AZ-305 question patterns

Choose the managed service (SQL Database, App Service, Container Apps, Functions) over VMs and custom scripts.

Patching, scaling and failover are Microsoft's job on managed services.

Use a managed identity with RBAC, and workload identity federation for workloads outside Azure such as GitHub Actions.

Tokens are issued and rotated automatically, so there is no secret to leak.

Assign an Azure Policy initiative or RBAC role at a management group.

Assignments inherit to every subscription beneath, including ones added later.

Pick the service that matches the current protocol or engine: SQL Managed Instance, Azure Files for SMB, Azure VMware Solution, Domain Services.

Refactoring to a different service would need code changes.

Zone-redundant services for datacentre failure; add a second region with Front Door or Traffic Manager for regional failure.

Zones give 99.99% for VMs; a region loss needs a second region.

Create a diagnostic setting on the resource (or enforce it with a DeployIfNotExists policy).

Resource logs aren't collected until a setting routes them.

Send to a storage account, or use workspace long-term retention or Basic/Auxiliary table plans.

Interactive analytics retention is the expensive part.

Enable Sentinel on the Log Analytics workspace and use playbooks (Logic Apps).

It is the SIEM and SOAR service; Defender for Cloud is posture and workload protection.

Use PTA with agents; otherwise default to password hash sync. Use federation only for requirements Entra can't meet.

PHS is simplest and most resilient, PTA keeps the check on-premises.

Make roles eligible in Privileged Identity Management with time-bound activation, MFA and approval.

Just-in-time activation shrinks standing privilege.

Use an external tenant for customer identity; B2B guests are for partner staff.

External ID is built for customer-facing sign-up and sign-in.

Install Entra Application Proxy connectors and pre-authenticate with Conditional Access.

Connectors make outbound connections only, so no inbound firewall holes.

Schedule access reviews with auto-apply on groups, apps and roles.

Reviews remove stale access without manual hunting.

Use Managed HSM rather than Key Vault Standard or Premium.

It is a dedicated HSM cluster with customer-controlled security domain.

Enable both on Key Vault; it is required for customer-managed keys in most services.

Purge protection blocks purging during retention.

Assign a Deny or Modify policy via an initiative at the right scope.

Policy controls resource properties; RBAC controls who can act.

Apply a CanNotDelete lock.

Locks override RBAC for the locked action.

Use Managed Instance for near-complete SQL Server compatibility as PaaS.

SQL Database lacks these instance-level features.

Put the databases in an elastic pool to share compute.

Shared resources are cheaper than provisioning each for its peak.

Use the Hyperscale tier (up to 128 TB) with named replicas for read scale.

Decoupled storage makes size and backups largely independent of speed.

Use serverless compute with auto-pause.

Compute is billed per second and paused when idle.

Encrypt the columns with Always Encrypted, keys held by the client.

Dynamic masking only hides output; TDE decrypts for admins.

Use Cosmos DB for NoSQL with multi-region replication; Session consistency unless the scenario says otherwise.

Designed for global distribution and elastic scale.

Enable the hierarchical namespace on the storage account.

It adds directories, ACLs and atomic rename for analytics engines.

Use Azure Files with Azure File Sync and cloud tiering.

On-premises servers keep SMB access to hot files.

Use NetApp Files rather than standard Azure Files.

It provides sub-millisecond latency and very high throughput.

Add rules moving blobs Hot to Cool to Cold to Archive and deleting them.

Policy automation beats manual tiering.

Use RA-GRS or RA-GZRS (with zones for zone failures).

Read access to the secondary works without failover.

Replicate with Azure Site Recovery and orchestrate with recovery plans.

ASR provides continuous replication and failover; Backup only restores.

Use Backup with soft delete, immutable vault and Resource Guard.

Replication copies the corruption, backup keeps points in time.

Spread VMs across zones with a zone-redundant load balancer.

Availability sets give 99.95%.

Use a failover group with read-write and read-only listeners.

Listener endpoints stay the same after failover.

Configure LTR weekly, monthly and yearly policies (up to 10 years).

PITR only covers 1 to 35 days.

Use Azure Container Apps; AKS only when direct Kubernetes control is required.

It is serverless containers with KEDA scaling and revisions.

Use Service Bus queues or topics with sessions.

Queue Storage lacks ordering, transactions and topics.

Subscribe a Function or Logic App to the Event Grid event.

Event Grid routes discrete events; Event Hubs is for streams.

Front the backends with APIM policies.

Rate limiting, JWT validation and versioning are native.

Run a Batch pool on Spot nodes.

Batch schedules and scales the nodes for you.

Deploy the Azure Migrate appliance, run assessments and dependency analysis.

It discovers, right-sizes and estimates cost.

Use DMS online mode or the Managed Instance link.

Offline needs downtime during the copy.

Order Data Box (80 TB) or Data Box Heavy (770 TB).

Shipping beats weeks of network transfer.

Use ExpressRoute, with VPN as backup.

VPN crosses the internet with variable performance.

Use a Virtual WAN hub.

Managed routing replaces hand-built hubs.

Add a private endpoint with a private DNS zone and a DNS resolver.

Service endpoints keep a public IP and aren't reachable from on-premises.

Use Azure Front Door with WAF.

Global L7; Application Gateway is regional.

Use Traffic Manager (or cross-region Load Balancer).

DNS-based and protocol-agnostic.

Attach a NAT Gateway to the subnet.

Static public IPs and scalable SNAT.

Deploy Bastion in the VNet.

Connects over TLS with no inbound ports.

Use Data Factory pipelines with a self-hosted integration runtime.

The runtime reaches private sources the cloud service can't.

Ingest through Event Hubs and process with Stream Analytics or Spark.

Built for high-volume streaming.