Microsoft Microsoft Azure AZ-305 Questions & Answers

• Question 1:

  HOTSPOT

  You need to ensure that users managing the production environment are registered for Azure MFA and must authenticate by using Azure MFA when they sign in to the Azure portal.

  The solution must meet the authentication and authorization requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  1: Azure AD Identity Protection Litware.com has Conditional Access Policy. Don't enable or enforce per-user Azure AD Multi-Factor Authentication if you use Conditional Access policies. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates Therefor it should NOT be Per user MFA

  2: Grant control in capolicy1 Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios. Grant Control is one step in process to enable MFA in Conditional Access Policy.

• Question 2:

  You have an Azure subscription that contains 1,000 resources.

  You need to generate compliance reports for the subscription. The solution must ensure that the resources can be grouped by department.

  What should you use to organize the resources?

  A. application groups and quotas

  B. Azure Policy and tags

  C. administrative units and Azure Lighthouse

  D. resource groups and role assignments

  Correct Answer: B

  Compliance Report using Azure Policy Azure Policy is a powerful tool for Azure Governance. With Azure Policy we can define rules for all Azure Subscriptions the we manage. We can use this rules for simple limitation actions, like permitting only specific VM Series and Sizes that can be created and also more complex rule sets that helps you standardize the whole Azure deployment.

  Enforce tags for resource creation So, why tags? Why we need to add tags to all Azure resources? The Microsoft Azure environments are getting bigger and bigger and managed by multiple people and teams. That makes it difficult to understand who created a resource and what is the purpose of that resource. Another critical matter that we need tags is Cost Management. At the Azure Cost Management Portal, we can sort and arrange the resource cost using the Tags. This way we can provide an expense dashboard with the actual cost of the resources per department, project or whatever tags we have added to the Resource.

  Reference: https://www.cloudcorner.gr/microsoft/azure/compliance-report-using-azure-policy/ https://www.cloudcorner.gr/microsoft/azure-policy-enforce-tags-for-resource-creation/

• Question 3:

  Your company has the divisions shown in the following table.

  

  Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.

  You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend?

  A. Configure Azure AD Identity Protection.

  B. Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).

  C. Configure Supported account types in the application registration and update the sign-in endpoint.

  D. Configure a Conditional Access policy.

  Correct Answer: C

  Identity and account types for single- and multi-tenant apps

  You, as a developer, can choose if your app allows only users from your Azure Active Directory (Azure AD) tenant, any Azure AD tenant, or users with personal Microsoft accounts. You can configure your app to be either single tenant or

  multitenant during app registration in Azure.

  Note: A required part of application registration in Azure AD is your selection of supported account types. While IT Pros in administrator roles decide who can consent to apps in their tenant, you, as a developer, specify who can use your app

  based on account type. When a tenant doesn't allow you to register your application in Azure AD, administrators will provide you with a way to communicate those details to them through another mechanism.

  You'll choose from the following supported account type options when registering your application.

  Accounts in this organizational directory only (O365 only - Single tenant)

  Accounts in any organizational directory (Any Azure AD directory - Multitenant)

  Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) Personal Microsoft accounts only

  Incorrect:

  * Configure Azure AD Identity Protection

  Identity Protection allows organizations to accomplish three key tasks: Automate the detection and remediation of identity-based risks. Investigate risks using data in the portal. Export risk detection data to other tools.

  Reference:

  https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types

• Question 4:

  Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.

  Several virtual machines exhibit network connectivity issues.

  You need to analyze the network traffic to identify whether packets are being allowed or denied from the Azure virtual machines to the on-premises virtual machines.

  Solution: Use Azure Advisor.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use Azure Network Watcher IP Flow Verify, which allows you to detect traffic filtering issues at a VM level.

  Note: IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

  Reference: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

• Question 5:

  Your company has the divisions shown in the following table.

  

  Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.

  You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.

  What should you recommend?

  A. Configure Azure AD join.

  B. Configure Azure AD Identity Protection.

  C. Configure a Conditional Access policy.

  D. Configure Supported account types in the application registration and update the sign-in endpoint.

  Correct Answer: D

  Identity and account types for single- and multi-tenant apps You, as a developer, can choose if your app allows only users from your Azure Active Directory (Azure AD) tenant, any Azure AD tenant, or users with personal Microsoft accounts. You can configure your app to be either single tenant or multitenant during app registration in Azure.

  Note: A required part of application registration in Azure AD is your selection of supported account types. While IT Pros in administrator roles decide who can consent to apps in their tenant, you, as a developer, specify who can use your app based on account type. When a tenant doesn't allow you to register your application in Azure AD, administrators will provide you with a way to communicate those details to them through another mechanism.

