Microsoft AZ-305: Monitoring, Cost Optimization and Operations — Study Guide

By Laurynas Brazys · 11 August 2026 · #microsoft #az-305 #certification #exam-prep #study-guide

Part of the Microsoft Azure Solutions Architect Expert AZ-305 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

A robust Azure monitoring and operations design establishes a single telemetry fabric, actionable alerts, governed costs, and fleet-wide compliance reporting. The solution spans Azure Monitor’s metrics and logs, Log Analytics and Kusto Query Language (KQL), Application Insights for application telemetry, and operational governance via Azure Policy, Azure Resource Graph, and Advisor. Cost control is reinforced through Azure Cost Management, while platform reliability and change awareness rely on Azure Service Health. Azure Automation closes the loop with repeatable remediation and update orchestration. Workbooks unify insights across these services for operational visibility.

Observability with Azure Monitor, Application Insights, and Workbooks

Azure Monitor collects telemetry across platform and workloads, storing time-series metrics and log data. Metrics are lightweight, near-real-time values suited for thresholds and SLO tracking (e.g., CPU, HTTP 5xx rate). Logs capture structured, queryable telemetry that supports correlation and root-cause analysis. Design metric alerts for fast symptom detection and log alerts for richer, condition-based detection using KQL.

Action groups decouple detection from response. Associate email/SMS/voice, push notifications, secure webhooks, ITSM connectors, Azure Functions, Logic Apps, and Automation runbooks. Use separate action groups for production versus nonproduction, and apply suppression schedules during planned maintenance. Route alerts to incident management with consistent payloads and include resource context and runbook links.

Diagnostic settings are mandatory to achieve complete visibility. Enable them at the resource, resource group, and subscription scopes to export metrics and resource logs (e.g., Activity, Administrative, Policy, Security, NetworkSecurityGroupFlowEvent) to Log Analytics for querying, to storage for cold retention, and to Event Hubs for streaming into SIEMs. Always configure a subscription-level diagnostic setting on the Activity Log so you can report on deployments and policy evaluations and build monthly change reports.

Application Insights adds deep application observability. Instrument with the SDK or OpenTelemetry for distributed tracing, dependencies, requests, exceptions, and custom events. Use autoinstrumentation on App Services, Functions, AKS, and VM/VMSS via the Azure Monitor agent where supported to minimize code changes. Availability tests simulate user traffic from multiple regions; configure frequency, test locations, SSL/HTTP checks, and success criteria. Smart Detection uses built-in analytics to flag anomaly patterns such as sudden failure spikes and performance degradation. Sampling controls ingestion and cost while preserving statistical fidelity; apply adaptive sampling for dynamic traffic or fixed-rate sampling for deterministic analysis, and exclude critical transactions from sampling where compliance requires full capture.

Azure Monitor Workbooks provide interactive, parameterized dashboards that unite metrics, logs, and cost signals in one artifact. Use parameters for subscription, region, environment, and time range to enable reusability across landing zones. Combine visualizations with narrative text to standardize operational playbooks and runbooks-on-a-page. Store workbooks in resource groups, apply RBAC for controlled access, and templatize JSON for infrastructure-as-code deployments.

Log Analytics and KQL at Scale

A Log Analytics workspace is the central aggregation point for Azure Monitor Logs. Choose a regional, centralized workspace per data residency requirements, or a federated design with one per landing zone when strict data sovereignty or RBAC segmentation is needed. For large enterprises, favor a hub (shared workspace) plus selective spoke workspaces for sensitive or high-volume domains. Align table plans to data value: use Analytics tables for high-value security and operations data; Basic Logs for verbose, low-value logs with search-only access; and Archive for long-term, low-cost retention with Search Jobs to retrieve.

Data Collection Rules (DCRs) define what the Azure Monitor Agent (AMA) collects, including syslog/event logs, performance counters, Windows event channels, and custom text logs. Use distinct DCRs per OS type and role, and manage scope via VMSS, scalesets, and Azure Arc for hybrid. Prefer DCR-based custom tables over legacy ingestion APIs for governance and consistency.

