AZ-305 Complete Exam Reference: Zero-Gap Pointer Guide

AZ-305 Complete Exam Reference

---

Domain 1 — Identity, Governance & Monitoring (25–30%)

Entra ID (Azure AD) Core

• Tenant = boundary for identity, billing, and administration.
• Custom domains replace .onmicrosoft.com for user sign-in.
• User types: Member (internal), Guest (B2B), External (B2C via separate tenant).
• Dynamic groups use rule-based membership; reduces manual administration.
• Administrative Units scope admin permissions to subsets of users/groups.

Authentication

• MFA requires two of: something you know, have, or are.
• Passwordless options: FIDO2 security keys, Microsoft Authenticator, Windows Hello for Business.
• FIDO2 = phishing-resistant hardware-based auth.
• Windows Hello for Business replaces passwords with biometrics/PIN tied to device.
• Temporary Access Pass (TAP) = time-limited password for onboarding passwordless.
• Certificate-based auth = smart card / PIV for high-security environments.

Hybrid Identity

• Microsoft Entra Connect Sync = on-prem AD → cloud sync; supports PHS, PTA, federation.
• Password Hash Sync (PHS) = hashes synced to cloud; enables leaked credential detection.
• Pass-through Authentication (PTA) = password validated against on-prem AD; no password hash in cloud.
• Federation (AD FS) = SAML / WS-Fed; highest complexity, supports third-party MFA.
• Seamless SSO = Kerberos-based silent sign-on for domain-joined devices.
• Microsoft Entra Cloud Sync = lightweight agent-based sync from multiple disconnected forests; replaces Connect for simple scenarios.
• Staging mode = secondary Connect server ready for failover.

Authorization & RBAC

• RBAC scopes: Management Group → Subscription → Resource Group → Resource.
• Role definitions = actions, notActions, dataActions, assignableScopes.
• Built-in roles: Owner (full control + RBAC), Contributor (full control no RBAC), Reader, User Access Administrator.
• Custom roles require Microsoft.Authorization/roleDefinitions/write at subscription scope.
• ABAC = attribute-based conditions on RBAC (e.g., blob path prefix).
• PIM (Privileged Identity Management) = just-in-time, time-bound, approval-based elevation.
• Access reviews = recurring attestation of group/role memberships.

Governance

• Management Groups = hierarchy for policy and billing aggregation; max depth = 6 levels.
• Azure Policy = enforce rules (deny, append, audit, deployIfNotExists, modify).
• Initiatives = grouped policies applied as a single assignment.
• Policy exemptions = scoped exclusions with expiration.
• Resource locks: CanNotDelete and ReadOnly; override RBAC.
• Azure Blueprints = deprecated; use Template Specs or Deployment Stacks.
• Template Specs = versioned ARM templates stored in Azure for reuse.
• Deployment Stacks = atomic deployment + cleanup of resources outside template.
• Tags: max 50 per resource; use for cost allocation, environment, owner.
• Cost Management + Billing: budgets, cost alerts, anomaly detection, reservation recommendations.
• Savings Plans = commit to hourly spend for compute; more flexible than Reserved Instances.
• Reservations = commit to 1 or 3 years for VM, SQL, App Service; up to 72% savings.
• Azure Hybrid Benefit = apply existing Windows Server / SQL licenses to Azure for discount.

Monitoring

• Azure Monitor = unified observability platform.
• Log Analytics Workspace = central log repository; pay per ingestion + retention.
• Basic Logs tier = reduced cost for high-volume verbose logs; no KQL alerts.
• Analytics Logs tier = full KQL, alerts, 90-day default retention.
• Data Collection Rules (DCR) = declarative ingestion and transformation; replaces MMA direct configuration.
• Azure Monitor Agent (AMA) = replaces MMA/Legacy Log Analytics agent; supports DCR.
• VM Insights = dependency map + performance via AMA.
• Container Insights = Prometheus + container stdout/stderr collection.
• Application Insights = APM for web apps; distributed tracing, smart detection, availability tests.
• Availability tests: URL ping (deprecated), Standard test, Custom TrackAvailability(), Multi-step web test.
• Metric alerts: static threshold, dynamic threshold (ML-based).
• Log alerts: metric measurement, number of results.
• Activity log alerts: subscription-level events (create/delete/change).
• Action Groups: email, SMS, push, voice, webhook, ITSM, Logic App, Function, Runbook.
• Workbooks = interactive visual reports.
• Dashboards = pinned tiles across services.
• NSG Flow Logs v2 = stored in Storage Account or Event Hub; use Traffic Analytics for insights.
• Traffic Analytics = NSG flow analysis with GeoIP, topology, traffic volume.
• Diagnostic Settings = send platform logs/metrics to Log Analytics, Storage, Event Hub, or Partner solution.

