ExamFinch.com My Study

Cheat sheet

Azure AZ-305 Cheat Sheet

Practice this exam

Identity, Governance & Monitoring

  • 25-30% of exam
  • Entra ID & Access Hybrid Identity Governance & Policy Monitoring & Observability Policy vs RBAC

Data Storage

  • 20-25% of exam
  • Storage Redundancy Blob & Files Databases Data Protection SQL DB vs SQL MI

Business Continuity

  • 15-20% of exam
  • BCDR Core High Availability RTO vs RPO Zones vs Sets

Infrastructure

  • 30-35% of exam
  • Networking Core Load Balancing & Front End Compute & Containers Messaging & Integration VPN vs ExpressRoute

Quick Facts

  • Exam AZ-305
  • Credential Solutions Architect Expert
  • Time 120 minutes
  • Pass 700 of 1000
  • Level Expert
  • Skill Justify design choice
  • Prereq AZ-104 for title only
  • Blueprint April 17 2026

Governance Stack ID

  • MG -> Sub -> RG -> Resource
  • MG: policy scope Sub: billing boundary RG: lifecycle bundle Resource: single instance

Azure Policy vs RBAC ID

Azure Policy

  • Enforces configuration rules
  • Deny or audit
  • Applies regardless of user

RBAC

  • Grants user permissions
  • Controls who can act
  • Role assignments scoped
  • What vs who

Governance & Identity Picker ID

  • Rules span many subscriptions → Management Group ( Policy plus RBAC scope )
  • Enforce resource configuration compliance → Azure Policy ( Deny or audit )
  • Prevent accidental resource deletion → Resource Lock ( CanNotDelete or ReadOnly )
  • Reduce standing admin access → PIM ( Just-in-time role activation )
  • Sync on-prem passwords simply → Password Hash Sync ( Simplest hybrid option )
  • Delegate auth to on-prem → Federation ( Requires AD FS )
  • Detect risky sign-in behavior → Identity Protection ( Feeds Conditional Access )
  • Guarantee tenant break-glass login → Emergency access account ( Excluded from Conditional Access )

Entra ID & Access ID

  • Entra ID Cloud identity provider
  • SSO One sign-in everywhere
  • MFA Extra verification factor
  • Conditional Access Risk-based access policy
  • Identity Protection Detects risky sign-ins
  • PIM Just-in-time role activation
  • B2B External guest collaboration
  • Break-glass account Emergency admin access

Hybrid Identity Menu ID

  • PHS simple | PTA live | Federation full
  • PHS: syncs hash copy PTA: checks on-prem live Federation: delegates to AD FS

Password Hash Sync vs Federation ID

Password Hash Sync

  • Cloud validates hash
  • Simplest to operate
  • No on-prem dependency

Federation

  • On-prem validates auth
  • Requires AD FS
  • More complex setup
  • Simple sync vs delegated auth

Hybrid Identity ID

  • AD Connect Syncs on-prem accounts
  • Password Hash Sync Cloud validates hash
  • Pass-through Auth On-prem validates password
  • Federation AD FS delegates auth
  • Seamless SSO No extra prompt needed
  • Cloud sync Lightweight multi-forest sync

Governance & Policy ID

  • Management Group Groups subscriptions together
  • Subscription Billing and access boundary
  • RBAC Who can act
  • Azure Policy What configs are allowed
  • Initiative Bundles multiple policies together
  • Deny effect Blocks noncompliant resources
  • Audit effect Flags noncompliant resources
  • Resource Lock Blocks delete or edit
  • Landing zone Governed subscription template
  • Tags Cost and owner metadata

Monitoring & Observability ID

  • Azure Monitor Metrics and logs platform
  • Metrics Near real-time numeric data
  • Log Analytics KQL log queries
  • App Insights Application code telemetry
  • Service Health Azure-side incidents and maintenance
  • Alert rule Threshold triggers an action
  • Action group Notifies or automates response
  • Workbook Custom monitoring report view

Storage Redundancy Ladder DA

  • LRS < ZRS < GRS < GZRS
  • LRS: one datacenter ZRS: zone spread GRS: paired region GZRS: zone plus geo

SQL Database vs SQL MI DA

SQL Database

  • PaaS single database
  • No instance features
  • Elastic pools available

SQL Managed Instance

  • Near-full SQL compatibility
  • Cross-database queries work
  • Linked servers supported
  • PaaS scope vs instance scope

