Home › Studies › AZ-305 › Exam-Day Cram Sheet

Exam-Day Cram Sheet

One page of the highest-yield rules across all four domains.

Read this the morning of the exam. Each line is trigger → answer. Deeper detail: Decision Guides, Numbers, Retirement Timeline.

Identity & Governance

Conditional Access = P1 · risk policies, PIM, access reviews = P2
No stored credentials → managed identity + Key Vault (RBAC model, purge protection)
Sign-in works if on-prem down → PHS · enforce on-prem policy → PTA
Disconnected forests, multi-agent HA, group provisioning to AD → Cloud Sync · >250K objects, resource-forest mailboxes → Connect Sync
New customer sign-up → Entra External ID (B2C closed to new customers)
Policy = WHAT · RBAC = WHO · Lock = can't delete/change (control plane only; most restrictive inherited lock wins)
Fix existing non-compliance → remediation task (modify/DINE need managed identity)
denyAction: delete only; blocks resource group delete only with cascadeBehaviors = deny; exempt: policy assignments, locks, deployment stacks
Tags not inherited → Modify policy 'inherit tag from resource group'
VM logs → Azure Monitor Agent + DCR · resource logs need a diagnostic setting (max 5 per resource) · SIEM → Event Hubs
Start with ONE Log Analytics workspace · plan switch once a week · total retention up to 12 years
On-prem web app without VPN → App Proxy · any protocol → Entra Private Access
Single-tenant HSM → Managed HSM or Cloud HSM; Azure Dedicated HSM is retiring (support to Jul 31, 2028)

SQL Agent / cross-DB / CLR → SQL Managed Instance
Free read replica → Business Critical/Premium · >4 TB → Hyperscale · idle → serverless (auto-pause min 15 min)
AHB + reservations → vCore provisioned only · free offer: 10 GP databases, 100,000 vCore s + 32 GB each
Many DBs, varying peaks → elastic pool (billed at the pool's peak per hour)
Hide from DBAs → Always Encrypted (no sorting or filtering without secure enclaves) · hide from support → masking
Cosmos default = Session · latest write = Strong (single write region) · serverless = single region, one-way to provisioned
Read secondary during outage → RA-GRS/RA-GZRS · zone + region → GZRS
Archive = offline: standard rehydration up to 15 h, high priority under 1 h (10 GiB/h per account) · Cool 30 / Cold 90 / Archive 180 days
Can't modify/delete even admins → immutable storage (locked) · litigation with no end date → legal hold
Ultra 400,000 IOPS · Premium SSD v2 80,000 · only Premium SSD and below as OS disks
On-prem source in Data Factory → self-hosted IR · new analytics → Fabric

Unchanged connection string → failover group
VMs to another region → ASR · restore data → Azure Backup
Blobs/disks/PostgreSQL → Backup vault · VMs/Files/SQL-in-VM/on-prem → Recovery Services vault
Admins can't delete backups alone → MUA (Resource Guard) + immutable vault · soft delete enforced by default: 14 days, up to 180
VM backup every 4 h / Ultra / PSSD v2 → Enhanced policy
SQL PITR 1–35 days · LTR up to 10 years · geo-restore RPO ~1 h (per a Microsoft Q&A quote of the docs)
Cosmos self-service PITR → continuous backup (7/30/35 days)
Blob backup: operational (360 days, restores to source) vs vaulted (10 years, restores to another account)
SLA: zones 99.99% · availability set 99.95% · single Premium SSD VM 99.9%
Test failovers: at least every six months · recovery plan up to 100 instances
Region pairs ≠ automatic failover

Global HTTP + WAF → Front Door · regional L7 → App Gateway · L4 → Load Balancer · DNS → Traffic Manager
Microservices, scale to zero → Container Apps · K8s API → AKS · simple job → ACI
New serverless functions → Flex Consumption · no cold start → Premium · ASE for >30 instances (v3 up to 200)
Ordered/transactional → Service Bus · telemetry → Event Hubs (retention 1/7/90 days) · reactive → Event Grid
On-prem → PaaS privately → Private Endpoint + DNS Private Resolver
Not over internet → ExpressRoute · cross-geo → Premium · site-to-site between DCs → Global Reach
New virtual network (API after Mar 31, 2026) has no default outbound → NAT Gateway; existing VNets aren't modified
TLS inspection/IDPS → Firewall Premium · DDoS cost protection → Network Protection · session recording → Bastion Premium
Azure Managed Redis: .redis.azure.net, port 10000, clustered · Redis Basic/Std/Premium retire Sep 30, 2028
Retired: Basic LB, App GW v1, low-priority VMs, Blueprints (→ Deployment Stacks), Front Door classic, Azure Cache for Redis (→ Managed Redis)

Read the LAST sentence first: it says what you're choosing
Underline constraints: cost, least admin effort, no code changes, connection string, RPO/RTO
Pick the cheapest option that meets EVERY requirement
If a retired service and its replacement both appear, choose the replacement
No penalty for guessing; 700 is a scaled score, not 70%
Case studies: re-read requirements per question; after a break you can't return to earlier questions
Mark and move on; never leave a question blank