Luyện thi Azure Solutions Architect Expert AZ-305

Microsoft Entra ID is the identity service for users, groups, and applications. DNS, Firewall, and Front Door serve networking purposes.

Conditional Access policies evaluate conditions and require actions such as MFA or device compliance. Policy enforces governance, Backup protects data, and Traffic Manager routes DNS traffic.

PIM gives eligible users temporary privileged roles with approval and justification. Site Recovery is disaster recovery, CDN caches content, and DNS resolves names.

Azure Policy evaluates resources and enforces rules across subscriptions. NSGs filter traffic, VMs run workloads, and Backup stores copies.

RBAC grants permissions by assigning roles such as Owner, Contributor, and Reader to principals. VNets, storage accounts, and DNS zones are resources.

Management groups sit above subscriptions and support policy, RBAC, and cost governance across many subscriptions. They do not store disks, filter traffic, or host apps.

A subscription is a billing and access boundary containing resource groups and resources. VNets, policies, and DNS records are inside subscriptions.

A landing zone provides a repeatable, governed environment with policies, networking, and identity baseline. It is not a data center, tier, or DNS zone.

Resource groups organize related resources for management, monitoring, and deletion. They are not identity groups, firewall rules, or schedules.

Entra ID manages identities, Conditional Access enforces sign-in conditions, Policy enforces resource rules, and RBAC assigns permissions.

Blob Storage stores unstructured objects at scale. SQL Database is relational, Files provides shares, and Queue Storage stores messages.

The Hot tier is optimized for frequent access. Cool is for infrequent access, Archive has the lowest cost and longest retrieval, and Premium is for high-performance block blobs.

Archive provides the lowest storage cost for rarely accessed data and can take hours to retrieve. Hot and Cool offer faster access at higher cost.

Azure Files provides managed SMB and NFS file shares. Blob is objects, Queue is messaging, and Table is NoSQL key-value.

Cosmos DB supports document, key-value, graph, and columnar APIs with global distribution. SQL Database is relational, Table is simple NoSQL, and Files is file storage.

Azure SQL Database is a managed relational database. Blob and Queue are storage services, and Front Door routes traffic.

A storage account groups blobs, files, queues, and tables with shared settings such as replication and access. VMs, DNS zones, and load balancers are not storage accounts.

GRS replicates data asynchronously to a paired secondary region. LRS keeps copies in one data center, and ZRS replicates across zones in one region.

Table Storage is a schemaless NoSQL key-value store. SQL Database is relational, Files provides shares, and CDN caches content.

Blob stores objects, Files provides shares, SQL Database is relational, and Cosmos DB is multi-model NoSQL.

Virtual Machines provides IaaS with full control over the OS. App Service is PaaS, Functions is serverless, and SQL Database is relational.

AKS is a managed Kubernetes service. ACI runs single containers, App Service hosts web apps, and VMSS manages VMs.

Functions is serverless event-driven compute. VMs and Dedicated Hosts require server management, and Availability Sets organize VMs.

App Service is a PaaS for web apps, APIs, and mobile backends. VMs are IaaS, ACI runs containers, and DNS resolves names.

ACI runs individual containers on demand without VM management. AKS manages a Kubernetes cluster, VMSS manages VMs, and Backup protects data.

VMSS manages identical VMs with autoscaling and load distribution. It is not an identity group, DNS zone, or storage account.

Availability sets spread VMs across fault and update domains within one data center. They do not protect against region-wide outages, key leaks, or DNS failures.

An availability zone is a physically separate data center within a region with independent power and networking. Resource groups and DNS records are logical objects.

Azure Virtual Desktop delivers managed Windows desktops and apps. Bastion provides secure VM access, App Service hosts web apps, and Remote Desktop Gateway is not a managed desktop platform.

VMs provide IaaS, AKS manages Kubernetes, Functions runs serverless code, and App Service hosts web apps.

