AZ-305 flashcards

Design identity, governance, and monitoring solutions

• Start with one Log Analytics workspace; split only for residency, separate tenants, data ownership, split billing or different retention for the same table.
• Resource-context access (the default mode) separates teams by resource; table-level access separates by table; granular RBAC with ABAC conditions separates rows, all with one copy of the data.
• Analytics is full-featured; Basic is cheaper, fast and still supports simple alerts, export and replication; Auxiliary is cheapest and slowest, with no alerts, export or replication.
• Analytics retention goes to two years and total retention to 12 years; a search job finds records in long-term data, restore reopens a short window for many queries, and export to immutable storage covers longer or tamper-proof retention.
• A diagnostic setting holds one destination of each type, a resource has up to five settings, and storage or Event Hubs destinations must be in the resource's region.
• The activity log keeps 90 days; a subscription diagnostic setting, deployed to every subscription by a DeployIfNotExists policy with remediation, keeps it longer.
• Azure Monitor Agent with data collection rules is the only supported agent; machines outside Azure need Azure Arc, and XPath or transformations filter data before it is billed.
• Data export rules copy new data only, whole tables, to same-region storage or Event Hubs, and never from Auxiliary tables.
• Alert processing rules suppress or add action groups for fired alerts by scope, severity and schedule without touching alert rules.
• Use Application Insights for traces and Standard availability tests, virtual network flow logs with traffic analytics and Connection Monitor for networks, and managed Prometheus with Managed Grafana for AKS.

• PTA enforces on-premises lockout, expiry and sign-in hours at each sign-in with internal agents only; keep PHS on as well for leaked-credential detection and as the manual fallback if domain controllers go down.
• Staged rollout moves groups of a federated domain to PHS, PTA or CBA without changing UPNs; converting the domain is all-or-nothing.
• Entra certificate-based authentication replaces AD FS for smart cards; certificates are single-factor until an authentication binding rule by issuer or policy OID makes them multifactor.
• Conditional Access needs P1, sign-in and user risk conditions need P2; report-only mode measures real impact, What If tests one sign-in.
• Only passkeys/FIDO2, Windows Hello for Business and multifactor CBA meet the phishing-resistant strength; the passwordless strength still allows Authenticator phone sign-in.
• Cloud Sync suits disconnected forests and multiple active agents; Connect Sync is needed for custom sync rules, cross-forest attribute merge and very large domains, with a staging-mode standby.
• B2B collaboration creates guests; B2B direct connect (Teams shared channels) creates none and needs mutual inbound/outbound settings; cross-tenant sync automates users between your own tenants; External ID external tenants serve customers, and B2C isn't sold to new customers.
• Use user-assigned managed identities for shared or short-lived resources, Arc for on-premises servers (system-assigned only) and federated credentials for GitHub Actions and AKS Workload ID.
• Delegate role assignment with Role Based Access Control Administrator plus a condition; remove standing admin access with PIM eligible assignments, authentication context and PIM for Groups.
• Use the Key Vault RBAC model with Secrets User for apps; Managed HSM for single-tenant PaaS keys, Cloud HSM for IaaS apps such as AD CS, Payment HSM for PIN work; rotate keys by policy with versionless URIs, certificates by integrated-CA auto-renewal and secrets with SecretNearExpiry plus a function.

• Assign policies and roles once at the highest management group where they are true; subscriptions added later inherit them.
• Management groups follow policy archetypes (Platform, Corp, Online, Sandbox); environments are subscriptions, not management groups.
• Change the hierarchy's default management group so new subscriptions start under governance instead of the tenant root.
• Use a separate subscription for a separate invoice, quota or admin boundary; resource groups handle access, lifecycle and reporting.
• Tags are not inherited: use a modify inherit-tag policy plus remediation to tag resources, or Cost Management tag inheritance to change only cost data.
• Deny rejects for everyone, deployIfNotExists creates missing related resources, modify changes tags or properties, denyAction blocks deletes (set cascadeBehaviors to cover resource group deletion).
• Exemptions keep reporting and can expire (Waiver or Mitigated); exclusions silently remove a scope. Existing resources need a remediation task and an identity with the right roles.
• Allowed locations skips resource groups and global resources: add Allowed locations for resource groups and a resource-type policy for global services.
• CanNotDelete locks stop accidents; deployment stacks at a parent scope stop subscription Owners; Blueprints retires 31 January 2027.
• PIM eligible assignments give just-in-time access; access reviews recertify; access packages grant bundles with expiry; lifecycle workflows act on HR dates.

