Azure AZ-305 Architecture Scenarios Guide (2026)

The Microsoft Azure Solutions Architect Expert exam doesn’t ask you to recite Azure service features. It presents complex, real‑world business problems and asks you to design solutions that balance security, performance, cost, and operational requirements. This scenario library mirrors the case‑study style of the AZ‑305 exam. You will learn to think like an enterprise architect: to extract the true business need, sift through constraints, compare competing designs, and justify the best path forward.

CloudCertPro focuses on architecture thinking, not exam dumps. Each scenario here builds your ability to solve problems—the same skill you need to pass the exam and to excel in your career as a solutions architect.

What Is an Azure Architecture Scenario?

An architecture scenario is a structured business problem that requires you to design an Azure solution. It goes beyond a simple technology question; it forces you to weigh competing priorities and apply the Microsoft Azure Well‑Architected Framework.

A complete scenario contains:

• Business objectives – What the organization wants to achieve (e.g., migrate 200 servers, launch a global web application, reduce operational costs by 30%).
• Functional requirements – What the solution must do, expressed in features and capabilities.
• Non‑functional requirements – Performance targets, availability SLAs, RTO/RPO objectives, security posture, and compliance mandates.
• Constraints – Existing systems, budget limits, team skills, regulatory boundaries, and timeline pressure.
• Risk factors – Potential pitfalls and what the business can tolerate.
• Trade‑off analysis – The inevitable balancing act between cost, security, reliability, and operational complexity.

The architecture decision process typically follows this flow:

Core AZ‑305 Scenario Categories

Scenarios in the exam can be mapped to the following categories. The table below gives a snapshot of each; the sections that follow explore them in depth.

Scenario Category	Typical Business Goal	Primary Azure Services	Architecture Focus
Azure Landing Zone	Establish a governed, secure enterprise foundation	Management Groups, Azure Policy, Blueprints, RBAC, Microsoft Entra ID	Governance, compliance, subscription design
Enterprise Governance	Enforce policy and cost control at scale	Azure Policy, Management Groups, Cost Management, Blueprints	Security, compliance, operational control
Hybrid Cloud	Integrate on‑premises and Azure environments	Azure Arc, ExpressRoute, VPN Gateway, Entra Connect, Azure Stack HCI	Identity, networking, unified operations
Hub‑and‑Spoke Networking	Centralize security and connectivity	VNet Peering, Azure Firewall, VPN Gateway, Virtual WAN	Network segmentation, traffic inspection
Multi‑Region Deployment	Deploy globally resilient, low‑latency applications	Azure Front Door, Traffic Manager, Cosmos DB multi‑region, geo‑redundant storage	Global traffic routing, data replication, failover
High Availability	Keep workloads running through local failures	Availability Zones, Availability Sets, Load Balancer, VM Scale Sets	Redundancy, fault isolation, self‑healing
Disaster Recovery	Recover from regional outages	Azure Site Recovery, Azure Backup, geo‑redundant storage, paired regions	RTO/RPO, cost‑effective resilience
Identity & Access Management	Centralize and secure workforce and workload access	Microsoft Entra ID, Entra ID B2B/B2C, Conditional Access, Privileged Identity Management	Federation, least privilege, governance
Security Architecture	Implement defense in depth	Microsoft Defender for Cloud, Microsoft Sentinel, Key Vault, Azure Firewall, Azure Policy	Threat protection, encryption, compliance
Data Platform	Ingest, store, process, and analyze data at scale	Synapse Analytics, Data Lake Storage, Databricks, Data Factory, Cosmos DB	Data pipelines, analytics, performance
AI Solutions	Build intelligent applications	Azure OpenAI Service, Azure AI Search, Azure AI Foundry, Azure Machine Learning	Secure AI integration, data grounding, cost control
Migration & Modernization	Move and transform workloads to Azure	Azure Migrate, Azure Site Recovery, Azure Database Migration Service, App Service Migration Assistant	Lift‑and‑shift, replatform, refactor
Containers & Kubernetes	Run portable, scalable microservices	Azure Kubernetes Service (AKS), Container Apps, Container Registry, App Configuration	Orchestration, service discovery, CI/CD
Serverless	Reduce infrastructure management	Azure Functions, Logic Apps, API Management, Event Grid	Event‑driven, operational efficiency
Cost Optimization	Minimize waste while meeting requirements	Azure Advisor, Reservations, Spot VMs, autoscaling, storage lifecycle management	Financial governance, right‑sizing
Business Continuity	Ensure critical operations survive disruptions	Azure Backup, Site Recovery, paired regions, geo‑redundant storage	RTO/RPO, recovery automation

