14.2 Common AZ-305 Decision Traps
Key Takeaways
- AZ-305 wrong answers are almost always technically real services — the differentiator is one specific word in the scenario stem, not whether the service exists.
- VPN Gateway vs. ExpressRoute vs. VNet Peering hinges on whether the stem requires a bandwidth SLA/dedicated circuit versus simple encrypted or backbone connectivity.
- SQL Managed Instance vs. Azure SQL Database vs. Cosmos DB hinges on instance-level compatibility needs versus PaaS simplicity versus global distribution.
- Storage redundancy (LRS/ZRS/GRS/RA-GRS/GZRS) hinges on whether the failure scope is hardware, datacenter/zone, or full region, and whether secondary read access is required.
- Build a signal-word reflex for the recurring trap pairs (Policy vs. RBAC, Backup vs. Site Recovery, Zones vs. Sets, NSG vs. Firewall) rather than re-deriving each from scratch under time pressure.
Why "trap pairs" dominate AZ-305 wrong answers
AZ-305 rarely tests whether you have memorized the name of an Azure service. It tests whether you can tell apart two or three services that all plausibly solve the same general problem but differ on one specific requirement. Nearly every hard question on this exam reduces to a trap pair: two options that both sound correct until you notice the one word in the stem that only one of them satisfies. Building a fast, reliable "signal word" reflex for the most common trap pairs is one of the highest-leverage things you can do in your final review.
Connectivity traps: VPN Gateway vs. ExpressRoute vs. VNet Peering
| Signal in the stem | Correct choice | Why |
|---|---|---|
| "Over the public internet, encrypted, quick to provision, lower cost" | Site-to-Site VPN Gateway | Uses an IPsec/IKE tunnel across the internet; cheapest and fastest of the three to stand up, but shares internet bandwidth and latency variability |
| "Private, dedicated circuit, guaranteed bandwidth and SLA, no internet path, large sustained data volume" | ExpressRoute | A private connection through a connectivity provider, bypassing the public internet entirely; scales from tens of Mbps up to 100 Gbps with ExpressRoute Direct, at higher cost and longer provisioning lead time |
| "Two Azure virtual networks need to talk to each other, low-latency Microsoft backbone routing, no encryption requirement stated" | VNet Peering | Routes over Microsoft's private backbone with no gateway to manage and no extra encryption; global peering spans regions, regional peering stays in one region, but neither is transitive by default |
The single most common wrong answer here is picking ExpressRoute whenever the word "private" appears, even when the stem never mentions guaranteed bandwidth, an SLA, or high sustained volume. If the requirement is simply "encrypted connectivity from on-premises to Azure," a VPN Gateway already satisfies it at a fraction of ExpressRoute's cost and lead time — do not over-engineer past what the stem actually requires.
Data platform traps: SQL Managed Instance vs. Azure SQL Database vs. Cosmos DB
| Signal in the stem | Correct choice | Why |
|---|---|---|
| "Lift-and-shift SQL Server, SQL Agent jobs, cross-database queries, linked servers, CLR" | Azure SQL Managed Instance | Near-100% surface-area compatibility with on-premises SQL Server, including instance-level features Azure SQL Database does not support |
| "Modern single database or elastic pool, serverless auto-pause, no instance-level features needed" | Azure SQL Database | Fully managed PaaS database with DTU or vCore purchasing models and a serverless compute tier that pauses during idle periods to save cost |
| "Global distribution, single-digit-millisecond read/write latency at the 99th percentile, schema-flexible, multi-region active-active writes" | Azure Cosmos DB | Purpose-built for globally distributed, horizontally scalable workloads with tunable consistency models, unlike either SQL option |
Watch for stems that mention "existing stored procedures" or "T-SQL compatibility" — those phrases point away from Cosmos DB even when the workload also mentions global users, because compatibility with existing relational code overrides the appeal of global distribution.