---

Domain 2 — Data Storage Solutions (20–25%) — Zero-Gap Deep Dive

Storage Accounts — Foundation

• Standard = HDD-backed; Blob, File, Table, Queue.
• Premium = SSD-backed; Block Blobs, File Shares, Page Blobs (disks).
• Redundancy ladder: LRS → ZRS → GRS → GZRS → RA-GRS → RA-GZRS.
• LRS = 3 copies in one datacenter.
• ZRS = 3 copies across 3 availability zones in one region.
• GRS = LRS + async replication to paired region.
• GZRS = ZRS + async replication to paired region.
• RA-GRS / RA-GZRS = read access to secondary endpoint.
• Failover = manually promote secondary to primary; RPO ≈ 15 minutes for GRS.
• Object replication = async blob replication between storage accounts (any region, any tier).
• Immutable storage = WORM via legal hold or time-based retention.
• Legal hold = indefinite until explicitly cleared; tags required.
• Time-based retention = locked policy prevents deletion/modification for N days.
• Soft delete: Blobs (7–365 days), Containers (7–365 days), File Shares (1–120 days).
• Versioning = automatic blob versions on overwrite/delete.
• Hierarchical namespace = enables ADLS Gen2 semantics; required for big data analytics.
• Firewall = IP rules, VNet service endpoints, private endpoints.
• Custom domains = map CNAME to blob/file endpoint with HTTPS via CDN.

Blob Storage

• Tiers: Hot (frequent access), Cool (30 days min), Archive (180 days min).
• Archive = lowest $/GB; highest access cost and rehydrate latency (hours).
• Rehydrate priority: Standard (up to 15 hrs), High (up to 1 hr for <10 GB).
• Lifecycle management policies = auto-tier based on age, last modified, blob index tags.
• Blob Index = key-value metadata for categorization and policy targeting.
• Block Blobs = default for unstructured data; upload via blocks + commit.
• Append Blobs = optimized for logging; only add blocks.
• Page Blobs = 512-byte pages; used for VHDs / managed disks.
• Snapshot = read-only point-in-time copy; billed at full rate.
• Blobfuse = mount Blob storage as Linux file system.

Azure Files

• Tiers: Transaction-optimized (default), Hot, Cool (min 15 days).
• Protocols: SMB (3.1.1 with AES-256), NFS (4.1, Premium only).
• SMB Multichannel = multiple NICs per VM for higher throughput (Premium).
• Azure File Sync = cache on-prem file server; cloud tiering keeps hot data local.
• Cloud tiering = store infrequently accessed files in Azure; recall on demand.
• Large file shares = up to 100 TiB; requires LRS/ZRS.
• Identity: AD DS authentication (on-prem), Microsoft Entra DS authentication, Entra Kerberos.
• Backup: Azure Backup uses file share snapshots; no agent required.

Managed Disks

• Disk types: Standard HDD, Standard SSD, Premium SSD, Premium SSD v2, Ultra Disk.
• Premium SSD v2 = sub-ms latency, granular IOPS/throughput, no bursting needed.
• Ultra Disk = highest IOPS (160K), lowest latency, zone-redundant, NVMe.
• Disk roles: OS disk, Data disk, Temp disk (ephemeral, local SSD).
• Shared disks = SCSI Persistent Reservations for clustered apps (SQL FCI, SAP ASCS).
• Disk bursting = credit-based burst above baseline for Premium SSD.
• Performance tiers = change tier without data movement (P10 → P20).
• Encryption: SSE with PMK (platform-managed), CMK (customer-managed in Key Vault / Managed HSM), ADE (Azure Disk Encryption via VM guest agent).
• Disk Access = secure private access for import/export via private endpoints.
• Snapshots = crash-consistent for OS, application-consistent via Azure Backup.
• Incremental snapshots = only delta since last snapshot; cost efficient.