  You'll choose from the following supported account type options when registering your application.

  Accounts in this organizational directory only (O365 only - Single tenant) Accounts in any organizational directory (Any Azure AD directory - Multitenant)

  Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) Personal Microsoft accounts only Incorrect:

  *

  Configure Azure AD join.

  Azure AD joined devices are signed in to using an organizational Azure AD account. Access to resources can be controlled based on Azure AD account and Conditional Access policies applied to the device.

  *

  Configure Azure AD Identity Protection

  Identity Protection allows organizations to accomplish three key tasks: Automate the detection and remediation of identity-based risks. Investigate risks using data in the portal. Export risk detection data to other tools.

  Reference:

  https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types

• Question 6:

  DRAG DROP

  You need to configure an Azure policy to ensure that the Azure SQL databases have TDE enabled. The solution must meet the security and compliance requirements.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Scenario: All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.

  Step 1: Create an Azure policy definition that uses the deployIfNotExists identity.

  The first step is to define the roles that deployIfNotExists and modify needs in the policy definition to successfully deploy the content of your included template.

  Step 2: Create an Azure policy assignment

  When creating an assignment using the portal, Azure Policy both generates the managed identity and grants it the roles defined in roleDefinitionIds.

  Step 3: Invoke a remediation task

  Resources that are non-compliant to a deployIfNotExists or modify policy can be put into a compliant state through Remediation. Remediation is accomplished by instructing Azure Policy to run the deployIfNotExists effect or the modify

  operations of the assigned policy on your existing resources and subscriptions, whether that assignment is to a management group, a subscription, a resource group, or an individual resource.

  During evaluation, the policy assignment with deployIfNotExists or modify effects determines if there are non-compliant resources or subscriptions. When non-compliant resources or subscriptions are found, the details are provided on the

  Remediation page.

• Question 7:

  DRAG DROP

  You need to recommend a solution that meets the file storage requirements for App2.

  What should you deploy to the Azure subscription and the on-premises network? To answer, drag the appropriate services to the correct locations. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Azure Files

  Scenario: App2 has the following file storage requirements:

  Save files to an Azure Storage account.

  Replicate files to an on-premises location.

  Ensure that on-premises clients can read the files over the LAN by using the SMB protocol.

  Box 2: Azure File Sync

  Use Azure File Sync to centralize your organization's file shares in Azure Files, while keeping the flexibility, performance, and compatibility of an on-premises file server. Azure File Sync transforms Windows Server into a quick cache of your

  Azure file share. You can use any protocol that's available on Windows Server to access your data locally, including SMB, NFS, and FTPS. You can have as many caches as you need across the world.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide

• Question 8:

  HOTSPOT

  How should the migrated databases DB1 and DB2 be implemented in Azure?

  Hot Area:

  

  Correct Answer:

  

  Box 1: SQL Managed Instance

  Scenario: Once migrated to Azure, DB1 and DB2 must meet the following requirements:

  1.

  Maintain availability if two availability zones in the local Azure region fail.

  2.

  Fail over automatically.

  3.

  Minimize I/O latency.

  The auto-failover groups feature allows you to manage the replication and failover of a group of databases on a server or all databases in a managed instance to another region.

  It is a declarative abstraction on top of the existing active geo-replication feature, designed to simplify deployment and management of geo-replicated databases at scale. You can initiate a geo-failover manually or you can delegate it to the

  Azure service based on a userdefined policy. The latter option allows you to automatically recover multiple related databases in a secondary region after a catastrophic failure or other unplanned event that results in full or partial loss of the

  SQL Database or SQL Managed Instance availability in the primary region.

  Box 2: Business critical

  SQL Managed Instance is available in two service tiers:

  General purpose: Designed for applications with typical performance and I/O latency requirements.

  Business critical: Designed for applications with low I/O latency requirements and minimal impact of underlying maintenance operations on the workload.

• Question 9:

  Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.

  The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.

  You need to recommend a solution to meet the regulatory requirement.

  Solution: You recommend using an Azure policy to enforce the location of resource groups.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 10:

  You are designing an app that will use Azure Cosmos DB to collate sales data from multiple countries. You need to recommend an API for the app. The solution must meet the following requirements:

  Support SQL queries.

  Support geo-replication.

  Store and access data relationally.

  Which API should you recommend?

  A. PostgreSQL

  B. NoSQL

  C. Apache Cassandra

  D. MongoDB

  Correct Answer: A