Microsoft AZ-305: Well-Architected Framework and Design Principles — Study Guide

By Laurynas Brazys · 11 August 2026 · #microsoft #az-305 #certification #exam-prep #study-guide

Part of the Microsoft Azure Solutions Architect Expert AZ-305 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

The Azure Well-Architected Framework (WAF) is a set of prescriptive principles that guide the design, build, and operation of reliable, secure, cost-efficient, operationally excellent, and performant workloads on Azure. Aligning solutions to the five pillars—reliability, security, cost optimization, operational excellence, and performance efficiency—ensures that architecture decisions are explicit trade-offs informed by business priorities, risk tolerance, and constraints such as data sovereignty and budget. Achieving consistency at scale requires landing zones, policy-driven governance, and automation as the default. Modern designs emphasize decoupling, event-driven communication, and patterns like CQRS, Strangler Fig, and microservices, implemented with Azure-native services and integrated observability, to accommodate both rapid change and stringent compliance.

The Five Pillars: Reliability, Security, Cost, Ops Excellence, Performance

Reliability ensures workloads continue to meet business SLAs under failure and during change. Design for fault domains and update domains by deploying across Availability Zones or region pairs, choosing managed services with built-in HA, and implementing resilience patterns. Test recoverability with chaos engineering and disaster recovery drills. For stateful data, choose services with RPO/RTO features—e.g., Azure SQL Database Active Geo-Replication or Cosmos DB multi-region writes—paired with automated backups and tested runbooks.

Security is layered defense in depth, anchored in Zero Trust. Enforce least privilege with Azure RBAC, Privileged Identity Management (PIM), and access reviews for ongoing entitlement hygiene. Isolate network blast radius using private endpoints, NSGs, and Azure Firewall; integrate Web Application Firewall (WAF) on Azure Front Door or Application Gateway. Assume breach with continuous monitoring via Defender for Cloud, threat detection in Sentinel, and rigorous identity protection (MFA, Conditional Access).

Cost optimization balances business value and total cost of ownership. Right-size compute and tiers based on telemetry; use scaling to match demand and power down non-production. Commit with reservations and savings plans for steady workloads, leverage Spot VMs for interruptible compute, tier storage and data retention, and prefer serverless where it aligns with workload profiles. Enforce tagging and budgets, and use Azure Policy to standardize cost controls.

Operational excellence emphasizes automation, repeatability, and learning loops. Treat environments as code with Bicep/ARM or Terraform, enforce drift remediation, and implement consistent CI/CD. Operational insights come from structured logs, metrics, traces, and synthetic tests, all wired into alerting and SLO dashboards, to shorten MTTR and inform proactive improvements.

Performance efficiency ensures the workload meets throughput and latency goals under varying load. Design for scale-out, cache aggressively, push content to the edge, and choose data partitions and read replicas suited to the access patterns. Validate with realistic load tests and tune based on evidence.

Reliability and Performance Patterns in Azure

Resilience patterns reduce the probability and impact of failures while keeping latency predictable.

• Retry with exponential backoff and jitter: Use Azure SDKs’ configurable retry policies or libraries like Polly (.NET) to handle transient faults from services like Storage, Service Bus, or Cosmos DB. Backoff with jitter avoids thundering herds; cap retries to protect SLAs and surface failures in time.

• Circuit breaker: Wrap outbound calls (e.g., to external APIs) with a breaker to fail fast when error rates exceed thresholds, allowing recovery periods. Implement at the client layer with Polly or at the gateway using API Management policies (retry, timeout, and cache) to avoid cascading failures.

• Bulkhead: Partition resources so one noisy neighbor doesn’t starve the system. Isolate thread pools, container replicas, and message processing partitions. At the platform level, use separate App Service plans, AKS node pools, or Service Bus queues/topics per bounded context to contain faults.

• Health endpoint monitoring: Expose liveness and readiness probes in services. Application Gateway/Front Door health probes route traffic only to healthy instances. In AKS, Kubernetes probes manage pod restarts and rollout gating. Combine with Application Insights availability tests and custom “/healthz” endpoints to detect dependency degradation early.

Performance patterns complement resilience:

• Caching strategies: Use Azure Cache for Redis for hot data and session offload. Apply output caching at Azure Front Door or API Management for idempotent GETs. Prefer write-through or write-behind patterns where appropriate; invalidate by key or event to maintain freshness. In data tiers, Cosmos DB integrated cache reduces RU consumption for read-heavy workloads.

• CDN: Push static assets and dynamic content closer to users with Azure Front Door or Azure CDN, enabling compression, TLS, and WAF. Configure rules-based caching, origin health checks, and geo-filtering to optimize latency and cost.