Storage & Database Picker DA

  • Need SMB or NFS share → Azure Files ( Lift-and-shift friendly )
  • Need simple object storage → Blob Storage ( REST/SDK access )
  • Need full SQL Server compatibility → SQL Managed Instance ( Cross-database queries )
  • Need PaaS single database → SQL Database ( No instance features )
  • Need global NoSQL scale → Cosmos DB ( Design partition key )
  • Need automatic failover endpoint → Failover Group ( Listener stays same )
  • Need survive datacenter loss → ZRS ( Same-region zones )
  • Need survive region loss → GRS or GZRS ( Paired region copy )

Storage Redundancy DA

  • LRS Three copies one datacenter
  • ZRS Copies spread across zones
  • GRS Async copy paired region
  • RA-GRS GRS plus readable secondary
  • GZRS Zone plus geo redundancy
  • Paired region Microsoft's designated DR partner

Access Tier Ladder DA

  • Hot -> Cool -> Cold -> Archive
  • Hot: frequent access Cool: monthly access Cold: rare access Archive: hours to retrieve

Blob & Files DA

  • Hot tier Frequent access, higher cost
  • Cool tier Infrequent access, lower storage cost
  • Archive tier Rarely accessed, hours to retrieve
  • Lifecycle policy Automates tier transitions
  • Azure Files SMB and NFS shares
  • Immutable storage Write-once-read-many compliance lock
  • Legal hold Blocks deletion indefinitely

Databases DA

  • SQL Database PaaS single database
  • SQL Managed Instance Near-full SQL Server compatibility
  • Elastic pool Shared DTUs many databases
  • Failover group Automatic failover, same endpoint
  • Active geo-replication Manual failover, four replicas
  • Cosmos DB Globally distributed NoSQL database
  • Partition key Distributes reads and writes
  • Consistency level Trades consistency for latency

Data Protection DA

  • Key Vault Stores secrets and keys
  • TDE Encrypts data at rest
  • Always Encrypted Encrypts data in memory
  • Purview Data governance and catalog
  • Private endpoint Private IP inside VNet
  • Service endpoint Public IP, VNet restricted

RTO vs RPO BU

  • RPO=data lost | RTO=time down
  • RPO: backup age limit RTO: restore speed limit

Availability Zones vs Sets BU

Availability Zones

  • Separate datacenters
  • 99.99% SLA
  • Region-wide spread

Availability Sets

  • Fault and update domains
  • 99.95% SLA
  • Single datacenter only
  • Datacenter vs rack failure

BCDR & Monitoring Picker BU

  • Protect against data loss → Azure Backup ( Point-in-time restore )
  • Protect against region outage → Site Recovery ( Replicated failover VMs )
  • Need 99.99% VM SLA → Availability Zones ( Cross-datacenter spread )
  • Need 99.95% VM SLA → Availability Sets ( Fault and update domains )
  • Track Azure-side incidents → Service Health ( Maintenance and outages )
  • Track your own metrics → Azure Monitor ( Threshold alerting )
  • Query logs across resources → Log Analytics ( KQL queries )
  • Trace application dependencies deeply → App Insights ( Distributed tracing )

BCDR Core BU

  • RTO Maximum acceptable downtime window
  • RPO Maximum acceptable data loss
  • Azure Backup Point-in-time data recovery
  • Site Recovery Replicates VMs for failover
  • Soft delete Keeps deleted backups recoverable
  • Immutable vault Blocks retention setting changes

HA SLA Numbers BU

  • Zones 99.99% | Sets 99.95%
  • Zones: separate datacenters Sets: fault domains Standard LB: zone redundant

Azure Backup vs Site Recovery BU

Azure Backup

  • Protects against data loss
  • Point-in-time restore
  • Ransomware recovery option

Site Recovery

  • Protects against site loss
  • Replicated failover VM
  • Regional DR failover
  • Data loss vs site loss

High Availability BU

  • Availability Zone Separate datacenters, 99.99% SLA
  • Availability Set Fault and update domains
  • Standard Load Balancer Zone-aware, secure by default
  • Active-active Two regions live simultaneously
  • Active-passive Standby region scales up
  • Update domain Rolling maintenance grouping unit

VNet Peering vs VPN Gateway IN

VNet Peering

  • No built-in encryption
  • No gateway cost
  • Backbone routing only

VPN Gateway

  • Encrypted tunnel
  • Gateway required
  • Supports transitive routing
  • Fast link vs encrypted link

