Question Cheat Sheet
What to look for in an AZ-305 question, the words that decide the answer, and the traps. Built from all 647 practice questions.
Read this before a practice session. Each row is a rule: if the question says the words in the first column, the answer family is the second column. The trap is the wrong option that looks right. Example questions are real IDs from the practice bank; open them in Practice or follow the topic link.
1. Before you answer
- Read the last sentence first. It says what you are choosing: a service, a tier, a setting or an order.
- Underline the constraints: cost, administrative effort, region or zone, RPO and RTO, connection string, existing licences, no code changes, must stay private.
- Classify the requirement: availability, disaster recovery, backup, security, cost, performance or governance.
- Eliminate every option that breaks a hard constraint, then every retired or wrong-tier option.
- Choose among the survivors: fully managed first, then lowest cost, then fewest moving parts.
The full method, pacing and requirement decoder are in How to Answer AZ-305 Questions. This sheet does not repeat the decoder; it maps the question bank onto those rules.
2. Question types
| Type | Bank count | What to do |
|---|---|---|
| Single answer | 521 | One best answer. Eliminate by hard constraint first, then by cost and effort. |
| Multi ("Which two…", "Choose N") | 80 | Select exactly N. Each correct choice earns a point, so a half-right answer still scores. Decide each choice on its own. |
| Yes/no solution set ("Does this meet the goal?") | 22 | Judge the proposed solution alone against the stated goal. Do not carry assumptions from other questions. Microsoft does not allow a break in the middle of one. |
| Ordering (build a list) | 15 | Put prerequisites first. Place the steps you are sure of first; a point can be earned for each correct position. |
| Matching (pair prompts and choices) | 9 | Start with the pairs you are certain of. A choice can be used once unless the question says otherwise, so the rest narrows. |
| Scenario (case-style block above the stem) | 70 | Read the requirements in the scenario, then answer the stem against the one requirement it targets. Re-read the constraints for each question. |
3. Keyword key
These are the words that the practice engine highlights in every question stem (colour-coded, hover or long-press for the hint). The count is the number of bank questions whose stem or scenario contains that kind of word.
| Highlight | Kind | Means | Questions |
|---|---|---|---|
| lowest cost | cost | Cheapest option that still meets every requirement. Do not over-engineer. | 18 |
| least administrative effort | effort | Prefer managed PaaS or serverless over VMs, AKS or self-managed tools. | 6 |
| no code changes | code | Rehost or replatform; avoid rewrites. | 3 |
| RPO RTO · connection string | recovery | RPO is data loss; RTO is downtime. An unchanged connection string points to a failover group. | 12 |
| availability zones · another region | scope | Zone = a datacenter fails inside one region. Region = the whole region fails. Pick the scope the question names. | 33 |
| on-premises · over the internet | hybrid | On-premises clients need a private path: ExpressRoute or a Private Endpoint. A site-to-site VPN still uses the internet. | 57 |
| managed identity · P2 | identity | No stored secrets: managed identity first. Risk-based policies, PIM and access reviews need Entra ID P2. | 13 |
| immutable · compliance | compliance | Regulators want WORM: locked immutable storage or a legal hold. Backup and replication alone do not satisfy it. | 22 |
| Premium · Standard | tier | Right service, wrong tier. Check which tier unlocks the feature (for example, Premium for messages over 256 KB). | 60 |
| retired | retired | Retired service: choose the current replacement. See section 5. | 4 |
| Which two · Does this meet the goal? | multi | Multi-select: exactly N choices. Yes/no: judge the proposed solution alone. | 103 |
Counts are whole-question matches (a question can contain more than one kind). Words such as "Standard" also match non-tier uses, so treat the tier highlight as a prompt to check, not a verdict.
4. What the question is asking
Each row is one answer rule. Trigger words are the words in the question; the answer family is the choice that satisfies them. Each row lists the topics it covers; follow the Practice link to drill that topic.
