AZ-305
Deep Dive
The storage design decisions on AZ-305: which redundancy meets the durability and DR requirements, which access tier minimizes cost for the access pattern, and which authorization mechanism is the most secure.
Contents
| Option | Copies | Survives... | Durability |
|---|---|---|---|
| LRS | 3 in one datacenter | Disk/rack failure | 11 nines |
| ZRS | 3 across 3 availability zones | An entire datacenter/zone going down | 12 nines |
| GRS | LRS + 3 async copies in the paired region | Regional disaster (failover) | 16 nines |
| GZRS | ZRS + 3 async copies in the paired region | Zone down AND regional disaster | 16 nines |
| RA-GRS / RA-GZRS | Same + read access to the secondary | Lets you READ from the secondary without failing over | 16 nines |
Design keys
How to choose
| Tier | Storage / access cost | Minimum retention | Use |
|---|---|---|---|
| Hot | Expensive storage / cheap access | — | Frequently accessed data |
| Cool | Cheaper / more expensive access | 30 days | Infrequent access: recent backups, 30-90 day-old data |
| Cold | Even cheaper / expensive access | 90 days | Rarely accessed but instantly available online |
| Archive | Minimal / rehydration required (hours) | 180 days | Compliance, years of retention. OFFLINE: rehydrate to Hot/Cool to read (1-15h, or High Priority <1h) |
Lifecycle management policies
Automatic rules based on age/last access: move to Cool after 30 days without access → Archive after 180 → delete after 7 years. If the scenario asks to "automatically optimize blob costs based on usage", the answer is lifecycle management — not scripts or Azure Functions.
Account types
Data Lake Storage Gen2
| Service | Protocol | When |
|---|---|---|
| Azure Files Standard/Premium | SMB, NFS (premium), REST | Managed file shares: lift-and-shift of apps that use shares, AVD FSLogix profiles. Kerberos auth with Entra DS/AD DS |
| Azure File Sync | SMB (agent on Windows Server) | Local cache on on-prem servers with cloud tiering — branch offices with fast access and the cloud as the source of truth |
| Azure NetApp Files | NFSv3/v4.1, SMB, dual | Demanding enterprise workloads: SAP HANA, HPC, databases over NFS — <1ms latency and extreme throughput |
| Blob NFS 3.0 | NFS over blob | Analytics/HPC reading objects via NFS, cheaper than NetApp |
| Mechanism | Risk | When |
|---|---|---|
| Entra ID + RBAC (DataActions) | Minimal — no secrets, with CA and auditing | ALWAYS the first option: managed identity + Storage Blob Data Contributor/Reader |
| User delegation SAS | Low — signed with Entra credentials, not the account key | Temporary delegated access for external clients (the best kind of SAS) |
| Service/Account SAS | Medium — signed with the account key; revoking = rotating the key | Temporary granular access when there is no Entra identity. Restrict with stored access policies |
| Account keys | High — full account access | Avoid in apps. Disable shared key if policy allows |
| Anonymous public access | Critical | Only deliberately public content (CDN origin). Disabled by default |
Network
Private Endpoints for VNet-only traffic (remember the privatelink private DNS zone), account firewall with allowed IPs/VNets, and "Allow trusted Microsoft services" so Backup/Defender can access the account despite the firewall.
| Requirement | Design |
|---|---|
| Critical data that must survive a zone AND a regional outage | GZRS (or RA-GZRS if they need to read during DR) |
| Reports read from the secondary without failing over | RA-GRS / RA-GZRS (-secondary endpoint) |
| 10-year retention at the lowest cost, almost never accessed | Archive tier + lifecycle policy |
| Automatically move blobs to colder tiers based on last access | Lifecycle management policy |
| Data lake with per-directory permissions for Synapse | ADLS Gen2 (hierarchical namespace + ACLs) |
| Low, consistent blob latency for an interactive workload | Premium block blob (LRS/ZRS) |
| Share SMB files with caching in branch offices | Azure Files + Azure File Sync (cloud tiering) |
| SAP HANA over NFS with <1ms latency | Azure NetApp Files |
| An app accesses blobs with no secrets | Managed identity + RBAC data plane |
| External partner uploads files for 48h | User delegation SAS with expiration |
Did you get this topic?
Test what you just learned
An insurance company stores scanned records: they're queried frequently in the first 60 days, almost never after, and regulation requires keeping them for 10 years and being able to retrieve them within 24 hours. They want the lowest possible cost with minimal administration. What do you design?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.