Azure Landing Zone Scenarios

Landing zone scenarios test your ability to design the enterprise’s cloud foundation. The exam may present a company with a handful of disjointed subscriptions and ask you to impose governance without disrupting existing workloads.

Typical design elements:

• Management Groups – Organize subscriptions into a hierarchy (e.g., root → sandbox, development, production). Apply Azure Policy at each level.
• Azure Policy – Enforce mandatory tagging, restrict allowed VM SKUs, deny creation of public IPs, and require encryption at rest.
• Subscription strategy – Decide how many subscriptions to use and how to isolate environments, business units, or compliance boundaries.
• Governance – Centralize logging with Log Analytics workspaces, security monitoring with Microsoft Defender for Cloud, and cost tracking with Cost Management.
• Azure RBAC – Assign built‑in roles (Owner, Contributor, Reader) at management group or subscription scope; implement Privileged Identity Management for just‑in‑time privileged access.

Architecture lens: You must design a structure that scales with the organization, enforces security guardrails, and provides the visibility and control demanded by auditors. The exam often pits simplicity against granular control; a single management group is easier to manage but less flexible.

Hybrid Cloud Scenarios

Hybrid scenarios ask you to extend an existing on‑premises environment into Azure, often while maintaining seamless identity, networking, and management.

Typical design elements:

• Azure Arc – Project on‑premises servers as Azure resources, enabling Azure Policy, update management, and monitoring from the portal.
• ExpressRoute – Provide dedicated, high‑bandwidth, low‑latency connectivity. Often combined with a Site‑to‑Site VPN as a cost‑effective backup.
• VPN Gateway – Use when budget or timeline prevents ExpressRoute. Understand bandwidth limits and latency implications.
• Microsoft Entra Connect – Synchronize on‑premises Active Directory to Microsoft Entra ID for hybrid identity; configure password hash sync or pass‑through authentication.
• On‑premises integration – Extend on‑premises networks into Azure via VNet gateways; use DNS forwarding for unified name resolution.

When hybrid is appropriate: Organizations that must maintain certain data on‑premises for regulatory reasons, those with large existing VMware or Hyper‑V investments, or those planning a phased migration. AZ‑305 expects you to know when to recommend ExpressRoute over VPN and how to design for high availability in hybrid connectivity (dual ExpressRoute circuits, redundant VPN).

Multi‑Region Deployment Scenarios

Global application scenarios require you to decide between active‑active and active‑passive architectures, and to select the appropriate global load balancing and data replication services.

• Active‑Active – Both regions serve live traffic. Use Azure Front Door to route users to the nearest healthy endpoint. Data replication must handle conflicts; Cosmos DB multi‑region writes or SQL Data Sync are typical. This pattern gives the best performance and resilience but increases cost and complexity.
• Active‑Passive – One region is primary; a secondary region stands by. Front Door or Traffic Manager detects primary failure and redirects traffic. Data is replicated asynchronously (geo‑redundant storage, SQL active geo‑replication). Cheaper than active‑active but involves failover time and potential data loss (RPO > 0).
• Azure Front Door – Layer‑7 global load balancer with SSL offloading, caching, and integrated Web Application Firewall (WAF). Best for HTTP/HTTPS workloads.
• Traffic Manager – DNS‑based global load balancer that works with any protocol. Use when Front Door’s layer‑7 features are not needed.
• Region Pairs – Azure pairs regions for prioritized recovery during large‑scale outages. Use paired regions for DR data replication (RA‑GRS storage, SQL active geo‑replication).