Design data storage solutions

• SQL Server Agent, cross-database queries, Database Mail or CLR plus a PaaS requirement point to Azure SQL Managed Instance; no Azure SQL Database tier adds them.
• FILESTREAM, SSRS on the server, linked servers to non-SQL Server sources or a pinned engine version point to SQL Server on an Azure VM; compatibility level doesn't pin the engine.
• Keep PostgreSQL or MySQL with flexible server; its HA standby can't be queried, so readable copies need read replicas.
• DTU bundles resources at a fixed price; vCore sizes them independently and is the only model with Azure Hybrid Benefit and reservations (no Hybrid Benefit for new Hyperscale, neither discount for serverless).
• Business Critical (or DTU Premium) for In-Memory OLTP, lowest latency and a free readable replica; Hyperscale beyond 4 TB or for snapshot backups.
• Leaving Hyperscale means reverse migrating to General Purpose within 45 days; Hyperscale has no memory-optimized tables, and every In-Memory OLTP object must be removed before converting.
• Serverless with auto-pause for one intermittent database that can wait to resume; elastic pools for many databases with non-overlapping peaks and no warm-up delay.
• ApplicationIntent=ReadOnly uses the included replica; Hyperscale named replicas give independent size and security; sharding with a shard map scales writes.
• TDE with a customer-managed key needs soft delete, purge protection and Crypto Service Encryption User; use database-level keys for per-customer revocation.
• Only Always Encrypted keeps data from DBAs; masking and row-level security limit what ordinary users see, and ledger proves integrity.

• Varying JSON queried on any property, in one or many regions, is Cosmos DB for NoSQL; key-only lookups in one region at the lowest cost are Azure Table storage.
• Pick the Cosmos DB API from the existing code: Tables SDK apps move to the API for Table, CQL apps to the API for Apache Cassandra (no nodes); Managed Instance for Apache Cassandra still means choosing nodes.
• Serverless Cosmos DB is single-region and pay-per-RU; autoscale scales between 10% and 100% of a set maximum and bills each hour's peak; manual throughput suits steady load.
• Throttling with spare RU/s is a hot partition: choose a high-cardinality key that spreads writes and matches queries, keep atomically updated items in one logical partition, and use hierarchical keys when tenants outgrow one logical partition.
• Session consistency gives read-your-own-writes cheaply; strong never returns stale data but rules out multi-region writes; bounded staleness caps lag by time or versions with one write region.
• Windows shares are Azure Files over SMB; NFS on Azure Files needs SSD (premium) shares; sub-millisecond shared NFS with adjustable service levels is Azure NetApp Files; Linux can mount blob containers with BlobFuse2 or NFS 3.0 on an HNS account.
• The hierarchical namespace gives atomic directory renames and POSIX ACLs but rules out point-in-time restore, object replication and version-level immutability.
• Cool, cold and archive have 30, 90 and 180-day minimums; archive is offline and needs an LRS, GRS or RA-GRS account; premium block blob accounts have no tiers and support only LRS and ZRS.
• Lifecycle rules tier or delete by creation, modification or last access (with tracking on) and can expire previous versions; smart tier automates hot, cool and cold with no early deletion fees but only on ZRS, GZRS or RA-GZRS accounts.
• Among built-in account features, only container soft delete brings back a deleted container; point-in-time restore needs soft delete, change feed and versioning; locked time-based retention meets SEC 17a-4(f); customer-managed keys need a purge-protected vault, and account-level infrastructure encryption is set only at creation.