A VNet provides isolated networking for Azure resources. Storage containers, VMs, and DNS zones are different resources.

Subnets divide VNet address space into segments for routing and security. Backups, DNS records, and firewall rules are separate.

NSGs filter traffic based on source, destination, port, and protocol. Policy enforces governance, resource groups organize, and storage accounts store data.

Load Balancer operates at Layer 4 for TCP and UDP. Application Gateway is Layer 7, Traffic Manager is DNS-based, and DNS resolves names.

Application Gateway is a Layer 7 load balancer for HTTP/HTTPS. Load Balancer is Layer 4, VPN Gateway connects networks, and DNS resolves names.

VPN Gateway creates encrypted tunnels over the internet. ExpressRoute is a private physical connection, DNS resolves names, and Application Gateway routes HTTP traffic.

ExpressRoute provides private connectivity through providers without the public internet. VPN uses encrypted internet tunnels, Front Door is global HTTP routing, and CDN caches content.

Private Link exposes PaaS services through private endpoints. DNS resolves names, Traffic Manager routes DNS traffic, and Bastion provides secure VM access.

Traffic Manager uses DNS-based routing across regional endpoints. Load Balancer and Application Gateway work within a region, and NSGs filter traffic.

NSGs filter traffic, Load Balancer balances Layer 4, Application Gateway routes HTTP, and VPN Gateway creates encrypted tunnels.

Azure Migrate discovers, assesses, and migrates on-premises workloads. Backup protects data, DNS resolves names, and CDN caches content.

Azure Migrate includes Server Migration for moving VMs to Azure. Policy enforces rules, Front Door routes traffic, and Monitor observes systems.

Database Migration Service moves databases to Azure SQL and other targets. DNS, CDN, and Files do not migrate databases.

AzCopy is optimized for data transfer to Azure Storage. Policy enforces rules, Traffic Manager routes traffic, and Bastion provides VM access.

Data Box ships physical storage devices for offline migration of large datasets. AzCopy is online transfer, File Sync syncs files, and DNS resolves names.

Azure File Sync keeps on-premises file servers synchronized with Azure Files. Migrate assesses workloads, Site Recovery replicates VMs, and Data Box transfers data physically.

Entra Connect synchronizes on-premises directories with Entra ID. DNS, Policy, and Monitor serve other purposes.

Lift and shift moves workloads as-is to reduce risk and time. Rewriting, deleting, or changing providers are different strategies.

Re-platforming makes small changes, such as using a managed database, without a full redesign. It is not keeping workloads, deleting infrastructure, or creating organizations.

Azure Migrate assesses workloads, Database Migration Service moves databases, Data Box transfers data physically, and File Sync syncs files.

Azure Monitor collects metrics, logs, and alerts. Policy enforces rules, Backup protects data, and Front Door routes traffic.

Azure Backup protects VMs, databases, and files with scheduled backups. Site Recovery replicates for disaster recovery, CDN caches content, and DNS resolves names.

Site Recovery replicates VMs and workloads to a secondary region for failover. Backup protects data, Monitor observes systems, and Policy enforces rules.

RPO defines acceptable data loss, usually measured in time. RTO defines acceptable downtime, while backup size and user count are different metrics.

RTO defines how quickly services must be restored. RPO defines data loss, and cost or bandwidth are separate concerns.

Autoscale adjusts instances or resources based on metrics and schedules. Policy enforces rules, DNS resolves names, and Firewall filters traffic.

Traffic Manager routes traffic across regional endpoints for availability. Load Balancer works within a region, NSGs filter traffic, and Policy enforces rules.

Cost Management provides budgets, cost analysis, and alerts. Monitor observes performance, Backup protects data, and DNS resolves names.

Budgets track spending against a limit and trigger alerts or actions. DNS records, backup schedules, and firewall rules are unrelated.

Monitor collects metrics, Backup protects data, Site Recovery replicates workloads, and Cost Management controls spending.