AZ-305 questions 81-90
AZ-305 Questions 81-90: Landing Zones, Governance, and Cost Optimization
Use this AZ-305 questions 81-90 practice set to review Azure landing zone, governance, monitoring, migration, quota, and cost optimization decisions for the Microsoft Azure Solutions Architect Expert exam. These questions are original, exam-style scenarios based on public Microsoft objectives and documentation — no exam dumps, no proprietary item reconstruction.
AZ-305 Designing Microsoft Azure Infrastructure Solutions
Questions 81-90
Design governance, monitoring, migration, and optimization solutions
Architect-level design tradeoffs
AZ-305 questions 81-90
Question 81 Management groups
Designing governance scopes for a multi-subscription environment
A company is building an Azure landing zone for several business units. Each business unit needs separate subscriptions for production and non-production workloads, but corporate security policies and baseline role assignments must be inherited consistently. The design should minimize repeated policy assignments while still allowing workload teams to manage their own subscriptions.
Choose one answer.
- Create one large subscription for all business units and separate workloads by resource group only.
- Create a management group hierarchy for platform and workload scopes, place subscriptions under the appropriate management groups, and assign baseline policies/RBAC at inherited scopes.
- Create a separate Microsoft Entra tenant for each workload team so policies cannot overlap.
- Assign all policies directly to every resource group and avoid management groups.
Explanation: Management groups provide a scope above subscriptions where Azure Policy and role assignments can be inherited by child management groups and subscriptions. That fits enterprise-scale governance: central guardrails at higher scopes, with workload subscriptions organized below them.
Why the other options are wrong: A creates scale, billing, blast-radius, and delegation problems. C is usually unnecessary and adds identity complexity unless there is a hard isolation requirement. D works for tiny environments but does not minimize repeated assignments or support scalable inheritance.
Objective/domain: Design governance and Azure landing zone solutions.
Reference: Microsoft Learn: azure/governance/management-groups/overview
Question 82 Azure Policy
Enforcing allowed regions and required resource tags
An architecture review board requires all new resources in a subscription family to be deployed only in approved Azure regions and to include a CostCenter tag. Existing resources should be assessed for compliance, and new deployments that violate the region rule should be blocked automatically.
Choose one answer.
- Assign an Azure Policy initiative at the management group scope with policies for allowed locations and required tags, using deny/modify effects where appropriate.
- Create Azure Monitor alerts for every resource that is created outside approved regions.
- Apply a CanNotDelete resource lock to each resource group.
- Grant all developers the Reader role so they can see which locations are approved.
Explanation: Azure Policy is the Azure governance service used to enforce standards and assess compliance at scale. Assigning an initiative at the management group scope allows consistent inherited governance across subscriptions. Deny can block disallowed deployments, and tag policies can audit or help remediate tagging requirements depending on the design.
Why the other options are wrong: B can notify after the fact but does not enforce deployment rules. C protects resources from deletion but does not evaluate allowed locations or tags. D changes visibility only; it does not enforce governance.
Objective/domain: Design governance solutions.
Reference: Microsoft Learn: azure/governance/policy/overview
Question 83 Hub-spoke networking
Centralizing inspection for spoke virtual networks
A company has ten application virtual networks that must use a shared ExpressRoute connection and centralized outbound traffic inspection. Application teams should not deploy their own firewalls. The design must avoid assuming that traffic automatically transits from one spoke virtual network to another through peering.
Choose one answer.
- Peer every spoke with every other spoke and let Azure automatically inspect traffic between them.
- Deploy a VPN gateway and firewall appliance into each spoke virtual network.
- Use a hub-spoke topology with the ExpressRoute gateway and Azure Firewall or an NVA in the hub, peer each spoke to the hub, enable gateway transit/remote gateway where appropriate, and use route tables to send required traffic to the inspection point.
- Place all workloads into one flat virtual network so no routing configuration is required.
Explanation: A hub-spoke design centralizes shared connectivity and security services in a hub while keeping workloads isolated in spokes. Because VNet peering is not automatically transitive, the design must explicitly route traffic through the hub firewall/NVA and configure gateway transit patterns where appropriate.
Why the other options are wrong: A creates a mesh that is hard to govern and incorrectly assumes automatic inspection/transit. B duplicates expensive shared services and increases operations. D reduces segmentation and does not scale well for independent workload teams.
Objective/domain: Design network infrastructure solutions.
Reference: Microsoft Learn: azure/architecture/networking/architecture/hub-spoke
Question 84 Landing zones
Separating platform and application landing zones
A regulated organization wants a repeatable Azure foundation. A central team must own identity integration, connectivity, monitoring standards, and security guardrails. Product teams need separate environments where they can deploy application resources within those guardrails. Which design best matches the Azure landing zone model?
