AZ-104 & AZ-305 Comprehensive Study Guide

Exam Overview & Strategy

AZ-104 is operational and hands-on. You must know how to configure, deploy, and manage Azure resources — not just what they are. Expect scenario-based questions asking you to choose the right command, portal setting, or configuration sequence.

Recommended Study Order

1.1 Manage Microsoft Entra ID (formerly Azure AD)

• Create and manage users (bulk create via CSV, guest invites)
• Create and manage groups: Security vs. Microsoft 365, Assigned vs. Dynamic
• Dynamic group membership rules — e.g., user.department -eq "Sales"
• Manage device settings: Entra Join vs. Hybrid Entra Join vs. Entra Registered
• Self-Service Password Reset (SSPR) — enabling per group, authentication methods required
• Microsoft Entra Connect — password hash sync vs. pass-through auth vs. federation

Entra ID Licenses:

• Free: Basic user/group management, MFA for admins
• P1: Conditional Access, dynamic groups, SSPR, Hybrid Entra Join
• P2: PIM, Identity Protection, Access Reviews

1.2 Manage Azure Role-Based Access Control (RBAC)

• Assign built-in roles: Owner, Contributor, Reader, User Access Administrator
• Create custom roles — know Actions, NotActions, DataActions, NotDataActions JSON fields
• Scope hierarchy: Management Group → Subscription → Resource Group → Resource
• Role assignments are additive — most permissive wins (except explicit deny)
• Managed Identities: System-assigned vs. User-assigned

Managed Identity Use Cases:

• System-assigned: Tied to resource lifecycle. Deleted when resource is deleted. Use for single-resource access.
• User-assigned: Standalone resource. Can be shared across multiple resources. Use when multiple VMs/apps need the same identity.

1.3 Manage Azure Policy and Governance

• Azure Policy effects: Deny, Audit, AuditIfNotExists, DeployIfNotExists, Modify, Append
• Policy vs. Initiative (policy set)
• Management Groups: up to 6 levels deep below root, max 10,000 management groups
• Resource locks: CanNotDelete vs. ReadOnly

Policy Effects — Know the Priority:

1. Disabled — policy not evaluated
2. Append — adds fields to request (e.g., force tags)
3. Modify — changes/adds properties
4. Deny — blocks the request
5. Audit / AuditIfNotExists — allows but logs non-compliance
6. DeployIfNotExists — deploys a related resource if missing

Resource Locks:

• CanNotDelete: Can read and modify, cannot delete
• ReadOnly: Can read only, cannot modify or delete
• Applied at resource, RG, or subscription scope — inherited downward
• Only Owner or User Access Administrator can manage locks

1.4 Manage Subscriptions and Costs

• Move resources between resource groups and subscriptions (not all resources are moveable)
• Apply and manage tags — tags are NOT inherited by default (use Policy)
• Cost Management + Budgets — create budget alerts
• Azure Reservations vs. Spot VMs vs. Savings Plans

Non-moveable resources (commonly tested): Azure AD Domain Services, Recovery Services Vaults (with conditions), VNet gateways when VNet has peerings.

2.1 Configure Storage Accounts

• Types: Standard (GPv2) vs. Premium (BlockBlob, FileShares, Page)
• Redundancy: LRS → ZRS → GRS → GZRS (and read-access variants RA-GRS, RA-GZRS)
• Access tiers: Hot, Cool, Cold, Archive (Archive is offline — rehydration takes hours)
• Storage firewall and virtual network rules; private endpoints

2.2 Manage Azure Blob Storage

• Blob types: Block (files/streaming), Append (logging), Page (VHDs/random write)
• Lifecycle management policies — automate tier transitions and deletions
• Blob versioning, soft delete, point-in-time restore
• SAS: Account SAS vs. Service SAS vs. User Delegation SAS
• Immutability policies: Time-based retention vs. Legal hold

2.3 Configure Azure Files and Azure File Sync

• SMB (port 445) vs. NFS shares — NFS requires Premium FileStorage + VNet
• Azure File Sync: Server endpoint, Cloud endpoint, Sync group
• Cloud tiering — stores hot files locally, cold files as pointers to Azure
• Mounting: Windows (net use), Linux (cifs-utils)

• Sync group = one cloud endpoint (Azure file share) + one or more server endpoints
• Cloud tiering = only on server endpoints; frees up local disk but keeps namespace visible
• Registered server = Windows Server registered with Storage Sync Service

2.4 Configure Azure Storage Security and Tools

• Storage access keys vs. SAS vs. Entra ID RBAC (data plane)
• Azure Key Vault integration for customer-managed keys (CMK)
• AzCopy: azcopy copy, azcopy sync, azcopy login
• Azure Data Box family: Data Box Disk, Data Box, Data Box Heavy (offline transfer)

