Skip to content
Study Guides

Reference & Cheat Sheets

Key Decision Trees & Reference

Section titled “Key Decision Trees & Reference”

Storage Selection

Section titled “Storage Selection”
Need to store...
├── Unstructured files/blobs (images, video, backups) → Blob Storage
├── Unstructured files + big data analytics          → ADLS Gen2
├── File shares (SMB/NFS for VMs or on-prem)         → Azure Files
├── VM disks                                         → Azure Managed Disks
├── NoSQL key-value (simple)                         → Azure Table Storage
├── NoSQL document/graph/column                      → Cosmos DB (choose API)
├── Relational data (cloud-native)                   → Azure SQL Database
├── Relational (needs SQL Agent, CLR)                → SQL Managed Instance
└── Full SQL Server control                          → SQL Server on Azure VM

Network Load Balancing

Section titled “Network Load Balancing”
Traffic type?
├── HTTP/HTTPS
│   ├── Global + CDN + WAF                           → Azure Front Door
│   └── Regional only
│       ├── WAF required                             → Application Gateway + WAF
│       └── Basic L7                                 → Application Gateway
└── TCP/UDP (non-HTTP)
    ├── Global routing (DNS-based)                   → Traffic Manager
    ├── Regional L4                                  → Azure Load Balancer (Standard)
    └── Global L4                                    → Cross-region Load Balancer

Identity Selection

Section titled “Identity Selection”
Who needs access?
├── Employees (cloud-only)                           → Microsoft Entra ID
├── Employees (hybrid, on-prem AD)                   → Entra ID + Entra Connect
├── Partners/vendors (B2B)                           → Entra External ID (B2B)
├── Customers (consumer-facing app)                  → Entra External ID (B2C)
└── Legacy apps needing Kerberos/LDAP (cloud-only)   → Entra Domain Services

CLI / PowerShell Cheat Sheet

Section titled “CLI / PowerShell Cheat Sheet”

Identity & RBAC

Section titled “Identity & RBAC”
Terminal window
# Create user
az ad user create --display-name "John Doe" --user-principal-name john@domain.com --password P@ssw0rd


# Assign role
az role assignment create --assignee <object-id> --role "Contributor" \
  --scope /subscriptions/<sub-id>/resourceGroups/<rg>


# Create custom role from JSON file
az role definition create --role-definition @custom-role.json


# List role assignments
az role assignment list --assignee <object-id> --all

Storage

Section titled “Storage”
Terminal window
# Create storage account
az storage account create --name mystorageacct --resource-group myRG \
  --location eastus --sku Standard_GRS


# Generate SAS token (User Delegation - preferred)
az storage blob generate-sas --account-name mystorageacct --auth-mode login \
  --container-name mycontainer --name myblob --permissions r --expiry 2026-12-31


# AzCopy sync
azcopy sync 'https://source.blob.core.windows.net/container' \
  'https://dest.blob.core.windows.net/container' --recursive

Networking

Section titled “Networking”
Terminal window
# Create VNet and subnet
az network vnet create --name myVNet --resource-group myRG \
  --address-prefix 10.0.0.0/16 --subnet-name default --subnet-prefix 10.0.0.0/24


# Create NSG rule
az network nsg rule create --name AllowSSH --nsg-name myNSG --resource-group myRG \
  --priority 100 --protocol Tcp --direction Inbound --destination-port-ranges 22 --access Allow


# IP flow verify (Network Watcher)
az network watcher test-ip-flow --vm <vm-id> --direction Inbound --protocol TCP \
  --local 10.0.0.4:22 --remote 203.0.113.0:12345

Compute

Section titled “Compute”
Terminal window
# Deploy VM in Availability Zone 1
az vm create --resource-group myRG --name myVM --image Ubuntu2204 --size Standard_D2s_v3 \
  --admin-username azureuser --generate-ssh-keys --zone 1


# Resize VM (deallocate first if changing hardware cluster)
az vm deallocate --resource-group myRG --name myVM
az vm resize --resource-group myRG --name myVM --size Standard_D4s_v3
az vm start --resource-group myRG --name myVM


# Create VMSS
az vmss create --resource-group myRG --name myScaleSet --image Ubuntu2204 \
  --upgrade-policy-mode automatic --admin-username azureuser --generate-ssh-keys

Common Exam Traps & Tips

Section titled “Common Exam Traps & Tips”

