CertifyDeck
Start for free
All cheat sheets
AZ-305 · CHEAT SHEET

Microsoft Certified: Azure Solutions Architect Expert

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Design identity, governance, and monitoring solutions

25–30%

Design solutions for logging and monitoring

  • Azure Monitor logs live in Log Analytics workspaces and are queried with KQL. Start with a single workspace and add more only for data residency, ownership, billing or different retention needs. The activity log is collected automatically, resource logs need a diagnostic setting, and table plans balance cost against retention and query needs.
  • Diagnostic settings route resource logs, platform metrics and the activity log to a Log Analytics workspace, a storage account, Event Hubs or a partner solution. Data export rules copy workspace tables, transformations filter data before it is stored, and Azure Monitor pipeline processes data at remote or hybrid sites.
  • Azure Monitor covers every layer: Application Insights for applications, VM insights and Azure Monitor Agent for machines (including hybrid ones through Azure Arc), managed Prometheus and Grafana for Kubernetes, and Connection monitor for the network. Metric, log search, activity log and Service Health alerts cover different signals, and workbooks serve reporting.

Design authentication and authorization solutions

  • Hybrid environments have three sign-in methods: password hash synchronization (simplest), pass-through authentication (validates against on-premises Active Directory) and federation (needed for requirements Entra does not cover natively). Enabling password hash synchronization as a backup is recommended. Phishing-resistant passwordless methods, Conditional Access and managed identities complete the design.
  • Cloud Sync synchronizes Active Directory with Entra ID through lightweight agents and supports disconnected forests, while Domain Services provides managed LDAP, Kerberos and domain join for legacy apps. External ID covers B2B collaboration and customers in an external tenant, and ID Governance manages the lifecycle with entitlements, reviews and workflows.
  • Azure RBAC grants access through role assignments (security principal, role definition and scope) that are inherited down the management group, subscription, resource group and resource hierarchy, with additive permissions. ABAC conditions refine access and PIM adds just-in-time activation. Key Vault separates the control plane from the data plane.
  • Microsoft Entra application proxy publishes on-premises web apps through an outbound-only connector with preauthentication and Conditional Access, and uses Kerberos Constrained Delegation for integrated SSO. Private Access tunnels private resources by FQDN or IP through Quick Access or per-app access. Cloud Kerberos trust gives SSO to Active Directory resources.
  • Azure Key Vault centralizes secrets, keys and certificates; use one vault per application and environment, managed identities and least-privilege Azure RBAC. Turn on soft-delete and purge protection. For a customer-owned root of trust and single tenancy choose Managed HSM; certificates from partner CAs renew automatically.

Design governance

  • Use a flat management group hierarchy that groups subscriptions by policy needs, with separate platform subscriptions. Resource groups hold resources that share a lifecycle. Tags are not inherited: enforce or inherit them with Azure Policy (modify effect), and never put sensitive values in them.
  • Azure Policy evaluates resources and applies effects such as audit, deny or deployIfNotExists; start with audit, use initiatives and remediation tasks for existing resources, and expiring exemptions for exceptions. Defender for Cloud shows regulatory compliance per control; Blueprints migrates to deployment stacks and template specs.
  • Microsoft Entra ID Governance covers the identity and access lifecycle: entitlement management uses access packages with approval and expiry, access reviews recertify access, lifecycle workflows automate joiners and leavers, and PIM gives just-in-time privileged access with MFA and approval.

2. Design data storage solutions

20–25%

Design data storage solutions for relational data

  • Azure SQL Database fits new cloud applications, SQL Managed Instance fits migrations needing near-complete instance compatibility (SQL Agent, linked servers, CLR), and SQL Server on VMs fits workloads requiring operating system access. For open-source engines use Azure Database for PostgreSQL or for MySQL.
  • In the vCore model choose General Purpose for balanced workloads, Business Critical for low-latency OLTP with a built-in read replica, and Hyperscale for highly scalable storage. Serverless compute suits intermittent usage; provisioned suits steady usage. In PostgreSQL, Burstable is not meant for production.
  • Scale vertically by changing compute size or by using elastic pools for databases whose peaks do not coincide. Read scale-out and Hyperscale named replicas offload reads, and geo-replication adds readers in other regions. When one database is not enough, shard with the Elastic Database tools.
  • Azure SQL offers distinct layers of protection: TDE encrypts data and backups at rest (service-managed or customer-managed key in Key Vault), Always Encrypted keeps keys out of the engine, dynamic data masking hides values in results, and ledger gives tamper evidence. Long-term backups and their redundancy setting address compliance and residency.

