Identity, Governance & Monitoring
25-30%of exam
Data Storage
20-25%of exam
Business Continuity
15-20%of exam
Infrastructure
30-35%of exam
Quick Facts
- Exam
- AZ-305
- Credential
- Solutions Architect Expert
- Time
- 120 minutes
- Pass
- 700 of 1000
- Level
- Expert
- Skill
- Justify design choice
- Prereq
- AZ-104 for title only
- Blueprint
- April 17 2026
Governance Stack
MG -> Sub -> RG -> Resource
MG: policy scopeSub: billing boundaryRG: lifecycle bundleResource: single instance
Azure Policy vs RBAC
Azure Policy
- Enforces configuration rules
- Deny or audit
- Applies regardless of user
RBAC
- Grants user permissions
- Controls who can act
- Role assignments scoped
What vs who
Governance & Identity Picker
- Rules span many subscriptions→Management Group(Policy plus RBAC scope)
- Enforce resource configuration compliance→Azure Policy(Deny or audit)
- Prevent accidental resource deletion→Resource Lock(CanNotDelete or ReadOnly)
- Reduce standing admin access→PIM(Just-in-time role activation)
- Sync on-prem passwords simply→Password Hash Sync(Simplest hybrid option)
- Delegate auth to on-prem→Federation(Requires AD FS)
- Detect risky sign-in behavior→Identity Protection(Feeds Conditional Access)
- Guarantee tenant break-glass login→Emergency access account(Excluded from Conditional Access)
Entra ID & Access
- Entra ID
- Cloud identity provider
- SSO
- One sign-in everywhere
- MFA
- Extra verification factor
- Conditional Access
- Risk-based access policy
- Identity Protection
- Detects risky sign-ins
- PIM
- Just-in-time role activation
- B2B
- External guest collaboration
- Break-glass account
- Emergency admin access
Password Hash Sync vs Federation
Password Hash Sync
- Cloud validates hash
- Simplest to operate
- No on-prem dependency
Federation
- On-prem validates auth
- Requires AD FS
- More complex setup
Simple sync vs delegated auth
Hybrid Identity
- AD Connect
- Syncs on-prem accounts
- Password Hash Sync
- Cloud validates hash
- Pass-through Auth
- On-prem validates password
- Federation
- AD FS delegates auth
- Seamless SSO
- No extra prompt needed
- Cloud sync
- Lightweight multi-forest sync
Governance & Policy
- Management Group
- Groups subscriptions together
- Subscription
- Billing and access boundary
- RBAC
- Who can act
- Azure Policy
- What configs are allowed
- Initiative
- Bundles multiple policies together
- Deny effect
- Blocks noncompliant resources
- Audit effect
- Flags noncompliant resources
- Resource Lock
- Blocks delete or edit
- Landing zone
- Governed subscription template
- Tags
- Cost and owner metadata
Monitoring & Observability
- Azure Monitor
- Metrics and logs platform
- Metrics
- Near real-time numeric data
- Log Analytics
- KQL log queries
- App Insights
- Application code telemetry
- Service Health
- Azure-side incidents and maintenance
- Alert rule
- Threshold triggers an action
- Action group
- Notifies or automates response
- Workbook
- Custom monitoring report view
Storage Redundancy Ladder
LRS < ZRS < GRS < GZRS
LRS: one datacenterZRS: zone spreadGRS: paired regionGZRS: zone plus geo
SQL Database vs SQL MI
SQL Database
- PaaS single database
- No instance features
- Elastic pools available
SQL Managed Instance
- Near-full SQL compatibility
- Cross-database queries work
- Linked servers supported
PaaS scope vs instance scope
Storage & Database Picker
- Need SMB or NFS share→Azure Files(Lift-and-shift friendly)
- Need simple object storage→Blob Storage(REST/SDK access)
- Need full SQL Server compatibility→SQL Managed Instance(Cross-database queries)
- Need PaaS single database→SQL Database(No instance features)
- Need global NoSQL scale→Cosmos DB(Design partition key)
- Need automatic failover endpoint→Failover Group(Listener stays same)
- Need survive datacenter loss→ZRS(Same-region zones)
- Need survive region loss→GRS or GZRS(Paired region copy)
Storage Redundancy
- LRS
- Three copies one datacenter
- ZRS
- Copies spread across zones
