AZ-304 Cheat Sheet 2026

The 30 highest-yield AZ-304 facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. An application needs read access to a specific Azure Storage container. Which principle should guide the scope of the role assignment? → Principle of least privilege — assign at the container level
2. You need to store relational data that requires multi-region writes with low latency. Which Azure service should you choose? → Azure Cosmos DB with multi-region writes
3. You need to grant an application access to Azure Key Vault secrets without storing credentials in code. What should you use? → Managed Identity
4. What is the purpose of Azure Management Groups in a large enterprise? → To apply policies and access controls hierarchically across multiple subscriptions
5. An application must process messages in strict order with exactly-once delivery guarantees. Which Azure messaging service should be selected? → Azure Service Bus with sessions
6. What does the Recovery Time Objective (RTO) represent in a disaster recovery plan? → The maximum acceptable time to restore a service after a disaster
7. An architect wants to inspect all outbound internet traffic from Azure VMs through a centralized appliance. Which routing technique must be configured? → User-Defined Routes (UDR) with a next hop to the appliance
8. Which role-based access control scope is the HIGHEST level in the Azure RBAC hierarchy? → Management Group
9. A company needs to provide external partners with access to Azure resources without managing their identities in Azure AD. Which solution should you recommend? → Azure AD B2B
10. What is the recommended approach to assign Azure built-in roles to groups rather than individual users at scale? → Dynamic group membership with RBAC assignment
11. An architect needs to design a hub-and-spoke network topology in Azure. What is the primary benefit of this design? → It centralizes shared services and network appliances in the hub VNet
12. What is the purpose of Privileged Identity Management (PIM) in Azure AD? → To provide just-in-time privileged access to Azure resources
13. Which Azure VPN Gateway SKU supports active-active configuration for higher availability and redundancy? → All SKUs above Basic
14. Which Azure service is best suited for implementing a serverless, event-driven architecture that responds to HTTP triggers without managing infrastructure? → Azure Functions
15. Which Azure Storage redundancy option replicates data synchronously across three availability zones within a single region? → Zone-Redundant Storage (ZRS)
16. What Azure Storage feature prevents accidental or malicious deletion of blobs by requiring a delete lock to be held for a defined retention period? → Immutable Storage with WORM policy
17. Which Azure networking feature allows you to connect two VNets in different Azure regions so they communicate over the Microsoft backbone network? → Global VNet Peering
18. Which Azure feature protects Azure Blob Storage data from accidental deletion by retaining deleted data for a configurable retention period? → Soft Delete for Blobs
19. Which Azure service allows you to deploy a managed network virtual appliance to inspect and filter all traffic between VNets and on-premises networks? → Azure Firewall
20. Which Azure feature allows you to test a disaster recovery failover of VMs without impacting the production environment or interrupting replication? → Test Failover in Azure Site Recovery
21. Which Azure service provides a centralized solution for collecting, analyzing, and acting on telemetry data from Azure and on-premises environments? → Azure Monitor
22. Which Azure Blob Storage access tier is most cost-effective for data that is accessed less than once per month and requires a 30-day minimum storage duration? → Cold
23. Which Azure tool allows you to visualize and query your entire Azure resource inventory and their relationships using a graph-based query language? → Azure Resource Graph
24. What is the purpose of Azure SQL Elastic Pools? → To share compute resources across multiple databases with variable workloads
25. Which Azure service provides centralized, scalable management of routing and security for a large number of branch offices connecting to Azure? → Azure Virtual WAN
26. Which identity model allows users to sign in to Azure resources using the same credentials as their on-premises AD without password hash sync to Azure AD? → Federation with ADFS
27. Which Azure SQL Database feature automatically tunes query performance by identifying and applying index recommendations? → Automatic Tuning
28. What is the purpose of Azure Route Server in a hub-and-spoke network design? → It enables dynamic BGP route exchange between NVAs and Azure VNets
29. A solution must ingest and process millions of events per second from thousands of IoT sensors with low latency. Which Azure service is most appropriate? → Azure Event Hubs
30. Which Azure service allows you to extend your on-premises Active Directory domain to Azure virtual machines without deploying domain controllers? → Azure AD Domain Services