• Read replicas: Scale read-heavy workloads with Azure SQL Database readable secondaries (Active Geo-Replication) or Hyperscale named replicas; use Azure Database for PostgreSQL/MySQL read replicas for analytics or reporting; enable multi-region reads in Cosmos DB with consistency modeling (e.g., Session, Consistent Prefix) aligned to business needs.

• Autoscaling patterns: Implement horizontal scaling with Virtual Machine Scale Sets, App Service autoscale rules, AKS HPA/KEDA for event-driven scale, and Functions Consumption/Premium plans. For data, use Cosmos DB autoscale RU/s and Event Hubs auto-inflate to handle bursty traffic. Always validate scale thresholds and cool-down periods to avoid oscillation.

Operational Excellence, Cost Optimization, and Security Design Principles

Infrastructure as code: Standardize on Bicep/ARM or Terraform modules, versioned in Git and validated with pre-deployment tests and policy-as-code. Use template specs or Terraform registries for reuse. Parameterize per environment and enforce consistent tags, resource locks, and diagnostic settings. Integrate with Azure DevOps or GitHub Actions; use staged deployments and approvals for controlled promotion.

Deployment automation: Favor deployment slots, blue-green, and canary strategies supported by App Service, AKS (progressive rollouts with Deployment strategies), and Traffic Manager/Front Door for weighted routing. Automate database schema changes with migration pipelines and backward-compatible contracts. Gate rollouts using health probes and business KPIs.

Observability: Instrument applications with OpenTelemetry, export to Application Insights for distributed tracing, metrics, and dependency maps. Enable Azure Monitor for platform metrics, deploy Log Analytics workspaces, and create Workbooks and dashboards for SLOs and capacity. Define alert rules with dynamic thresholds, integrate with ITSM, and store Activity Logs and diagnostic logs centrally for audit and forensics.

Right-sizing and cost controls: Use Azure Advisor, Azure Monitor usage metrics, and Application Insights profiling to identify waste (idle cores, overprovisioned vCores, over-allocated RU/s). Apply Reservations/Savings Plans to steady workloads (VMs, SQL, Synapse), reserved capacity for Storage, and Cosmos DB commitment tiers. Choose Spot VMs for build agents, batch, and ML training with checkpointing. Balance architectural trade-offs: managed PaaS can reduce ops cost and improve reliability at higher unit costs; caching lowers data egress and RU costs at the expense of cache invalidation complexity; multi-region HA increases spend but may be required by RTO/RPO.

Security principles in practice:

• Defense in depth: Layer controls from identity to data. Use Private Link to keep traffic off the public Internet, NSGs and ASGs for microsegmentation, Azure Firewall Premium for TLS inspection, and WAF at the edge. Enable Defender for Cloud recommendations and just-in-time VM access.
• Least privilege: Implement fine-grained RBAC, scoped to management group/subscription/resource group levels; prefer managed identities over secrets; govern at scale with Azure Policy and access reviews for groups, enterprise apps, and privileged roles.
• Assume breach: Require MFA and Conditional Access, monitor with Sentinel, and isolate workloads with separate landing zones and subscriptions. Encrypt data at rest with platform keys or CMK in Key Vault; use double encryption where regulators require it. Use SAS for time-bound storage access and rotate keys by policy.
• Data classification: Catalog data with Microsoft Purview, label sensitivity, and enforce DLP. Align encryption, retention, and access to data classification tiers; log access to PII and support privacy requirements with features like Dynamic Data Masking and Always Encrypted where applicable.

Azure Landing Zones and Modern Architecture Patterns

Azure Landing Zones operationalize the framework at scale. Organize a management group hierarchy (root → platform → business units) to scope Azure Policy, RBAC, and budgets. Platform landing zones provide shared services—identity (Azure AD), connectivity (hub with Azure Firewall, DDoS, DNS), management (Log Analytics, Automation, Update Management), and security (Defender for Cloud). Application landing zones host workloads, segmented by environment and compliance boundaries, with inherited policies that enforce tagging, diagnostics, and allowed resource types. Adopt the Cloud Adoption Framework (CAF) Enterprise-Scale design or the Terraform/Bicep-based landing zone accelerators to bootstrap quickly and consistently.

Microservices on Azure emphasize decoupled teams and independently deployable services:

• Service discovery: In AKS, use Kubernetes DNS/CoreDNS for intra-cluster resolution; enhance with Dapr sidecars for name-based discovery and retries. Service Fabric provides built-in naming and health management for stateful services.
• API gateway pattern: Use Azure API Management to centralize routing, versioning, auth (OAuth 2.0/JWT validation), quotas, and caching. Place Azure Front Door in front for global anycast, SSL offload, and WAF; route per region and perform canary releases safely.
• Event-driven communication: Use Azure Service Bus for ordered, transactional commands with sessions; choose Event Hubs for high-throughput telemetry; and Event Grid for reactive, push-style event subscriptions. Design for at-least-once delivery, idempotent handlers, poison message handling, and DLQs.

