← Back to Learning Portal

AZ-305 Study Manual

Exam study guide for Designing Microsoft Azure Infrastructure Solutions.

📘 AZ-305 EXAM STUDY GUIDE 2026

Deep Dive with Azure CLI and PowerShell Examples

Exam: AZ-305 — Designing Microsoft Azure Infrastructure Solutions
Skills measured: April 17, 2026 | Pass: 700/1000

DOMAIN 1: IDENTITY, GOVERNANCE, AND MONITORING

1.1 Management Group Hierarchy

Azure CLI

# Create management group structure
az account management-group create --name mg-platform --display-name "Platform"
az account management-group create --name mg-workloads --display-name "Workloads" --parent mg-platform

# Move subscription into management group
az account management-group subscription add --name mg-workloads --subscription "<subscription-id>"

# List hierarchy
az account management-group list --tree

PowerShell

New-AzManagementGroup -GroupName "mg-platform" -DisplayName "Platform"
New-AzManagementGroup -GroupName "mg-workloads" -DisplayName "Workloads" -ParentId (Get-AzManagementGroup -GroupName "mg-platform").Id
New-AzManagementGroupSubscription -GroupName "mg-workloads" -SubscriptionId "<subscription-id>"

1.2 Azure Policy — Deploy Diagnostic Settings

# Assign built-in policy: Deploy diagnostic settings for Storage Accounts
az policy assignment create \
  --name "deploy-storage-diagnostics" \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/0a2e5c2e-8b0e-4c2e-9c2e-8b0e4c2e9c2e" \
  --scope "/subscriptions/<sub-id>" \
  --params '{"logAnalyticsWorkspaceId":{"value":"/subscriptions/<sub-id>/resourceGroups/rg-mgmt/providers/Microsoft.OperationalInsights/workspaces/law-central"}}' \
  --mi-system-assigned

1.3 Entra ID — Conditional Access (PowerShell)

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

$params = @{
    DisplayName = "Require MFA for Admins"
    State = "enabled"
    Conditions = @{
        Users = @{ IncludeUsers = @("All") }
        Applications = @{ IncludeApplications = @("All") }
        Users = @{ IncludeRoles = @("62e90394-69f5-4237-9190-012177145e10") } # Global Admin
    }
    GrantControls = @{
        Operator = "OR"
        BuiltInControls = @("mfa")
    }
}
New-MgIdentityConditionalAccessPolicy @params

1.4 Log Analytics Workspace

# Create central workspace
az monitor log-analytics workspace create \
  -g rg-mgmt -n law-central --location westeurope --retention-time 90

# Enable diagnostic settings on a VM
az monitor diagnostic-settings create \
  --name vm-diagnostics \
  --resource <vm-resource-id> \
  --workspace law-central \
  --metrics '[{"category":"AllMetrics","enabled":true}]' \
  --logs '[{"category":"Syslog","enabled":true}]'

DOMAIN 2: DATA STORAGE

2.1 SQL Database with Failover Group

# Create primary SQL server and database
az sql server create -g rg-data -n sql-az305-primary -l westeurope \
  --admin-user sqladmin --admin-password '<P@ssw0rd!>'
az sql db create -g rg-data -s sql-az305-primary -n db-app --service-objective S2

# Create secondary server in paired region
az sql server create -g rg-data -n sql-az305-secondary -l northeurope \
  --admin-user sqladmin --admin-password '<P@ssw0rd!>'

# Create failover group
az sql failover-group create -g rg-data -n fg-app \
  --partner-server sql-az305-secondary \
  --failover-policy Automatic --grace-period 60 \
  --add-db db-app

2.2 Cosmos DB Multi-Region

az cosmosdb create -g rg-data -n cosmos-az305 \
  --default-consistency-level Session \
  --locations regionName=westeurope failoverPriority=0 isZoneRedundant=true \
  --locations regionName=northeurope failoverPriority=1 isZoneRedundant=true \
  --enable-automatic-failover true

2.3 Storage Lifecycle Management

# Create storage account with ADLS Gen2
az storage account create -g rg-data -n staz305datalake \
  --sku Standard_LRS --kind StorageV2 --hierarchical-namespace true

# Apply lifecycle policy (Hot → Cool after 30 days → Archive after 90)
az storage account management-policy create --account-name staz305datalake -g rg-data \
  --policy @lifecycle-policy.json

lifecycle-policy.json:

{
  "rules": [{
    "name": "tiering-rule",
    "type": "Lifecycle",
    "definition": {
      "filters": { "blobTypes": ["blockBlob"] },
      "actions": {
        "baseBlob": {
          "tierToCool": { "daysAfterModificationGreaterThan": 30 },
          "tierToArchive": { "daysAfterModificationGreaterThan": 90 }
        }
      }
    }
  }]
}

DOMAIN 3: BUSINESS CONTINUITY

3.1 Recovery Services Vault and VM Backup

# Create vault
az backup vault create -g rg-dr -n rsv-az305 --location westeurope

# Register VM for backup
az backup protection enable-for-vm \
  --vault-name rsv-az305 -g rg-dr \
  --vm $(az vm show -g rg-data -n vm-app --query id -o tsv) \
  --policy-name DefaultPolicy

# Enable soft delete and immutable vault
az backup vault backup-properties set -g rg-dr --name rsv-az305 \
  --soft-delete-feature-state Enable