Design data storage solutions for semi-structured and unstructured data

  • For semi-structured data you choose by data model and access pattern: Cosmos DB for NoSQL for JSON documents with flexible schema and global distribution, Cosmos DB for Table or Table storage for key/attribute data, Redis for key-value caching, and Data Explorer for telemetry and time series. Partition key and consistency level shape scale and latency.
  • For unstructured data, Blob Storage is the object store for images, documents, backups and analytics data; Data Lake Storage adds a hierarchical namespace, POSIX ACLs and Hadoop-compatible access on top of Blob; Azure Files offers managed SMB and NFS file shares for applications that expect a file system.
  • Blob access tiers balance cost and performance: hot has the highest storage cost and lowest access cost, cool and cold lower storage and raise access costs while keeping millisecond latency, and archive is cheapest but offline. Lifecycle management automates transitions and deletion, and in Azure Files you pick HDD or SSD according to latency needs.
  • Redundancy (LRS, ZRS, GRS, GZRS and the read-access variants) protects against hardware, zone or region failures, but it also replicates deletions and overwrites. For those, combine Resource Manager locks, container and blob soft delete, versioning, point-in-time restore and WORM immutability policies.

Design data integration

  • Azure Data Factory orchestrates ETL and ELT pipelines with copy and transformation activities; the integration runtime is chosen by network: Azure for public stores, self-hosted for private networks, and Azure-SSIS to lift and shift SSIS packages. Event Hubs ingests event streams with Kafka support and Stream Analytics processes them with SQL.
  • Microsoft Fabric unifies data engineering, warehousing, real-time analytics and Power BI over OneLake as SaaS; within Fabric, the warehouse serves T-SQL BI, the lakehouse serves big data and ML with Spark, and Eventhouse serves time series with KQL. Azure Databricks offers an open lakehouse with Spark, Delta Lake and MLflow, and Stream Analytics processes simple streams with SQL.

3. Design business continuity solutions

15–20%

Design solutions for backup and disaster recovery

  • Pick the solution from the RTO and RPO of each criticality tier: backup and restore for administrative workloads, warm or cold standby for operational ones, and multi-region active-active for mission-critical ones. Azure Site Recovery replicates Azure, VMware, Hyper-V and physical machines and orchestrates failover through recovery plans. Always test the procedures and treat failback as a separate process.
  • Azure Backup protects compute according to the workload: VM backup takes application-consistent snapshots (VSS on Windows, pre and post scripts on Linux), Disk Backup takes agentless incremental snapshots of a single disk, and AKS backup protects cluster state and persistent volumes. App Service uses automatic or custom backups. Geo-redundant vault storage enables restores across regions.
  • Azure SQL Database takes automatic full, differential and log backups: point-in-time restore creates a new database, geo-restore requires geo-redundant backup storage, and long-term retention keeps full backups for compliance. SQL Server on VMs is protected with Azure Backup workload backup, and Cosmos DB offers periodic or continuous backup mode with point-in-time restore.
  • For blobs, combine an account lock, container and blob soft delete, and versioning. Azure Backup operational backup is continuous, has no schedule and restores in the same account; vaulted backup is periodic, keeps the data outside the account through object replication and restores to a different account. Azure Files is protected with share snapshots and optional vaulted backup.

Design for high availability

  • For compute high availability, spread instances across availability zones (availability sets only spread across fault domains inside one datacenter) and use a load balancer that reroutes traffic. Scale sets with Flexible orchestration, zone-redundant App Service and AKS with zonal node pools, several replicas and ZRS disks make this possible; for several regions use Front Door or Traffic Manager.
  • In Azure SQL Database local availability is the baseline, and zone redundancy adds resilience to a zone failure without losing committed data. Across regions, failover groups move sets of databases with stable endpoints and active geo-replication works per database. SQL Server on VMs uses availability groups or failover cluster instances; PostgreSQL uses zone-redundant high availability.
  • In Azure Storage, ZRS keeps data readable and writable if a zone fails and GZRS adds a secondary region; only the RA-GRS and RA-GZRS variants allow reading from the secondary without a failover, and Azure Files does not support them. In Cosmos DB, zone redundancy is configured per region and multiple write regions give higher resiliency, without strong consistency and with conflict resolution.

4. Design infrastructure solutions

30–35%

Design compute solutions

  • Choosing compute starts with the hosting model: IaaS (virtual machines) gives the most control and requires OS administration, while PaaS (App Service, Container Apps) and FaaS (Functions) delegate more. Evaluate each component separately, weigh team skills, and remember that every platform is regional and needs an external router for multiregion designs.
  • For virtual machines, pick the size family that matches the workload (general purpose, burstable B-series, compute, memory, storage) and build availability with availability zones and scale sets in Flexible mode. Spot suits interruptible work, Dedicated Host gives isolation and maintenance control, and Site Recovery handles recovery from a regional outage.
  • Container Apps offers serverless containers with KEDA, Dapr, revisions and scale to zero without exposing the Kubernetes API. AKS gives the most control (Kubernetes API, network policies, disparate workloads) at the cost of more operations. Container Instances runs standalone containers without orchestration, and Container Apps jobs cover finite tasks.
  • Serverless on Azure combines Functions (event-driven code), Logic Apps (designer-first workflows with connectors), Container Apps (containers with scale to zero) and Event Grid. Flex Consumption scales from zero with virtual network support, Durable Functions adds stateful workflows in code, and HTTP-triggered functions have a fixed maximum response time.
  • Azure Batch manages a pool of VM nodes, installs the application and schedules jobs without scheduler software of your own; it fits independent parallel workloads and MPI-based tightly coupled ones. Spot VMs and automatic scaling cut cost, and CycleCloud fits when you must keep an existing scheduler such as Slurm.

