📋 AZ-305 QUICK REFERENCE CHEAT SHEET
Golden Rules, Critical Numbers, and Comparison Tables
Print this or keep it open during final review. One page per section recommended.
WELL-ARCHITECTED FRAMEWORK
| Pillar | Key Question | Azure Tools |
|---|
| -------- | ------------- | ------------- |
| Cost Optimization | Paying for what we need? | RI, Spot, lifecycle policies, Advisor |
| Operational Excellence | Can we run it reliably? | IaC, Monitor, Automation, CI/CD |
| Performance Efficiency | Fast enough at scale? | CDN, Redis, autoscale, right-sizing |
| Reliability | Survives failure? | AZ, ASR, failover groups, GZRS |
| Security | Data and access protected? | MI, PE, Firewall, Policy, Key Vault |
DOMAIN 1: IDENTITY, GOVERNANCE, MONITORING
Entra ID Licences
| Feature | P1 | P2 |
|---|
| --------- | :--: | :--: |
| Conditional Access | ✅ | ✅ |
| PIM | ❌ | ✅ |
| Identity Protection | ❌ | ✅ |
Hybrid Identity
| Method | Password in Cloud | Best For |
|---|
| -------- | :-----------------: | ---------- |
| PHS | Hash | Default hybrid |
| PTA | No | On-prem validation |
| Cloud Sync | Hash | Multi-forest, light footprint |
| Federation | No | AD FS claims |
Azure Policy Effects
| Effect | Action |
|---|
| -------- | -------- |
| Audit | Log only |
| Deny | Block creation |
| DeployIfNotExists | Auto-deploy (needs MI) |
| Modify | Change tags/properties |
Monitoring Stack
Resources → Diagnostic Settings → Log Analytics → Alerts → Action Groups
DOMAIN 2: DATA STORAGE
SQL Family
| SQL DB | MI | SQL VM |
|---|
| --- | :---: | :---: | :---: |
| Agent | ❌ | ✅ | ✅ |
| VNet | PE | Native | Native |
| Ops | Low | Low | High |
| Lift-shift | Partial | Best | Full |
Cosmos DB Consistency
| Level | Reads Stale? | Cost |
|---|
| ------- | :------------: | :----: |
| Strong | Never | $$$$ |
| Session | Other sessions | $$ |
| Eventual | Yes | $ |
Storage Replication
| Zone | Region | Read 2nd |
|---|
| --- | :---: | :---: | :---: |
| LRS | ❌ | ❌ | ❌ |
| ZRS | ✅ | ❌ | ❌ |
| GRS | ❌ | ✅ | ❌ |
| GZRS | ✅ | ✅ | ❌ |
| RA-GRS | ❌ | ✅ | ✅ |
Blob Tiers
Hot → Cool (30d) → Cold (90d) → Archive (180d)
DOMAIN 3: BUSINESS CONTINUITY
DR Strategies (cost ↑, RTO ↓)
Backup → Pilot Light → Warm Standby → Hot Standby → Active-Active
HA: AZ vs AS
| Availability Set | Availability Zone |
|---|
| --- | :---: | :---: |
| Protects | Rack failure | DC failure |
| SLA | 99.95% | 99.99% |
| Cost | Free | Zone IP cost |
SQL DR
| Feature | Failover |
|---|
| --------- | ---------- |
| Geo-replication | Manual |
| Auto-failover group | Automatic |
Load Balancing
| Service | Layer | Scope |
|---|
| --------- | :-----: | ------- |
| Load Balancer | L4 | Regional |
| App Gateway | L7 | Regional |
| Front Door | L7 | Global |
| Traffic Manager | DNS | Global |
DOMAIN 4: INFRASTRUCTURE
Compute Selection
| Workload | Service |
|---|
| ---------- | --------- |
| Web/API PaaS | App Service |
| Serverless | Functions |
| Containers K8s | AKS |
| Simple containers | Container Apps |
| Legacy | VMs |
| Batch/HPC | Batch |
Network Topology
| Scale | Topology |
|---|
| ------- | ---------- |
| <10 VNets, 1 region | Hub-spoke |
| 5+ branches, multi-region | Virtual WAN |
Hybrid Connectivity
| VPN | ExpressRoute |
|---|
| --- | :---: | :---: |
| Bandwidth | 1.25 Gbps | 100 Gbps |
| SLA | 99.9% | 99.95% |
| Encrypt | Built-in | No (add MACsec) |
| Setup | Hours | Months |
Private Access
| Service Endpoint | Private Endpoint |
|---|
| --- | :---: | :---: |
| From on-prem | ❌ | ✅ |
| Cost | Free | Per hour |
| IP | Public (filtered) | Private VNet IP |
Migration 6 R's
Rehost · Refactor · Rearchitect · Rebuild · Replace · Retire
Event Services
| Service | Use |
|---|
| --------- | ----- |
| Event Grid | React to events (blob created) |
| Event Hubs | Stream ingestion (IoT) |
| Service Bus | Enterprise messaging (queues) |
EXAM TRAPS — AVOID THESE
| Wrong | Right |
|---|
| ------- | ------- |
| Direct RBAC for JIT admin | PIM eligible |
| RBAC to block resource types | Azure Policy Deny |
| SQL DB for SQL Agent | Managed Instance |
| GRS for zone protection only | ZRS |
| Service Endpoint from on-prem | Private Endpoint |
| App Gateway for global WAF | Front Door |
| ASR for dev/test DR | Backup |
| Event Hubs for blob trigger | Event Grid |
| TDE to hide PII from DBA | Always Encrypted |
| Hub-spoke for 60 branches | Virtual WAN |
KEY NUMBERS
| Item | Value |
|---|
| ------ | ------- |
| Pass score | 700/1000 |
| Exam time | 100 min |
| MG max depth | 6 levels |
| VNet peering | Non-transitive |
| Reserved IPs/subnet | 5 |
| Backup soft delete | 14 days |
| ASR RPO | ~30 sec |
| Cosmos SLA (multi-region) | 99.999% |
CASE STUDY FRAMEWORK
1. Read full case (5 min)
2. List requirements + conflicts
3. Identify WAF priority
4. Answer in order (don't contradict earlier choices)
5. Pick BEST answer (not just valid)
6. Match team skills + existing architecture
*AZ-305 Quick Reference Cheat Sheet — April 17, 2026 skills measured*