Infrastructure
| If the question says… | Answer family | Trap (looks right, is wrong) | Example questions | Practice |
|---|---|---|---|---|
| Global HTTP(S) with WAF, edge routing, fast regional failover, URL path routing | Front Door (global L7); Application Gateway WAF_v2 (regional L7); Load Balancer (L4, TCP/UDP); Gateway Load Balancer for NVAs | Traffic Manager (DNS only, no WAF or TLS termination); Application Gateway v1 or Basic Load Balancer (retired) | inf-lb-001, inf-lb-002, inf-lb-004 | Load balancing |
| Microservices that scale to zero with minimal management; need the Kubernetes API or Helm/CRDs; one short nightly container | Container Apps (microservices); AKS (Kubernetes API); Container Instances (single job) | AKS when no Kubernetes API is needed (cluster overhead); ACI when you need autoscaling or load balancing | inf-ct-001, inf-ct-002, inf-ct-003 | Containers |
| Serverless function app with VNet access; no cold start with VNet; app needs a fixed outbound IP | Flex Consumption (new serverless with VNet); Premium plan (no cold start, VNet); NAT Gateway with VNet integration (fixed IP) | Consumption plan (no VNet, legacy); Premium v4 for a fixed outbound IP (dynamic outbound IPs) | inf-fn-001, inf-fn-002, inf-fn-004 | App Service and Functions |
| Survive a datacenter failure in the region; HA in a region with no zones; autoscale with mixed Spot and on-demand; lowest-cost interruptible work; no shared physical host | Availability zones; availability set in a region without zones; VMSS Flexible; Spot VMs; Dedicated Host | Availability set as protection against a datacenter failure (it is not); Uniform scale set when Backup or ASR is needed | inf-vm-001, inf-vm-002, inf-vm-004 | VMs and scale sets |
| Large parallel or HPC jobs; restartable tasks at lowest cost; tightly coupled MPI with a strict deadline | Batch pool with Spot nodes; dedicated HPC nodes for MPI; baseline dedicated plus Spot | Spot for a job that must finish on a deadline (capacity can drop to zero); low-priority VMs (retired) | inf-bt-001, inf-bt-002, inf-bt-004 | Batch processing |
| FIFO or exactly-once per customer; duplicate detection; messages over 256 KB; millions of telemetry events; Kafka producers; a blob-uploaded trigger | Service Bus sessions (Standard or Premium); Service Bus Premium for large messages; Event Hubs for telemetry or Kafka; Event Grid for reactive events | Storage Queues (no ordering, duplicates or transactions); Event Hubs for a reactive trigger; Service Bus Standard for messages over 256 KB | inf-mq-001, inf-mq-002, inf-mq-003 | Messaging and events |
| Gateway injected into a VNet in production; gateways in several regions; on-premises APIs with a local gateway; public gateway with private backends and an SLA | Premium v2 (VNet injection); Premium (classic) for multi-region; self-hosted gateway (Premium); Standard v2 with VNet integration | Developer tier (no SLA, non-production); tiers without multi-region gateways or VNet integration | inf-ap-001, inf-ap-002, inf-ap-003 | API Management |
| In-memory cache with active geo-replication or Redis modules; edge caching of static content; caching API responses; reduce repeated database reads | Azure Managed Redis (cache-aside, OSS clustering policy); Front Door for edge; APIM cache policies for APIs | Azure Cache for Redis Basic, Standard or Premium (retiring; no active geo-replication or modules); a cache that still reads the database every time | inf-ca-001, inf-ca-002, inf-ca-004 | Caching and CDN |
| Central settings and feature flags across apps; a database password; a landing zone locked against deletion; a pipeline that must not store a secret | App Configuration (+ Key Vault references); Key Vault for secrets; Deployment Stacks with deny settings; workload identity federation (OIDC) | Storing the password in App Configuration; Azure Blueprints (retiring; new definitions blocked); a client secret in the pipeline | inf-cf-001, inf-cf-002, inf-cf-003 | Configuration and deployment |
| Discover and assess VMware or physical servers; find dependencies; move with no code changes, or to PaaS with minimal changes; large data sets over limited bandwidth | Azure Migrate (agentless dependency analysis); Rehost; Replatform; DMS online migration to SQL Managed Instance; Data Box for large data sets | DMS to Azure SQL Database for near-zero downtime (offline only); lift-and-shift VMs when the question says PaaS | inf-mg-001, inf-mg-002, inf-mg-003 | Migrations |
