Microsoft Azure Solutions Architect AZ-305 Certification Training

You can describe Azure's global infrastructure, map a business requirement onto the right service tier, and explain where an architect's decisions differ from an administrator's.

1. Azure global infrastructure and the subscription model1 hr
   • regions and region pairs
   • availability zones
   • edge locations
   • sovereign clouds
   • subscription boundaries
2. Resource groups, tags and naming conventions1 hr
   • resource group lifecycle
   • tagging taxonomy
   • naming standards
   • inherited tags
   • tag-driven billing
3. Reading requirements like an architect1 hr
   • functional vs non-functional
   • RTO and RPO
   • SLA composition
   • constraint discovery
   • stakeholder mapping
4. Service tiers, SKUs and capacity planning1 hr
   • SKU families
   • vCPU quotas
   • regional capacity
   • reservation planning
   • burst headroom
5. Architecture decision records and trade-off documentation1 hr
   • ADR structure
   • options considered
   • consequences section
   • review cadence
   • decision reversal
6. Azure pricing calculator and TCO modelling1 hr
   • pricing calculator
   • TCO calculator
   • egress charges
   • reserved instances
   • savings plans

Hands-on project: Produce a one-page architecture decision record for a fictional retailer choosing between regional and zone-redundant deployment, justifying the cost and resilience trade-off.

You can design a tenant topology for a multi-subsidiary organisation and justify where to use a single tenant with administrative units versus multiple tenants.

1. Entra ID objects, tenants and directory structure1 hr
   • users and groups
   • service principals
   • managed identities
   • administrative units
   • directory schema
2. Single tenant vs multi-tenant architecture1 hr
   • tenant isolation
   • B2B collaboration
   • cross-tenant sync
   • acquisition patterns
   • divestiture planning
3. Hybrid identity with Entra Connect and cloud sync1 hr
   • password hash sync
   • pass-through auth
   • federation with ADFS
   • seamless SSO
   • sync scoping filters
4. External identity: B2B, B2C and guest governance1 hr
   • guest invitation flow
   • entitlement management
   • access reviews
   • B2C user flows
   • identity providers
5. Application registration and consent design1 hr
   • app registrations
   • enterprise applications
   • delegated vs application permissions
   • admin consent workflow
   • publisher verification
6. Identity for workloads: managed identities and workload identity federation1 hr
   • system vs user assigned
   • workload identity federation
   • credential-free auth
   • federated credentials
   • GitHub OIDC trust

Hands-on project: Design the Entra ID topology for a company acquiring two subsidiaries, documenting tenant strategy, domain federation and user provisioning.

You can design a least-privilege access model with time-bound elevation and risk-based conditional access, and explain the blast radius of every role assignment you make.

1. Azure RBAC scope hierarchy and inheritance1 hr
   • management group scope
   • subscription scope
   • resource group scope
   • resource scope
   • deny assignments
2. Built-in roles, custom roles and least privilege1 hr
   • role definition JSON
   • actions and notActions
   • dataActions
   • assignable scopes
   • custom role versioning
3. Privileged Identity Management and just-in-time elevation1 hr
   • eligible vs active
   • activation approval
   • time-bound assignment
   • justification and MFA
   • access review integration
4. Conditional Access policy design1 hr
   • signals and conditions
   • grant and session controls
   • named locations
   • device compliance
   • report-only mode
5. Zero Trust principles applied to Azure1 hr
   • verify explicitly
   • least privilege access
   • assume breach
   • segmentation strategy
   • continuous validation
6. Break-glass accounts and emergency access1 hr
   • break-glass design
   • exclusion from CA
   • credential storage
   • alerting on use
   • quarterly validation

Hands-on project: Build an RBAC and PIM design for a platform team of thirty engineers across production and non-production, with break-glass accounts and audited elevation.

You can enforce organisational standards at scale with Azure Policy and management group hierarchy, so that non-compliant resources cannot be created rather than being found later.

1. Management group hierarchy design1 hr
   • root management group
   • hierarchy depth limits
   • subscription placement
   • landing zone alignment
   • inheritance rules
2. Azure Policy: definitions, initiatives and effects1 hr
   • deny and audit effects
   • deployIfNotExists
   • modify effect
   • policy aliases
   • initiative parameters
3. Policy remediation and compliance reporting1 hr
   • remediation tasks
   • managed identity for remediation
   • compliance dashboard
   • exemptions
   • non-compliance alerting
4. Azure Landing Zones and the Cloud Adoption Framework1 hr
   • CAF methodology
   • enterprise-scale architecture
   • platform vs application landing zones
   • subscription vending
   • landing zone accelerators
5. Cost management, budgets and chargeback1 hr
   • cost analysis views
   • budget alerts
   • cost allocation rules
   • showback vs chargeback
   • anomaly detection
6. Resource locks and governance guardrails1 hr
   • CanNotDelete locks
   • ReadOnly locks
   • lock inheritance
   • lock vs policy
   • deployment stacks

Hands-on project: Design a management group hierarchy with policy initiatives enforcing tagging, allowed regions and SKU restrictions, including remediation tasks for existing resources.

