Free AZ-305 Exam Flashcards

Management groups sit above subscriptions in the hierarchy and let you apply Azure Policy and RBAC consistently across many subscriptions at once. Subscriptions remain the billing and resource boundary. Use management groups when governance rules must span multiple subscriptions the same way.

RBAC controls WHO can perform WHAT actions on resources (access control). Azure Policy controls WHAT configurations are allowed regardless of who is acting (e.g., enforcing allowed regions or SKUs). A complete governance design uses both together, not one instead of the other.

Deny blocks a non-compliant resource from being created or updated at all. Audit lets the action proceed but flags it as non-compliant in reporting. Use Audit first to see impact, then switch to Deny once you're confident it won't break legitimate deployments.

Grants just-in-time, time-bound activation of privileged roles instead of standing (always-on) access, with approval workflows and periodic access reviews. This shrinks the attack surface of admin accounts compared to permanently assigned roles.

Conditional Access enforces policies (require MFA, block by location, require compliant device) based on defined conditions. Identity Protection detects risk signals (leaked credentials, atypical travel) and can feed that risk score into Conditional Access to trigger an automatic response.

Password Hash Sync (PHS) syncs a hash of the on-prem password hash to Microsoft Entra ID for the simplest cloud sign-in. Pass-through Authentication validates the password against on-prem AD in real time without storing hashes in the cloud. Federation (AD FS) delegates authentication entirely to an on-prem identity provider. Complexity and control both increase down that list.

Cloud-only admin accounts kept explicitly excluded from every Conditional Access and MFA policy, so the organization is never locked out of Microsoft Entra ID if MFA or on-prem federation fails. Their credentials and sign-ins must be monitored closely since they bypass normal controls.

Vault access policies grant permissions at the whole-vault level with limited granularity. Azure RBAC on Key Vault allows scoped permissions down to individual keys, secrets, or certificates and integrates with the standard Entra ID role model. Microsoft recommends RBAC for new designs.

Consistent tags (cost center, environment, owner) enable chargeback, automation, and Policy targeting. Without an Azure Policy that enforces required tags, tagging discipline erodes as the estate grows, breaking cost reports and automated governance that depend on those tags.

Metrics are lightweight, near-real-time numeric time series, best for threshold alerting (e.g., CPU%). Logs, queried in Log Analytics with KQL, are structured event data better suited to deep diagnostics and correlating activity across many resources. Design alerting on metrics and root-cause investigation on logs.

One centralized workspace simplifies cross-resource KQL queries and alerting but mixes data-ownership and access boundaries. Separate per-team or per-subscription workspaces isolate access and cost but complicate cross-cutting queries. Choose based on RBAC and data-residency needs, not convenience alone.

Application Insights instruments application code for distributed tracing, dependency maps, and exception telemetry. Platform-level Azure Monitor metrics and logs cover the infrastructure the app runs on. A complete design needs both to tell whether a problem is in the code or the platform.

Service Health reports Microsoft-side incidents, planned maintenance, and health advisories affecting the Azure services in your subscriptions. Monitor alerts fire on your own resource metrics and logs. Wire both into the same action group so you can distinguish 'my app broke' from 'Azure broke'.

Tiers trade storage cost against access/retrieval cost and latency: Hot for frequent access, Cool/Cold for infrequent access with minimum-duration charges, Archive for rarely accessed data with retrieval taking hours. Lifecycle management policies can automate tier transitions based on last-access age.

LRS keeps 3 copies in one datacenter (cheapest, no datacenter-failure protection). ZRS spreads copies across availability zones in one region (survives a datacenter outage). GRS asynchronously replicates to a paired region (survives a regional outage, secondary not readable until failover). RA-GRS adds read access to that secondary at any time.

Azure Files exposes SMB/NFS file shares that can be mounted like a traditional file server, which is friendly to lift-and-shift apps. Blob Storage is object storage accessed via REST/SDK and isn't natively mountable as a drive without extra tooling. Pick Files whenever an app expects a real file system.

GRS and GZRS replicate to a Microsoft-paired region that can sit in a different jurisdiction. When regulation requires data to stay in-country, restrict the account to LRS or ZRS within that single region rather than defaulting to geo-redundant options for 'extra safety'.