# Copy blob to blob
azcopy copy 'https://source.blob.core.windows.net/container/file' \
  'https://dest.blob.core.windows.net/container/' --recursive

# Sync (only copies new/changed, can delete destination extras)
azcopy sync 'source' 'dest' --delete-destination=true

# Login with Entra ID (preferred over SAS for automation)
azcopy login

3.1 Configure Virtual Machines

• VM sizes: D-series (general), F-series (compute), E/M-series (memory), L-series (storage), N-series (GPU)
• Availability: Availability Sets (FD/UD) vs. Availability Zones
• Managed Disks: Standard HDD, Standard SSD, Premium SSD, Ultra Disk
• Disk encryption: SSE (default) vs. ADE (guest OS level) vs. Encryption at host
• Resize a VM — requires deallocating if moving to a different hardware cluster

3.2 ARM Templates and Bicep

• ARM template structure: $schema, contentVersion, parameters, variables, resources, outputs
• Bicep syntax — transpiles to ARM JSON
• Deployment stacks: enforce what can/can't be deployed, managed cleanup
• What-if deployments before applying changes
• Template specs — store and share ARM templates as Azure resources

{
  "type": "Microsoft.Compute/virtualMachines",
  "apiVersion": "2023-09-01",
  "name": "[parameters('vmName')]",
  "dependsOn": ["[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]"]
}

• dependsOn = explicit dependency (when resource references don't create implicit dependency)
• [resourceId()] = function to reference another resource's ID
• Bicep string interpolation: '${param1}-suffix'

3.3 Virtual Machine Scale Sets (VMSS)

• Uniform vs. Flexible orchestration modes
• Autoscale rules: metric-based, schedule-based
• Scale-in policy: Default, NewestVM, OldestVM
• Overprovisioning — creates extra VMs, deletes extras (no charge for over-provisioned VMs)
• Rolling, blue/green upgrade policies

3.4 Azure App Service Plans and Web Apps

• Tiers: Free/Shared → Basic → Standard → Premium → Isolated (ASE)
• Deployment slots (Standard+): staging, swapping, traffic routing %
• Autoscale available on Standard and above
• App Service Environment (ASE) — fully isolated, VNet injected

3.5 Containers

4.1 Configure Virtual Networks

• VNet address space planning — Azure reserves 5 IPs per subnet: .0, .1, .2, .3, .255
• VNet peering: non-transitive by default (Hub-spoke requires UDR for transitivity)
• Service endpoints vs. Private endpoints
• DNS: Azure-provided vs. custom DNS servers vs. Private DNS zones

4.2 Configure Network Security Groups (NSGs)

• NSG rules: Priority 100–4096 — lower number = higher priority
• Default rules: AllowVNetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound
• NSG can attach to subnet AND/OR NIC — both apply
• Application Security Groups (ASGs) — tag VMs for NSG rules without managing IPs

NSG Evaluation Logic:

• Inbound: Subnet NSG → NIC NSG
• Outbound: NIC NSG → Subnet NSG
• Traffic must be allowed at BOTH levels to flow

4.3 Configure Load Balancing

4.4 Configure VPN Gateway and ExpressRoute

• Site-to-Site (S2S): on-prem to Azure, requires local network gateway + VPN gateway
• Point-to-Site (P2S): individual client machines to Azure VNet
• VNet-to-VNet: VPN between Azure VNets (different regions/subscriptions)
• ExpressRoute: private MPLS circuit, not over internet
• Basic VPN Gateway SKU: no zone support, no BGP, no active-active
• Global Reach: connect two on-prem sites through Microsoft backbone via ExpressRoute

4.5 Monitor and Troubleshoot Networking

• IP flow verify: tells you if traffic is allowed/denied and which NSG rule is responsible
• Next hop: tells you where traffic is routed (useful for UDR/BGP debugging)
• Connection Monitor: continuous monitoring between sources and endpoints
• Packet capture: capture traffic to/from a VM for deep analysis

5.1 Configure Azure Monitor

• Log Analytics workspaces — central store for logs (KQL queryable)
• Azure Monitor Metrics (numerical time-series) vs. Logs (KQL text)
• Diagnostic settings: platform logs/metrics → Log Analytics, Storage, Event Hub
• Action groups: email, SMS, webhook, ITSM, Azure Function, Logic App, Runbook

5.2 Configure Azure Backup and Recovery

• Recovery Services Vault: location must match resource being backed up
• Azure Backup for: VMs, SQL in VMs, Azure Files, blobs
• Soft delete — 14-day retention after backup item deletion
• Cross-region restore: replicate vault to paired region
• Backup Center — centralized management dashboard

5.3 Azure Update Manager and Automation

• Azure Update Manager: replaces Update Management in Automation for OS patching
• Azure Automation: runbooks (PowerShell, Python), schedules, DSC
• Change Tracking and Inventory for software/service change detection

Exam Overview & Strategy

AZ-305 is about architectural decision-making. You're not asked how to configure — you're asked which service to choose, why, and what the trade-offs are. Questions present a business requirement and ask which design meets it with the fewest compromises.