AZ-104 Traps

Section titled “AZ-104 Traps”
  1. ReadOnly lock on storage account blocks listing access keys — even though it looks like a read. Listing keys is internally a write operation.
  2. NSG + subnet = BOTH must allow — traffic denied by either level is blocked. Don’t assume subnet NSG alone controls everything.
  3. VNet peering is non-transitive — A↔B and B↔C does NOT give A↔C connectivity. Requires UDR + NVA in hub.
  4. Availability Set ≠ Availability Zones — AV Sets = rack failures within one DC. AV Zones = entire datacenter failures.
  5. User Access Administrator can assign roles but CANNOT manage Azure resources. Often confused with Contributor.
  6. Tags are not inherited by child resources — must use Azure Policy to enforce tag inheritance.
  7. Standard Load Balancer requires NSG — without NSG, all inbound traffic is blocked by default on Standard LB.
  8. Basic VPN Gateway SKU doesn’t support BGP, zone redundancy, or active-active mode. Use VpnGw1 or higher.
  9. Archive tier blobs must be rehydrated before access — this takes hours, not minutes.
  10. Service Endpoints don’t extend to on-prem. Private Endpoints do (via ExpressRoute/VPN).

AZ-305 Traps

Section titled “AZ-305 Traps”
  1. SQL MI vs. SQL DB — SQL Agent jobs, cross-DB queries, CLR, linked servers → Managed Instance ONLY.
  2. Cosmos DB consistency — “Session” is the default and best for most apps. “Strong” kills performance across regions.
  3. ASR vs. Azure Backup — ASR = DR replication for whole workloads. Backup = point-in-time restore for individual data items.
  4. Composite SLA is always LOWER than individual SLAs for serial dependencies. Two 99.9% services in series = 99.8%.
  5. Traffic Manager = DNS only — it doesn’t proxy traffic. Failover isn’t instantaneous due to DNS TTL.
  6. Front Door vs. App Gateway — Front Door = global HTTP/HTTPS + CDN. Application Gateway = regional L7 only.
  7. Warm standby ≠ Hot standby — warm standby is scaled down until failover; hot standby runs at full capacity.
  8. Entra Domain Services ≠ Entra ID — AADS provides Kerberos/LDAP for lift-and-shift. Entra ID is REST/OAuth only.
  9. Policy remediation requires assigning a managed identity to the policy assignment for DeployIfNotExists/Modify effects.
  10. vWAN vs. Hub-spoke — vWAN for simplicity at scale. Hub-spoke for custom NVAs and complex routing requirements.
  11. Diagnostic settings are required for ingestion — platform metrics/activity logs emit automatically, but nothing reaches a Log Analytics workspace without an explicit diagnostic setting.
  12. PHS vs. PTA vs. AD FS — “minimize admin effort” + “password hashes never leave on-premises” together eliminates PHS (fails the hash requirement) and AD FS (fails the effort requirement). PTA is the only method satisfying both.
  13. Functions Consumption plan hard-caps at a 10-minute execution timeout regardless of language — anything longer needs Premium/Dedicated or a different service.
  14. ADLS Gen2 ACLs are bypassed by RBAC — assigning Reader/Contributor/Owner grants blanket access that skips ACL evaluation entirely, defeating an ACL-based access design.
  15. GZRS is the answer whenever a requirement stacks “survive a zone failure” and “survive a region failure” together — it’s the only SKU combining both.

General Strategy

Section titled “General Strategy”
  • Read the entire question — Microsoft often adds critical constraints at the end that rule out most answer choices.
  • “Minimum cost” + requirements = eliminate over-engineered solutions first. Pick the simplest service that meets all requirements.
  • “Least administrative effort” = prefer managed PaaS services over IaaS VMs.
  • “On-premises” in the scenario = think Private Endpoint, ExpressRoute, Hybrid Entra Join.
  • AZ-305 case studies — read all requirements and constraints tab BEFORE looking at individual questions.

