AZ-305 · Domain 4 of 4

AZ-305 Domain 4: Design infrastructure solutions

This is the largest AZ-305 domain. It covers designing compute, application architecture, migrations and networking: choosing VMs, containers or serverless, messaging and eventing, migration strategy with the Cloud Adoption Framework, and connectivity and load balancing.

Exam format
30–35%
Official functional groups
4
Assessment estimate
13–20
Suggested study time estimate
30–40 hrs

About 11 min read Reviewed October 2026

Overview

Design infrastructure solutions is the largest AZ-305 domain, bringing together compute, application architecture, migration and networking. It has four objective groups. Compute covers specifying components and recommending virtual machine, container, serverless and batch-processing solutions by workload. Application architecture covers recommending messaging, event-driven architectures, API integration, caching, configuration management and automated deployment. Migrations covers evaluating and recommending migration using the Cloud Adoption Framework, assessing on-premises servers, data and applications, and recommending migration to IaaS and PaaS, databases and unstructured data. Network solutions covers recommending connectivity to the internet and on-premises, optimizing network performance and security, and load balancing and routing.

At 30–35%, this is the single heaviest domain. The exam rewards choosing the right compute model, messaging or eventing service, migration approach and networking design for the stated requirements, across the breadth of Azure infrastructure.

How it's tested

AZ-305 questions in this domain describe a compute, application, migration or networking requirement and ask you to recommend the design, across the broad infrastructure surface. AZ-305 questions are requirement-driven design scenarios where several options may work, so read every requirement and recommend the design that meets all of them before answering.

  • Right compute model

    A workload is described, and you recommend VMs, containers, serverless or batch.

  • Application integration

    A messaging, eventing, caching or deployment need is described, and you recommend the service.

  • Networking and migration

    A connectivity, load-balancing or migration need is described, and you recommend the design.

Reasoning it through

An application serves global users and must route each to the lowest-latency healthy regional endpoint, with web application firewall protection at the edge. Azure Load Balancer operates at the regional, transport level, and Application Gateway is regional layer-7. Azure Front Door provides global, layer-7 routing to the closest healthy backend with an integrated web application firewall, which matches the global low-latency, protected-edge requirement, so Front Door is the recommended service.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

4.1 Design compute solutionsSpecify components and recommend VM, container, serverless and batch compute.
What it means
This covers specifying components of a compute solution based on workload requirements, and recommending virtual machine-based, container-based, serverless and batch-processing compute solutions, using Azure Virtual Machines, Container Apps and AKS, Azure Functions and Azure Batch.
What to understand
VMs give full control for lift-and-shift or specialized workloads, containers package and scale applications, serverless Functions run event-driven code without managing servers, and Batch runs large-scale parallel batch jobs. The design matches the compute model to the workload's control, scaling and operational needs.
How it shows up
A workload is described, and you must recommend VMs, containers, serverless or batch compute.
Common confusion
Defaulting to VMs for event-driven or bursty workloads where serverless or containers fit better.
4.2 Design an application architectureMessaging, eventing, API integration, caching, configuration and automated deployment.
What it means
This covers recommending a messaging architecture with Azure Service Bus, an event-driven architecture with Azure Event Grid or Event Hubs, API integration with API Management, a caching solution such as Azure Cache for Redis, application configuration management with App Configuration, and automated deployment such as CI/CD pipelines and infrastructure as code.
What to understand
Messaging (Service Bus) carries work items reliably, eventing (Event Grid) routes events, and Event Hubs ingests high-volume streams. API Management fronts and governs APIs. Caching cuts latency. App Configuration centralizes settings. Automated deployment uses pipelines and infrastructure as code. The design decouples and scales the application.
How it shows up
An application integration or deployment need is described, and you must recommend the messaging, eventing, API, caching or deployment design.
Common confusion
Confusing Service Bus (messaging), Event Grid (eventing) and Event Hubs (high-volume streaming).
4.3 Design migrationsEvaluate and recommend migration with the Cloud Adoption Framework.
What it means
This covers evaluating a migration solution that leverages the Microsoft Cloud Adoption Framework for Azure, evaluating on-premises servers, data and applications for migration, and recommending solutions for migrating workloads to IaaS and PaaS, migrating databases, and migrating unstructured data, using Azure Migrate, Database Migration Service and Data Box.
What to understand
The Cloud Adoption Framework guides migration strategy and readiness. Azure Migrate assesses and migrates servers, Database Migration Service migrates databases including across engines, and Data Box moves large data offline. The design recommends the migration target (IaaS or PaaS) and tools matched to the workload and constraints.
How it shows up
A migration requirement is described, and you must recommend the assessment, target and tooling.
Common confusion
Confusing a lift-and-shift to IaaS with modernization to PaaS; the target depends on the workload and goals.
4.4 Design network solutionsConnectivity, performance, security, and load balancing and routing.
What it means
This covers recommending connectivity from Azure resources to the internet and to on-premises networks with VPN and ExpressRoute, optimizing network performance and security, and recommending a load-balancing and routing solution with Azure Load Balancer, Application Gateway, Azure Front Door and Traffic Manager.
What to understand
VPN connects over the internet and ExpressRoute provides a dedicated private link. Load balancing differs by scope and layer: Load Balancer is regional transport-level, Application Gateway is regional layer-7 with a web application firewall, Front Door is global layer-7 with a web application firewall, and Traffic Manager is DNS-based global routing. The design matches the connectivity and routing requirements.
How it shows up
A connectivity or load-balancing requirement is described, and you must recommend the networking design.
Common confusion
Confusing the load-balancing services; Load Balancer, Application Gateway, Front Door and Traffic Manager differ by scope and layer.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • VMs vs. containers vs. serverless vs. batch