| Many regions and branches with SD-WAN and managed transit; spoke-to-spoke traffic through a hub; new VNet needing internet access; fixed outbound IP or SNAT exhaustion | Virtual WAN with routing intent; hub-spoke with UDRs through the firewall; NAT Gateway (explicit outbound and fixed IP) | VNet peering for overlapping address spaces (re-address first); gateway transit as a spoke-to-spoke route; default outbound access on a new VNet | inf-tp-001, inf-tp-002, inf-tp-003 | Network topology |
| Private connection that avoids the internet; resilience to a peering-location failure; two on-premises sites connected to each other; a zone-resilient VPN; remote users with Entra sign-in | ExpressRoute (Premium for cross-geography); ExpressRoute Metro; Global Reach; VpnGw AZ SKUs; point-to-site VPN with Entra ID | Site-to-site VPN for a "private" requirement (it uses the internet); a non-AZ VPN gateway SKU for new zone-resilient designs; gateway routing as a way to connect two on-premises sites (Global Reach connects their circuits) | inf-hy-001, inf-hy-002, inf-hy-003 | Hybrid connectivity |
| Inspect encrypted outbound traffic or IDPS; DDoS cost protection and response team; RDP or SSH to VMs with recorded sessions; on-premises access to a PaaS service privately | Azure Firewall Premium; DDoS Network Protection; Bastion Premium; Private Endpoint with DNS Private Resolver | Azure Firewall Standard or Basic (no TLS inspection or IDPS); Bastion Developer or Standard (no session recording); service endpoints for on-premises clients | inf-ns-001, inf-ns-002, inf-ns-003 | Network security |
Identity & Governance
| If the question says… | Answer family | Trap (looks right, is wrong) | Example questions | Practice |
|---|---|---|---|---|
| Collect Windows events or syslog from VMs; servers outside Azure (on-premises or AWS); resource logs such as Key Vault access | Azure Monitor Agent with a data collection rule; Azure Arc first for non-Azure servers; a diagnostic setting for resource logs | The Log Analytics agent (retired); an agent for PaaS resource logs (use a diagnostic setting) | idg-ag-001, idg-ag-002, idg-ag-101 | Monitor and agents |
| Shared workspace where teams see only their resources; EU and US data residency; verbose logs queried rarely; audit logs kept for years at low cost | Resource-context access; one workspace per required region; Auxiliary or Basic table plans; total retention | One shared workspace when data must stay in a region; Analytics retention for long audit periods (expensive, short maximum) | idg-la-001, idg-la-002, idg-la-003 | Log Analytics |
| Resource logs streamed to an on-premises SIEM; the same logs to two workspaces; a policy that makes every resource send logs | Diagnostic setting to Event Hubs; two diagnostic settings (one per workspace); Azure Policy deployIfNotExists with a remediation task | A single diagnostic setting with two workspaces (one setting targets one workspace); a destination in another region | idg-lr-001, idg-lr-002, idg-lr-003 | Log routing |
| Notify when someone deletes a production resource; suppress alerts in a maintenance window; be told about a platform incident; a CPU threshold with a seasonal baseline | Activity log alert; alert processing rule (suppression schedule); Service Health alert; metric alert with dynamic thresholds | A metric alert for a delete (metrics don't record deletes); disabling rules to suppress notifications | idg-al-001, idg-al-002, idg-al-003 | Alerts |
| Exploitable attack paths; PCI DSS mapping for auditors; correlate events and run response playbooks; threat detection on VMs or storage | Defender CSPM (paid); regulatory compliance dashboard; Microsoft Sentinel with an automation rule and playbook; Defender for Servers or Storage | Defender for Cloud foundational posture (no attack path analysis); Sentinel in the Azure portal after March 31, 2027 | idg-df-001, idg-df-002, idg-df-003 | Defender and Sentinel |
| MFA only outside the office (Conditional Access); risky sign-in or PIM or access reviews; lifecycle automation; free MFA for all users | Conditional Access (P1); Entra ID P2 for risk, PIM and access reviews; Entra ID Governance for lifecycle workflows; security defaults (free, fixed rules) | Security defaults when a location or risk condition is needed (no custom conditions); lifecycle workflows as a P2 feature (they need Governance) | idg-li-001, idg-li-002, idg-li-003 | Entra licensing |