• Copy activity moves data; mapping data flows transform it without code; Lookup, Web and Get Metadata are control activities for small results, not bulk movement.
• On-premises or private-network sources need a self-hosted IR (outbound HTTPS only); private Azure stores with no VMs to manage need an Azure IR in a managed virtual network with managed private endpoints.
• A self-hosted IR becomes highly available by registering up to four nodes to the same runtime; strict data residency needs an Azure IR in an explicit region, because managed-network autoresolve uses the factory region.
• Existing SSIS packages run on an Azure-SSIS IR in Data Factory (SSISDB in SQL Database or Managed Instance), joined to a virtual network for on-premises data and stopped outside the package window; Synapse pipelines don't support it.
• Tumbling window triggers backfill and chain windows; storage event triggers react to new files; the watermark pattern loads only changed rows when change tracking and CDC aren't available.
• Data Lake Storage needs the hierarchical namespace (upgradable in place, one-way); ACL traversal needs execute on every parent, and default ACLs give access to child items created later.
• Delta Lake gives atomic MERGE and time travel only within its retention settings; Unity Catalog governs and traces lineage across workspaces; scheduled jobs belong on job compute.
• Serverless SQL bills per data processed, so use Parquet and partition pruning; dedicated SQL pools isolate loads from reports with workload groups.
• Microsoft recommends Fabric for new analytics platforms: shortcuts reference data in place, mirroring replicates Azure SQL Database and Cosmos DB with no ETL (Synapse Link for Cosmos DB isn't supported for new projects), and Direct Lake gives near-Import speed without refresh copies.
• Stream Analytics serves the hot path (tumbling windows count each event once, reference data enriches it), Event Hubs Capture feeds the cold path, and Azure Data Explorer sizes cost with a caching policy separate from retention.

Design business continuity solutions

• RPO is how much data you may lose, RTO is how fast you must run again; decide both per workload and per failure scope.
• Site Recovery replicates for minutes-level RPO and failover; Azure Backup keeps history. Replication copies corruption, so ransomware recovery needs backup.
• Zone-to-zone Site Recovery gives minutes-level DR that stays in the region; region-to-region protects against a regional outage.
• Recovery plans order the failover and run scripts; replication groups give several VMs one recovery point; test failover into an isolated network proves DR without touching production.
• VMware and physical servers use a replication appliance and the Mobility service; Hyper-V uses the Provider and Recovery Services agent on hosts (or the Provider on VMM).
• Recovery Services vaults hold VMs, SQL and SAP HANA in VMs, Azure Files and on-premises backups; Backup vaults hold blobs, disks, AKS and PostgreSQL.
• Choose vault redundancy before the first backup; Cross Region Restore needs GRS. Locked immutability is irreversible, MUA needs a Resource Guard owner's approval, soft delete keeps deletions 14 to 180 days.
• Enhanced VM policies give backups every 4 hours, up to 30 days of instant restore and support for Premium SSD v2 and Ultra; Disk Backup gives agentless hourly disk snapshots.
• Azure SQL: PITR up to 35 days, LTR up to 10 years, geo-restore for relaxed objectives, failover groups for unchanged connection strings; SQL Managed Instance uses failover groups only.
• Vaulted blob and vault-standard Azure Files backups survive account deletion; with File Sync cloud tiering, back up the file share, not the server.