Azure Data Lake Storage Gen2

• Built on Blob Storage = adds hierarchical namespace + POSIX ACLs.
• ACLs: Access ACLs (files/folders) + Default ACLs (inherited by new children).
• Permission model: RBAC (coarse, Azure roles) + ACL (fine-grained, POSIX).
• ABFS driver = abfss:// URI for Spark/Hadoop.
• Optimizations: high-throughput partitions, directory-level atomic operations.

SQL Solutions

Service	Model	Best For	Key Limitation
Azure SQL DB	PaaS	New cloud apps, elastic scale	No SQL Agent, no linked servers
SQL Managed Instance	PaaS	Lift-and-shift, linked servers, SQL Agent	VNet-only, no public endpoint by default
SQL VM	IaaS	Full control, legacy features	Patch/manage OS + SQL yourself
Azure SQL Edge	Container	IoT, edge compute	ARM64/x64, T-SQL subset

• Azure SQL Database tiers:
  • DTU: Basic, Standard, Premium; bundled compute + storage.
  • vCore: General Purpose (remote storage), Business Critical (local SSD, 3 HA replicas), Hyperscale (de-coupled storage, 100 TB).
  • Serverless = auto-pause after inactivity; pay per second used.
  • Elastic Pools = share resources among multiple databases with variable load.
• Hyperscale = separate compute, log, page servers; instant backups, fast scaling.
• Read replicas = HA secondary in BC tier; geo-replicas in paired region.
• Failover groups = automatic geo-failover; listener endpoint abstracts primary/secondary.
• TDE = transparent data encryption; on by default (service-managed key).
• Always Encrypted = client-side encryption; column master key in Key Vault.
• Dynamic Data Masking = obfuscate non-privileged users.
• Row-Level Security = predicate-based access control.
• Advanced Threat Protection = anomaly detection, SQL injection alerts.
• Ledger = tamper-evident tables for blockchain-like integrity.
• Migration tools:
  • DMA = assess and migrate schema/data to SQL DB / MI.
  • DMS = online migration with minimal downtime; supports SQL, MySQL, PostgreSQL, MongoDB.
  • Azure Migrate = discovery, assessment, dependency mapping for SQL VMs.

Cosmos DB

• APIs: SQL (Core), MongoDB, Cassandra, Gremlin, Table.
• Consistency levels (strongest → weakest): Strong, Bounded Staleness, Session, Consistent Prefix, Eventual.
• Session = default; read-your-writes within same session token.
• Bounded Staleness = K versions or T seconds lag; global distribution with predictability.
• Partition key = logical partition boundary; must be high cardinality.
• Logical partitions = max 20 GB per partition key value.
• Physical partitions = backend split based on 10K RU/s or 50 GB storage.
• Throughput: Manual (fixed RU/s) or Autoscale (10–1000% of max).
• RU/s = normalized measure of compute; 1 RU = read 1 KB document with 10 fields.
• Analytical Store = columnar T-SQL for Spark/Synapse; no ETL, no impact on transactional.
• Change Feed = ordered log of inserts/updates; no deletes; use for event sourcing, CQRS.
• Global distribution = multi-region writes (multi-master) or single-region writes.
• Conflict resolution: Last-Writer-Wins (LWW) or custom (stored procedure).
• Backup: Periodic (default 4 hrs, 2 retained) or Continuous (point-in-time, 7–30 days).
• Point-in-time restore = requires continuous backup policy.
• Materialized views = Cassandra API feature for pre-aggregated queries.