    Full control, packaged scaling, event-driven, and parallel jobs.

    Remember
    Match the compute model to the workload.
    Tested as
    Compute design questions.
    Trap
    Defaulting to VMs.

  • Azure Functions

    Serverless event-driven compute.

    Remember
    For event-driven, variable workloads.
    Tested as
    Compute design questions.
    Trap
    Using VMs for bursty events.

  • Service Bus vs. Event Grid vs. Event Hubs

    Messaging, eventing, and high-volume streaming.

    Remember
    Match the pattern to the service.
    Tested as
    Application design questions.
    Trap
    Confusing the three.

  • API Management

    Fronts, secures and governs APIs.

    Remember
    It centralizes API policies.
    Tested as
    Integration questions.
    Trap
    Exposing APIs without governance.

  • Azure Cache for Redis

    In-memory caching for applications.

    Remember
    It cuts latency and load.
    Tested as
    Caching questions.
    Trap
    Scaling instead of caching.

  • App Configuration

    Centralized application settings and feature flags.

    Remember
    It separates configuration from code.
    Tested as
    Configuration questions.
    Trap
    Hard-coding configuration.

  • Cloud Adoption Framework migration

    Guides migration strategy and readiness.

    Remember
    It frames assessment and planning.
    Tested as
    Migration questions.
    Trap
    Migrating without assessment.

  • Azure Migrate and DMS

    Assess and migrate servers and databases.

    Remember
    DMS migrates databases, including across engines.
    Tested as
    Migration questions.
    Trap
    Using the wrong migration tool.

  • VPN vs. ExpressRoute

    Encrypted internet versus dedicated private link.

    Remember
    ExpressRoute gives consistent bandwidth.
    Tested as
    Connectivity questions.
    Trap
    Using VPN where a private link is required.

  • Load Balancer vs. Application Gateway vs. Front Door vs. Traffic Manager

    Regional transport, regional layer-7, global layer-7, and DNS global routing.

    Remember
    Match scope and layer to the need.
    Tested as
    Load-balancing questions.
    Trap
    Confusing the services.

  • Web application firewall

    Layer-7 protection in Application Gateway and Front Door.

    Remember
    It protects web apps from attacks.
    Tested as
    Network security questions.
    Trap
    Expecting it from Load Balancer.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

VMs vs. containers vs. serverless vs. batch

ConceptMeaningKey differenceCommon trap
Virtual machines Full OS control Lift-and-shift, specialized Using them for event-driven work
Containers Packaged, portable scaling Microservices Confusing with VMs
Serverless (Functions) Event-driven, no servers Variable, bursty workloads Using VMs instead
Batch Large-scale parallel jobs High-throughput batch Using VMs manually

Service Bus vs. Event Grid vs. Event Hubs

ConceptMeaningKey differenceCommon trap
Service Bus Reliable messaging Work items, ordering Using it for streaming
Event Grid Lightweight event routing Announcements, reactive Using it for reliable work
Event Hubs High-volume event streaming Telemetry and ingestion Using it for discrete messages

Load Balancer vs. App Gateway vs. Front Door vs. Traffic Manager

ConceptMeaningKey differenceCommon trap
Azure Load Balancer Regional transport-level Layer 4, regional Using it for layer-7 web traffic
Application Gateway Regional layer-7 with WAF Web traffic in a region Confusing with Front Door
Front Door Global layer-7 with WAF Global low-latency web routing Using it for regional only
Traffic Manager DNS-based global routing Routes by DNS to regions Expecting layer-7 features

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. VM for event workload

    What candidates pick
    Recommend always-on VMs for an event-driven, bursty workload.
    Why it looks right
    VMs are a default compute choice.
    Why it's wrong
    Azure Functions runs event-driven code serverlessly, scaling with demand without idle VMs.

    Clue to watch for The workload is event-driven, intermittent or bursty.