Abbreviations & Acronyms

Section titled “Abbreviations & Acronyms”
Acronym Stands for Quick context
ACL Access Control List Fine-grained permission list, e.g., on ADLS Gen2 files/folders
ACID Atomicity, Consistency, Isolation, Durability Transactional guarantee model of relational databases
ADF Azure Data Factory Managed ETL/ELT orchestration service
ADLS Azure Data Lake Storage (Gen2) Hierarchical-namespace storage for analytics workloads
ADX Azure Data Explorer Kusto-based big-data/telemetry analytics engine
AD DS Active Directory Domain Services On-premises/IaaS directory service
AD FS Active Directory Federation Services On-prem federated identity provider
AGW Application Gateway Regional Layer-7 load balancer with WAF
AKS Azure Kubernetes Service Managed Kubernetes with full API access
APIM API Management Gateway for publishing/governing APIs
APM Application Performance Management Monitoring category Application Insights belongs to
ARM Azure Resource Manager Deployment/management layer and template format
BCDR Business Continuity and Disaster Recovery Combined resiliency planning discipline
BGP Border Gateway Protocol Dynamic routing protocol used by ExpressRoute/VPN Gateway
CAF Cloud Adoption Framework Microsoft’s structured cloud-adoption methodology
CIDR Classless Inter-Domain Routing IP address range notation, relevant to VNet address planning
DCR Data Collection Rule Defines what telemetry flows where in Azure Monitor
DMA Data Migration Assistant Assessment tool for SQL migration readiness
DMS Database Migration Service Automatable, low-downtime DB migration service
DR Disaster Recovery Recovery from a large-scale outage (e.g., region failure)
DTU Database Transaction Unit Blended (legacy) SQL DB purchasing/performance unit
ETL / ELT Extract-Transform-Load / Extract-Load-Transform Data pipeline processing order; ELT transforms after loading, typically in the target platform
FCI Failover Cluster Instance SQL Server HA feature requiring shared storage
GRS Geo-Redundant Storage Storage replication across a paired region
GZRS Geo-Zone-Redundant Storage Combines zone + region redundancy; highest storage durability
HA High Availability Resilience to component/zone/datacenter-level failure
HPK Hierarchical Partition Key Multi-level Cosmos DB partition key strategy
IaaS Infrastructure as a Service You manage the OS and up (e.g., VMs)
IR Integration Runtime Compute infrastructure used by ADF/Synapse pipelines
JWT JSON Web Token Token format used in OIDC auth flows
KQL Kusto Query Language Query language for Log Analytics / ADX
LRS Locally Redundant Storage Single-datacenter storage replication
LTR Long-Term Retention SQL DB backup retention beyond the 35-day PITR window
MABS Microsoft Azure Backup Server On-prem backup server requiring dedicated infrastructure
MFA Multi-Factor Authentication Requires 2+ verification factors to sign in
MI Managed Instance (Azure SQL) Near-full SQL Server compatibility, PaaS-managed
MSEE Microsoft Enterprise Edge (router) ExpressRoute’s Microsoft-side network edge
NSG Network Security Group Stateful subnet/NIC-level traffic filter
NVA Network Virtual Appliance Third-party firewall/inspection VM appliance
OIDC OpenID Connect Modern auth protocol built on OAuth 2.0
PaaS Platform as a Service Microsoft manages the underlying platform (e.g., App Service, Azure SQL DB)
PHS Password Hash Synchronization Cloud-side hybrid auth method
PIM Privileged Identity Management Just-in-time, time-bound privileged role activation
PITR Point-in-Time Restore Short-term (≤35 day) automatic SQL DB recovery
PTA Pass-through Authentication On-prem-validated hybrid auth method
RBAC Role-Based Access Control Azure’s resource-permission model
RPO Recovery Point Objective Maximum tolerable data loss, measured in time
RTO Recovery Time Objective Maximum tolerable downtime
RU Request Unit Cosmos DB’s throughput/cost currency
SAML Security Assertion Markup Language XML-based auth/SSO protocol, alternative to OIDC
SKU Stock-Keeping Unit A specific product/tier/size configuration
SLA Service-Level Agreement Contracted uptime/performance guarantee
SSIS SQL Server Integration Services On-prem ETL toolset, portable to ADF’s SSIS IR
SSO Single Sign-On One authentication, access to multiple apps
TDE Transparent Data Encryption At-rest encryption for Azure SQL DB, on by default
UDR User-Defined Route Custom route overriding Azure’s default routing
VM Virtual Machine IaaS compute unit
VNet Virtual Network Azure’s software-defined network boundary
VPN Virtual Private Network Encrypted tunnel, typically over the public internet
WORM Write Once, Read Many Immutability model behind time-based retention policies
WSFC Windows Server Failover Cluster Clustering technology required by distributed AGs / FCI
ZRS Zone-Redundant Storage Storage replication across availability zones in-region
Section titled “Recommended Study Resources”

📘 Official Microsoft Learn

Section titled “📘 Official Microsoft Learn”

🧪 Hands-On Labs

Section titled “🧪 Hands-On Labs”

🎯 High-Quality Third-Party

Section titled “🎯 High-Quality Third-Party”