• Name the failure scope first: availability sets handle racks and maintenance, zones handle datacenters, and only a second region handles a region outage.
• The least redundant component on the request path caps the whole workload; give every dependency the same failure isolation as the tier that calls it.
• Availability set membership is fixed at VM creation; a proximity placement group is a latency feature, so use one per zone when you need both latency and zone resilience.
• Zone-spanning scale sets survive a zone loss; over-provision (C × N ÷ (N − 1) instances, so 1.5× across three zones) when capacity must be there immediately, and use best-effort balancing so autoscale can replace instances.
• App Service zone redundancy needs Premium v2–v4 (or Isolated v2) and at least two instances on a zone-capable scale unit; AKS node pool zones are set at creation, replicas need zone topology spread, and pods need ZRS disks or Azure Files to move zones.
• Azure SQL Database: zone redundancy in General Purpose, Business Critical, Hyperscale (creation only) and Premium; failover groups add group failover and listeners; customer-managed failover is recommended.
• SQL Managed Instance has failover groups but no active geo-replication; SQL Server on VMs uses availability groups across zones, and a multi-subnet deployment removes the listener's load balancer.
• Cosmos DB zone redundancy is set per region when it is added; strong consistency rules out multi-region writes, so pair it with service-managed failover.
• RA-GRS/RA-GZRS keep reads available through the -secondary endpoint; check Last Sync Time for staleness, and don't rely on account failover for read availability.

Design infrastructure solutions

• Pick the most managed compute that meets every requirement: VMs only when you need the OS, App Service for web code, Container Apps for containers without Kubernetes, AKS when you need the Kubernetes API.
• VM families follow resource shape: B burstable, D general purpose, E/M memory, F compute, L storage, N GPU, H-series HPC with InfiniBand for tightly coupled MPI.
• Reservations suit fixed size and region; savings plans follow changing families, regions and some PaaS compute; Hybrid Benefit removes the licence charge and stacks with either.
• Spot VMs can be evicted at any time: Deallocate keeps the disks (still billed) so you can resume, Delete removes everything; a max price of -1 stops only price evictions.
• Flexible orchestration mixes VM sizes and Spot with regular instances and supports Azure Backup; the mode is fixed at creation, so changing it means a new scale set.
• Known peaks need schedule-based autoscale ahead of time; keep a metric rule for unplanned spikes.
• Dedicated Host answers "no shared hardware"; confidential VMs answer "protect memory from the host" with no code changes; SGX enclaves need code changes.
• In AKS, put GPU or Spot capacity in its own tainted user pool with the cluster autoscaler; Spot pools can't be system pools.
• Flex Consumption is the default serverless Functions plan (Linux, VNet, scale to zero, no slots); Premium covers Windows, slots and no cold start; Dedicated reuses spare App Service capacity.
• Azure Batch manages pools and scheduling; use a dedicated baseline plus Spot for deadlines, custom images for long installs, and CycleCloud to keep existing Slurm or PBS workflows.

• Business messages that must be processed once go to Service Bus; reactions to discrete events go to Event Grid; high-volume replayable streams go to Event Hubs; huge simple backlogs at lowest cost go to Queue Storage.
• Service Bus sessions give ordered, exclusive handling per key; duplicate detection drops retried sends with the same MessageId; the dead-letter queue takes messages past the maximum delivery count; transactions make receive-and-forward atomic.
• Service Bus Premium brings dedicated messaging units, messages up to 100 MB, private endpoints, JMS 2.0 and Geo-Replication, which copies messages as well as metadata; Geo-Disaster Recovery copies metadata only.
• Event Grid retries for at most 24 hours, filters per subscription and dead-letters to Blob Storage; its MQTT broker serves publish/subscribe among clients.
• Event Hubs partitions cap parallel readers per consumer group and are fixed at creation on Standard; partition keys keep per-entity order; Standard and higher expose Kafka; Capture archives to storage with no code.
• API Management is the API gateway (keys, products, policies, developer portal); multi-region deployment needs Premium (classic), and a production self-hosted gateway needs Premium.
• rate-limit returns 429 per subscription, quota returns 403; validate-jwt checks the caller, managed identity authenticates the gateway to the backend; outbound policies change responses.
• New Redis caches use Azure Managed Redis; active geo-replication gives multi-region read/write on in-memory tiers; cache-aside updates the store first, then invalidates the key.
• App Configuration stores settings and feature flags centrally; Key Vault references are resolved by the app's identity; stores (not labels) are the access boundary; a sentinel key applies change sets together.
• Template specs share versioned IaC under RBAC; deployment stacks protect and clean up deployed resources; pipelines sign in with workload identity federation; slots plus traffic routing and swap give canary releases and instant rollback.