Azure Cache for Redis

• Tiers: Basic (single node, no SLA), Standard (2-node replicated), Premium (clustering, persistence, VNet), Enterprise (Redis modules, active geo-replication).
• Clustering = shard data across multiple nodes; requires Premium+.
• Persistence = AOF (append-only file, every write) or RDB (snapshot, interval).
• Geo-replication = linked primary/replica pair across regions.
• Private Link = secure access without public IP.
• Eviction policies: allkeys-lru, volatile-lru, noeviction, etc.

PostgreSQL / MySQL / MariaDB

• Flexible Server = recommended; zone-redundant HA, private access, burstable SKUs.
• Single Server = deprecation path; migrate to Flexible Server.
• Hyperscale (Citus) = PostgreSQL horizontal scaling; coordinator + worker nodes.
• Read replicas = async replication for read scaling; up to 5 replicas.
• Private Link = private endpoint access to Flexible Server.

Azure AI Search (Cognitive Search)

• Indexes = inverted index for full-text search.
• Indexers = auto-crawl data sources (Blob, SQL, Cosmos DB, ADLS).
• Skillsets = AI enrichment (OCR, entity recognition, image analysis).
• Scoring profiles = boost relevance by field value or freshness.
• Knowledge Store = persist enriched documents to Blob/Table for Power BI.

---

Domain 3 — Business Continuity Solutions (15–20%)

Azure Backup

• RS vault = Recovery Services vault; stores backup data for VMs, SQL in VM, SAP HANA, File Shares, MARS agent, MABS, DPM.
• Backup policies: schedule, retention (daily/weekly/monthly/yearly), GFS.
• Immutable vault = lock for 1–5 years; prevents malicious deletion.
• Soft delete = 14-day retention after deletion; reversible.
• Cross Region Restore (CRR) = restore from secondary region for GRS vaults.
• MARS agent = backup on-prem Windows files/folders/system state to Azure.
• MABS / DPM = disk-to-disk-to-cloud backup for on-prem workloads.
• File Share backup = snapshot-based; no agent on VM.
• SQL in VM backup = workload-aware; log truncation supported.
• SAP HANA backup = native HANA backint integration.
• Encryption: backup data encrypted at rest by default; optional CMK.

Azure Site Recovery (ASR)

• Scenarios: VMware → Azure, Hyper-V → Azure, Physical → Azure, Azure → Azure.
• Replication = async; crash-consistent every 5 minutes, app-consistent via VSS every 1 hour.
• Recovery Point Objective (RPO) = max data loss window; typically < 15 minutes.
• Recovery Time Objective (RTO) = time to bring workload online; depends on automation.
• Recovery Plans = orchestrated failover sequence; pre/post actions via Automation Runbooks.
• Network mapping = map source VM networks to target VNets.
• Capacity planning = use Deployment Planner for VMware/Hyper-V.
• Mobility Service = agent installed on replicated VM.
• Process Server = handles replication for VMware; compresses, encrypts, caches.
• Configuration Server = coordinates replication; includes Process Server.
• Azure-to-Azure = no on-prem infrastructure; zone-to-zone or region-to-region.

High Availability Patterns

• Availability Sets = FD (fault domain) + UD (update domain); not zone-aware.
• Availability Zones = physically separate datacenters within region; 1, 2, or 3 zones.
• Proximity Placement Groups (PPG) = co-locate VMs for low latency.
• Capacity Reservations = reserve compute capacity in advance for guaranteed availability.
• VM Scale Sets = identical VM orchestration; Uniform (load balanced) or Flexible (availability-like).
• Orchestration modes: Uniform (5 NICs max, LB required), Flexible (up to 1000 VMs, mixing sizes).
• Autoscale = metric-based or schedule-based scale out/in.
• Load Balancer SKUs: Basic (legacy, no AZ), Standard (zone-redundant, HA ports, 5-tuple).
• Application Gateway: Layer 7 load balancing; WAF, SSL termination, path-based routing, private link.
• SQL HA: Always On AG (SQL MI BC), Failover Groups (geo), FCI (shared disk on VM).

Chaos & Resilience

• Azure Chaos Studio = fault injection against VMs, AKS, Network, Cosmos DB.
• Experiments = actions (CPU pressure, network latency, POD kill) + targets + duration.