3.2 Azure Site Recovery

# Create ASR vault
az site-recovery vault create -g rg-dr -n asr-vault --location westeurope

# Enable replication for a VM (simplified — full ASR setup via portal recommended for labs)
az vm create -g rg-data -n vm-asr-test --image Ubuntu2204 --size Standard_B2s
# Configure replication via Azure Migrate/ASR blade or REST API

3.3 Availability Zones

# Create zone-redundant VMSS
az vmss create -g rg-data -n vmss-app \
  --image Ubuntu2204 --upgrade-policy-mode automatic \
  --lb sku=Standard --zones 1 2 3 --instance-count 3

DOMAIN 4: INFRASTRUCTURE

4.1 Hub-and-Spoke Network

# Hub VNet
az network vnet create -g rg-net -n vnet-hub \
  --address-prefix 10.0.0.0/16 \
  --subnet-name AzureFirewallSubnet --subnet-prefix 10.0.1.0/26

# Deploy Azure Firewall
az network firewall policy create -g rg-net -n fw-policy --sku Tier2
az network firewall create -g rg-net -n azfw-hub --sku AZFW_VNet --tier Standard \
  --firewall-policy fw-policy --vnet-name vnet-hub --public-ip-count 1

# Spoke + peering
az network vnet create -g rg-net -n vnet-spoke-prod --address-prefix 10.1.0.0/16
az network vnet peering create -g rg-net -n hub-to-prod \
  --vnet-name vnet-hub --remote-vnet vnet-spoke-prod \
  --allow-vnet-access --allow-forwarded-traffic
az network vnet peering create -g rg-net -n prod-to-hub \
  --vnet-name vnet-spoke-prod --remote-vnet vnet-hub \
  --allow-vnet-access --allow-forwarded-traffic

4.2 Private Endpoint

# Private endpoint for storage account
az network private-endpoint create -g rg-net -n pe-storage \
  --vnet-name vnet-spoke-prod --subnet default \
  --private-connection-resource-id $(az storage account show -g rg-data -n staz305 --query id -o tsv) \
  --group-id blob --connection-name storage-connection

# Private DNS zone
az network private-dns zone create -g rg-net -n privatelink.blob.core.windows.net
az network private-dns link vnet create -g rg-net -n storage-dns-link \
  --zone-name privatelink.blob.core.windows.net \
  --virtual-network vnet-spoke-prod --registration-enabled false

4.3 App Service with Deployment Slots

az appservice plan create -g rg-app -n plan-az305 --sku S1 --is-linux
az webapp create -g rg-app -p plan-az305 -n app-az305-prod --runtime "NODE:18-lts"
az webapp deployment slot create -g rg-app -n app-az305-prod --slot staging

# Configure auto-scale
az monitor autoscale create -g rg-app -n autoscale-app \
  --resource $(az appservice plan show -g rg-app -n plan-az305 --query id -o tsv) \
  --min-count 1 --max-count 5 --count 2
az monitor autoscale rule create -g rg-app --autoscale-name autoscale-app \
  --condition "Percentage CPU > 70 avg 5m" --scale out 1

4.4 AKS with Workload Identity

az aks create -g rg-app -n aks-az305 --node-count 2 --enable-managed-identity \
  --enable-oidc-issuer --enable-workload-identity \
  --network-plugin azure --generate-ssh-keys

# Assign Key Vault Secrets User to kubelet identity
az role assignment create --role "Key Vault Secrets User" \
  --assignee $(az aks show -g rg-app -n aks-az305 --query identityProfile.kubeletidentity.clientId -o tsv) \
  --scope $(az keyvault show -g rg-app -n kv-az305 --query id -o tsv)

4.5 Azure Migrate Assessment

# Create Migrate project
az migrate project create -g rg-migrate -n migrate-az305 --location westeurope

# Install discovery appliance (on-premises) — download from Migrate portal
# After discovery, create assessment:
az migrate assessment create -g rg-migrate --project-name migrate-az305 \
  --group-id discovered-vms --assessment-name vm-assessment \
  --azure-location westeurope --azure-vm-sizes Standard_D2s_v3

DOMAIN CHECKLISTS

Domain 1 Checklist

  • [ ] Design management group hierarchy for 50+ subscriptions
  • [ ] Create Policy initiative with Deny, Audit, DeployIfNotExists
  • [ ] Configure central Log Analytics with diagnostic settings
  • [ ] Design hybrid identity (PHS vs PTA vs Cloud Sync)
  • [ ] Configure PIM eligible assignments for admin roles

Domain 2 Checklist

  • [ ] Compare SQL DB vs MI vs VM for a migration scenario
  • [ ] Design Cosmos DB partition key and consistency level
  • [ ] Configure storage lifecycle policies
  • [ ] Design SQL failover group for DR
  • [ ] Select appropriate storage replication (ZRS vs GRS)

Domain 3 Checklist

  • [ ] Map RTO/RPO to DR strategy (backup vs ASR vs active-active)
  • [ ] Configure backup vault with immutable storage
  • [ ] Design Availability Zone deployment for 99.99% SLA
  • [ ] Configure ASR test failover
  • [ ] Design multi-region failover with Front Door

Domain 4 Checklist

  • [ ] Design hub-and-spoke with Azure Firewall UDRs
  • [ ] Compare vWAN vs hub-spoke for 20+ branches
  • [ ] Configure Private Endpoints with DNS Private Resolver
  • [ ] Select compute platform (App Service vs AKS vs VMs)
  • [ ] Design migration path with Azure Migrate

*AZ-305 Exam Study Guide 2026 — pair with [AZ-305-CRASHCOURSE.md](AZ-305-CRASHCOURSE.md) for concept depth*