Azure AZ-305 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Entra ID P2

Adds Privileged Identity Management, access reviews, entitlement management, and Identity Protection risk-based Conditional Access policies beyond P1 capabilities.

Azure RBAC scope

Role assignments apply at management group, subscription, resource group, or resource and are inherited downward; multiple allow assignments combine additively.

Azure Policy Deny effect

Blocks creation or update of noncompliant resources at deployment time; existing noncompliant resources are not remediated unless a remediation task is run.

System-assigned managed identity

Created with an Azure resource and deleted with it; credentials are managed by Azure and cannot be shared with another resource.

User-assigned managed identity

Standalone Azure identity that can be assigned to multiple resources and persists independently of any single resource lifecycle.

Diagnostic settings

Resource setting that sends platform logs and metrics to Log Analytics, storage accounts, Event Hubs, or partner monitoring solutions.

PIM activation

Just-in-time, time-bound role activation that can require approval, MFA, and justification; reduces standing privileged access.

B2B vs B2C

B2B invites external partners as guests into your tenant; B2C is a separate customer identity service for consumer-facing applications.

LRS

Storage replication keeping three synchronous copies within a single Azure datacenter, protecting against local hardware failure but not zone or region failure.

RA-GRS

Geo-redundant storage with read access to the secondary region; replication is asynchronous and secondary reads may lag.

Blob archive tier

Lowest-cost blob tier for rarely accessed data; objects must be rehydrated to hot or cool before they can be read.

Cosmos DB partition key

Defines logical partition placement; choose high cardinality and even distribution to avoid hot partitions and cross-partition queries.

Cosmos DB session consistency

Consistency level guaranteeing read-your-writes within a client session; default and common choice balancing consistency and performance.

Azure SQL vCore model

Purchasing model exposing compute, memory, and storage separately; supports Azure Hybrid Benefit and reserved capacity.

Private endpoint

Network interface with a private IP in your virtual network that connects privately to a PaaS service, removing public internet exposure.

Lifecycle management

Storage account rules that transition blobs between tiers or delete current blobs, previous versions, and snapshots based on age or conditions.

RTO

Recovery time objective: maximum acceptable time to restore service after disruption; drives failover automation and standby design.

RPO

Recovery point objective: maximum acceptable data loss measured in time; drives backup frequency and replication method.

Azure Backup vault

Vault type for newer workloads such as Azure blobs, managed disks, and PostgreSQL; distinct from Recovery Services vault.

Recovery Services vault

Vault used by Azure Backup for VMs, SQL Server, SAP HANA, and Azure Files, and by Site Recovery for replication.

Soft delete

Backup feature retaining deleted backup data for a configured period so accidental or malicious deletion can be reversed.

Site Recovery test failover

Non-disruptive validation of replication and recovery plans into an isolated network without affecting production or ongoing replication.

Auto-failover group

Azure SQL feature with a listener endpoint that automatically redirects connections to a secondary server or managed instance during regional outage.

Availability zone

Physically separate datacenter group within an Azure region with independent power, cooling, and networking; protects against datacenter failure.

Availability set

Groups VMs across fault domains and update domains to reduce simultaneous hardware failure and maintenance impact within a datacenter.

Azure Front Door

Global layer 7 HTTP/HTTPS routing service with CDN, WAF, TLS offload, and failover across regional backends.

Application Gateway

Regional layer 7 load balancer with URL routing, TLS termination, Web Application Firewall, and autoscaling capabilities.

Traffic Manager

DNS-based global traffic router supporting priority, weighted, performance, geographic, and multivalue routing methods.

Service endpoint

Extends virtual network identity to a PaaS service over the Azure backbone; the service still uses its public endpoint.

ExpressRoute

Private dedicated connection from on-premises to Azure through a connectivity provider, bypassing the public internet for predictable latency.

AKS cluster autoscaler

Adds or removes nodes in a node pool based on pending pod resource requests and configured minimum and maximum counts.

Event Hubs

High-throughput event ingestion service for telemetry streaming, supporting partitions, consumer groups, and retention periods.