---

Domain 4 — Infrastructure Solutions (30–35%)

Compute — VMs

• VM generations: Gen 1 (BIOS), Gen 2 (UEFI, Secure Boot, vTPM, larger disks).
• VM sizes: General purpose (Dsv5), Compute optimized (Fsv2), Memory optimized (Esv5), Storage optimized (Lsv2), GPU (NC, ND, NV), High performance compute (HB, HC).
• Constrained vCPU = reduce cores to save licensing cost while keeping memory.
• Burstable (B-series) = baseline CPU with credits; ideal for dev/test.
• Spot VMs = up to 90% discount; evictible with 30-second notice.
• Azure Dedicated Host = physical server dedicated to you; visibility/control over maintenance.
• Isolated sizes = guaranteed single-tenant hardware.
• Azure Hybrid Benefit = apply Windows Server / SQL licenses to VMs.
• Reserved Instances = 1 or 3-year commitment; up to 72% off pay-as-you-go.
• Savings Plans = 1 or 3-year compute commitment; flexible across regions, sizes.
• Temp disk = local SSD; ephemeral; do not store persistent data.
• Custom Script Extension = post-deploy automation via PowerShell/Bash.
• Desired State Configuration (DSC) = declarative VM configuration via PowerShell.
• Disk encryption: ADE (BitLocker/dm-crypt), SSE (platform), CMK (customer key).
• Azure Automanage = best-practice configuration for VMs (backup, monitoring, updates).

Compute — Containers

• Azure Kubernetes Service (AKS):
  • Node pools: System (min 1, required) + User (workload).
  • Network models: Kubenet (default, node gets IP from VNet, pods NATed) vs Azure CNI (pod gets VNet IP; plan IP carefully).
  • Azure CNI Overlay = pod IPs outside VNet; solves IP exhaustion.
  • Ingress: NGINX, Application Gateway, Traefik, Istio (service mesh).
  • Scaling: Cluster Autoscaler (node), HPA (pod), VPA (pod resources), KEDA (event-driven).
  • Private cluster = API server private endpoint only.
  • Uptime SLA = 99.95% for API server; free tier = 99.9%.
  • Azure Policy for AKS = gate deployments via OPA/Gatekeeper.
• Azure Container Instances (ACI):
  • Fastest container startup; billed per second.
  • Container Groups = multi-container sharing lifecycle, network, storage.
  • Virtual Network integration = deploy to subnet.
  • Use case: burst scaling, simple tasks, dev test.
• Azure Container Apps (ACA):
  • Serverless microservices; built-in KEDA + Dapr.
  • Environments = network boundary; multiple apps per environment.
  • Revisions = immutable deployment versions; traffic splitting.
  • Ingress = built-in HTTP; custom domains, bring your own certificates.
• Azure Container Registry (ACR):
  • SKUs: Basic, Standard, Premium (geo-replication, content trust, private link).
  • Tasks = build images in Azure; base image update triggers.
  • ACR Cache = pull-through cache for public images.

Compute — App Service

• App Service Plans: Free, Shared, Basic, Standard, Premium (v2/v3), Isolated (ASE).
• Premium v3 = best price/performance; supports private endpoints, zone redundancy.
• ASE (App Service Environment) = single-tenant stamps; VNet injection; ASE v3 = no subnet delegation complexity.
• Scaling: Scale Up (bigger SKU) vs Scale Out (more instances).
• Autoscale = metric-based (CPU, memory, queue depth) or schedule-based.
• Deployment Slots = staging environments; swap with zero downtime.
• Networking: VNet integration (regional), Private Endpoints, Hybrid Connections (on-prem TCP via Relay).
• Custom domain + TLS: free managed cert, App Service cert, or Key Vault cert.
• Diagnostics: App Service logs, Application Insights, Log Stream.
• Backup: built-in backup to Storage Account; manual or scheduled.

