Azure AZ-305 key terms

Microsoft's cloud-based identity and access management service. It stores users, groups, and app registrations, and issues tokens so people and applications can sign in to Azure, Microsoft 365, and custom apps.

A policy engine in Microsoft Entra ID that evaluates signals such as user, device, location, and app, then grants access, requires extra verification like MFA, or blocks the sign-in.

A Microsoft Entra ID feature that grants privileged roles only when needed, for a limited time and with approval or MFA, instead of leaving permanent administrator rights assigned.

An automatically created identity in Microsoft Entra ID that an Azure resource such as a virtual machine or function uses to obtain tokens, so code never stores credentials.

A role-based authorization system that grants principals permissions to Azure resources at a chosen scope: management group, subscription, resource group, or single resource. Roles combine actions, not-actions, and data actions.

A governance service that evaluates resources against rules and can deny, audit, or remediate noncompliant configurations, enforcing standards such as allowed regions or required tags across scopes.

A container that groups subscriptions so role assignments, policies, and budgets can be applied once and inherited by every subscription beneath it, forming a governance hierarchy.

A central store for log and metric data collected from Azure and hybrid resources, queried with KQL to build workbooks, alerts, and dashboards.

Configuration on a resource that sends its platform logs and metrics to destinations such as a Log Analytics workspace, a storage account, or an event hub.

A named set of notification and automation targets, such as email, SMS, webhook, function, or runbook, that an Azure Monitor alert invokes when it fires.

A top-level Azure resource that provides a unique namespace for blob, file, queue, and table data, and that defines redundancy, performance tier, and access settings.

A setting on blob data that trades storage price against access cost and latency: hot for frequent reads, cool and cold for infrequent data, and archive for long-term offline retention.

Rules on a storage account that automatically move blobs between access tiers or delete them based on age or last-modified conditions, lowering cost without manual work.

The replication option chosen for a storage account, such as locally redundant, zone redundant, geo-redundant, or geo-zone-redundant, plus read-access variants, determining durability and failure tolerance.

A signed token or URL that grants time-limited, scoped access to storage resources, such as a specific container or blob with specific permissions, without sharing account keys.

A property chosen when a container is created that hashes items into logical partitions, driving scale-out, query efficiency, and even data distribution. It cannot be changed later.

A setting that balances read freshness against latency and availability, ranging from strong through bounded staleness, session, consistent prefix, and eventual consistency.

A shared set of compute and storage resources for many Azure SQL databases that lets each draw capacity on demand, which suits workloads with varying usage across tenants or applications.

A storage account configuration with hierarchical namespace enabled, giving blob storage directory semantics and POSIX-style permissions for analytics engines such as Synapse and Databricks.

A managed in-memory data store used to speed up applications by caching frequently read data and holding session state, reducing load on backend databases.

The maximum acceptable time a workload can be unavailable after a disruption before business impact becomes unacceptable; it drives how quickly a recovery design must restore service.

The maximum acceptable amount of data loss measured in time. It determines how frequently backups or replication must occur to meet business requirements.

A grouping of virtual machines that Azure spreads across fault domains and update domains within one datacenter, protecting against hardware failure and planned maintenance.

A physically separate group of datacenters within an Azure region, with independent power, cooling, and networking, used to build highly available solutions across zones.

Two Azure regions in the same geography that Microsoft links for platform updates and, for some services, replication, so a broad regional outage can be recovered in the paired region.

A disaster recovery service that continuously replicates on-premises or Azure virtual machines to a target region and orchestrates failover and failback through tested recovery plans.

An Azure resource that stores backup and Site Recovery data, including recovery points, policies, and replication settings, for protected workloads.

A configuration that groups databases on a primary server with a secondary server in another region, providing automatic or manual failover and readable secondaries behind a listener endpoint.

A DNS-based global load balancer that routes users to the healthiest endpoint across regions using priority, weighted, performance, or geographic routing methods.

A logically isolated network in Azure that holds subnets and provides private IP addressing, routing, and connectivity for resources such as virtual machines and private endpoints.

A set of allow and deny rules applied to a subnet or network interface that filters inbound and outbound traffic by source, destination, port, and protocol.

A managed service that provides secure RDP and SSH access to virtual machines through the Azure portal over TLS, avoiding public IP addresses and open management ports.

A network interface in a subnet that connects privately to a PaaS or partner service, giving it a private IP address and removing exposure to the public internet.

A connection between two virtual networks that lets resources communicate using private IP addresses with low latency, without gateways or the public internet.

A network design where a central hub virtual network provides shared services such as firewalls and gateways, and spoke networks peer to it to isolate individual workloads.

A managed, stateful cloud firewall service that enforces rules for network, application, and NAT traffic across virtual networks and supports centralized policy in a hub.

A regional layer-7 load balancer for web traffic that offers URL-based routing, TLS termination, session affinity, and an optional web application firewall.

A global layer-7 entry point that routes users to the fastest healthy backend using anycast, adding caching, web application firewall, and TLS offload at the edge.

A private dedicated connection between on-premises networks and Azure that bypasses the public internet, offering predictable latency, higher bandwidth, and a connectivity SLA.

A group of identical virtual machines managed as one unit that can scale out or in automatically based on demand or schedule, with load balancing and configurable upgrade policies.