Design an application architecture

  • A message broker decouples producer and consumer in time, levels load and enables competing consumers. Use Service Bus for high-value commands (sessions, deduplication, dead-lettering, topics with filters), Event Hubs for event streams with replay, and the Claim Check pattern when the payload is too large for the broker.
  • An event-driven architecture has decoupled producers, channels and consumers. Use publish-subscribe (Event Grid) for discrete notifications and event streaming (Event Hubs) when you need per-partition ordering and replay. Choose between broker and mediator topologies, and plan for eventual consistency, duplicates and idempotent consumers.
  • API Management acts as a facade for backends: it validates keys and tokens, enforces quotas and call-rate limits, transforms messages with policies and can cache responses. The self-hosted gateway covers APIs in hybrid environments and workspaces give decentralized teams autonomy. For messaging, Service Bus carries commands, Event Grid discrete events, Event Hubs event streams and Logic Apps orchestrates workflows with connectors.
  • A private in-memory cache is fast but every instance keeps its own copy; a shared cache such as Azure Managed Redis gives a common view and can scale as a cluster. With cache-aside you update the data store first and then invalidate the entry; write-through gives immediate reads after a write. The cache must never be the primary store, and the application needs a fallback when it becomes unavailable.
  • Azure App Configuration centralizes hierarchical settings and feature flags that applications can refresh without redeploying, and it complements Key Vault: secrets stay in Key Vault and App Configuration only holds the reference. Labels create per-environment variants, snapshots are immutable for safe rollout and a return to a known-good configuration, and geo-replication adds resilience.

Design migrations

  • The Cloud Adoption Framework organizes adoption into seven phases: strategy, plan, ready (landing zone), adopt, govern, secure and manage. Each workload gets a strategy (retire, retain, rehost, replatform, refactor, rearchitect, replace or rebuild) based on its business driver. Waves are ordered by dependencies and risk, with a data migration path, a downtime or near-zero downtime method and a tested rollback plan.
  • Azure Migrate discovers servers, databases and web apps with an appliance (or the collector on air-gapped networks) and assesses readiness, sizing and cost. Agentless dependency analysis groups the servers that must migrate together. Also assess baseline performance, security and identity, code, databases, compliance and third-party compatibility, and keep a risk register.
  • In Azure Migrate, VMware is preferably replicated agentless with the appliance and Hyper-V with providers on the hosts; physical servers and other clouds use agent-based replication with a replication appliance. For databases, SQL Managed Instance minimizes changes and SQL Server on virtual machines gives operating system access. ASP.NET apps can go to App Service, containers or Azure VMware Solution.
  • The target follows the engine and the level of management: Azure SQL Managed Instance for migrating with few changes, SQL Database for per-database PaaS, and SQL Server on VMs when you need the operating system. The Managed Instance link gives the lowest-downtime online migration with reads on the target; Log Replay Service and native restore are simpler. PostgreSQL offers online or offline migration.
  • The choice depends on bandwidth, volume and how much the data changes. Azure Storage Mover migrates SMB and NFS shares online with central management; AzCopy suits scripted one-off copies; Azure File Sync keeps a hybrid cache long term; Azure Data Box imports large volumes offline and pairs with Storage Mover for the final delta.

Design network solutions

  • For internet egress, Azure NAT Gateway is the recommended method: it allocates SNAT ports dynamically, allows only response traffic and gives predictable addresses. Instance-level public IPs and load balancer outbound rules are explicit alternatives; default outbound access is implicit and not recommended. Private Link avoids SNAT toward PaaS and Bastion manages VMs without public IPs.
  • VPN Gateway encrypts traffic with IPsec over the internet and is the simple choice for light traffic. ExpressRoute offers a private circuit with higher bandwidth and consistent latency, but needs a provider and does not encrypt by default. A VPN can coexist as a backup path, and Virtual WAN centralizes connectivity and transit between branches and virtual networks.
  • Accelerated Networking uses SR-IOV to bypass the host virtual switch and reduces latency, jitter and CPU. Proximity placement groups colocate VMs and pair well with it, although they do not span zones. FastPath makes ExpressRoute bypass the gateway, virtual network peering connects networks with low latency, and Front Door accelerates global content delivery.
  • Network security is layered: NSGs and application security groups filter between workloads without IP lists; Azure Firewall applies network and FQDN application rules with threat intelligence; WAF protects web apps from SQL injection and XSS; DDoS Protection mitigates volumetric layer 3 and 4 attacks. Private Link restricts PaaS access to your network.
  • Services differ by scope and layer: Front Door is global HTTP(S) with acceleration and fast failover; Application Gateway is regional layer 7 with URL routing, TLS and WAF; Load Balancer is layer 4; Traffic Manager is global and DNS-based with methods such as geographic or weighted. For routing, UDRs and longest prefix match decide the next hop.
Practice this certification