Networking

• Virtual Network (VNet) = Layer 2 isolation; regional; non-overlapping RFC 1918 addresses.
• Subnets = segment VNet; NSG + Route Table association.
• Network Security Group (NSG) = 5-tuple rules (source, dest, port, protocol, action); stateful.
• Application Security Group (ASG) = group VMs as source/destination in NSG without IP.
• Service Endpoints = extend VNet identity to Azure PaaS; traffic stays Azure backbone.
• Private Link / Private Endpoint = private IP for PaaS in your VNet; gold standard for security.
• Private Link Service = expose your service privately to other VNets/tenants.
• VNet Peering = connect VNets; transitive via hub-spoke + NVA or Azure Firewall.
• Gateway Transit = allow peered VNet to use VPN/ExpressRoute gateway in hub.
• VPN Gateway:
  • Policy-based: static routing; limited to 1 S2S tunnel.
  • Route-based: dynamic routing; BGP support; preferred.
  • Active-Active = two public IPs, two tunnels for HA.
  • P2S: IKEv2, OpenVPN, SSTP; certificate or RADIUS/MFA auth.
  • S2S: IPsec tunnel; BGP for dynamic routes.
  • VNet-to-VNet = route-based VPN between VNets.
• ExpressRoute:
  • Private Peering = connect to VNets.
  • Microsoft Peering = connect to Microsoft 365 / PaaS public endpoints.
  • Global Reach = connect on-prem sites via ExpressRoute without VNet transit.
  • FastPath = bypass gateway for data path; lower latency.
  • Local SKU = connect to same metro region; cheapest.
  • Standard / Premium = add global connectivity, more VNet links, higher bandwidth.
• Azure Virtual WAN = hub-and-spoke as a managed service; transitive routing, any-to-any.
• Azure Firewall:
  • Standard = L3-L7, threat intelligence, NAT, forced tunneling.
  • Premium = TLS inspection, IDPS, URL filtering, web categories.
  • Firewall Policy = centralized rule management across multiple firewalls.
  • Forced Tunneling = route all Internet traffic via on-prem for inspection.
• Azure Front Door:
  • Global HTTP/S load balancer; edge-based WAF.
  • Rules Engine = route based on header, path, device.
  • Caching = CDN-like behavior at edge.
  • Private Link origins = secure backend via Private Link.
• Application Gateway:
  • Standard = L7, SSL offload, path-based, multi-site.
  • WAF = OWASP Core Rule Set, bot protection, custom rules.
  • Autoscaling = dynamic instance count.
  • Private Front End = internal-only apps.
• Azure Load Balancer:
  • Standard = HA ports, zone-redundant, high availability.
  • Health Probes = TCP, HTTP, HTTPS; determine backend health.
  • Outbound Rules = explicit SNAT configuration.
• Traffic Manager = DNS-based global routing; profiles: Priority, Weighted, Performance, Geographic, Multivalue, Subnet.
• Azure DNS: Public zones + Private DNS Zones (VNet-linked, auto-registration).
• NAT Gateway = scalable outbound SNAT; static public IP; prevents SNAT port exhaustion.
• Route Server = BGP exchange with NVAs; simplifies dynamic routing.
• Bastion = RDP/SSH over TLS via browser; no public IP on VM.
• DDoS Protection: Basic (free, automatic) vs Standard (advanced mitigation, cost protection).
• Network Watcher = Connection Monitor, NSG Flow Logs, Packet Capture, IP Flow Verify, Next Hop, VPN diagnostics.

Integration & Messaging

• Azure Service Bus:
  • Queues = point-to-point; FIFO via Sessions.
  • Topics & Subscriptions = pub/sub; filters (SQL, Correlation).
  • Tiers: Basic (queues only), Standard, Premium (VNet, JMS, geo-disaster recovery).
  • Dead-letter queue = poison pill handling.
  • Duplicate detection = idempotent sends.
• Azure Event Grid:
  • Event routing; serverless.
  • Topics: System (Azure resources), Custom (application).
  • Event Handlers: Functions, Logic Apps, Webhooks, Event Hubs, Service Bus, Storage Queues.
  • Filters: event type, subject begins/ends with, advanced (data fields).
• Azure Event Hubs:
  • Big data streaming; partitioned.
  • Throughput units = 1 MB/s ingress, 2 MB/s egress per TU.
  • Partitions = parallel consumers; max 32.
  • Capture = auto-write to Blob/Data Lake for long-term retention.
  • Dedicated = single-tenant, 10+ TUs.
  • Kafka protocol = Kafka client can connect directly.
• Logic Apps:
  • Low-code workflow; connectors for SaaS, PaaS, on-prem.
  • Consumption = serverless, pay per action.
  • Standard = single-tenant, VNet integration, fixed pricing.
  • Integration Service Environment (ISE) = deprecated; use Standard.
• API Management:
  • Tiers: Developer, Basic, Standard, Premium (VNet, multi-region).
  • Policies: inbound, backend, outbound, on-error (CORS, caching, rate-limit, transformation).
  • Products = group APIs with terms + rate limits.
  • Subscriptions = consumer access keys.
  • Self-hosted gateway = deploy APIM gateway on-prem/Kubernetes.

