AZ-304 Cheat Sheet 2026

The 30 highest-yield AZ-304 facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. An application needs read access to a specific Azure Storage container. Which principle should guide the scope of the role assignment? → Principle of least privilege — assign at the container level
2. An architect needs to ensure that Azure resources can only be deployed to specific regions due to data sovereignty requirements. What should be implemented? → Azure Policy with 'allowed locations' rule
3. You need to store relational data that requires multi-region writes with low latency. Which Azure service should you choose? → Azure Cosmos DB with multi-region writes
4. You need to grant an application access to Azure Key Vault secrets without storing credentials in code. What should you use? → Managed Identity
5. What is the purpose of Azure Management Groups in a large enterprise? → To apply policies and access controls hierarchically across multiple subscriptions
6. An application must process messages in strict order with exactly-once delivery guarantees. Which Azure messaging service should be selected? → Azure Service Bus with sessions
7. What does the Recovery Time Objective (RTO) represent in a disaster recovery plan? → The maximum acceptable time to restore a service after a disaster
8. An organization must ensure that Azure resources are deployed only to approved regions. Which governance tool enforces this at scale across all subscriptions? → Azure Policy assigned at the Management Group level
9. An architect wants to inspect all outbound internet traffic from Azure VMs through a centralized appliance. Which routing technique must be configured? → User-Defined Routes (UDR) with a next hop to the appliance
10. Which role-based access control scope is the HIGHEST level in the Azure RBAC hierarchy? → Management Group
11. A company needs to provide external partners with access to Azure resources without managing their identities in Azure AD. Which solution should you recommend? → Azure AD B2B
12. An organization needs to implement just-in-time VM access to reduce the attack surface of administrator ports. Which Azure service provides this capability? → Microsoft Defender for Cloud JIT VM access
13. What is the recommended approach to assign Azure built-in roles to groups rather than individual users at scale? → Dynamic group membership with RBAC assignment
14. An architect needs to design a hub-and-spoke network topology in Azure. What is the primary benefit of this design? → It centralizes shared services and network appliances in the hub VNet
15. You need to migrate a large on-premises SQL Server database (10 TB) to Azure SQL Managed Instance with minimal downtime. Which migration method should you use? → Azure Database Migration Service online migration with log replay
16. What is the purpose of Privileged Identity Management (PIM) in Azure AD? → To provide just-in-time privileged access to Azure resources
17. Which Azure VPN Gateway SKU supports active-active configuration for higher availability and redundancy? → All SKUs above Basic
18. Which Azure service is best suited for implementing a serverless, event-driven architecture that responds to HTTP triggers without managing infrastructure? → Azure Functions
19. Which Azure Storage redundancy option replicates data synchronously across three availability zones within a single region? → Zone-Redundant Storage (ZRS)
20. What Azure Storage feature prevents accidental or malicious deletion of blobs by requiring a delete lock to be held for a defined retention period? → Immutable Storage with WORM policy
21. Which Azure networking feature allows you to connect two VNets in different Azure regions so they communicate over the Microsoft backbone network? → Global VNet Peering
22. A multi-tier application needs to scale its web tier independently from its business logic tier. Which design pattern best addresses this in Azure? → Use Azure Service Bus to decouple tiers and scale independently
23. Which Azure feature protects Azure Blob Storage data from accidental deletion by retaining deleted data for a configurable retention period? → Soft Delete for Blobs
24. Which Azure service allows you to deploy a managed network virtual appliance to inspect and filter all traffic between VNets and on-premises networks? → Azure Firewall
25. Which Azure feature allows you to test a disaster recovery failover of VMs without impacting the production environment or interrupting replication? → Test Failover in Azure Site Recovery
26. Which Azure service allows an architect to run containerized workloads without managing Kubernetes control plane or nodes? → Azure Container Instances (ACI)
27. An application must process messages in strict order with exactly-once delivery guarantees. Which Azure messaging service supports this requirement? → Azure Service Bus with sessions enabled
28. Which Azure service provides a centralized solution for collecting, analyzing, and acting on telemetry data from Azure and on-premises environments? → Azure Monitor
29. Which Azure Blob Storage access tier is most cost-effective for data that is accessed less than once per month and requires a 30-day minimum storage duration? → Cold
30. Which Azure tool allows you to visualize and query your entire Azure resource inventory and their relationships using a graph-based query language? → Azure Resource Graph