Network Connectivity Picker IN

  • Need OS-level VM control → VM ( IaaS full control )
  • Need full Kubernetes control → AKS ( Ops overhead )
  • Need serverless containers → Container Apps ( No cluster management )
  • Need private PaaS access → Private Link ( No public exposure )
  • Need encrypted internet link → VPN Gateway ( Site-to-site )
  • Need private dedicated circuit → ExpressRoute ( Predictable latency )
  • Need global HTTP routing → Front Door ( Anycast edge network )
  • Need regional L7 plus WAF → App Gateway ( Regional ingress control )

Networking Core IN

  • VNet Private isolated network boundary
  • Subnet Segment within a VNet
  • VNet peering Backbone link, no encryption
  • VPN Gateway Encrypted internet site connection
  • ExpressRoute Private dedicated network circuit
  • NSG Stateless subnet packet filter
  • Azure Firewall Stateful managed egress control
  • Private Link Private IP for PaaS
  • Hub-spoke Central shared-services network topology
  • Bastion Browser RDP and SSH access

VPN Gateway vs ExpressRoute IN

VPN Gateway

  • Public internet path
  • IPsec encryption
  • Lower cost

ExpressRoute

  • Private dedicated circuit
  • No internet path
  • Predictable latency
  • Internet vs dedicated circuit

Load Balancing & Front End IN

  • Load Balancer Layer 4 TCP/UDP routing
  • App Gateway Layer 7, regional plus WAF
  • Front Door Global anycast layer 7
  • Traffic Manager DNS-only global routing
  • WAF Blocks common web attacks

NSG vs Azure Firewall IN

NSG

  • Stateless packet filter
  • Subnet or NIC level
  • Simple 5-tuple rules

Azure Firewall

  • Stateful managed service
  • FQDN filtering
  • Centralized hub logging
  • Basic vs centralized control

Compute & Containers IN

  • VM Full control over OS
  • VMSS Identical VMs that autoscale
  • App Service Managed web and API PaaS
  • AKS Full Kubernetes cluster control
  • Container Apps Serverless, Kubernetes-based containers
  • ACI Quick single container instance
  • Functions Consumption Scales to zero, billed per-use
  • Functions Premium Pre-warmed, no cold start

Load Balancer vs App Gateway IN

Load Balancer

  • Layer 4 routing
  • TCP and UDP
  • No content awareness

App Gateway

  • Layer 7 routing
  • HTTP-aware routing
  • Includes a WAF
  • Transport vs application layer

Messaging & Integration IN

  • Service Bus Reliable ordered enterprise messaging
  • Event Grid Reactive pub/sub event routing
  • Event Hubs High-throughput telemetry event streaming
  • Logic Apps Low-code workflow integration
  • Redis Cache In-memory read-heavy offload

Front Door vs Traffic Manager IN

Front Door

  • Proxies HTTP traffic
  • SSL offload included
  • Edge caching available

Traffic Manager

  • DNS-only routing
  • Works any protocol
  • No data path
  • Proxy vs DNS routing

Common Traps

Policy vs RBAC

  • Policy enforces configuration ≠ RBAC grants user actions

Backup vs Site Recovery

  • Backup restores lost data ≠ Recovery fails over sites

Zones vs Sets

  • Zones span datacenters ≠ Sets span fault domains

Peering vs VPN

  • Peering has no encryption ≠ VPN encrypts all traffic

SQL DB vs SQL MI

  • Database is PaaS-scoped only ≠ Instance supports cross-database queries

Metrics vs Logs

  • Metrics are numeric alerts ≠ Logs are queried events

Private vs Service Endpoint

  • Endpoint gets a private IP ≠ Service endpoint keeps public IP

PHS vs PTA

  • PHS syncs a hash copy ≠ PTA checks on-prem live

Last Minute

  • 1. Infrastructure domain weighs most: 30-35%
  • 2. AZ-104 needed only for Expert title
  • 3. Passing score is 700 of 1000
  • 4. RPO measures data loss window
  • 5. RTO measures downtime restore window
  • 6. Policy enforces rules; RBAC grants actions
  • 7. Zones give 99.99% VM uptime SLA
  • 8. ExpressRoute is private; VPN encrypts internet
  • 9. Choose SQL MI for cross-database queries
  • 10. Private endpoints remove public internet exposure
  • 11. PIM grants just-in-time privileged role access
  • 12. GRS survives regional loss, not local

Azure AZ-305

  • Practice Questions 180 questions Study Guide 56 topics Cheat Sheet 99 facts Flashcards 50 cards Shorts 2 short s Blogs 1 blog Free CE Podcast