Choose one answer.
- A single shared resource group where the platform team and all product teams deploy every resource.
- Only application subscriptions, with each product team independently choosing its own identity, network, and monitoring standards.
- One Azure policy assignment per virtual machine after deployment.
- A platform landing zone for shared foundation services and governance, plus application landing zones for workload resources operated by product teams.
Explanation: Azure landing zones separate the platform foundation from workload landing zones. The platform landing zone provides centralized governance, security, connectivity, and shared services. Application landing zones give workload teams a place to deploy and operate applications inside the organization’s guardrails.
Why the other options are wrong: A lacks isolation and delegation. B misses the central foundation and creates inconsistent controls. C is too narrow and reactive for landing zone design.
Objective/domain: Design Azure landing zone and governance solutions.
Reference: Microsoft Learn: azure/cloud-adoption-framework/ready/landing-zone/
Question 85 Azure Monitor
Collecting different telemetry from different VM groups
A monitoring team is standardizing VM telemetry collection. Domain controllers must send security events to a restricted Log Analytics workspace, while application servers must send performance counters and selected Windows event logs to a separate workspace. The team wants a scalable Azure Monitor Agent configuration model rather than per-machine manual setup.
Choose one answer.
- Create Azure Monitor data collection rules and associate the rules with the appropriate VM groups so each group sends the required data to the correct destination.
- Create one activity log alert per VM and configure email notifications.
- Enable boot diagnostics only on each VM.
- Use resource locks to prevent VM telemetry settings from changing.
Explanation: Data collection rules define what data Azure Monitor Agent collects, where it sends that data, and which resources the rule applies to. This supports different collection profiles and destinations for different groups of machines.
Why the other options are wrong: B alerts on Azure control-plane activity and does not configure guest telemetry collection. C helps troubleshoot VM boot issues but does not collect the requested operational/security logs. D protects configuration from changes but does not define telemetry collection.
Objective/domain: Design monitoring solutions.
Reference: Microsoft Learn: azure/azure-monitor/data-collection/data-collection-rule-overview
Question 86 Resource locks
Preventing accidental deletion while allowing updates
A production resource group contains a virtual network, firewall, and private DNS zones that many workloads depend on. Administrators must still be able to update configuration during approved changes, but accidental deletion of the resource group or its critical resources must be prevented, even by users who otherwise have high privileges.
Choose one answer.
- Apply a ReadOnly lock at the resource group scope.
- Apply a CanNotDelete lock at the resource group scope and document the controlled process for removing it during intentional decommissioning.
- Remove all RBAC role assignments from the resource group.
- Move the resource group to a different Azure region.
Explanation: A CanNotDelete lock allows authorized users to read and modify resources but blocks deletion. Locks are useful for protecting critical shared infrastructure from accidental deletion and apply regardless of normal RBAC permissions until the lock is removed by an authorized user.
Why the other options are wrong: A would also block many update operations, which violates the requirement to allow approved changes. C would break operations and still is not the right design pattern for accidental deletion protection. D does not address deletion risk.
Objective/domain: Design governance and operational protection solutions.
Reference: Microsoft Learn: azure/azure-resource-manager/management/lock-resources
Question 87 Migration design
Assessing and migrating VMware workloads with minimal refactoring
A company plans to migrate 120 VMware virtual machines from an on-premises datacenter to Azure. The first phase should discover dependencies, estimate Azure sizing and cost, and replicate selected servers for migration with minimal application refactoring. Which service best supports this scenario?
Choose one answer.
- Azure App Service Migration Assistant only
- Azure Resource Mover
- Azure Migrate, including discovery/assessment and server migration capabilities
- Azure Policy Guest Configuration
Explanation: Azure Migrate is the central Microsoft service for discovering, assessing, and migrating on-premises servers, including VMware workloads, to Azure. It supports dependency discovery, assessment, sizing guidance, and migration tooling for server moves.
Why the other options are wrong: A is focused on web app migration, not broad VMware server assessment and migration. B moves resources between Azure regions, not from on-premises VMware to Azure. D audits or configures guest settings but is not a migration assessment and replication service.
Objective/domain: Design migration solutions.
Reference: Microsoft Learn: azure/migrate/migrate-services-overview
Question 88 Cost optimization
Reducing cost for steady-state virtual machine compute
A production analytics platform runs a fixed set of Azure virtual machines 24 hours a day. Utilization has been stable for six months, and the business expects the same capacity to be required for at least the next three years. The workload cannot tolerate eviction. Which purchasing option should the architect recommend first after rightsizing?