Migration

• Azure Migrate:
  • Discovery: agentless appliance for VMware, Hyper-V, physical.
  • Assessment: readiness, sizing, cost estimate, dependency mapping.
  • Migration: server migration, database migration (DMS), web app migration.
  • Movere = acquired by Microsoft; now part of Azure Migrate.
• Azure Data Box:
  • Data Box Disk = 40 TB; small datasets.
  • Data Box = 100 TB; rack-shipped appliance.
  • Data Box Heavy = 1 PB; for massive seeding.
  • Data Box Gateway = virtual appliance for ongoing network data transfer.
  • Data Box Edge = with compute capabilities (now Azure Stack Edge).
• Storage Migration Service = migrate on-prem file shares to Azure Files or Windows Server.

Security & Secrets

• Azure Key Vault:
  • Secrets: passwords, connection strings, tokens.
  • Keys: encryption keys (RSA, EC); HSM-backed or software.
  • Certificates: import or auto-renewal via DigiCert/GlobalSign integration.
  • Soft-delete = recoverable deletion; on by default.
  • Purge protection = enforce retention until period expires.
  • Private Link = access vault from VNet only.
  • RBAC vs Access Policies: RBAC (recommended) or legacy access policies.
• Managed Identities:
  • System-assigned = tied to resource lifecycle; 1:1.
  • User-assigned = standalone; shared across resources.
  • Use: authenticate to Key Vault, Storage, SQL, etc., without secrets in code.
• Microsoft Defender for Cloud:
  • Secure Score = posture assessment across subscriptions.
  • Defender plans: Servers, Storage, SQL, Containers, App Service, DNS, Key Vault, etc.
  • Just-in-time (JIT) access = lock down VM management ports; request on-demand.
  • Adaptive Application Controls = whitelist safe apps via ML.
  • File Integrity Monitoring = track OS and registry changes.

Mermaid Diagrams

Hub-and-Spoke Topology

graph TD
    A[On-Premises] -->|ExpressRoute| B[Azure Firewall / NVA]
    B --> C[Hub VNet: 10.0.0.0/16]
    C -->|Peering| D[Spoke 1: Web: 10.1.0.0/16]
    C -->|Peering| E[Spoke 2: Data: 10.2.0.0/16]
    C -->|Peering| F[Spoke 3: Identity: 10.3.0.0/16]
    D -->|Private Endpoint| G[Azure SQL DB]
    E -->|Private Endpoint| H[Azure Storage]
    F -->|Private Endpoint| I[Key Vault]

SQL High Availability

graph LR
    A[Primary Region] -->|Failover Group| B[Secondary Region]
    A --> C[Azure SQL DB / MI]
    B --> D[Azure SQL DB / MI Replica]
    C -->|Sync| E[Availability Zone 1]
    C -->|Sync| F[Availability Zone 2]
    C -->|Sync| G[Availability Zone 3]

Backup Architecture

graph TD
    A[VMs / SQL / Files] -->|Backup Data| B[Recovery Services Vault]
    B -->|LRS/ZRS| C[Primary Region Storage]
    B -->|GRS/GZRS| D[Secondary Region Storage]
    B -->|Immutable| E[Locked Vault]
    B -->|Soft Delete| F[14-Day Retention]