• Assign a CAF strategy per workload: rehost for speed and stability, replatform to stop patching, rearchitect for structural limits, replace when SaaS fits, retain (with Azure Arc) when regulation or hardware keeps it on premises.
• Deploy an Azure landing zone before the first wave; start with simple, low-integration apps and non-production environments, and keep directly dependent components in the same wave.
• A rollback plan needs criteria, an owner and an intact source: decommission only after validation, because Azure Migrate doesn't replicate back on premises.
• Discover with the Azure Migrate appliance when connected, the collector when air-gapped, and a CSV import only for a trusted inventory; agentless dependency analysis is the recommended way to group servers.
• Performance-based sizing right-sizes but needs a representative history (the confidence rating shows it); as on-premises sizing gives like-for-like VMs.
• VMware can migrate agentless, Hyper-V through host providers, and physical or other-cloud servers agent-based; run a test migration into an isolated network before cutover.
• Azure VMware Solution with HCX moves VMware VMs without conversion, and HCX Network Extension keeps their IP addresses during phased waves.
• DMS goes offline to Azure SQL Database and online or offline to Managed Instance and SQL Server VMs; transactional replication gives minimal downtime to Azure SQL Database.
• The Managed Instance link (SQL Server 2016+, private connectivity) cuts over in seconds and can fail back with SQL Server 2022+; Log Replay Service (SQL Server 2008+, public endpoint) waits for the final restore and has no reverse path.
• Data Box when the link can't carry the data in time (seed, then catch up online); Storage Mover for tracked share and S3 migrations; AzCopy for scripted copies; Azure File Sync when servers stay as caches.

• NAT gateway is the recommended outbound path for private subnets: static IPs you own, no inbound connections, dynamic SNAT ports. Default outbound access is being retired and new VNets default to private subnets.
• One Azure Bastion host from the Basic tier up serves peered VNets; native clients need Standard, session recording needs Premium, and Developer has no peering support.
• Site-to-site VPN is encrypted but crosses the internet; ExpressRoute is private with predictable latency but isn't encrypted by default. MACsec needs ExpressRoute Direct; provider circuits use IPsec over private peering.
• Survive a peering-location outage with a second circuit at another location or a coexisting VPN (route-based, not Basic, in a /27 or larger GatewaySubnet). Global Reach links circuits so datacenters talk over the Microsoft backbone.
• Point-to-site Entra ID authentication requires OpenVPN; RADIUS uses existing AD DS credentials through NPS; Windows clients need a fresh profile after topology changes.
• Peering is non-transitive: hub allows gateway transit, spokes use remote gateways, and spoke-to-spoke traffic goes through the hub firewall by UDR. Longest prefix wins, so disable gateway route propagation when 0.0.0.0/0 must catch on-premises traffic.
• Private endpoints give one resource a private IP reachable from on-premises and allow public access to be disabled; service endpoints only serve traffic from an Azure subnet to the public endpoint.
• On-premises DNS can't reach 168.63.129.16: forward to a DNS Private Resolver inbound endpoint, and link privatelink zones to every VNet (or DNS server VNet) that resolves them.
• Azure Firewall Premium adds TLS inspection, IDPS and full-URL filtering; Virtual Network Manager security admin Deny rules beat any NSG; DDoS IP Protection is per IP, Network Protection adds rapid response and cost protection; layer-7 floods need a WAF rate-limit rule.
• Pick load balancing by HTTP(S) versus any protocol and global versus regional; Traffic Manager geographic routing enforces residency; Front Door Premium adds Private Link origins and managed WAF rules; HA ports on an internal load balancer for NVAs, Gateway Load Balancer for transparent chaining.

Yes — the whole AZ-305 deck is free and needs no account, as is every AZ-305 revision lesson. Create a free account to save progress and drill practice questions; full-length mock exams are a one-time unlock per certification.