| Simplest hybrid sign-in; sign-in must work if on-premises is down; no password hashes in the cloud; enforce on-premises logon hours; sync that survives a single server failure | Password hash sync (+ leaked-credential detection); pass-through authentication; Cloud Sync with multiple agents | Pass-through authentication when sign-in must survive an on-premises outage (agents fail); Connect Sync for high availability (one active server) | idg-hi-001, idg-hi-002, idg-hi-003 | Hybrid identity |
| Risk-based sign-in or user risk; phishing-resistant MFA; trial a policy without blocking; sign-in and user risk in one policy; avoid locking everyone out | Conditional Access with risk conditions (P2); authentication strength; report-only mode; separate policies per risk type; break-glass accounts | One policy that combines sign-in and user risk (Microsoft says no); turning a policy on to "test" it (that enforces it) | idg-ca-001, idg-ca-002, idg-ca-003 | Conditional Access |
| Consumer sign-up with Google or Facebook; partners using their own corporate credentials; partner access that must end; B2C-style custom logic | Entra External ID (external tenant); B2B collaboration; entitlement management with access packages; custom authentication extensions | Azure AD B2C for a new customer (closed to new customers); B2C custom policies in External ID (not supported) | idg-ex-001, idg-ex-101, idg-ex-102 | External identities |
| App on Azure reads secrets with no credentials; many VMs need the same access; identity deleted with the resource; a workload outside Azure needs access with no secret | Managed identity with RBAC; user-assigned managed identity; system-assigned managed identity; workload identity federation | A system-assigned identity shared by many VMs (its lifecycle is tied to one resource); managed identities for workloads outside Azure (they don't exist there) | idg-mi-001, idg-mi-002, idg-mi-101 | Managed identities |
| Publish an internal web app to remote users without a VPN; replace the VPN for file shares and RDP; connector high availability; LDAP or Kerberos without domain controllers | Entra application proxy with Conditional Access; Entra Private Access; two or more connectors in one connector group; Entra Domain Services | Application proxy for SMB or RDP (web apps only, so Private Access); header-based SSO for an IWA app | idg-op-001, idg-op-002, idg-op-101 | On-premises access |
| Team manages VMs but not others; tag-based read limits on shared data; a managed service provider across many customer tenants; access that must not bypass the rule | Contributor or VM Contributor; ABAC role-assignment condition; Azure Lighthouse; disable Shared Key and SAS | Roles alone to filter by tag (roles can't filter by tag); a SAS or account key, which bypasses ABAC; guest accounts for MSP access | idg-rb-001, idg-rb-002, idg-rb-003 | RBAC, ABAC and Lighthouse |
| Owner only when needed, for at most 4 hours, with approval; access that ends on a date; periodic confirmation of admins; just-in-time group membership | PIM eligible assignment with role settings (max activation, MFA, approval); PIM for Groups; PIM assignment with an end date; access reviews | Active (standing) assignments, which skip activation controls; assuming subscription PIM settings apply to resource groups (they don't) | idg-pm-001, idg-pm-002, idg-pm-101 | Privileged Identity Management |
| Prevent permanent deletion of keys; contributors must not gain secret access; single-tenant FIPS 140 HSM; a retiring Dedicated HSM | Purge protection with soft delete; Azure RBAC permission model; Managed HSM or Cloud HSM; Cloud HSM as the Dedicated HSM replacement | Switching the vault permission model to prevent deletion (it prevents escalation only); Dedicated HSM for new onboarding (retiring); the Contributor role for data access | idg-kv-001, idg-kv-002, idg-kv-101 | Key Vault and Managed HSM |
| Apply one policy to many subscriptions; inherit a tag from the resource group; delete protection that still allows updates; a ReadOnly lock that breaks key listing; CAF hierarchy | Management group; Modify policy "inherit a tag"; CanNotDelete lock; Cloud Adoption Framework landing zones (flat hierarchy) | ReadOnly lock on an account whose apps sign requests with keys (blocks POST); assuming a lock stops blob data changes (locks only affect the control plane) | idg-hr-001, idg-hr-002, idg-hr-003 | Hierarchy, tags and locks |