Trade‑offs: Active‑active designs demand that you handle data consistency conflicts, which adds application complexity. Active‑passive designs are simpler but may not meet tight RTO/RPO requirements. The exam often presents a global e‑commerce site and asks you to recommend the most cost‑effective solution that still meets the availability SLA.

High Availability & Disaster Recovery Scenarios

High availability (HA) and disaster recovery (DR) are tightly linked but test different architectural layers. HA protects against local failures; DR protects against regional catastrophes.

High availability within a region:

• Availability Zones – Deploy VM Scale Sets, Load Balancer, and zone‑redundant services across physically separate datacenters within an Azure region. Provides 99.99% VM connectivity SLA.
• Availability Sets – Distribute VMs across fault and update domains for workloads that do not require zone redundancy (e.g., legacy applications).
• Azure Load Balancer – Standard SKU supports zone‑redundant frontends; ensures traffic only reaches healthy VMs.

Disaster recovery strategies: The RTO/RPO matrix below compares the strategies you must know for the exam.

Strategy	RTO	RPO	Cost	Complexity
Backup & Restore	Hours to days	Hours	Low	Low
Pilot Light	Minutes to hours	Minutes	Medium	Medium
Warm Standby	Minutes	Seconds to minutes	High	High
Multi‑Site Active‑Active	Near zero	Near zero	Very High	Very High

• Azure Site Recovery – Orchestrate replication and failover of entire VM landscapes to another region. Use for pilot light and warm standby approaches.
• Azure Backup – Application‑consistent backups with long‑term retention. Foundation for backup‑and‑restore strategies.

Architecture lens: A financial services firm with an RTO of 15 minutes and RPO of 5 minutes cannot rely on backup‑and‑restore. You must recommend at least a warm standby with SQL active geo‑replication and Azure Site Recovery for application servers. The exam will ask you to select the DR approach that meets the given RTO/RPO at the lowest cost.

Security & Identity Scenarios

Security architecture is woven into every scenario, but some focus explicitly on identity, access control, and threat protection. You may be asked to design a zero‑trust framework or consolidate identity across multiple directories.

Core components:

• Microsoft Entra ID – The identity control plane. Configure Conditional Access policies (require MFA, compliant device), Privileged Identity Management (JIT for admin roles), and Identity Protection (risk‑based policies).
• Azure Key Vault – Centralize secrets, keys, and certificates. Use RBAC or access policies to grant least‑privilege access. Integrate with App Service, VMs, and Azure Disk Encryption.
• Microsoft Defender for Cloud – Assess secure score, enforce regulatory compliance standards (CIS, PCI DSS, ISO 27001), and enable workload protection plans.
• Microsoft Sentinel – Cloud‑native SIEM. Collect data from across the enterprise, detect threats, and automate response with playbooks (Logic Apps).
• Azure Policy – Audit and enforce encryption, allowed locations, and resource types. Deny creation of resources that violate security standards.
• Azure Firewall – Centrally inspect outbound and east‑west traffic in a hub‑and‑spoke network.

Architecture decisions: When integrating a partner organization, you may choose Entra ID B2B for guest access, applying Conditional Access to guests. When securing a data lake, you design network isolation (Private Link, VNet service endpoints) combined with Azure RBAC and ACLs on Data Lake Storage. The exam expects you to layer controls and avoid a single point of security failure.

AI Solution Scenarios

AI workloads are increasingly part of the AZ‑305 landscape. Architects must understand how to securely integrate Azure AI services into enterprise solutions without exposing sensitive data or blowing the budget.

Common enterprise use cases:

• Internal knowledge assistants – Use Azure OpenAI Service with your organization’s own data (through Azure AI Search) to build a chatbot that answers employee questions from HR policies, technical documentation, etc.
• Retrieval‑Augmented Generation (RAG) applications – Combine Azure AI Search (for vector and keyword indexing) with Azure OpenAI to ground model responses in authoritative data.
• Intelligent document processing – Use Azure AI Document Intelligence (formerly Form Recognizer) with Logic Apps to automate invoice processing.
• AI copilots – Integrate Azure OpenAI into existing line‑of‑business applications through API Management, ensuring authentication (Entra ID) and rate limiting.