You can design a monitoring solution that answers who did what, whether the service is healthy and why it is slow, with retention and cost deliberately chosen rather than defaulted.

1. Azure Monitor architecture and the data platform1 hr
   • metrics vs logs
   • platform metrics
   • resource logs
   • activity log
   • diagnostic settings
2. Log Analytics workspace design and KQL1 hr
   • workspace topology
   • table plans
   • KQL joins
   • summarise operator
   • saved queries
3. Workspace strategy: centralised, decentralised, hybrid1 hr
   • data sovereignty
   • RBAC on workspaces
   • resource-context access
   • cross-workspace queries
   • cost per GB
4. Application Insights and distributed tracing1 hr
   • auto-instrumentation
   • dependency tracking
   • sampling configuration
   • live metrics
   • end-to-end transaction view
5. Alerting, action groups and incident routing1 hr
   • metric alerts
   • log alerts
   • dynamic thresholds
   • action groups
   • alert processing rules
6. Retention, archive and data export design1 hr
   • interactive retention
   • long-term retention
   • archive tier
   • data export rules
   • cost optimisation

Hands-on project: Design a Log Analytics workspace topology for three business units with differing retention and data-residency requirements, including cost projections.

You can choose between SQL Database, Managed Instance and SQL on VM for a given workload and defend the choice on compatibility, cost and operational burden.

1. Azure SQL deployment options and when each fits1 hr
   • single database
   • elastic pool
   • managed instance
   • SQL on VM
   • feature parity gaps
2. Purchasing models: DTU, vCore, serverless and Hyperscale1 hr
   • DTU vs vCore
   • serverless auto-pause
   • Hyperscale architecture
   • read replicas
   • storage autogrow
3. High availability and zone redundancy for SQL1 hr
   • local redundancy
   • zone redundancy
   • failover groups
   • auto-failover policy
   • read-only routing
4. Azure Database for PostgreSQL and MySQL flexible server1 hr
   • flexible server architecture
   • burstable tiers
   • high availability modes
   • read replicas
   • maintenance windows
5. Security: authentication, encryption and auditing1 hr
   • Entra authentication
   • TDE and customer-managed keys
   • Always Encrypted
   • dynamic data masking
   • SQL auditing
6. Migration tooling and cutover planning1 hr
   • Data Migration Assistant
   • Azure Database Migration Service
   • online vs offline
   • schema drift
   • cutover rehearsal

Hands-on project: Design the data tier for a line-of-business application migrating from on-premises SQL Server 2016, including sizing, HA and a tested rollback path.

You can design a Cosmos DB partition key that will still perform at a hundred times the current data volume, and explain the consistency trade-off you accepted.

1. Cosmos DB APIs, request units and throughput models1 hr
   • NoSQL API
   • MongoDB API
   • RU provisioning
   • autoscale throughput
   • serverless containers
2. Partition key design and hot partition avoidance1 hr
   • logical partitions
   • physical partitions
   • cardinality analysis
   • synthetic keys
   • cross-partition queries
3. Consistency levels and multi-region writes1 hr
   • strong consistency
   • bounded staleness
   • session consistency
   • conflict resolution
   • multi-master writes
4. Azure Storage account design: blob, file, queue, table1 hr
   • account kinds
   • access tiers
   • lifecycle management
   • immutable blob storage
   • soft delete
5. Data Lake Storage Gen2 and medallion architecture1 hr
   • hierarchical namespace
   • bronze silver gold
   • ACLs vs RBAC
   • file format choice
   • partitioning on disk
6. Synapse Analytics and Microsoft Fabric positioning1 hr
   • dedicated SQL pools
   • serverless SQL
   • Spark pools
   • pipeline orchestration
   • Fabric workspace model

Hands-on project: Design the storage and analytics tier for an IoT platform ingesting two million events per hour, choosing partition strategy, consistency level and analytical store.

You can design a data protection scheme that satisfies a regulator, covering encryption at rest and in transit, key custody, classification and defensible deletion.

1. Encryption at rest: platform-managed vs customer-managed keys1 hr
   • Microsoft-managed keys
   • customer-managed keys
   • double encryption
   • key rotation
   • Key Vault integration
2. Azure Key Vault and Managed HSM design1 hr
   • vault vs managed HSM
   • access policies vs RBAC
   • soft delete and purge protection
   • private endpoints
   • secret rotation
3. Data classification and Microsoft Purview1 hr
   • sensitivity labels
   • data map
   • scanning rules
   • lineage tracking
   • glossary terms
4. Azure Data Factory pipeline architecture1 hr
   • integration runtimes
   • self-hosted IR
   • mapping data flows
   • trigger types
   • parameterised pipelines
5. Data residency, sovereignty and compliance boundaries1 hr
   • region selection
   • data residency guarantees
   • in-country replication
   • compliance offerings
   • audit evidence
6. Retention, archival and defensible deletion1 hr
   • lifecycle policies
   • legal hold
   • immutability windows
   • purge workflows
   • deletion evidence

Hands-on project: Design the data protection and retention architecture for a healthcare platform subject to data-residency and seven-year retention obligations.

You can size a compute tier from a throughput requirement rather than a guess, and choose between IaaS, PaaS and serverless with the operational cost of each made explicit.

1. VM families, sizing and disk performance1 hr
   • general purpose series
   • memory optimised
   • compute optimised
   • premium SSD v2
   • disk bursting
2. Virtual Machine Scale Sets and autoscale design1 hr
   • uniform vs flexible orchestration
   • scale-in policy
   • autoscale metrics
   • instance protection
   • upgrade policies
3. App Service plans, deployment slots and scaling1 hr
   • plan tiers
   • slot swapping
   • warm-up and health check
   • scale rules
   • VNet integration
4. Azure Functions hosting plans and cold start1 hr
   • consumption plan
   • premium plan
   • dedicated plan
   • cold start mitigation
   • durable functions
5. Azure Container Apps and serverless containers1 hr
   • KEDA scaling
   • revisions and traffic splitting
   • Dapr integration
   • scale to zero
   • ingress configuration
6. Availability sets, zones and fault domains1 hr
   • fault domains
   • update domains
   • zonal vs zone-redundant
   • SLA calculation
   • placement groups

Hands-on project: Size and design the compute tier for a seasonal e-commerce workload peaking at twenty times baseline, with autoscale rules and a cost model for both states.

You can design a production AKS cluster with a defensible network model, node pool strategy and upgrade path, rather than accepting portal defaults.

1. AKS architecture, control plane and node pools1 hr
   • managed control plane
   • system vs user node pools
   • spot node pools
   • node sizing
   • taints and tolerations
2. AKS networking: kubenet, Azure CNI and overlay1 hr
   • CNI address planning
   • overlay networking
   • network policies
   • private clusters
   • API server VNet integration
3. Identity and secrets in AKS1 hr
   • workload identity
   • Key Vault CSI driver
   • pod-managed identity deprecation
   • image pull secrets
   • RBAC mapping
4. Ingress, service mesh and east-west traffic1 hr
   • application gateway ingress
   • NGINX ingress
   • Istio add-on
   • mTLS between services
   • traffic splitting
5. Cluster upgrades, maintenance windows and node image patching1 hr
   • upgrade channels
   • surge upgrades
   • maintenance windows
   • node image upgrade
   • PDB interaction
6. Container registry, image supply chain and scanning1 hr
   • ACR tiers
   • geo-replication
   • content trust
   • vulnerability scanning
   • image retention policy

Hands-on project: Design a multi-tenant AKS platform for four product teams with namespace isolation, per-team quotas, private ingress and a documented upgrade runbook.

You can design an enterprise network topology with deliberate segmentation and private-only data paths, and explain every route a packet takes.

1. Virtual network design and address space planning1 hr
   • CIDR planning
   • subnet delegation
   • reserved addresses
   • IP exhaustion avoidance
   • address overlap in M&A
2. Hub-spoke and Virtual WAN topologies1 hr
   • hub-spoke pattern
   • peering transitivity
   • Virtual WAN hubs
   • secured virtual hub
   • topology selection criteria
3. Hybrid connectivity: VPN Gateway and ExpressRoute1 hr
   • site-to-site VPN
   • ExpressRoute circuits
   • private peering
   • Global Reach
   • gateway SKU sizing
4. Network security groups, ASGs and Azure Firewall1 hr
   • NSG rule evaluation
   • application security groups
   • Azure Firewall policy
   • forced tunnelling
   • FQDN filtering
5. Private Link, private endpoints and service endpoints1 hr
   • private endpoint DNS
   • private DNS zones
   • service endpoint limits
   • cross-tenant private link
   • DNS forwarding design
6. Load balancing: Load Balancer, App Gateway, Front Door1 hr
   • layer 4 vs layer 7
   • WAF policies
   • global vs regional
   • health probes
   • session affinity

Hands-on project: Design a hub-spoke topology for an organisation with three regions, on-premises connectivity and a requirement that no PaaS service is reachable from the public internet.

You can design to a stated RTO and RPO and prove the design meets them with a tested failover, rather than asserting resilience on a diagram.