Retention must balance investigation windows with cost. Apply per-table retention for hot data used in day-to-day operations (e.g., 30–90 days) and archive long-tail data (e.g., 6–24 months) for compliance and threat hunting. Monitor ingestion volume, top noisy tables, and apply sampling or filtering at DCRs to avoid collecting redundant logs. Use commitment tiers to optimize ingestion cost when predictable.

KQL is the operational lingua franca. Master filters (where), transforms (extend, project), time-binning (bin/1m), aggregations (summarize by), joins (inner/leftouter), and rendering (render timechart). Build scheduled queries for log alerts with throttling controls, split-by dimensions for high-cardinality alerts, and dynamic thresholds for baselined alerts. Materialized views and query performance tuning (e.g., project-away unused columns early, time window narrowing) ensure cost-effective querying. For ARM deployment reporting, query AzureActivity or the Azure Resource Graph change history exported into Log Analytics and correlate with Policy events for governance analytics.

Cost, Health, Advisor, Resource Graph, and Policy Compliance

Azure Cost Management enables proactive governance. Budgets scoped to subscriptions, resource groups, or management groups trigger alerts at cumulative thresholds (e.g., 50%, 80%, 100%). Link budget alerts to action groups to run Logic Apps or Functions that tag, scale down, or even quarantine noncritical resources. Use Cost Analysis to build amortized views, group by tag (cost center, owner), and identify anomalies by service or region. Reservation and Savings Plan recommendations surface commitment opportunities for VMs, SQL, Cosmos DB, and more. Evaluate purchase scope (single subscription or shared), term (1- or 3-year), and coverage match (instance size flexibility, Azure Hybrid Benefit).

Azure Advisor continuously evaluates subscriptions and resources, producing prioritized recommendations across cost (rightsizing, idle resources, reservations), security (via Defender for Cloud), reliability (zone redundancy, backup/restore posture), performance (scaling, SKU guidance), and operational excellence (tag hygiene, policy adoption). Track Advisor Score to quantify posture and drive engineering backlogs.

Azure Service Health operationalizes platform awareness. Service issues capture live incidents; planned maintenance communicates upcoming platform changes; health advisories include deprecations and best practices. Configure service health alerts with action groups, filtering by subscription, region, and service. Pair Service Health with Resource Health to distinguish platform faults from workload issues for accurate incident triage.

Azure Resource Graph supplies tenant-wide inventory and compliance analytics with low-latency, at-scale queries using a KQL-like syntax. Query across thousands of subscriptions to enumerate resource drift, untagged assets, insecure configurations, or unsupported SKUs. Join Resource Graph results with Policy compliance resources to produce management-group rollups, including exceptions and last evaluation time. Use change tracking (where available) to capture property deltas for forensic analysis.

Azure Policy enforces guardrails and measures compliance. Assign policies and initiatives at management group, subscription, or resource group scopes. Understand compliance states: compliant, non-compliant, conflict, error, and exempt. Use exemptions with justification and expiry to model risk acceptance without skewing compliance metrics, and exclude only the minimal scope necessary. For deployIfNotExists and modify effects, configure remediation tasks backed by a managed identity with least-privilege permissions. Monitor remediation job status, failures, and operations in the compliance dashboard and Activity Log; set alerts on persistent non-compliance. Combine Policy evaluations with Resource Graph and Workbooks to surface executive-level governance dashboards.

Automation and Patch Management

Azure Automation orchestrates repeatable tasks. Author runbooks in PowerShell or Python, triggered by schedules, webhooks, event-based triggers, or alerts. Use Hybrid Runbook Workers to execute automation close to resources in private networks or other clouds, governed by Azure Arc. Implement standardized modules and error handling, and store secrets in Key Vault.

Update Management ensures OS currency. Organizations can use Azure Automation Update Management (legacy) or Azure Update Manager for at-scale patch orchestration with assessment, approval, maintenance windows, and dynamic groups. Integrate alerts to catch failed deployments and generate compliance reports by subscription, OS, and severity. For configuration drift, Azure Automation State Configuration (DSC) applies declarative configurations, tracks compliance, and remediates deviations. Model configurations as code, version them, and stage through environments.

