Azure AZ-305 Glossary: Key Terms

March 30, 2026

Azure AZ-305 glossary of governance, storage, resilience, networking, and architecture terms.

On this page

Use this glossary when architecture, governance, networking, and continuity terms start to blur together. Keep it beside the cheat sheet and resources instead of using it as a replacement for scenario practice.

High-yield terms

Term	Short meaning	Why it matters on AZ-305
Landing zone	Standardized Azure environment design for governance, identity, networking, and platform controls	Core platform-boundary concept
Management group	Azure scope above subscriptions used for policy and governance inheritance	High-value governance scope term
Subscription	Billing and administrative boundary for Azure resources	Common scope and isolation question
Resource group	Lifecycle boundary for related Azure resources	Frequently confused with subscription scope
RBAC	Azure authorization model for who can do what at a given scope	Core authorization control
Policy	Azure governance engine for allowed, denied, or modified resource configurations	Core compliance and guardrail control
Private Endpoint	Private IP mapping into a PaaS service through Azure Private Link	Central private-access design term
Service Endpoint	VNet-to-service routing enhancement without assigning a private IP inside the service	Common distractor against Private Endpoint
Hub-spoke	Network topology with shared central services and segmented workload spokes	Classic Azure network architecture pattern
Zone redundancy	Service deployment pattern spread across Azure availability zones	High-availability term distinct from geo patterns
Failover group	Managed database failover and endpoint abstraction across regions	Continuity term for relational data
Managed identity	Azure-managed workload identity used instead of stored secrets	Strong identity-first design answer
Availability set	VM distribution across fault and update domains within one datacenter pattern	Often confused with zone design
Geo-redundancy	Replication across regions for continuity and durability	Distinct from zone redundancy
Log Analytics workspace	Central Azure Monitor log store and query surface	Core monitoring and routing term
Application Insights	Application telemetry and tracing service	Commonly confused with broader Monitor/Workspace roles
Front Door	Global edge entry service with routing/WAF/CDN-style behavior	Frequent ingress choice distractor
Application Gateway	Regional Layer 7 load balancer with WAF and routing rules	Needs to be separated from Front Door and Load Balancer
Traffic Manager	DNS-based traffic routing service	Commonly confused with proxying ingress tools
Recovery Services vault	Azure vault for backup and some recovery workflows	Core continuity term

Commonly confused pairs

Pair	Keep this distinction clear
RBAC vs Policy	access authorization versus configuration governance
Private Endpoint vs Service Endpoint	private IP access path versus service-boundary routing optimization
subscription vs resource group	billing and admin scope versus lifecycle grouping scope
zone redundancy vs geo-redundancy	protection across zones in one region versus replication across regions
backup vs failover	restore path versus low-downtime continuity path
Front Door vs Application Gateway	global edge ingress versus regional L7 ingress
Application Gateway vs Load Balancer	L7 HTTP-aware routing versus L4 network balancing
Azure Monitor vs Application Insights	broad monitoring platform versus app-centric telemetry
Log Analytics workspace vs storage archive	queryable log workspace versus cheaper long-term retention target

If three terms blur together

Cluster	Fast separation
management group / subscription / resource group	governance scope, billing/admin scope, or lifecycle boundary
RBAC / Policy / lock	who can act, what is allowed, or what cannot be changed casually
Private Endpoint / Service Endpoint / public endpoint with restrictions	private IP path, VNet-identity optimization, or public path with controls
Front Door / Application Gateway / Traffic Manager	global edge proxy, regional L7 ingress, or DNS-based routing
backup / geo-replication / failover	restore safety, replicated durability, or low-downtime continuity

One-sentence memory hooks

If the question is about stored secrets vs secretless auth, think managed identity first.
If the question is about private PaaS access, think Private Endpoint plus DNS.
If the requirement is global web entry, think Front Door before regional ingress.
If the requirement is regional HTTP routing with WAF, think Application Gateway.
If the requirement is restore later, think backup; if it is stay available, think failover.

Operational clusters worth keeping straight

Cluster	What it usually signals on the exam
governance scope / RBAC / Policy	organization and compliance design
private access / DNS / hub-spoke	network-boundary architecture
SQL / Cosmos / Blob / Files	data-platform fit questions
backup / DR / HA / RTO / RPO	continuity design questions
Monitor / Log Analytics / App Insights	observability-routing questions

If the confusion is really about…

Topic family	Best page to revisit
architecture pickers and high-confusion pairs	Cheat Sheet
current Microsoft facts and primary docs	Resources
pacing and review order	Study Plan
overall exam framing	Guide root

Revised on Sunday, May 10, 2026

Resources