| Only allow specific locations or SKUs; auto-configure diagnostics on new resources; fix existing non-compliant resources; block deletion even for Owners | Policy deny; deployIfNotExists; remediation task; denyAction with actionNames delete | Deny for existing resources (it only blocks new create or update); a Modify policy when a Deny follows (Modify runs first); denyAction for update | idg-po-001, idg-po-002, idg-po-003 | Azure Policy |
| Partners self-request project access with approval and expiry; quarterly access confirmations; joiner, mover and leaver automation; partners in another tenant | Entitlement management access package; access reviews with auto-apply; lifecycle workflows; connected organisations | An access package with no approval or expiry (the trap in idg-ig-001); approvers who lack partner context (use partner sponsors) | idg-ig-001, idg-ig-101, idg-ig-102 | Identity governance |
Data Storage
| If the question says… | Answer family | Trap (looks right, is wrong) | Example questions | Practice |
|---|---|---|---|---|
| SQL Agent, cross-database queries or CLR; minimal admin for one database; OS access or SSRS on the same machine; many small SQL instances | SQL Managed Instance; SQL Database; SQL Server on a VM; a Managed Instance pool | SQL Database for SQL Agent or cross-database queries (no SQL Agent); Managed Instance for OS-level access (PaaS, no OS access) | ds-cs-001, ds-sp-001, ds-sp-002 | SQL platform |
| Many tenant databases with unpredictable peaks; reporting off the OLTP primary at no extra cost; many read replicas; fast reads in another region | Elastic pool; Business Critical or Premium read replica (ApplicationIntent ReadOnly); Hyperscale named replicas; readable geo-replica | Single databases sized for every tenant's peak (pays for all peaks); HA replicas for reads (they exist for failover) | ds-cs-002, ds-sc-001, ds-sc-002 | SQL scalability |
| Reads must return the latest write; users see their own updates; bounded lag; strong consistency with multi-region writes; a large tenant over 20 GB; a hot partition | Strong; Session (default); Bounded staleness; hierarchical partition keys; a high-cardinality partition key | Strong across multi-region writes (strong needs a single write region); a per-request override stronger than the account default; adding a level to fix a single hot partition key | ds-cs-003, ds-cs-005, ds-cs-006 | Cosmos consistency |
| Recover a deleted blob; recover after an overwrite; WORM for SEC 17a-4; litigation with no end date; ransomware protection | Blob soft delete; blob versioning; immutable storage (locked time-based retention); legal hold; versioning with soft delete and immutability | Soft delete or versioning for WORM (they are recoverable, not locked); an unlocked time-based policy (it can be changed or deleted); replication as protection (it copies deletes) | ds-cs-004, ds-bp-001, ds-bp-002 | Blob protection |
| Dev or test database idle most of the day; a serverless database that never pauses; a 50 TB database with fast restores; reused licences with a 3-year commitment; a read replica for reporting | Serverless with auto-pause; a failover group or LTR (stops auto-pause); Hyperscale; vCore provisioned with Azure Hybrid Benefit and reserved capacity; Business Critical | DTU for licence reuse (neither benefit applies); serverless for a steady 24x7 load | ds-st-001, ds-st-002, ds-st-003 | SQL tiers |
| PostgreSQL with zone failure and zero data loss; BI reads off the primary; MySQL Single Server in a design; MySQL 5.7 running late 2026 | Zone-redundant HA (synchronous standby); read replica; MySQL Flexible Server; upgrade to MySQL 8.0 or 8.4 | Read replica for zone-loss durability (asynchronous); MySQL Single Server (retired); leaving MySQL 5.7 on paid Extended Support | ds-os-001, ds-os-002, ds-os-003 | PostgreSQL and MySQL |
| DBAs must never see plaintext data; partial display for support; a customer-controlled encryption key; tenant rows in a shared table; SQL injection detection | Always Encrypted; dynamic data masking; TDE with a customer-managed key; row-level security; Defender for SQL | Dynamic masking for DBA-hidden data (admins see the plaintext); TDE for hiding data from DBAs (it encrypts files at rest) | ds-db-001, ds-db-002, ds-db-003 | Database security |
