AZ-305 Cheat Sheet 2026

The 30 highest-yield AZ-305 facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. You need to design a solution to detect and alert when users sign in from locations that are anomalous for their profile. Which feature should you enable? → Azure AD Identity Protection sign-in risk policies
2. Which Azure Firewall feature allows it to perform deep packet inspection and decrypt TLS traffic to detect and block hidden threats? → Azure Firewall Premium with TLS inspection and IDPS
3. Which Azure Load Balancer SKU is required to support cross-zone load balancing, global load balancing, and availability zones? → Standard SKU
4. What do Azure regions' availability zones do? → Different Azure datacenters within a region
5. A company needs to allow users from a partner organization to access Azure resources without creating new accounts. Which Azure AD feature should you recommend? → Azure AD B2B collaboration
6. An Azure SQL Managed Instance needs to meet an RPO of 1 hour and an RTO of 4 hours for cross-region disaster recovery. Which feature should you configure? → Auto-failover groups with a secondary in a paired region
7. A global application needs to route users to the nearest healthy Azure region and perform SSL offloading. Which Azure service is best suited? → Azure Front Door
8. What is the default interactive data retention period for a Log Analytics workspace before data must be archived or deleted? → 90 days
9. Your organization needs to reduce Azure VM costs by up to 72% for workloads that can tolerate interruptions. Which pricing model should you use? → Azure Spot Virtual Machines
10. You need to design a caching layer to reduce read latency for an Azure SQL Database backing a high-traffic web application. Which service should you add? → Azure Cache for Redis
11. You need to query Azure Monitor logs to identify all failed authentication events on your VMs over the past 24 hours. Which query language should you use? → Kusto Query Language (KQL)
12. You need to enforce that all users signing in from outside the corporate network must use MFA. Which solution should you design? → Conditional Access policies with location-based conditions
13. Your company is implementing a Zero Trust architecture. Which Azure AD capability most directly supports the 'verify explicitly' principle? → Conditional Access with device compliance, location, and risk signals
14. Which Azure Cosmos DB feature provides continuous backup and allows you to restore your database to any point in the past 30 days? → Continuous backup mode with point-in-time restore (PITR)
15. A workload spans two Azure regions and needs fast, low-latency failover routing for TCP/UDP traffic. Which Azure service provides this? → Azure Cross-Region Load Balancer
16. Which Azure Backup feature ensures that backups cannot be deleted for a specified retention period, protecting against ransomware or malicious administrators? → Immutable vault with locked policy
17. You want to reuse the same set of email, SMS, and webhook notifications across multiple alert rules. Which Azure Monitor feature enables this? → Action groups
18. You need an alert that fires when CPU utilization on a VM exceeds 80% for five consecutive minutes. Which Azure Monitor alert type should you use? → Metric alert
19. You need Azure Functions to run within your VNet to access private resources, with no cold starts and pre-warmed instances. Which plan should you choose? → Premium Plan
20. You need to design an auto-scaling solution for Azure VMs that scales out based on custom application metrics from Azure Monitor. Which service enables this? → Virtual Machine Scale Sets with Azure Monitor autoscale rules
21. A multi-tenant SaaS application needs to authenticate users from thousands of different Azure AD tenants. What is the recommended design? → Register the app as a multi-tenant application in Azure AD
22. You need to monitor node health, pod resource usage, and container logs for an AKS cluster using Azure Monitor. Which solution should you enable? → Container insights
23. What are regions in Azure? → Geographical locations around the globe that contain Azure datacenters
24. You need to capture network packet-level traffic to and from a VM's NIC for forensic security analysis. Which Azure Network Watcher feature should you use? → Packet capture
25. Your data warehouse needs to query petabytes of data with massively parallel processing (MPP). Which Azure service is designed for this workload? → Azure Synapse Analytics dedicated SQL pool
26. You need to diagnose why two Azure VMs cannot communicate with each other despite being in the same VNet. Which Azure Network Watcher tool should you use first? → Connection troubleshoot
27. Your security team requires that stale guest accounts be automatically removed after 90 days of inactivity. Which feature enables this? → Azure AD Access Reviews
28. Your web application is hosted in Azure and needs to be protected against OWASP top-10 web vulnerabilities at the network edge. Which service should you enable? → Azure Web Application Firewall (WAF)
29. To satisfy the security and compliance requirements after migrating App1 to Azure, you must enforce the data modification restrictions. What should you do? → Implement Azure resource locks
30. You are designing a solution where Azure VMs need outbound internet access but must not have public IP addresses. Which managed service provides this? → Azure NAT Gateway