AZ-305 Study Material
Final Exam Attack Plan
Architect sprint protocol — decision matrices, comparison tables, and golden rules for infrastructure design scenarios.
Decision 1: SQL Database vs Managed Instance vs SQL on VM
Need near 100% SQL Server compatibility (Agent, CLR, linked servers)?
├── YES → SQL Managed Instance
│ └── Need VNet isolation? → MI in dedicated delegated subnet
└── NO → New cloud-native app?
├── YES → Azure SQL Database
└── Need full OS/SQL Server control? → SQL on VM (IaaS)
| Factor | SQL Database | Managed Instance | SQL on VM |
|---|---|---|---|
| SQL Agent | ❌ | ✅ | ✅ |
| VNet native | PE only | ✅ | ✅ |
| Lift-and-shift | Partial | Best | Full |
Decision 2: Hub-and-Spoke vs Virtual WAN
How many locations / VNets? ├── 1 region, <10 VNets → Hub-and-Spoke ├── Multi-region, 5+ branches / global mesh → Virtual WAN └── Need SD-WAN integration? → vWAN + VPN/ER sites
Decision 3: ExpressRoute vs VPN vs ER+VPN
├── <200 Mbps, cost-sensitive → Site-to-Site VPN ├── 99.99% SLA, dedicated bandwidth → ExpressRoute + VPN backup └── Encryption on dedicated circuit? → MACsec or VPN over ER
Decision 4: Compute Platform Selection
├── Web/API, minimal ops → App Service ├── Event-driven → Azure Functions ├── Containers / microservices → AKS or Container Apps ├── Legacy monolith → VMs / VMSS └── Long-running workflows → Durable Functions / Logic Apps
Decision 5: Cosmos DB Consistency Level
├── NO stale reads (financial) → Strong / Bounded Staleness ├── Within user session → Session (most common) ├── Global reads, lowest latency → Eventual / Consistent Prefix └── Multi-region writes → Session + LWW conflict resolution
Decision 6: DR Strategy Selection
├── RTO hours, RPO hours → Backup & Restore ├── RTO minutes, RPO minutes → Warm Standby (ASR) └── RTO seconds, RPO near-zero → Active-Active (multi-region)
Decision 7: Private Endpoint vs Service Endpoint
Need on-premises private access?
├── YES → Private Endpoint + Private DNS Zone
└── VNet-only?
├── Cost-sensitive → Service Endpoint
└── Exfiltration protection → Private Endpoint
Decision 8: Load Balancing Selection
├── L4 regional → Azure Load Balancer ├── L7 regional + WAF → Application Gateway v2 ├── L7 global + CDN → Azure Front Door └── DNS routing only → Traffic Manager
Storage Replication
| Option | Zone Safe | Region Safe | Read Secondary |
|---|---|---|---|
| LRS | ❌ | ❌ | ❌ |
| ZRS | ✅ | ❌ | ❌ |
| GZRS | ✅ | ✅ | ❌ |
| RA-GZRS | ✅ | ✅ | ✅ |
Event Services
| Service | Pattern | Throughput |
|---|---|---|
| Event Grid | Push (reactive) | Medium |
| Event Hubs | Stream (ingestion) | Very High |
| Service Bus | Queue/Topic | Medium |
Hybrid Identity
| Method | Password in Cloud | On-Prem Validation |
|---|---|---|
| PHS | Hash only | No |
| PTA | No | Yes (agent) |
| Federation | No | Yes (AD FS) |
Read the prompt. Think. Reveal the rule.
Rule 1
Lift-and-shift SQL with Agent / linked servers?
Managed Instance — not SQL Database
Rule 2
Can spoke A reach spoke B through the hub by default?
NO — peering is non-transitive; use hub UDR
Rule 3
Does ExpressRoute encrypt traffic by default?
NO — add MACsec or VPN over ER
Rule 4
ZRS vs GRS — what failure does each cover?
ZRS = zone failure; GRS/GZRS = regional disaster
Rule 5
Does PIM eligible role grant access immediately?
NO — must activate eligible assignment first
Rule 6
Policy Deny vs RBAC Allow — which wins?
Policy Deny blocks at resource creation
Rule 7
Which AZ-305 domain has highest weight?
Domain 4 Infrastructure — 30–35%
Rule 8
Every architect answer should map to?
A Well-Architected Framework pillar
Rule 9
Hybrid PaaS access from on-premises?
Private Endpoint — Service Endpoint is VNet-only
Rule 10
When to choose Virtual WAN over hub-spoke?
5+ branches or multi-region mesh at scale