AZ-305 — Example Quiz

RA-GRS replicates data asynchronously to a secondary region hundreds of kilometres away and provides read access to the secondary copy. If the primary region fails, the data is still accessible from the secondary. LRS and ZRS only protect within a single region. Managed disks are block storage for VMs, not document storage.

A Service Bus queue acts as a buffer — the API writes orders to the queue and they're never lost, even during traffic spikes. Azure Functions with a queue trigger processes the messages asynchronously at a sustainable rate. Traffic Manager and Front Door are load balancing and routing services that don't provide message buffering. Bastion is for secure VM access.

Azure Policy can enforce allowed locations at the subscription or management group level. Any deployment to a non-allowed region is denied automatically, regardless of the user's RBAC role. RBAC controls what actions a user can take, but it cannot restrict which regions resources are deployed to. Advisor provides recommendations but does not enforce them.

Azure VMs provide full control over the operating system, allowing installation of custom drivers and legacy software. App Service, AKS, and Functions are all PaaS/serverless options that abstract away the OS — you cannot install custom drivers on them. VMs are the right choice when you need OS-level control.

High availability requires: spreading resources across Availability Zones (survives data centre failure), health probes to detect and route around failed instances, and managed database services with automatic failover (e.g. Azure SQL with auto-failover groups). A single large VM is a single point of failure. Local session state breaks when traffic moves between instances. Disabling auto-scaling means the app cannot respond to demand changes.

Azure AD B2C (now Entra External ID) is designed for consumer-facing identity — it supports self-service sign-up, social identity providers, and custom branding. Azure AD is for organisational identities. B2B is for inviting external business users into your Azure AD. AD DS is for domain-joined on-premises or VM workloads.

Start by defining your RPO and RTO — these business requirements drive all technical decisions. Then configure geo-replication to a paired region. Set up a failover group to automate the failover process and manage DNS endpoints. Finally, test the failover to ensure the application reconnects correctly and meets the defined RTO.

Customer-managed keys (CMK) stored in Azure Key Vault give the company full control over the encryption keys while still using Azure's server-side encryption. Microsoft-managed keys are the default but don't meet the requirement for company-managed keys. Client-side encryption works but adds complexity and isn't necessary when CMK is available. Disk Encryption applies to VM disks, not Blob Storage.

Azure Traffic Manager operates at the DNS level, not the application layer. It directs clients to different endpoints based on DNS resolution using routing methods like priority, weighted, or geographic. It performs health checks via HTTP/HTTPS/TCP, but it does not inspect or route based on URL paths. For URL path-based routing, use Azure Application Gateway or Azure Front Door.

Azure Service Bus with sessions guarantees FIFO (first-in, first-out) ordering and exactly-once processing within a session. Event Grid is for event-driven reactive programming (at-least-once delivery). Event Hubs is for high-throughput telemetry streaming. Azure Queue Storage provides basic queuing but does not guarantee ordering or exactly-once processing.

99.99% availability (about 52 minutes downtime per year) typically requires multi-region deployment with automatic failover — a single-region deployment cannot achieve this SLA regardless of the number of Availability Zones. Azure Front Door provides global load balancing across regions. Active-active deployment means both regions serve traffic, with automatic failover if one fails. A single SQL Database and nightly restarts introduce single points of failure.

Azure Event Hubs is designed for massive-scale event ingestion — millions of events per second with low latency. It supports both real-time consumers (e.g. Stream Analytics for dashboards) and batch consumers (e.g. capture to storage for later analysis). Service Bus is for transactional messaging, not high-throughput telemetry. Queue Storage is basic and low-throughput. Logic Apps is for workflow orchestration.

Azure Container Instances provides serverless containers — no infrastructure to manage, per-second billing, and fast startup. It's ideal for short-lived batch workloads. AKS requires managing a cluster (overkill for simple batch jobs). App Service is for long-running web applications. VM Scale Sets require managing VMs.

Azure Reserved Instances offer up to 72% savings compared to pay-as-you-go pricing for VMs, SQL Database, Cosmos DB, and other services. You commit to a one-year or three-year term. This is ideal for workloads with predictable, steady-state usage. For variable or short-lived workloads, pay-as-you-go or spot instances are more cost-effective.

Azure Cache for Redis provides a fully managed, in-memory data store that supports rich data structures (strings, hashes, lists, sets, sorted sets). It's accessible from any application instance over the network, making it perfect for shared caching. Blob Storage with CDN caches static files, not application data. Table Storage is persistent NoSQL, not an in-memory cache. Cosmos DB is a database, not a caching layer.

Azure Key Vault stores secrets securely (encrypted at rest, access-controlled). Managed Identity lets the application authenticate to Key Vault without needing credentials — the identity is managed by Azure and never exposed in code. Together, they eliminate secrets from source code and config files entirely. Policy enforces rules, Advisor gives recommendations, and NSGs control network traffic — none of them store or retrieve secrets.

Start with assessment — Data Migration Assistant identifies T-SQL compatibility issues, deprecated features, and breaking changes. Fix those issues before migrating. Then use Azure Database Migration Service for the actual data migration (supports online migration with minimal downtime). Finally, validate that the application works correctly against the new Azure SQL Database before cutting over production traffic.

Azure API Management is a full API gateway — it provides rate limiting (throttling policies), authentication (OAuth2, API keys, certificates), usage analytics, developer portal, and API versioning. Application Gateway is a web traffic load balancer with WAF. Front Door is a global CDN and load balancer. Load Balancer operates at layer 4 (TCP/UDP) with no API-level features.

Azure Cosmos DB offers guaranteed single-digit millisecond reads at the 99th percentile globally, with turnkey multi-region distribution and multi-region writes. It natively supports JSON documents. SQL Database and PostgreSQL can geo-replicate but don't guarantee sub-10ms reads globally. Redis provides low latency but is a cache, not a primary database for documents.

WAF (deployed on Application Gateway or Front Door) protects against common web exploits like SQL injection, XSS, and other OWASP top 10 threats. DDoS Protection Standard provides enhanced DDoS mitigation with traffic monitoring, automatic attack detection, and mitigation policies. Together they form a comprehensive protection layer. Bastion is for secure VM management access. Private Link provides private connectivity to services. Key Vault stores secrets.