AZ-305: Azure Solutions Architect Expert — Study Guide

Exam Overview#

Domain Weightings#

---

Domain 1: Identity, Governance, and Monitoring (25–30%)#

Identity architecture#

• Single tenant vs multi-tenant — enterprise apps use single tenant; ISVs use multi-tenant.
• Hybrid identity — Microsoft Entra Connect (sync on-prem AD to Entra ID); Password Hash Sync vs Pass-through Auth vs Federation.
• Entra ID B2B — invite external partners; they authenticate with their own IdP.
• Entra External ID (B2C) — customer identity; custom branding; OAuth, OIDC, SAML.
• Entitlement Management — access packages for automated provisioning of groups, apps, and SharePoint sites.

Governance at scale#

• Azure Landing Zones — prescriptive, scalable environment design following CAF.
  • Management subscriptions (Log Analytics, Automation)
  • Platform subscriptions (Identity, Connectivity/Hub)
  • Landing zone subscriptions (workloads)
• Azure Policy + Management Groups — enforce compliance top-down.
• Tagging strategy — mandatory tags enforced by Policy (Modify/Deny effect).
• Naming conventions — consistent resource naming for large environments.

Monitoring architecture#

• Centralised Log Analytics — single workspace aggregating logs from all subscriptions.
• Azure Monitor — unified monitoring: metrics, alerts, dashboards.
• Application Insights — per-application APM; linked to central workspace.
• Diagnostic settings at scale — deploy via Azure Policy (DeployIfNotExists).

---

Domain 2: Data Storage Solutions (15–20%)#

Storage service selection#

Cosmos DB design#

• API choice — NoSQL API (documents), MongoDB API, Cassandra API, Gremlin (graphs), Table.
• Consistency levels — Strong → Bounded Staleness → Session → Consistent Prefix → Eventual.
• Partitioning — choose partition key carefully; high cardinality, even distribution.
• RU/s capacity — provision or autoscale; design for peak with auto-scale.
• Global distribution — add regions for low-latency reads; multi-write for active-active.

Data protection#

• Geo-redundant storage — 6 copies across paired regions (GRS/GZRS).
• Soft delete — for blobs (1–365 days), containers, file shares, VMs.
• Point-in-time restore — roll back blob storage to a previous point.
• Immutable storage — WORM for compliance.

---

Domain 3: Business Continuity Solutions (15–20%)#

Azure SLAs and composite SLA#

• Availability = product of individual service SLAs.
• Improve availability: multi-instance (Availability Zones), active-active multi-region.
• RPO / RTO targets drive service selection (ASR, Backup, Geo-replication).

Compute resilience#

Database business continuity#

• Azure SQL — Active Geo-Replication (up to 4 readable secondaries), auto-failover groups.
• Cosmos DB — global distribution; automatic failover; multi-master for active-active.
• Azure SQL Managed Instance — failover groups across regions; automatic DNS switch.

Backup and DR architecture#

• Azure Backup + Recovery Services Vault — per-workload RPO/RTO.
• Azure Site Recovery — replicate VMs to secondary region; test failover quarterly.
• Recovery plans — orchestrate failover order across tiers (DB first, app second, web last).

---

Domain 4: Infrastructure Solutions (30–35%)#

Compute service selection#

Network architecture patterns#

Hub-and-spoke topology

Hub VNet (connectivity subscription)
├── Azure Firewall (centralised inspection)
├── VPN Gateway / ExpressRoute
└── Azure Bastion

Spoke VNets (peered to hub)
├── Spoke-Production
├── Spoke-Dev
└── Spoke-DMZ

Benefits: centralised security, shared services, cost optimisation.

Azure Virtual WAN

• Managed hub-and-spoke at scale; automated routing; SD-WAN integration.
• Supports: VPN, ExpressRoute, P2S, Firewall, Route Manager.

Connectivity options decision tree

On-premises to Azure:
  Low bandwidth, internet OK → VPN Gateway (up to 10 Gbps)
  High bandwidth, private, consistent latency → ExpressRoute
  ExpressRoute + fallback → S2S VPN as backup

Inter-VNet connectivity:
  Same region, few VNets → VNet Peering
  Many VNets, cross-region, complex routing → Azure Virtual WAN or Transit Gateway

Migration architecture#

• Azure Migrate — discover, assess, and migrate VMs, databases, web apps.
• Azure Database Migration Service — migrate on-prem SQL to Azure SQL with minimal downtime.
• Lift and shift — Rehost (VMs → Azure VMs); fast but not cloud-optimised.
• Refactor — Replatform (move to App Service or managed DB); moderate effort.
• Rearchitect — Rebuild as cloud-native (containers, functions); highest benefit, most effort.

Well-Architected Framework review#

Every architecture decision in AZ-305 should reference the 5 pillars:

---

Study Plan (10–12 Weeks)#

---

Key Resources#