on VMs only when the constraint forces it.
Paired choice: SQL Database for most PaaS OLTP; Managed Instance when near-full SQL Server compatibility and instance features matter; PostgreSQL/MySQL when the app already depends on those engines.
Semi-structured and unstructured storage
Cosmos DB fits document and multi-model NoSQL with global distribution and tunable consistency. Table storage or similar is for simple key-value at lower cost. Azure Blob Storage holds unstructured objects; choose hot, cool, cold, or archive tiers from access frequency. Azure Files fits shared file protocols (SMB/NFS). Data Lake Storage patterns matter when analytics needs hierarchical namespaces and large-scale file analytics.
Balance features against cost: multi-region Cosmos writes and strong consistency cost more; archive tiers save money but rehydrate slowly. Soft delete, versioning, and immutability are design options when recovery or compliance requires them.
Data integration and analysis
Recommend Azure Data Factory or Synapse pipelines for orchestrated extract and load. Event-driven ingestion may use Event Hubs or IoT patterns when the stem is streaming. For analysis, match Synapse, Fabric, Databricks, or a simpler SQL/analysis path to the volume and skill constraint. Do not invent a lakehouse when a single relational store meets the requirement.
Extra Deep Spark tuning is beyond the architect midpoint. Knowing when to recommend a pipeline versus a single database is in scope.
Domain 3: Business continuity solutions
Read the RPO (how much data loss is acceptable) and RTO (how long recovery may take) in the stem. Recommend only what those numbers require.
Backup and disaster recovery
Azure Backup protects Azure VMs, files, databases, and other supported workloads into Recovery Services or Backup vaults as the workload requires. Backup is point-in-time restore. Azure Site Recovery replicates machines for failover to another region (or between sites in hybrid scenarios). Many designs use Backup for data protection and Site Recovery for short RTO compute failover.
Design for Azure and hybrid: on-premises workloads may need MARS/MABS agents or ASR to Azure. For databases, prefer native PaaS geo-backup and failover groups when the service provides them. For unstructured data, use blob/file backup, geo-redundant storage, object replication, or a combination that meets RPO.
Paired choice: GRS/GZRS reduces region-loss risk for storage but is not a full application DR plan. Site Recovery fails over compute. Database failover groups fail over the data plane the app connects to.
High availability
Within a region, recommend availability zones and zone-redundant SKUs when the stem needs datacenter-level isolation. Availability sets protect against rack-level faults inside a non-zonal layout. Load balancers and health probes remove unhealthy instances from rotation.
For relational data, recommend zone-redundant or geo-redundant HA features the SKU supports (for example, zone-redundant Azure SQL, failover groups). For Cosmos and similar stores, multi-region writes or multi-region accounts are HA/DR design choices tied to consistency. For blobs and files, zone-redundant storage and RA-GRS/GZRS address durability and read access after regional issues.
Extra Running a manual portal restore drill is operational. Designing RPO/RTO coverage across compute and data is AZ-305.
Domain 4: Infrastructure solutions
The largest share of the exam. Place compute, shape the app, plan the migration, then design the network.
Compute
Virtual machines fit custom OS, lift-and-shift, and software that needs a full machine. Prefer availability zones or scale sets when scale and HA matter. Containers: Azure Container Apps for revisions and event-driven scale without managing nodes; AKS when you need Kubernetes control; Container Instances for short jobs; App Service when a web or API host is enough. Serverless: Azure Functions for event-driven and HTTP APIs without managing servers. Azure Batch for large parallel compute jobs.
Paired choice: recommend the simplest host that meets OS, scale, and ops constraints. Do not recommend AKS when Container Apps or App Service already fit.
Application architecture
Decouple with messaging and events: Service Bus for durable queues and topics; Event Hubs for high-throughput streams; Event Grid for filtered reactive events. API integration may use API Management as a gateway when the stem needs a managed front door for APIs. Caching with Azure Cache for Redis reduces latency for hot reads. App Configuration holds feature flags and non-secret settings; Key Vault holds secrets. Automated deployment belongs in pipelines (GitHub Actions, Azure DevOps, or equivalent) with infrastructure as code (Bicep/ARM/Terraform) for repeatable environments.
Paired choice: queue for competing consumers; Event Grid for fan-out reactions; Event Hubs when ingestion volume dominates.
Migrations
Use the Cloud Adoption Framework for strategy, landing zones, and governance context. Assess with Azure Migrate. Choose IaaS when the app must move with little change; choose PaaS when you can refactor to managed services. Database migrations use Database Migration Service or native export/import paths. Unstructured data moves with AzCopy, Storage migration tools, or Data Box for large offline transfers. Recommend a wave plan that matches downtime windows and dependency order.
Networking
Internet-facing designs use public load balancing, Application Gateway or Front Door when layer-7 or global entry is required, and WAF when the stem names web threats. Hybrid connectivity uses VPN Gateway or ExpressRoute; ExpressRoute for private circuits and predictable performance, VPN for simpler or backup connectivity. Performance designs use proximity placement, accelerated networking, CDN, or Traffic Manager/Front Door for geo routing. Security designs use NSGs, Azure Firewall, private endpoints, and Private Link. Load balancing and routing: Azure Load Balancer at layer 4; Application Gateway at layer 7; Traffic Manager or Front Door for DNS/global HTTP patterns. User-defined routes steer traffic through appliances.
Paired choice: private endpoint for a private IP to a PaaS service; service endpoint to identify the VNet while still using the public service address; ExpressRoute versus VPN from the bandwidth, latency, and private-peering need.
Extra Configuring every NSG rule in the portal is AZ-104. Recommending Firewall plus private endpoints for a hub-spoke landing zone is AZ-305.
Frequently asked questions
How is AZ-305 different from AZ-104?
AZ-104 measures whether you can implement, manage, and monitor Azure resources. AZ-305 measures whether you can recommend and design solutions against constraints. The Expert credential requires the Azure Administrator Associate certification. See the Azure Administrator path.
When do you recommend Site Recovery instead of Backup alone?
Recommend Azure Site Recovery when the RTO requires a replicated standby that can fail over. Backup restores point-in-time data and may not meet a short RTO by itself. Many designs use both.
When do you recommend a private endpoint?
Recommend a private endpoint when a platform service needs a private IP in your virtual network and you want to disable or restrict public access. A service endpoint keeps the service's public address and identifies your virtual network.
Continue the Azure Solutions Architect study path
Drill the distinctions, then test them under a timer.
Core Notes
Reference notes for identity, storage, continuity, and infrastructure design.
Flashcards & Memory Notes
40 recall cards in four decks, plus memory notes for design distinctions.
Practice Exams
200 original questions with custom exams, explanations, and a score report by domain.
Related Tools
Useful companions while you study.
JSON YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Diff Checker
Compare two text blocks and highlight added, removed, and changed content.
CSV JSON Converter
Convert CSV spreadsheet data to JSON or turn JSON arrays into downloadable CSV files.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Microsoft, Azure, and related marks are trademarks of Microsoft Corporation. Certicab is not affiliated with, endorsed by, or sponsored by Microsoft.