- GRS
- Async copy paired region
- RA-GRS
- GRS plus readable secondary
- GZRS
- Zone plus geo redundancy
- Paired region
- Microsoft's designated DR partner
Access Tier Ladder
Hot -> Cool -> Cold -> Archive
Hot: frequent accessCool: monthly accessCold: rare accessArchive: hours to retrieve
Blob & Files
- Hot tier
- Frequent access, higher cost
- Cool tier
- Infrequent access, lower storage cost
- Archive tier
- Rarely accessed, hours to retrieve
- Lifecycle policy
- Automates tier transitions
- Azure Files
- SMB and NFS shares
- Immutable storage
- Write-once-read-many compliance lock
- Legal hold
- Blocks deletion indefinitely
Databases
- SQL Database
- PaaS single database
- SQL Managed Instance
- Near-full SQL Server compatibility
- Elastic pool
- Shared DTUs many databases
- Failover group
- Automatic failover, same endpoint
- Active geo-replication
- Manual failover, four replicas
- Cosmos DB
- Globally distributed NoSQL database
- Partition key
- Distributes reads and writes
- Consistency level
- Trades consistency for latency
Data Protection
- Key Vault
- Stores secrets and keys
- TDE
- Encrypts data at rest
- Always Encrypted
- Encrypts data in memory
- Purview
- Data governance and catalog
- Private endpoint
- Private IP inside VNet
- Service endpoint
- Public IP, VNet restricted
RTO vs RPO
RPO=data lost | RTO=time down
RPO: backup age limitRTO: restore speed limit
Availability Zones vs Sets
Availability Zones
- Separate datacenters
- 99.99% SLA
- Region-wide spread
Availability Sets
- Fault and update domains
- 99.95% SLA
- Single datacenter only
Datacenter vs rack failure
BCDR & Monitoring Picker
- Protect against data loss→Azure Backup(Point-in-time restore)
- Protect against region outage→Site Recovery(Replicated failover VMs)
- Need 99.99% VM SLA→Availability Zones(Cross-datacenter spread)
- Need 99.95% VM SLA→Availability Sets(Fault and update domains)
- Track Azure-side incidents→Service Health(Maintenance and outages)
- Track your own metrics→Azure Monitor(Threshold alerting)
- Query logs across resources→Log Analytics(KQL queries)
- Trace application dependencies deeply→App Insights(Distributed tracing)
BCDR Core
- RTO
- Maximum acceptable downtime window
- RPO
- Maximum acceptable data loss
- Azure Backup
- Point-in-time data recovery
- Site Recovery
- Replicates VMs for failover
- Soft delete
- Keeps deleted backups recoverable
- Immutable vault
- Blocks retention setting changes
HA SLA Numbers
Zones 99.99% | Sets 99.95%
Zones: separate datacentersSets: fault domainsStandard LB: zone redundant
Azure Backup vs Site Recovery
Azure Backup
- Protects against data loss
- Point-in-time restore
- Ransomware recovery option
Site Recovery
- Protects against site loss
- Replicated failover VM
- Regional DR failover
Data loss vs site loss
High Availability
- Availability Zone
- Separate datacenters, 99.99% SLA
- Availability Set
- Fault and update domains
- Standard Load Balancer
- Zone-aware, secure by default
- Active-active
- Two regions live simultaneously
- Active-passive
- Standby region scales up
- Update domain
- Rolling maintenance grouping unit
VNet Peering vs VPN Gateway
VNet Peering
- No built-in encryption
- No gateway cost
- Backbone routing only
VPN Gateway
- Encrypted tunnel
- Gateway required
- Supports transitive routing
Fast link vs encrypted link
Network Connectivity Picker
- Need OS-level VM control→VM(IaaS full control)
- Need full Kubernetes control→AKS(Ops overhead)
- Need serverless containers→Container Apps(No cluster management)
- Need private PaaS access→Private Link(No public exposure)
- Need encrypted internet link→VPN Gateway(Site-to-site)
- Need private dedicated circuit→ExpressRoute(Predictable latency)
- Need global HTTP routing→Front Door(Anycast edge network)
- Need regional L7 plus WAF→App Gateway(Regional ingress control)
Networking Core
- VNet
- Private isolated network boundary
- Subnet
- Segment within a VNet
- VNet peering