CQRS and Event Sourcing separate write and read models for performance and complexity isolation. Persist append-only events in an event store (Cosmos DB, Azure SQL, or Event Hubs with compaction via downstream storage), replay to rebuild state, and project into read models optimized for queries such as Azure SQL Database, Cosmos DB containers, or Azure Cognitive Search. Cosmos DB change feed is the linchpin for projections: Azure Functions or Azure Stream Analytics can process changes to update read stores in near-real time. Event Hubs buffers high-volume event streams, with consumers scaling independently. Embrace eventual consistency with clear SLAs and user experience patterns (e.g., command acknowledgement followed by read-model convergence).

Strangler Fig pattern enables incremental modernization. Put Azure API Management in front of the monolith to route specific endpoints to new microservices while the rest continue to the legacy backend. Use policies for header-based routing, response transformation, and authentication. Synchronize data with change data capture (e.g., Azure Data Factory or Database CDC to Event Hubs) and build new read models with Cosmos DB + change feed, gradually retiring monolith capabilities. Manage risk with feature flags, canary routing at Front Door, and comprehensive observability to compare behavior.

Practical Problem Scenario

Starbucks is modernizing its global ordering platform, currently a monolith hosted on VMs in a single region. They must improve reliability across regions, reduce latency for mobile clients, enforce least privilege and Zero Trust, and migrate incrementally without business disruption.

1. Establish enterprise landing zones

• Create a management group hierarchy with platform and application landing zones. Apply Azure Policy for tagging, diagnostics, allowed SKUs, and private endpoints. Choose the CAF Enterprise-Scale reference for identity, connectivity (hub with Azure Firewall Premium, Private DNS), and management (central Log Analytics). Why: Landing zones enforce consistent security, networking, and governance baselines so workloads inherit controls by design.

2. Put an edge and API facade in front of the monolith

• Deploy Azure Front Door (Standard/Premium) with WAF to provide global anycast entry, TLS termination, and DDoS protection. Place Azure API Management as the API gateway, integrated with Front Door, to authenticate clients (OAuth 2.0), apply rate limits per consumer group, and transform requests/responses. Why: Front Door reduces latency and protects at the edge; API Management implements the API gateway pattern, enabling the Strangler Fig approach and tenant-specific throttling.

3. Implement the Strangler Fig migration

• Use API Management policies to route selected endpoints (e.g., menu, store locator) to new microservices running on AKS in two regions; all other routes go to the legacy monolith behind an internal load balancer. Why: Incremental routing avoids big-bang cutovers and lets teams migrate capabilities independently.

4. Build microservices with resilient, performant patterns

• In AKS, enable HPA with KEDA for event-driven autoscaling. Use Dapr for service discovery, retries with exponential backoff and circuit breaking between services. Integrate Azure Cache for Redis for hot reads and session offload. Why: AKS and Dapr provide platform-agnostic resiliency and service discovery; caching reduces read latency and backend load.

5. Adopt event-driven communication and CQRS

• Publish domain events to Azure Event Hubs; persist orders in Cosmos DB with partitioning by customer or store. Use the Cosmos DB change feed with Azure Functions to project to read models in Azure SQL Database (reporting) and Azure Cognitive Search (store inventory search). Why: Event Hubs decouples producers and consumers at high throughput; change feed enables near-real-time materialized views for CQRS without impacting write performance.

6. Strengthen security and identity

• Enforce private endpoints for data services, NSGs/ASGs for segmentation, and Azure Firewall for egress control. Use managed identities for all workloads, PIM for privileged roles, and access reviews for API Management product subscriptions. Enable Conditional Access and MFA for ops staff. Why: Defense in depth and least privilege reduce blast radius and credential risk; access reviews sustain entitlement hygiene.

7. Engineer for reliability and observability

• Deploy across Availability Zones in each region, with active-active Front Door routing and API Management multi-region. Enable health endpoint monitoring with Front Door and AKS probes; configure canary releases for new services. Instrument with OpenTelemetry to Application Insights, centralize logs in Log Analytics, and create SLO dashboards with alerts. Implement backup/DR for stateful stores and run chaos experiments. Why: Zonal and regional redundancy, health-driven routing, and comprehensive observability maintain SLAs and enable rapid incident response.

8. Optimize cost continuously

• Right-size AKS node pools and App Service plans based on telemetry; apply Reservations/Savings Plans for steady compute; use Spot VMs for non-critical batch. Enable Cosmos DB autoscale and evaluate commitment tiers. Enforce budgets/tags and review Azure Advisor recommendations monthly. Why: Systematic cost governance preserves performance while minimizing waste and unit costs.

← Migration and Modernization · All domains

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →