Exam AZ-304: Microsoft Azure Architect Design Practice Test
AZ-304 practice focuses on designing Azure infrastructure and application architectures around reliability, security, connectivity, and operational needs. The available questions sample decisions such as choosing private network links, protecting application access to secrets, selecting compute for scheduled work, and distributing traffic or content. These scenarios call for matching service capabilities to workload constraints rather than simply recalling product names.
Exam overview
About the Exam AZ-304: Microsoft Azure Architect Design Exam
Architecture decisions involve identifying requirements such as private communication, predictable addressing, read scaling, geographic reach, and reduced server management, then choosing Azure capabilities that meet them. The practice bank includes scenarios involving ExpressRoute, virtual network peering, static private IP configuration, outbound load distribution, and content delivery caching. Other prompts address Azure SQL readable replicas, managed identity access to Key Vault, on-demand execution, Kubernetes management across environments, and durable workflow orchestration. Working through these cases develops service-selection judgment: distinguish network connectivity patterns, determine where credentials should reside, and match execution models to task duration and operational constraints. Architects also need to consider how a design behaves during failures, restarts, and changes in demand, while keeping access controls and data availability aligned with application requirements.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
An organization needs private connectivity from its on-premises network to an Azure virtual network over a dedicated connection that does not traverse the public internet. Which service is designed for this requirement?
Show answer
Correct answer: BExpressRoute provides private connectivity between an organization's network and Microsoft cloud services through a connectivity provider. It is designed for private network connections rather than internet-based VPN connectivity.
A team wants to keep an Azure SQL database available for read-heavy workloads while reducing load on the primary database. Which feature provides readable secondary replicas in the same Azure SQL Database logical server?
Show answer
Correct answer: BRead scale-out routes eligible read-only workloads to a readable secondary replica, reducing pressure on the primary. Active geo-replication creates secondary databases in other regions primarily for disaster recovery and additional read scenarios; it is not the same feature.
An application running in Azure must access a secret stored in Azure Key Vault without placing credentials in its source code or configuration files. Which approach is most appropriate?
Show answer
Correct answer: AA managed identity provides an Azure-managed identity for an application or resource. Granting that identity appropriate Key Vault permissions avoids embedding long-lived credentials in code or configuration.
A solution needs to process a scheduled data-cleanup task that runs for several minutes and may require custom dependencies. The team wants to run code on demand without managing a continuously running server. Which Azure option is a suitable fit?
Show answer
Correct answer: AAzure Container Instances can run a containerized task on demand without requiring the team to manage a virtual machine or a persistent orchestration cluster. It is suitable when the task's dependencies can be packaged in a container.
A solution must run a distributed application across multiple cloud providers and on-premises Kubernetes environments, while using a consistent Kubernetes management layer. Which Azure service is designed for this purpose?
Show answer
Correct answer: BAzure Arc-enabled Kubernetes connects Kubernetes clusters running outside Azure to Azure management, enabling consistent governance and management across environments. AKS is a managed Kubernetes service for clusters hosted in Azure, while the other options do not provide this cross-environment Kubernetes management layer.
A solution needs to coordinate a durable workflow that spans multiple services and can resume after transient failures or process restarts. Which Azure service is purpose-built for this orchestration pattern?
Show answer
Correct answer: ADurable Functions extends Azure Functions with stateful orchestration, allowing workflows to coordinate activities and manage checkpoints and retries. The other services provide caching, container image storage, and DNS hosting, respectively.
A company wants to connect an Azure virtual network to another virtual network in a different Azure region using private IP connectivity over the Microsoft backbone. Which capability should it use?
Show answer
Correct answer: AGlobal virtual network peering connects virtual networks across Azure regions using private IP addresses over the Microsoft backbone. Front Door is an application delivery service, NAT Gateway handles outbound connectivity, and DNS Private Resolver handles DNS queries.
How to use this practice test
The free AZ-304 practice session draws up to 20 random questions from the 50-question bank. Answer each scenario by identifying its constraints before selecting an Azure service or configuration. Results appear after the session, helping you spot topics—such as network design, identity, or workload orchestration—that merit further review.
Preparation tips
- For each connectivity scenario, compare ExpressRoute, virtual network peering, and public-internet paths by connection scope and routing behavior.
- Practice selecting identity-based Key Vault access, and trace how an application obtains secrets without embedding credentials in code or configuration.
- Compare compute and orchestration choices for scheduled jobs, durable multi-step workflows, and distributed Kubernetes environments.
- Map workload requirements to Azure SQL readable replicas, stable private IP addresses, outbound NAT, and edge caching; note which constraint each choice addresses.