| Existing MongoDB app with no code change; sporadic traffic at lowest cost in one region; unpredictable spikes with an SLA across two regions; steady 10,000 RU/s | Cosmos DB for MongoDB; serverless; autoscale provisioned throughput; manual provisioned throughput with reserved capacity | Serverless for multi-region (single region only); the graph API for a document workload; converting serverless back to provisioned (the change is irreversible) | ds-cc-001, ds-cc-002, ds-cc-003 | Cosmos capacity |
| Cheapest simple key-value store with no latency SLA; filters on non-key properties; global distribution; single-digit-millisecond latency and high throughput | Azure Table Storage (cheapest, pay for use); Cosmos DB for Table (indexing, global, SLA) | Table Storage for filters or SLA latency (slow filters, no SLA); Cosmos DB for Table when the question says cheapest (it reserves capacity) | ds-tb-001, ds-tb-002, ds-tb-102 | Table storage |
| Survive a zone failure, data stays in one region; zone plus regional failure with reads during the outage; some containers need GRS and others LRS; data residency with no copies out of the region | ZRS; RA-GZRS; separate storage accounts (redundancy is per account); ZRS when residency forbids a geo copy | LRS for a zone failure (no zone protection); GRS for a per-container requirement (set per account) | ds-rd-001, ds-rd-002, ds-rd-003 | Storage redundancy |
| Keep 7 years, read yearly, lowest cost; rarely read but needed within seconds; auto-move after 30 days without access; archived blob needed urgently | Archive tier; Cold tier; lifecycle management with last-access tracking; high-priority rehydration | Cold for archive (higher cost than Archive); assuming no charge when archived blobs are deleted early (an early-deletion charge applies) | ds-bt-001, ds-bt-002, ds-bt-003 | Blob tiers |
| Replace an on-premises file server with AD DS identity and NTFS permissions; POSIX or hard links; cache shares on branch servers; geo-redundant NFS | Azure Files SMB with AD DS identity; Azure Files NFS; Azure File Sync with cloud tiering; Entra Kerberos for hybrid identities | NFS with GRS (NFS supports LRS and ZRS only); one share mounted over SMB and NFS (one protocol per share) | ds-af-001, ds-af-002, ds-af-101 | Azure Files |
| Up to 60,000 IOPS with IOPS tuned independently of size; live IOPS changes; an OS disk on Premium; a disk that survives a zone failure | Premium SSD v2; Ultra Disk (live adjustment); Premium SSD for OS disks; ZRS managed disk | Premium SSD v2 as an OS disk (not supported); Premium SSD (performance tied to size, 20,000 IOPS max) | ds-dk-001, ds-dk-002, ds-dk-101 | Managed disks |
| Copy from an on-premises SQL Server or a custom ODBC source; run SSIS in Azure with minimal change; data flows; a file landing trigger; private endpoints without managing runtimes | Self-hosted integration runtime; Azure-SSIS integration runtime; Azure integration runtime with a managed VNet; storage event trigger | Azure integration runtime for on-premises sources (it can't reach them); rewriting SSIS packages when the question says minimal change | ds-in-001, ds-in-002, ds-cs-105 | Data integration |
| SaaS unified analytics with OneLake and Power BI; interactive KQL over billions of logs; a new project that needs analytics on Cosmos DB without touching transactions | Microsoft Fabric; Azure Data Explorer or Fabric Eventhouse; Cosmos DB mirroring in Fabric | Engines you provision and size yourself instead of the SaaS platform; a retired option for interactive KQL (see the ds-an-002 trap) | ds-an-001, ds-an-002, ds-an-101 | Data analytics |
Business Continuity
| If the question says… | Answer family | Trap (looks right, is wrong) | Example questions | Practice |
|---|---|---|---|---|
| Fail over VMs to another region with RPO of minutes; start the database before the web tier; a DR drill without affecting production; zone DR with data kept in the region | Azure Site Recovery with a recovery plan (boot order); test failover to an isolated VNet; ASR zone-to-zone replication | Restoring from backups for a VM failover (RPO of hours); a production-network test failover | bc-cs-001, bc-cs-005, bc-as-001 | Site Recovery |
| Connection string must not change after regional failover; readable secondaries in three regions; keep backups 7 years; a table dropped 3 hours ago | Failover group; active geo-replication (up to 4 readable secondaries); long-term retention; point-in-time restore to a new database | Active geo-replication for a connection-string requirement (each secondary has its own endpoint); a failover group for many secondaries (one partner); PITR beyond 35 days | bc-cs-002, bc-dd-001, bc-dd-002 | Database BCDR |