Storage redundancy traps: LRS vs. ZRS vs. GRS vs. RA-GRS vs. GZRS
| Option | Copies & placement | Durability | Protects against |
|---|---|---|---|
| LRS (Locally Redundant Storage) | 3 synchronous copies, single datacenter | 11 nines (99.999999999%) per year | Hardware failure only — no datacenter or region protection |
| ZRS (Zone-Redundant Storage) | 3 synchronous copies across availability zones, same region | ~12 nines | A full datacenter/zone outage within the region |
| GRS (Geo-Redundant Storage) | LRS in primary region + async copy to a paired secondary region (6 copies total) | ~16 nines | A full region outage — secondary data is not readable by default |
| RA-GRS | Same as GRS, plus read access to the secondary endpoint | ~16 nines | Region outage, with read access to secondary during the outage |
| GZRS | ZRS in primary + async replication to secondary region | ~16 nines | Zone outage in primary AND region outage, in one tier |
The recurring trap: a stem that says "must remain available during a full region outage" but a candidate answers ZRS because it "sounds like more redundancy than LRS." ZRS never leaves the region, so it cannot survive a region-wide outage — only GRS, RA-GRS, or GZRS qualify. Conversely, if the stem asks for the lowest-cost option and a single datacenter outage is an acceptable risk, LRS is correct even though it looks "weak" next to the other four.
Other high-frequency trap pairs
| Trap pair | Rule of thumb |
|---|---|
| Azure Policy vs. RBAC | Policy enforces what configuration is allowed; RBAC controls who can perform actions |
| Azure Backup vs. Azure Site Recovery | Backup recovers from data loss (point-in-time restore); Site Recovery recovers from site loss (regional failover) |
| Availability Zones vs. Availability Sets | Zones span separate datacenters (99.99% SLA); Sets span fault/update domains within one datacenter (99.95% SLA) |
| NSG vs. Azure Firewall | NSG is a stateless, free, subnet/NIC-level 5-tuple filter; Azure Firewall is a stateful, centrally managed service with FQDN filtering and threat intelligence |
| Password Hash Sync vs. Pass-through Authentication vs. Federation | PHS validates a synced hash in the cloud (simplest, no on-premises dependency); PTA validates live against on-premises AD (requires an always-on agent); Federation delegates to AD FS (most complex, needed for advanced on-premises auth rules) |
| Load Balancer vs. Application Gateway vs. Front Door | Load Balancer is Layer 4 (TCP/UDP); Application Gateway is regional Layer 7 with a built-in WAF; Front Door is global Layer 7 with edge caching and anycast routing |
Practice questions
A requirement states that data must remain readable from a secondary region during a full primary-region outage, at the lowest cost that still meets this requirement. Which storage redundancy option should you recommend?
A stem describes a workload that needs a private, dedicated connection from an on-premises datacenter to Azure with a guaranteed bandwidth SLA and no path over the public internet, for consistently high-volume data transfer. Which service should you recommend?
A requirement says an application must survive the loss of an entire Azure datacenter within the same region, with synchronous replication and no data loss on failover. Which option is correct?
Key takeaways for spotting decision traps
- Most AZ-305 wrong answers are technically real Azure services — the exam tests which one satisfies the specific word in the stem, not which one exists.
- Memorize the signal-word table for connectivity (VPN Gateway/ExpressRoute/Peering), data platform (SQL MI/SQL Database/Cosmos DB), and storage redundancy (LRS/ZRS/GRS/RA-GRS/GZRS) — these three trap families appear across dozens of question variations.
- "Private" alone does not mean ExpressRoute; check for a stated bandwidth SLA or sustained volume requirement before recommending it over a VPN Gateway.
- ZRS never protects against a full region outage — only GRS, RA-GRS, or GZRS extend beyond the primary region.
- When two answers both look defensible, re-read the stem for the one differentiating word (reads vs. writes, datacenter vs. region, who vs. what) rather than picking the more advanced-sounding service.