Azure AZ-305 cheat sheet

Microsoft Entra ID P1 enables Conditional Access; P2 adds Privileged Identity Management, access reviews, entitlement management, and Identity Protection risk policies.

Azure RBAC assignments are additive and scoped to a management group, subscription, resource group, or resource; deny assignments override allow assignments.

Azure Policy effects Deny and Audit enforce or report compliance at deployment; DeployIfNotExists and Modify require a managed identity and remediation tasks for existing resources.

A system-assigned managed identity lifecycle follows its Azure resource; a user-assigned managed identity is independent and can be attached to multiple resources.

Diagnostic settings route platform logs and metrics to Log Analytics workspaces, Azure Storage accounts, Event Hubs, or partner monitoring solutions.

Metric alerts evaluate near real time; log search alerts run on a schedule and can use dimensions, thresholds, and query results.

Azure Monitor Agent collects data using data collection rules and supersedes the legacy Log Analytics agent for new onboarding.

PIM provides just-in-time, time-bound role activation with optional approval, MFA, and justification; access reviews recertify group and role membership.

B2B collaboration invites external partners as guests into your tenant; B2C is a separate customer identity service for consumer-facing applications.

Storage redundancy: LRS keeps three copies in one region; ZRS spreads three copies across zones; GRS keeps six copies across paired regions; RA-GRS adds read access to the secondary.

Blob access tiers are hot, cool, cold, and archive; archive has the lowest storage cost but requires rehydration before data can be read.

Lifecycle management rules can tier or delete current blobs, previous versions, and snapshots; they apply to block blobs in supported storage accounts.

Choose a Cosmos DB partition key with high cardinality and even access distribution; point reads that include the partition key avoid cross-partition fan-out.

Cosmos DB consistency levels from strongest to weakest are strong, bounded staleness, session, consistent prefix, and eventual.

Azure SQL DTU model bundles compute, storage, and IO; vCore model exposes compute and storage separately and supports Azure Hybrid Benefit.

Azure Files supports SMB and NFS; identity-based SMB authentication can use on-premises AD DS or Microsoft Entra Domain Services.

Use private endpoints for PaaS data services to assign a private IP; service endpoints restrict access from a subnet but still target the public endpoint.

Disk options: Ultra Disk and Premium SSD v2 for high IOPS and low latency; Premium SSD for production; Standard SSD or HDD for lower-throughput workloads.

RTO is the maximum acceptable downtime after disruption; RPO is the maximum acceptable data loss measured in time.

Azure Backup uses Recovery Services vaults for VMs, SQL Server, SAP HANA, and Azure Files; Backup vaults support newer workloads such as blobs and disks.

Soft delete, immutable vaults, and multi-user authorization protect backup data from accidental or malicious deletion.

Azure Site Recovery replicates VMs to a secondary region and supports test failover, recovery plans, and planned or unplanned failover.

Availability zones protect against datacenter failure within a region; availability sets protect against hardware faults and planned maintenance within a datacenter.

GRS and GZRS replicate asynchronously to a paired region; storage account failover can promote the secondary region if the primary is unavailable.

SQL auto-failover groups provide a listener endpoint and automatic regional failover; active geo-replication provides readable secondaries without automatic failover.

Cosmos DB multi-region writes require a conflict resolution policy; single-write multi-region accounts can fail over to another read region.

Site Recovery recovery plans group VMs and run scripts or manual actions in sequence during failover.

Availability sets use fault domains and update domains; availability zones distribute resources across physically separate datacenters for higher availability.

Azure Front Door is global HTTP/HTTPS layer 7 with CDN and WAF; Application Gateway is regional layer 7; Load Balancer is regional layer 4.

Traffic Manager routes by DNS and supports priority, weighted, performance, geographic, and multivalue routing methods.

Private endpoints assign a private IP to a PaaS service; service endpoints keep traffic on the Azure backbone but target the public endpoint.

ExpressRoute provides private dedicated connectivity; VPN Gateway provides encrypted internet connectivity; Virtual WAN centralizes branch and transit connectivity.

App Service deployment slots enable staged swaps with warm-up; autoscale uses metric or schedule rules to adjust instance counts.

AKS separates the managed control plane from node pools; cluster autoscaler scales nodes and horizontal pod autoscaler scales pods.

Choose Container Apps for serverless microservices with scale-to-zero; AKS for full Kubernetes control; ACI for simple isolated containers.

Event Grid routes discrete events; Event Hubs ingests high-throughput telemetry streams; Service Bus provides enterprise messaging with queues and topics.