Cosmos DB Global Distribution

graph LR
    A[Write Region: West US] -->|Async| B[Read Region: East US]
    A -->|Async| C[Read Region: West Europe]
    A -->|Async| D[Read Region: Southeast Asia]
    B -->|Conflict Resolution| A

---

Quick Decision Tables

When to Choose What — Storage

Requirement	Choose
Lowest cost, rarely accessed, hours retrieval	Blob Archive + GRS
SMB file shares, lift-and-shift, AD auth	Azure Files Premium + Entra Kerberos
100 TB+ file shares, on-prem cache	Azure File Sync + Cool tier
Hadoop/Spark analytics, ACLs	ADLS Gen2
Sub-millisecond latency, 160K IOPS	Ultra Disk
SQL FCI shared storage	Premium SSD + Shared Disk
Immutable audit logs	Blob + Time-based Retention + Legal Hold

When to Choose What — SQL

Requirement	Choose
New app, no SQL Agent, elastic scale	Azure SQL Database Hyperscale
Linked servers, SQL Agent, minimal changes	SQL Managed Instance Business Critical
Full OS control, third-party backup agents	SQL VM + Always On AG
IoT/edge, containerized	Azure SQL Edge
Multi-tenant SaaS, variable load	Elastic Pool

When to Choose What — Compute

Requirement	Choose
Microservices, serverless, event-driven	Container Apps
Kubernetes, complex orchestration	AKS
Simple burst container, no orchestration	ACI
Legacy .NET app, quick deploy	App Service
Full control, bring own license	VM + Hybrid Benefit

When to Choose What — Network Security

Requirement	Choose
Filter by IP/port, 5-tuple	NSG
Filter by application path, SSL offload	Application Gateway
Global HTTP/S + WAF + CDN	Front Door
East-west + southbound L3-L7 + threat intel	Azure Firewall
Private access to PaaS from VNet	Private Endpoint
DNS-based global routing	Traffic Manager

---

Key CLI / PowerShell Snippets

# Create ZRS storage account
az storage account create \
  --name mystorage \
  --resource-group myRG \
  --sku Standard_ZRS \
  --kind StorageV2 \
  --enable-hierarchical-namespace true

# Enable blob versioning and soft delete
az storage account blob-service-properties update \
  --account-name mystorage \
  --enable-versioning true \
  --delete-retention-days 7 \
  --container-delete-retention-days 7

# Create SQL failover group
$failoverGroup = New-AzSqlDatabaseFailoverGroup `
  -ResourceGroupName myRG `
  -ServerName primaryServer `
  -FailoverGroupName myFG `
  -PartnerResourceGroupName myRG `
  -PartnerServerName secondaryServer `
  -FailoverPolicy Automatic `
  -GracePeriodWithDataLossHours 1

# Add database to failover group
Add-AzSqlDatabaseToFailoverGroup `
  -ResourceGroupName myRG `
  -ServerName primaryServer `
  -FailoverGroupName myFG `
  -DatabaseName myDB

# Create AKS with Azure CNI
az aks create \
  --resource-group myRG \
  --name myAKS \
  --network-plugin azure \
  --network-policy azure \
  --node-count 3 \
  --generate-ssh-keys

---

Final Checklist — Before You Sit the Exam

• Can you draw hub-and-spoke with Firewall, UDR, and Private Endpoints?
• Can you explain why GZRS beats GRS for zonal failures but still needs failover for region?
• Can you pick between SQL DB, MI, and VM in under 10 seconds?
• Do you know the difference between Azure Policy (prevent) and RBAC (allow)?
• Can you map RPO/RTO to Backup, ASR, and Always On?
• Do you know when to use Front Door vs Traffic Manager vs App Gateway vs Load Balancer?
• Can you explain Cosmos consistency levels with real-world tradeoffs?
• Do you know the difference between Private Endpoint and Service Endpoint?
• Can you calculate whether Reserved Instances or Savings Plans fit a workload?
• Do you know the backup SLA and retention limits for each Azure service?

End of Reference.

---

🚀 Ready to get hands-on? Spin up an interactive AI or Kubernetes Sandbox at Aicademy Labs for free.