1. RTO, RPO and translating them into architecture1 hr
   • RTO definition
   • RPO definition
   • tiering applications
   • cost of each nine
   • dependency mapping
2. Azure Backup: vaults, policies and restore testing1 hr
   • recovery services vault
   • backup policies
   • soft delete
   • cross-region restore
   • restore drills
3. Azure Site Recovery and replication design1 hr
   • replication policy
   • recovery plans
   • capacity planning
   • test failover
   • failback steps
4. Active-active, active-passive and pilot light patterns1 hr
   • active-active trade-offs
   • warm standby
   • pilot light
   • cost comparison
   • data consistency on failover
5. Database and storage replication choices1 hr
   • geo-redundant storage
   • RA-GRS read access
   • SQL failover groups
   • Cosmos multi-region
   • replication lag monitoring
6. Chaos engineering and resilience validation1 hr
   • Azure Chaos Studio
   • fault injection
   • game days
   • blast radius control
   • findings to backlog

Hands-on project: Produce a disaster recovery design and test plan for a tier-one application with a four-hour RTO and fifteen-minute RPO, including a failback procedure.

You can run a migration assessment, pick the right R for each workload, and sequence a wave plan that does not strand dependencies.

1. The six Rs and selecting a migration strategy1 hr
   • rehost
   • refactor
   • rearchitect
   • rebuild
   • replace and retire
2. Azure Migrate: discovery, assessment and dependency mapping1 hr
   • appliance deployment
   • agentless dependency analysis
   • right-sizing reports
   • readiness checks
   • cost estimates
3. Wave planning and cutover sequencing1 hr
   • dependency clustering
   • wave sizing
   • freeze windows
   • cutover runbook
   • rollback triggers
4. Application modernisation paths1 hr
   • containerisation
   • App Service migration
   • database modernisation
   • API-first refactor
   • strangler fig pattern
5. Data migration at scale1 hr
   • Azure Data Box
   • AzCopy tuning
   • Storage Mover
   • bandwidth planning
   • integrity verification
6. Post-migration optimisation and hypercare1 hr
   • right-sizing after observation
   • reservation purchase timing
   • hypercare staffing
   • decommission plan
   • benefits realisation

Hands-on project: Build a three-wave migration plan for a fifty-server estate, with dependency analysis, right-sizing recommendations and a rollback trigger for each wave.

You can review an existing architecture against the five WAF pillars and produce a prioritised remediation list with the cost and risk of each item stated.

1. The five pillars and how they conflict1 hr
   • reliability
   • security
   • cost optimisation
   • operational excellence
   • performance efficiency
2. Running a Well-Architected review1 hr
   • assessment tool
   • evidence gathering
   • scoring
   • stakeholder workshop
   • remediation backlog
3. Cost optimisation levers in practice1 hr
   • reservations
   • savings plans
   • spot capacity
   • autoscale tuning
   • orphaned resource cleanup
4. Performance efficiency and right-sizing1 hr
   • baseline measurement
   • load testing
   • caching layers
   • async patterns
   • premium tier justification
5. Operational excellence and platform automation1 hr
   • infrastructure as code
   • Bicep modules
   • deployment stacks
   • drift detection
   • runbook automation
6. Security pillar: Defender for Cloud and secure score1 hr
   • Defender plans
   • secure score
   • regulatory compliance dashboard
   • attack path analysis
   • recommendation triage

Hands-on project: Perform a Well-Architected review of a supplied reference architecture and deliver a prioritised remediation backlog with effort and saving estimates.

You can take an ambiguous business brief to a defended architecture covering identity, data, compute, network, continuity and cost, and answer AZ-305 case-study questions under timed conditions.

1. Reading an AZ-305 case study under time pressure1 hr
   • requirement extraction
   • distractor identification
   • constraint mapping
   • answer elimination
   • time budgeting
2. Designing the identity and governance layer1 hr
   • tenant decision
   • RBAC model
   • policy initiatives
   • PIM configuration
   • landing zone choice
3. Designing the data and compute layers2 hrs
   • data store selection
   • partitioning plan
   • compute sizing
   • autoscale rules
   • service tier justification
4. Designing the network and continuity layers2 hrs
   • topology selection
   • private connectivity
   • firewall policy
   • BCDR tiering
   • failover testing plan
5. Cost modelling and the architecture decision record1 hr
   • three-year TCO
   • reservation strategy
   • cost guardrails
   • ADR authoring
   • assumption register
6. Panel defence and full-length mock exam1 hr
   • architecture walkthrough
   • challenge questions
   • trade-off defence
   • timed mock exam
   • score review

Hands-on project: Deliver a complete solution architecture for a multinational manufacturer moving to Azure: identity topology, data platform, compute and network design, BCDR plan, governance model, cost model and migration sequence, defended in a panel review.