Standard SSD suits general-purpose or dev/test workloads. Premium SSD targets production VMs needing consistent low latency. Ultra Disk offers independently configurable IOPS and throughput for the most demanding workloads (e.g., SAP HANA) but has tighter region and VM-size availability constraints.

Time-based retention or legal-hold policies make blobs Write-Once-Read-Many, so data can't be modified or deleted by anyone, including the account owner, until the retention period expires. This is a regulatory/compliance-archiving control, distinct from ordinary backup.

A private endpoint gives the storage account a private IP inside your VNet, removing it from the public internet path entirely. A service endpoint keeps the account's public IP but routes traffic over the Azure backbone and restricts access by VNet/subnet. Private endpoints give the stronger isolation and support on-prem access over VPN/ExpressRoute.

SQL Database is a PaaS single-database/elastic-pool service without full SQL Server instance surface area (no cross-database queries, no SQL Agent). Managed Instance offers near-complete SQL Server compatibility (cross-db queries, linked servers, SQL Agent), which lift-and-shift migrations needing instance-scoped features require.

Failover groups add automatic failover behind a listener endpoint, so the application's connection string doesn't change after failover. Active geo-replication gives up to 4 readable secondaries but requires manual failover and updating the app's endpoint yourself. Prefer failover groups when failover must be automatic.

Five levels trade consistency for latency/throughput, from strongest to weakest: Strong, Bounded Staleness, Session (default, consistent within one client session), Consistent Prefix, and Eventual. Pick the weakest level the application can tolerate to maximize performance and reduce cost.

A well-chosen partition key spreads reads and writes evenly and keeps related data together to avoid cross-partition queries. A poorly chosen key (low cardinality or 'hot' values) causes throttling on specific partitions no matter how much throughput (RU/s) is provisioned overall.

TDE encrypts the database at rest, so storage and backup files are unreadable outside SQL Server, but data is decrypted for any authorized query. Always Encrypted keeps sensitive columns encrypted even in memory and query results, so not even a DBA with full server access sees plaintext.

RPO is the maximum acceptable data loss, measured in time — how far back your last good backup or replica sits. RTO is the maximum acceptable downtime to restore service. A design can have a good RPO (frequent backups) but a bad RTO (slow restore process), so size each independently.

Availability Zones spread VMs across physically separate datacenters within a region, protecting against datacenter-level failure with a 99.99% SLA. Availability Sets spread VMs across fault/update domains inside a single datacenter, protecting only against rack or host failure with a 99.95% SLA.

ASR continuously replicates VM disk writes to a target region or on-prem site asynchronously, giving a regional failover a small RPO (seconds to minutes) without running duplicate compute in the target region until failover is actually triggered — far cheaper than an always-on active-active design.

Azure Backup protects against DATA loss, corruption, or ransomware by retaining point-in-time recoverable copies. Azure Site Recovery protects against SITE or region unavailability by keeping a replicated, failover-ready copy of the whole VM. A complete BC/DR design typically needs both, not one instead of the other.

Standard Load Balancer supports Availability Zones (zone-redundant or zonal frontends) and is secure-by-default, blocking traffic unless an NSG explicitly allows it. Basic Load Balancer has no zone awareness or SLA and is being retired, so new HA designs should always specify Standard.

Soft-delete retains deleted backup data for a recovery window even if an attacker or admin deletes it. Combined with immutable vault settings that block disabling soft-delete or shortening retention, this stops backups from being wiped out as part of a ransomware attack on the account.

Azure sequences platform updates so paired regions are never updated at the same time, and prioritizes recovery of one region in a pair during a broad outage. That's a reason to target a paired region for GRS or ASR rather than an arbitrary secondary region.

Active-active runs full production capacity in two regions simultaneously for near-zero RTO/RPO, at roughly double the cost and with data-sync/conflict handling to design for. Active-passive keeps a scaled-down or cold standby region to cut cost, accepting a longer RTO while it scales up during failover.

VNet peering connects two VNets over the Microsoft backbone with low latency and no gateway charge, but no built-in encryption and no transitive routing by default. A VPN Gateway (or Virtual WAN) encrypts traffic and can support hub-spoke transitive routing, at added cost and latency.

A VPN Gateway connects over the public internet with IPsec encryption at lower, variable-latency cost. ExpressRoute is a private, dedicated connection through a connectivity provider offering higher, more predictable bandwidth and latency without traversing the public internet — the standard for enterprise hybrid connectivity at scale.