Key architecture concerns:

• Data privacy – Ensure training data and prompts are not used to improve Microsoft models (Azure OpenAI does not use customer data for training). Enforce private networking with Azure Private Link.
• Cost control – Token‑based pricing can escalate. Implement monitoring, quotas, and alerts.
• Responsible AI – Apply content filters on model outputs; provide transparency to users.

The exam may ask you to design a secure, scalable AI‑powered search solution. You must combine Azure AI Search, Azure OpenAI, and a web front‑end (App Service or Container Apps) with Entra ID authentication and network isolation.

Migration & Modernization Scenarios

Migration scenarios test your ability to plan and execute movement of workloads to Azure, choosing the right strategy for each application.

Migration strategies (the 5 Rs):

• Rehost (lift‑and‑shift) – Move VMs as‑is using Azure Migrate or Azure Site Recovery. Fastest but doesn’t leverage cloud‑native benefits.
• Refactor (repackage) – Modify the application slightly to use PaaS, e.g., migrate a web app to Azure App Service using the Migration Assistant. Balances speed and modernization.
• Rearchitect – Significantly modify the application to adopt cloud‑native architecture, e.g., break a monolith into microservices on AKS. Highest effort, highest long‑term value.
• Rebuild – Rewrite the application from scratch using cloud‑native technologies (serverless, event‑driven). Only when existing code is not viable.
• Replace – Switch to a SaaS offering (e.g., replace on‑premises CRM with Dynamics 365). Avoids cloud migration entirely.

Decision factors: Business drivers (speed, cost, innovation), application criticality, and technical debt. The exam may describe a legacy .NET application and ask you to recommend the most appropriate modernization path. Know when to use App Service Migration Assistant vs. containerization vs. AKS.

Cost Optimization Scenarios

Cost optimization scenarios present an existing architecture and ask you to identify waste and recommend improvements. They test your ability to balance financial goals with performance and reliability.

Common optimizations:

• Autoscaling – Replace statically sized VM Scale Sets with autoscale rules based on CPU, queue length, or schedule. Scale down development environments at night.
• Reserved Capacity – For stable workloads (databases, long‑running application servers), 1‑ or 3‑year reservations can cut costs by up to 72%.
• Spot Virtual Machines – Use for interruptible, stateless workloads like batch processing or CI/CD. Not for production databases.
• Storage lifecycle management – Transition blobs to Cool or Archive tier based on last access. Delete old snapshots and unattached managed disks.
• PaaS over IaaS – Replace self‑managed SQL Server on VMs with Azure SQL Database Managed Instance or elastic pools; replace self‑managed Kubernetes with AKS serverless node pools.

Trade‑offs: Moving to Spot VMs adds interruption risk; adopting PaaS may require code changes. The exam often asks for the “most cost‑effective” solution that still meets the SLA—so you must ensure your cost reduction doesn’t break the reliability requirement.

How to Solve AZ‑305 Architecture Scenarios

Use a structured decision framework for every scenario. This stops you from jumping to a familiar service before fully understanding the problem.

1. Understand business objectives – Read the scenario carefully. Highlight the company’s strategic goals (e.g., expand to Europe, improve customer experience, reduce data center costs).
2. Identify functional requirements – What does the solution need to do? “The website must serve product catalog and process orders.”
3. Analyze non‑functional requirements – Performance (page load < 2 seconds), availability (99.99% SLA), security (PCI DSS compliance), RTO/RPO (recover within 1 hour, lose no more than 5 minutes of data).
4. Identify constraints – Budget caps, existing on‑premises systems that must integrate, team skills (no Kubernetes experience), regulatory data residency.
5. Compare Azure architecture options – For each major design decision (compute, data, networking, identity), list at least two valid Azure services or patterns.
6. Evaluate trade‑offs – Compare options against the Well‑Architected pillars. A more resilient option (active‑active) costs more; a cheaper option (Spot VMs) increases risk. Be explicit about what you gain and what you sacrifice.
7. Recommend the optimal solution – Choose the design that best satisfies all requirements and constraints. Justify your choice with data and reasoning—this is what the exam’s multiple‑choice options measure.