  2. Event Hubs for discrete messages

    What candidates pick
    Recommend Event Hubs for reliable, ordered processing of discrete work items.
    Why it looks right
    It handles events.
    Why it's wrong
    Event Hubs ingests high-volume streams; Service Bus handles reliable, ordered discrete messages.

    Clue to watch for The need is reliable ordered messaging, not high-volume streaming.

  3. Load Balancer for global web

    What candidates pick
    Recommend Azure Load Balancer to route global web users to the nearest region with WAF.
    Why it looks right
    It balances load.
    Why it's wrong
    Load Balancer is regional and layer 4; Front Door provides global layer-7 routing with a web application firewall.

    Clue to watch for The requirement is global, low-latency, protected web routing.

  4. VPN for consistent bandwidth

    What candidates pick
    Recommend a VPN for a connection needing consistent high bandwidth to on-premises.
    Why it looks right
    VPN is quick to set up.
    Why it's wrong
    VPN runs over the internet with variable performance; ExpressRoute gives a dedicated private link with consistent bandwidth.

    Clue to watch for The requirement is predictable, high-throughput private connectivity.

  5. Migrate without assessment

    What candidates pick
    Recommend migrating all workloads directly without assessment.
    Why it looks right
    It seems faster.
    Why it's wrong
    The Cloud Adoption Framework and Azure Migrate assessment identify the right target and workloads to retire or modernize.

    Clue to watch for The estate must be evaluated before migrating.

Answer framework

For any Domain 4 design scenario, use these steps to find the answer AZ-305 expects.

  1. Identify whether the requirement is compute, application architecture, migration or networking, and read all constraints.
  2. For compute, recommend VMs for control or lift-and-shift, containers for packaged scaling, serverless for event-driven work, and batch for parallel jobs.
  3. For application architecture, choose Service Bus for messaging, Event Grid for eventing, Event Hubs for streaming, plus API Management, caching and automated deployment.
  4. For migration, use the Cloud Adoption Framework and Azure Migrate to assess, then recommend the IaaS or PaaS target and the right tooling.
  5. For networking, choose VPN or ExpressRoute for connectivity and the load-balancing service, Load Balancer, Application Gateway, Front Door or Traffic Manager, that matches the scope, layer and protection needed.

Practice question

A web application serves users worldwide and must route each user to the lowest-latency healthy regional deployment, provide layer-7 routing, and include web application firewall protection at the edge. Which Azure service should the architect recommend?

Want more like this? The AZ-305 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the most study time, since at 30–35% it is the largest and broadest. Start with compute design, learning when to recommend VMs, containers, serverless or batch, and stop defaulting to VMs. Then master application architecture, keeping Service Bus (messaging), Event Grid (eventing) and Event Hubs (streaming) distinct, and learning API Management, caching and automated deployment.

Next, learn migration design with the Cloud Adoption Framework and Azure Migrate, and the IaaS-versus-PaaS target decision. Finally, master networking, which is heavily tested: the connectivity choice of VPN versus ExpressRoute, and especially the four load-balancing services, Load Balancer, Application Gateway, Front Door and Traffic Manager, distinguished by scope and layer, with web application firewall in Application Gateway and Front Door.

Because the domain is broad and requirement-driven, practice many scenario questions across all four areas. This is the final domain, so finish with full practice tests spanning all four and connect each design back to the requirements.

FAQ

How much of AZ-305 is Domain 4?

Design infrastructure solutions is 30–35% of the exam, the single largest domain, spanning compute, application architecture, migration and networking.

When should I recommend serverless instead of VMs?

For event-driven, intermittent or bursty workloads, where Azure Functions scales with demand and avoids paying for idle virtual machines.

What is the difference between Service Bus, Event Grid and Event Hubs?

Service Bus is reliable messaging for work items, Event Grid is lightweight event routing, and Event Hubs ingests high-volume event streams such as telemetry.

How do the Azure load-balancing services differ?

Azure Load Balancer is regional and layer 4, Application Gateway is regional layer 7 with a web application firewall, Front Door is global layer 7 with a web application firewall, and Traffic Manager is DNS-based global routing.

When do I need ExpressRoute instead of a VPN?

When the connection to on-premises needs consistent, high bandwidth and must not traverse the public internet. ExpressRoute is a dedicated private link, while a VPN runs over the internet.

How does the Cloud Adoption Framework fit migration design?

It guides migration strategy and readiness, and with Azure Migrate it assesses the estate to determine which workloads to migrate, retire or modernize and whether to target IaaS or PaaS.

How does Domain 4 connect to the rest of the exam?

Infrastructure is designed within the identity and governance control plane of Domain 1, consumes the data of Domain 2, and is made resilient by the continuity design of Domain 3.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered compute, application architecture, migration and networking design. Test whether you can recommend the infrastructure design that meets every requirement.

Take the AZ-305 practice test Check your AZ-305 readiness

Keep going