NSGs are stateless 5-tuple packet filters applied at the subnet or NIC level — cheap, basic segmentation. Azure Firewall is a stateful, managed service supporting FQDN filtering, threat intelligence, and centralized logging from a hub VNet. Use NSGs for baseline micro-segmentation and Firewall for centralized, application-aware egress control.

A central hub VNet hosts shared services (firewall, VPN/ExpressRoute gateway, DNS) that spoke VNets peer into, so individual spokes don't each need their own gateway. This centralizes cost, security policy, and connectivity management as the number of workloads grows.

Front Door is a global, Anycast-based Layer 7 load balancer and CDN that routes users to the closest healthy regional backend, suited to multi-region web apps. Application Gateway is a regional Layer 7 load balancer with a Web Application Firewall for traffic within one region. Use Front Door for global routing, App Gateway for regional ingress and WAF.

Azure Load Balancer distributes TCP/UDP traffic based on IP and port with no awareness of HTTP content. Application Gateway inspects HTTP(S) requests, can route by URL path or host header, terminates SSL, and adds a WAF. Choose Layer 7 whenever routing decisions depend on request content, not just the port.

Traffic Manager is DNS-based global routing — the client resolves directly to an endpoint IP, so it works for non-HTTP protocols and Microsoft never sees the data path. Front Door proxies actual HTTP(S) traffic through Microsoft's edge, enabling SSL offload, WAF, and caching that DNS-only routing can't provide.

A private endpoint gives a PaaS service (SQL, Storage, Key Vault, etc.) a private IP inside your VNet so traffic never leaves the Microsoft backbone, and the public endpoint can be disabled entirely. IP-firewall rules on a public endpoint still expose the service to the internet, just restricted by source IP — weaker isolation than Private Link.

Provides browser-based RDP/SSH to VMs over TLS through the Azure portal, without exposing VMs' RDP/SSH ports to the public internet or requiring a jump-box VM you must patch yourself. Removes a common attack surface from VNet design.

Services like Azure Firewall, Application Gateway, and VPN/ExpressRoute Gateway each require their own dedicated subnet, some with mandated names (e.g., AzureFirewallSubnet, GatewaySubnet). Subnet design must reserve these upfront since they can't share space with VM subnets or be renamed easily after deployment.

The App Service Plan tier (Basic/Standard/Premium/Isolated) determines available features — custom domains, staging slots, VNet integration, autoscale — and is the compute SKU shared by every app hosted on that plan. Scaling out adds instances behind a built-in load balancer; scaling up changes the SKU for more CPU/RAM per instance.

The system node pool runs required Kubernetes system pods (CoreDNS, metrics-server, etc.) and should be kept isolated from application workloads. User node pools run application pods and can use different VM sizes, such as GPU nodes, or scale independently — separating them protects cluster stability from noisy applications.

Consumption scales to zero and bills per execution, but has cold-start latency and a default 5-10 minute timeout. Premium keeps pre-warmed instances (no cold start) and allows VNet integration with longer timeouts. Dedicated runs on an App Service plan's always-on VMs you already pay for. Choose based on latency sensitivity and spare capacity.

VMSS manages a group of identical VMs as one unit with built-in autoscale rules and safely-orchestrated OS-image rollouts. Manually provisioned VMs behind a load balancer require you to build your own scaling and update orchestration. VMSS is the standard choice whenever a workload needs elastic scale.

Service Bus is a message broker for reliable, ordered, transactional enterprise messaging with queues/topics and dead-lettering. Event Grid is a lightweight, reactive pub/sub service for discrete event notifications (e.g., 'blob created') fanned out to many subscribers. Event Hubs is a high-throughput streaming pipeline for telemetry-scale event ingestion. Match the service to guaranteed delivery, reactive notification, or firehose streaming.

Placing a managed Redis cache in front of a database offloads repeated read queries and session-state storage to sub-millisecond in-memory access, cutting database load and latency. It also introduces a cache-invalidation problem — stale data — that the architecture must explicitly handle.

Container Apps is a serverless container platform (built on Kubernetes and KEDA under the hood) for microservices and event-driven apps without managing cluster infrastructure or the Kubernetes API. AKS gives full Kubernetes control — custom controllers, node-level configuration, CNI choice — at the cost of operating the cluster yourself. Pick Container Apps for Kubernetes-style scaling without the operational burden.