Choose one answer.
- Azure Reservations for the predictable VM compute usage
- Spot VMs for all production nodes
- Premium SSD v2 disks without changing compute purchasing
- A ReadOnly management lock on the VM resource group
Explanation: Azure Reservations can reduce costs for predictable, committed usage such as steady VM compute. After confirming that the workload is rightsized and consistently running, a reservation is a strong fit for long-running capacity that cannot be interrupted.
Why the other options are wrong: B can be cheaper but is interruptible and not appropriate for capacity that cannot tolerate eviction. C may improve disk performance/cost in some storage scenarios but does not address compute commitment savings. D is a governance protection feature, not a cost-optimization purchasing model.
Objective/domain: Design cost optimization solutions.
Reference: Microsoft Learn: azure/cost-management-billing/reservations/save-compute-costs-reservations
Question 89 Quotas and scale
Planning around subscription limits during regional growth
A workload team is deploying a large batch-processing platform in one Azure region. Deployment fails because the required number of vCPUs exceeds the current regional quota for the subscription. A developer suggests creating more resource groups in the same subscription to bypass the limit. What should the architect recommend?
Choose one answer.
- Create additional resource groups because quotas are calculated independently per resource group.
- Rename the virtual machines so Azure treats them as a new quota pool.
- Move the virtual network to another resource group and retry the deployment.
- Request the required quota increase or design the workload/subscription strategy around documented Azure subscription and regional service limits.
Explanation: Many Azure limits are enforced at subscription, regional, or service scopes. Resource groups are management containers; adding more of them does not create additional regional vCPU quota. Architects should plan capacity against documented limits and request quota increases or use an appropriate subscription strategy.
Why the other options are wrong: A misunderstands quota scope. B has no effect on quota. C reorganizes resources but does not change regional compute quota.
Objective/domain: Design infrastructure scale and governance solutions.
Reference: Microsoft Learn: azure/azure-resource-manager/management/azure-subscription-service-limits
Question 90 Azure Advisor
Choosing an optimization signal across Well-Architected pillars
An operations team wants an Azure-native service that analyzes deployed resources and provides recommendations across cost, security, reliability, operational excellence, and performance. The recommendations should help teams prioritize improvements without building a custom analytics platform first.
Choose one answer.
- Azure Resource Graph only
- Azure Advisor
- Azure DNS Private Resolver
- Azure Bastion
Explanation: Azure Advisor analyzes Azure configurations and usage telemetry to provide recommendations aligned to major optimization categories such as cost, security, reliability, operational excellence, and performance. It is a practical starting point for continuous optimization work.
Why the other options are wrong: A is useful for querying resource inventory but does not itself provide the Advisor recommendation experience. C resolves DNS queries in hybrid/private network designs. D provides secure VM connectivity, not broad architecture optimization recommendations.
Objective/domain: Design for operational excellence, reliability, performance, security, and cost optimization.
Answer key summary
| Question | Answer | Key idea |
|---|---|---|
| 81 | B | Management groups provide inherited governance above subscriptions |
| 82 | A | Azure Policy initiatives enforce allowed locations and tagging standards |
| 83 | C | Hub-spoke centralizes shared connectivity and inspection |
| 84 | D | Platform and application landing zones separate shared foundation from workloads |
| 85 | A | Data collection rules define Azure Monitor Agent collection and destinations |
| 86 | B | CanNotDelete locks prevent accidental deletion while allowing updates |
| 87 | C | Azure Migrate supports VMware discovery, assessment, and server migration |
| 88 | A | Azure Reservations fit predictable, non-interruptible steady compute |
| 89 | D | Resource groups do not bypass subscription/regional service quotas |
| 90 | B | Azure Advisor provides built-in optimization recommendations |
Sources
- Microsoft Learn: Study guide for Exam AZ-305
- Microsoft Learn: Azure Well-Architected Framework
- Microsoft Learn: Azure landing zones in the Cloud Adoption Framework
- Microsoft Learn: Organize resources with Azure management groups
- Microsoft Learn: Overview of Azure Policy
- Microsoft Learn: Hub-spoke network topology in Azure
- Microsoft Learn: Data collection rules in Azure Monitor
- Microsoft Learn: Lock Azure resources to protect infrastructure
- Microsoft Learn: About Azure Migrate
- Microsoft Learn: What are Azure Reservations?
- Microsoft Learn: Azure subscription and service limits, quotas, and constraints
- Microsoft Learn: Introduction to Azure Advisor