Integrate alerts to trigger runbooks for auto-remediation scenarios: scale out on CPU saturation, restart failed services upon heartbeat loss, or quarantine non-compliant resources detected by Policy. Close the loop with incident creation via ITSM connectors and include pre- and post-remediation evidence through Log Analytics queries embedded in runbooks.

Practical Problem Scenario

Tailwind Traders operates a multi-region e-commerce platform on AKS, App Service, and Azure SQL Database across six subscriptions. Leadership mandates 99.9% service availability, monthly deployment-change reporting, 20% cost reduction via commitments, and auditable compliance with tagging and network policies.

Establish centralized telemetry

Create two Log Analytics workspaces (US, EU) to satisfy data residency and RBAC needs. Configure diagnostic settings on subscriptions, resource groups, and all critical resources to send metrics/resource logs and the Activity Log to the regional workspace. Chosen because a regional dual-workspace model balances sovereignty, performance, and centralized analytics without cross-border data movement.

Instrument applications

Enable Application Insights with autoinstrumentation for App Service and AKS sidecar where supported; use OpenTelemetry for services written in Go. Configure adaptive sampling and distributed tracing. Selected to gain deep request, dependency, and exception visibility with minimal code changes and controlled ingestion cost.

Actionable alerting

Implement metric alerts for SLO symptoms (p95 latency, 5xx rate, queue depth) and log alerts for error bursts and custom KQL detections. Route to role-based action groups: Ops On-Call (PagerDuty + email), SRE Automation (Logic App), and Leadership (email digest). This separates detection from response and enables tailored, reliable incident routing.

Availability and user experience

Configure multi-region Application Insights availability tests against the storefront and checkout APIs with strict SSL and content assertions. Chosen to detect external customer-impacting issues independent of internal metrics.

Operational dashboards

Build Azure Monitor Workbooks with parameters (subscription, region, environment) combining metrics, KQL charts, and drill-through links to traces and logs. Adopt IaC deployment of workbook JSON. Workbooks provide shared, interactive runbooks-on-a-page for NOC and SRE.

Cost governance

Set budgets per subscription and per department tag with alerts at 50/80/100% that trigger a Logic App to notify owners and open ITSM tickets. Use Cost Analysis amortized views and enable reservation and savings plan recommendations; purchase 3-year reservations for steady SQL MI workloads and savings plans for bursty compute. This directly achieves the 20% cost target with automated guardrails.

Advisor and Service Health

Review Azure Advisor weekly; create backlog items for right-sizing and zone redundancy. Configure Service Health alerts for regions and services in use, flowing to the on-call action group. These ensure continuous improvement and rapid platform-incident awareness.

Compliance and fleet reporting

Assign an Azure Policy initiative enforcing required tags, disallowing public IPs on NICs, and requiring diagnostic settings. Use exemptions for approved exceptions with expiry. Configure remediation tasks with a managed identity. Use Azure Resource Graph to query policy compliance and untagged assets across all subscriptions, and surface results in Workbooks for audit. This creates auditable, automated governance with measurable compliance.

Deployment change reporting

Query AzureActivity in Log Analytics for ARM deployments and correlate with policy evaluation logs to produce a monthly report, emailed via a Logic App. This leverages the Activity Log as the authoritative source of deployment events without custom agents.

Automated remediation and patching

Use Azure Automation runbooks to restart unhealthy pods via AKS APIs when heartbeat alerts fire and to rotate secrets from Key Vault. Enable Azure Update Manager for patch compliance with maintenance windows and dynamic groups. Hybrid Runbook Workers execute network-bound tasks securely. This closes the loop from detection to resolution and keeps the fleet current.

Each chosen service minimizes custom development, scales across subscriptions, and aligns with governance, cost, and reliability objectives while maintaining clear operational ownership.

← Integration and Messaging Architecture · All domains · Migration and Modernization →

Practice these questions → · Timed practice on ExamRoll.io →