| Restore blobs to a point 2 days ago in the same account; 7-year vaulted blob backups; data loss on unplanned failover; test storage DR without losing data | Operational blob backup (point-in-time, same account); vaulted blob backup; check Last Sync Time; customer-managed planned failover | Vaulted backup for a 30-day same-account restore (scheduled, offsite); an unplanned failover for a DR test (can lose data and convert to LRS) | bc-cs-003, bc-sp-001, bc-sp-002 | Storage protection |
| A compromised admin must not delete backups alone; ransomware-proof backups; backups for disks, blobs or PostgreSQL; a deleted backup from yesterday; VMs in two regions | Multi-user authorization with a Resource Guard; immutable locked vault with soft delete; Backup vault; Recovery Services vault per region; soft delete (14 days default, up to 180) | One Recovery Services vault for VMs in two regions (backup is in-region); Recovery Services vault for disks or blobs (use a Backup vault) | bc-cs-004, bc-bv-001, bc-bv-002 | Backup vaults |
| Replication is enough, no backups needed; "no more than 15 minutes of data lost, restored within 2 hours"; cheapest option meeting the RPO and RTO; prove DR works | Keep backups (replication copies deletes); RPO = data loss, RTO = downtime; the cheapest option that meets every requirement; a DR test | Replication as backup; swapping RPO and RTO; over-engineering a 24-hour requirement with a costly design | bc-rs-001, bc-rs-002, bc-rs-003 | RPO, RTO and strategy |
| VM backups every 4 hours or on Premium SSD v2; restore one deleted file; restore in the paired region without a declared disaster; move a policy back to Standard | Enhanced policy; file recovery (item-level restore); Cross Region Restore with a GRS vault | Standard policy for 4-hour RPO; reverting an Enhanced policy to Standard (not allowed); restoring the whole VM for one file | bc-vb-001, bc-vb-002, bc-vb-003 | VM backup |
| VM SLA with two or more zones; a single Premium SSD VM; composite SLA of two services in series; stateless tier that autoscales and survives a zone failure | 99.99% (zones); 99.9% (single Premium VM); multiply SLAs in series; VMSS Flexible across zones behind a zone-redundant Standard Load Balancer | Ignoring the second service in a composite SLA; Basic Load Balancer (retired) or no zone resilience | bc-hc-001, bc-hc-002, bc-hc-003 | HA for compute |
| Assume a paired region fails over automatically; no region pair; near-zero RTO for a global app; cheap DR with hours of RTO; benefits of region pairs | Design your own HA and DR (pairs don't fail over automatically); zones plus a chosen secondary; active-active with Front Door; backup and redeploy (cold standby); sequential updates and recovery priority | Relying on a paired region for automatic failover; cold standby for a near-zero RTO | bc-rg-001, bc-rg-002, bc-rg-003 | Regions and multi-region |
5. Retired or wrong-tier traps
A retired service and its replacement often both appear. If the question names a retired service, choose the current replacement, and check the date against the Retirement Timeline. Common ones:
- Basic Load Balancer and Application Gateway v1: retired. Use Standard Load Balancer and Application Gateway v2.
- Log Analytics agent (MMA): retired. Use Azure Monitor Agent with a data collection rule.
- Batch low-priority VMs: retired. Use Spot VMs.
- Azure Blueprints: retiring. Use Deployment Stacks; new definitions are blocked.
- Azure AD B2C: closed to new customers. Use Entra External ID.
- Azure Cache for Redis Basic, Standard and Premium: retiring. Use Azure Managed Redis.
- Azure Dedicated HSM: retiring, no new onboarding. Use Cloud HSM or Managed HSM.
- MySQL Single Server: retired. Use MySQL Flexible Server.
- Wrong tier, right service: Premium for messages over 256 KB; Business Critical for a free read replica; Standard v2 for VNet-integrated gateways; a Premium v2 or classic tier for VNet injection and multi-region.
Next steps: drill a topic with its Practice link, then check your answer against the method in How to Answer AZ-305 Questions. For facts and numbers, use the Decision Guides, Commonly Confused Pairs and Exam-Day Cram Sheet.