Azure Well-Architected Framework (WAF) — Always in Context

Every AZ-305 design decision should be evaluated against WAF pillars:

1.1 Design Identity and Access Management

• Choose between Entra ID, AD DS (on-prem), and Entra Domain Services
• Hybrid identity: password hash sync vs. pass-through auth vs. federation (ADFS)
• External identity: B2B (partner access) vs. B2C (customer-facing apps)
• Conditional Access: named locations, sign-in risk, device compliance
• PIM — just-in-time access, time-bound role assignments, approval workflows

1.2 Design Governance Solutions

• Management group hierarchy and policy inheritance
• Azure Policy at scale — initiative assignments, remediation tasks
• Tagging strategy for cost allocation and resource organization
• Azure Cost Management: budgets, cost alerts, Advisor recommendations
• Landing Zone design (CAF) — platform and application landing zones

• Platform landing zone: Centralized shared services — identity, connectivity, management
• Application landing zone: Subscriptions for individual workloads/apps
• Hub-spoke: Hub = shared services (firewall, DNS, VPN/ER); Spokes = workload VNets
• Policies with DeployIfNotExists or Modify require a managed identity for remediation tasks

1.3 Design Monitoring Solutions

• Azure Monitor: Metrics, Logs, Traces, Changes
• Application Insights: APM, distributed tracing, availability tests
• Microsoft Sentinel: SIEM/SOAR for security monitoring
• Azure Service Health (platform-wide) vs. Resource Health (your specific resource)

2.1 Design Storage Accounts

2.2 Design Relational Database Solutions

2.3 Design NoSQL / Cosmos DB Solutions

• Cosmos DB APIs: NoSQL (document), MongoDB, Cassandra, Table, Gremlin (graph)
• Request Units (RUs) — currency for Cosmos DB throughput
• Partition key selection — determines data distribution and hot partition risk
• Multi-region writes for global active-active

The 5 Consistency Levels (memorize these):

1. Strong — linearizability, highest read consistency, highest latency
2. Bounded Staleness — lag by K operations or T time
3. Session — consistent within a session (default, most popular)
4. Consistent Prefix — never see out-of-order writes
5. Eventual — lowest latency, highest throughput, no ordering guarantees

2.4 Design Data Integration Solutions

3.1 Design for High Availability

• SLA targets and composite SLA calculation
• Availability Zones for zone-redundant services
• Regional pairs — used for GRS storage and some service replication

Composite SLA Formulas:

3.2 Design for Disaster Recovery

• RTO (Recovery Time Objective) — max acceptable downtime
• RPO (Recovery Point Objective) — max acceptable data loss
• Azure Site Recovery (ASR): VM replication — Azure-to-Azure, on-prem-to-Azure
• Azure Backup: point-in-time recovery for VMs, SQL, blobs, files

3.3 Design Backup Solutions

• Azure Backup supports: VMs, SQL Server in VMs, Azure Files, SAP HANA, Azure Blobs
• Recovery Services Vault vs. Backup Vault (newer — for Blobs, Disks, PostgreSQL)
• Immutable vaults — prevent backup deletion (compliance)
• Long-term retention policies (years/decades for compliance)

4.1 Design Compute Solutions

• Spot VMs: Fault-tolerant, interruptible workloads (ML training, batch, rendering)
• Azure Dedicated Hosts: Compliance/licensing requirements
• Proximity Placement Groups: Ultra-low latency between VMs

4.2 Design Network Solutions

• Hub-spoke vs. Virtual WAN (vWAN) — vWAN is a managed hub, auto-connects spokes
• Azure Firewall: stateful L3-L7, FQDN filtering, threat intelligence
• Private Link Service — expose your service to others via private endpoint
• DNS architecture: Azure DNS zones, Private DNS zones, DNS forwarding

Network Security — Defense in Depth (outer to inner):

1. DDoS Protection (edge)
2. Azure Firewall / NVA (hub)
3. NSG (subnet/NIC)
4. Application Gateway + WAF (app layer)
5. Private Endpoints (PaaS access)
6. Encryption in transit (TLS)

4.3 Design Application Architecture

• API Management (APIM): gateway, rate limiting, transformation, developer portal
• Event-driven: Event Grid + Functions, Event Hubs + Stream Analytics
• Azure Cache for Redis: distributed cache, session state, pub/sub
• Deployment patterns: blue/green, canary, rolling

4.4 Design Migrations

Migration phases: Discover → Assess → Migrate → Optimize