- Backbone link, no encryption
- VPN Gateway
- Encrypted internet site connection
- ExpressRoute
- Private dedicated network circuit
- NSG
- Stateless subnet packet filter
- Azure Firewall
- Stateful managed egress control
- Private Link
- Private IP for PaaS
- Hub-spoke
- Central shared-services network topology
- Bastion
- Browser RDP and SSH access
VPN Gateway vs ExpressRoute
VPN Gateway
- Public internet path
- IPsec encryption
- Lower cost
ExpressRoute
- Private dedicated circuit
- No internet path
- Predictable latency
Internet vs dedicated circuit
Load Balancing & Front End
- Load Balancer
- Layer 4 TCP/UDP routing
- App Gateway
- Layer 7, regional plus WAF
- Front Door
- Global anycast layer 7
- Traffic Manager
- DNS-only global routing
- WAF
- Blocks common web attacks
NSG vs Azure Firewall
NSG
- Stateless packet filter
- Subnet or NIC level
- Simple 5-tuple rules
Azure Firewall
- Stateful managed service
- FQDN filtering
- Centralized hub logging
Basic vs centralized control
Compute & Containers
- VM
- Full control over OS
- VMSS
- Identical VMs that autoscale
- App Service
- Managed web and API PaaS
- AKS
- Full Kubernetes cluster control
- Container Apps
- Serverless, Kubernetes-based containers
- ACI
- Quick single container instance
- Functions Consumption
- Scales to zero, billed per-use
- Functions Premium
- Pre-warmed, no cold start
Load Balancer vs App Gateway
Load Balancer
- Layer 4 routing
- TCP and UDP
- No content awareness
App Gateway
- Layer 7 routing
- HTTP-aware routing
- Includes a WAF
Transport vs application layer
Messaging & Integration
- Service Bus
- Reliable ordered enterprise messaging
- Event Grid
- Reactive pub/sub event routing
- Event Hubs
- High-throughput telemetry event streaming
- Logic Apps
- Low-code workflow integration
- Redis Cache
- In-memory read-heavy offload
Front Door vs Traffic Manager
Front Door
- Proxies HTTP traffic
- SSL offload included
- Edge caching available
Traffic Manager
- DNS-only routing
- Works any protocol
- No data path
Proxy vs DNS routing
Common Traps
Policy vs RBAC
Policy enforces configuration ≠ RBAC grants user actions
Backup vs Site Recovery
Backup restores lost data ≠ Recovery fails over sites
Zones vs Sets
Zones span datacenters ≠ Sets span fault domains
Peering vs VPN
Peering has no encryption ≠ VPN encrypts all traffic
SQL DB vs SQL MI
Database is PaaS-scoped only ≠ Instance supports cross-database queries
Metrics vs Logs
Metrics are numeric alerts ≠ Logs are queried events
Private vs Service Endpoint
Endpoint gets a private IP ≠ Service endpoint keeps public IP
PHS vs PTA
PHS syncs a hash copy ≠ PTA checks on-prem live
Last Minute
- 1.Infrastructure domain weighs most: 30-35%
- 2.AZ-104 needed only for Expert title
- 3.Passing score is 700 of 1000
- 4.RPO measures data loss window
- 5.RTO measures downtime restore window
- 6.Policy enforces rules; RBAC grants actions
- 7.Zones give 99.99% VM uptime SLA
- 8.ExpressRoute is private; VPN encrypts internet
- 9.Choose SQL MI for cross-database queries
- 10.Private endpoints remove public internet exposure
- 11.PIM grants just-in-time privileged role access
- 12.GRS survives regional loss, not local
Buy on Amazon
Learning path on PluralsightSame family resources
Explore More Microsoft Azure Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
VideoAI-900 Exam Guide 2026: FREE Azure AI Fundamentals Study PlanVideoAZ-104 Study Guide 2026: Pass the Azure Administrator ExamVideoAZ-500 Exam Guide 2026: Free Azure Security Prep Before RetirementVideoAZ-900 Exam Guide 2026: Pass Azure Fundamentals Free (Complete Study Plan)ArticleAzure vs AWS Certification 2026: Which Cloud Cert Should You Get First?18 min readArticleAZ-104 Study Guide 2026: Pass the Azure Administrator Exam19 min readArticleFREE AZ-700 Exam Guide 2026: 5 Domains, $165, Pass Score 700/100017 min readArticleFREE DP-300 Exam Guide 2026: 5-Domain Skills Outline + Pass on First Try16 min read