AZ-305 Cheat Sheet

RBAC controls WHO can perform WHAT action. Azure Policy controls WHAT configuration/resource is valid, regardless of who creates it.

A custom role is defined at a scope (sub/MG) and can be assigned at that scope or below. AssignableScopes limits where it can be used.

Blocks the create/update operation if it doesn't meet the rule. Evaluated before the resource is created (unlike Audit).

Effect that automatically deploys a related resource if it's missing (e.g. Diagnostic Settings). Requires a managed identity with permissions.

Just-in-time role activation with approval, MFA, and automatic expiration. Reduces standing access for privileged roles.

Up to 6 levels deep plus root. RBAC and Policy are inherited top-down throughout the hierarchy.

Groups several related Policy definitions (e.g. CIS Benchmark) so they can be assigned together as a single compliance unit.

Partners or employees of another company → B2B (guest users in your tenant). Customers of your app → Microsoft Entra External ID in an external tenant (successor to Azure AD B2C).

Defender for Cloud assesses security posture (Secure Score) and protects workloads. Microsoft Sentinel is the SIEM/SOAR: it correlates events from multiple sources and automates the response.

Data governance: discovers, catalogs, classifies and shows the lineage of data across Azure, on-premises and other clouds. Azure Policy governs resources; Purview governs data.

Deploy resources defined in Bicep/ARM (policies, roles, resources) as a single unit and protect them with deny settings. They replace Azure Blueprints, retired in July 2026.

DNS-level balancing (name layer). Doesn't see the actual HTTP traffic, only resolves the domain to the optimal endpoint. Works with any protocol.

Global L7 (HTTP/S) balancing with TLS termination, WAF, caching, and path-based routing — acts as a global reverse proxy (anycast).

Regional L7 balancing (within a region/VNet). WAF, path-based routing, SSL offload. Not global like Front Door.

Common pattern: Front Door as the global entry point (WAF, cache), App Gateway as the regional balancer behind it, within each region.

Priority, Weighted, Performance, Geographic, MultiValue, Subnet — each resolves DNS using a different strategy.

If the traffic isn't HTTP/S (e.g. raw TCP/UDP, RDP, direct SQL) — use Traffic Manager or Load Balancer instead.

Creates a NIC with a private VNet IP for the PaaS service. Traffic never leaves to the Internet — reachable even on-premises via VPN/ER.

Optimizes the route to the service over the Azure backbone, but the resource keeps a public IP. Only works from within the same region/VNet.

Lets you expose your own service (behind a Standard LB) as a Private Endpoint consumable by other VNets/tenants.

Requires a Private DNS Zone linked to the VNet to resolve the public FQDN to the endpoint's private IP (e.g. privatelink.blob.core.windows.net).

When enabling a Private Endpoint, it's recommended to disable public access on the PaaS resource to force all traffic through the private route.

Service Endpoint is free. Private Endpoint has an hourly cost plus data processing charges.

The resource is pinned to ONE specific zone (e.g. a VM pinned to Zone 1). If that zone fails, the resource is unavailable.

The service automatically replicates across the region's availability zones (e.g. ZRS Storage, zone-redundant Standard LB). No client action needed.

The resource has no zone awareness — it lives in a single logical datacenter within the region.

Requires a region with Availability Zone support (not all Azure regions have them).

Availability Zones protect against datacenter failure (same region). A secondary (paired) region protects against a full regional failure.

VMs distributed across 2+ Availability Zones offer a 99.99% SLA, the highest available for VMs.

Must be chosen to evenly distribute reads/writes and avoid "hot partitions." Cannot be changed after the container is created.

A normalized unit of operation cost. Can be provisioned manually, autoscale, or serverless.

Shares resources (eDTU/vCore) across multiple databases with variable usage patterns — optimizes cost in multi-tenant SaaS.

Geo-replication creates readable replicas. Failover Group adds a listener with automatic/manual failover and groups several DBs.

Encrypts data at rest at the page level in SQL Database/MI. Enabled by default, uses Microsoft-managed keys or BYOK.

The vCore serverless compute pauses after configurable inactivity and only charges for storage — ideal for intermittent workloads.

Rules based on days since last modification/access to automatically move blobs between Hot → Cool → Archive → Delete.

RPO = how much data loss is acceptable (measured backward from the failure). RTO = how much downtime is acceptable.

Continuously replicates entire VMs (OS + disks) to a secondary region. RPO of seconds/minutes, RTO of minutes via orchestrated failover.

Backup protects against data loss/corruption (RPO in hours). ASR protects against a full datacenter/region outage (RPO in minutes).

Configurable as LRS/ZRS/GRS. GRS is the default and recommended option — the vault itself must survive the disaster it protects against.

Wait time before automatic failover (default 1h) to avoid unnecessary failovers from transient outages.

Azure prioritizes sequential updates and joint recovery between paired regions (e.g. East US ↔ West US).