This framework turns an overwhelming case study into a manageable analytical task. Practice it consistently, and it will become second nature.

Recommended Learning Roadmap

Build your scenario‑solving skills in this order, which moves from the essential enterprise foundation to advanced topics.

1. Landing Zone – Without a secure, governed foundation, all other solutions are at risk.
2. Governance – Extends the landing zone; understand Azure Policy and management groups deeply.
3. Networking – Hub‑and‑spoke is the most common topology; master it before hybrid and multi‑region.
4. High Availability – Core resilience patterns that every workload needs.
5. Disaster Recovery – Builds on HA to cover regional failures; critical for business continuity.
6. Hybrid Cloud – Connect on‑premises and Azure; essential for migration and real‑world enterprises.
7. Security – Cross‑cutting; best studied after you have workload and networking context.
8. AI Solutions – A rapidly growing area; understand secure integration and cost management.
9. Migration – Apply governance, networking, and security to moving workloads at scale.
10. Cost Optimization – A lens applied to all previous patterns; fine‑tune your designs for efficiency.

Continue Learning

• AZ‑305 Certification Guide – Full exam overview and learning framework.
• AZ‑305 Skills – Official exam objectives expanded with design guidance.
• AZ‑305 Services – Design‑oriented deep dives into key Azure services.
• AZ‑305 Architecture Patterns – Reusable patterns and trade‑off analysis.
• AZ‑305 Resources – Study guides, checklists, and official Microsoft references.

For detailed Azure implementation tutorials, service deep dives, and enterprise architecture guidance, continue learning on CloudComputingDevPro.

Frequently Asked Questions

What kinds of scenarios appear in AZ‑305?
They are typically enterprise‑scale case studies involving governance, hybrid connectivity, global applications, disaster recovery, security, AI, migration, or cost optimization. Most questions are design‑focused, asking you to choose the most appropriate architecture or service combination.

Are architecture scenarios based on real enterprise environments?
Yes. Microsoft uses realistic business problems that mirror customer engagements. The scenarios reflect the challenges Azure architects face daily.

How should I prepare for scenario‑based questions?
Practice the structured decision framework described above. Work through the CloudCertPro scenario library and, for each scenario, write down your architecture reasoning before reading the solution. This builds the analytical muscle memory you need for the exam.

Which Azure services appear most frequently?
Microsoft Entra ID, Azure Policy, Azure Virtual Network, Azure Firewall, ExpressRoute, VPN Gateway, Front Door, Azure Key Vault, Azure SQL Database, Cosmos DB, Storage, and Azure Monitor are pervasive. However, the exam tests how you integrate them, not isolated features.

How important are trade‑offs in AZ‑305?
Trade‑off analysis is the core skill. Almost every design question asks you to balance cost, security, and reliability. Knowing the strengths and weaknesses of each Azure service and pattern is what differentiates a passing candidate from a memorizer.

Key Takeaways

• AZ‑305 is a scenario‑driven exam that evaluates your architecture decision‑making, not your ability to recall service limits.
• Focus on the core scenario categories—Landing Zone, Hybrid, Multi‑Region, HA/DR, Security, AI, and Cost Optimization—they appear repeatedly and often interweave in a single case study.
• Use the structured decision framework to approach every scenario: objectives → requirements → constraints → options → trade‑offs → recommendation.
• Architecture trade‑off analysis is your most valuable skill. Be prepared to justify why you chose one service over another and what sacrifices that entails.
• Supplement this guide with the CloudCertPro Scenarios, Architecture Patterns, and Skills sections to build integrated, real‑world design competence.