Microsoft AZ-305 Online Practice Questions and Exam Preparation

Microsoft AZ-305 Online Questions & Answers

• Question 101:

  You plan to migrate App1 to Azure. The solution must meet the authentication and authorization requirements.

  Which type of endpoint should App1 use to obtain an access token?

  A. Azure Instance Metadata Service (IMDS)
  B. Azure AD
  C. Azure Service Management
  D. Microsoft identity platform
  A. Azure Instance Metadata Service (IMDS)

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token

• Question 102:

  HOTSPOT

  You plan to implement an access review to meet the following requirements:

  The access review must be enforced until otherwise configured. Each user or group that has access to the Azure environment must be in the scope of the access review.

  The access review must be completed within two weeks. A lack of response must not cause changes in the operational environment.

  An administrator creates the access review shown in the answer area.

  Which two sections of the access review should you modify to meet the requirements? To answer, select the appropriate sections in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Area 1: Start date..End Date

  The access review must be enforced until otherwise configured. We set

  End: Never

  The access review must be completed within two weeks. We set Duration (in days) to 14

  Area 2: Upon completion settings

  A lack of response must not cause changes in the operational environment. We set 'If reviewers don't respond: No change (which leave user's access unchanged)

• Question 103:

  You have an Azure subscription that contains 1,000 resources.

  You need to generate compliance reports for the subscription. The solution must ensure that the resources can be grouped by department.

  What should you use to organize the resources?

  A. application groups and quotas
  B. Azure Policy and tags
  C. administrative units and Azure Lighthouse
  D. resource groups and role assignments
  B. Azure Policy and tags

  ---

  Explanation

  Compliance Report using Azure Policy

  Azure Policy is a powerful tool for Azure Governance. With Azure Policy we can define rules for all Azure Subscriptions the we manage. We can use this rules for simple limitation actions, like permitting only specific VM Series and Sizes that can be created and also more complex rule sets that helps you standardize the whole Azure deployment.

  Enforce tags for resource creation

  So, why tags? Why we need to add tags to all Azure resources? The Microsoft Azure environments are getting bigger and bigger and managed by multiple people and teams. That makes it difficult to understand who created a resource and what is the purpose of that resource. Another critical matter that we need tags is Cost Management. At the Azure Cost Management Portal, we can sort and arrange the resource cost using the Tags. This way we can provide an expense dashboard with the actual cost of the resources per department, project or whatever tags we have added to the Resource.

  References:

  https://www.cloudcorner.gr/microsoft/azure/compliance-report-using-azure-policy/https://www.cloudcorner.gr/microsoft/azure-policy-enforce-tags-for-resource-creation/

• Question 104:

  HOTSPOT

  You have an Azure web app named App1 and an Azure key vault named KV1.

  App1 stores database connection strings in KV1.

  App1 performs the following types of requests to KV1:

  Get

  List

  Wrap

  Delete

  Unwrap

  Backup

  Decrypt

  Encrypt

  You are evaluating the continuity of service for App1.

  You need to identify the following if the Azure region that hosts KV1 becomes unavailable:

  To where will KV1 fail over?

  During the failover, which request type will be unavailable?

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: A server in the same paired region

  The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets.

  Box 2: Delete

  During failover, your key vault is in read-only mode. Requests that are supported in this mode are: List certificates

  Get certificates

  List secrets

  Get secrets

  List keys

  Get (properties of) keys Encrypt Decrypt Wrap Unwrap Verify Sign Backup

  References:

  https://docs.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance

• Question 105:

  Your company currently has an application that is hosted on their on-premises environment. The application currently connects to two databases in the on-premises environment. The databases are named whizlabdb1 and whizlabdb2.

  You have to move the databases onto Azure. The databases have to support server-side transactions across both of the databases.

  Solution: You decide to deploy the databases to an Azure SQL database-managed instance.

  Would this fulfill the requirement?

  A. Yes
  B. No
  A. Yes

• Question 106:

  DRAG DROP

  You are planning an Azure solution that will host production databases for a high-performance application. The solution will include the following components:

  1. Two virtual machines that will run Microsoft SQL Server 2016, will be deployed to different data centers in the same Azure region, and will be part of an Always On availability group.

  2. SQL Server data that will be backed up by using the Automated Backup feature of the SQL Server IaaS Agent Extension (SQLIaaSExtension)

  You identify the storage priorities for various data types as shown in the following table.

  

  Which storage type should you recommend for each data type? To answer, drag the appropriate storage types to the correct data types.

  Each storage type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 107:

  Your company has the divisions shown in the following table.

  

  Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.

  You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.

  What should you recommend?

  A. Configure Azure AD join.
  B. Configure Azure AD Identity Protection.
  C. Configure a Conditional Access policy.
  D. Configure Supported account types in the application registration and update the sign-in endpoint.
  D. Configure Supported account types in the application registration and update the sign-in endpoint.

  ---

  Explanation

  Identity and account types for single-and multi-tenant apps

  You, as a developer, can choose if your app allows only users from your Azure Active Directory (Azure AD) tenant, any Azure AD tenant, or users with personal Microsoft accounts. You can configure your app to be either single tenant or multitenant during app registration in Azure.

  Note: A required part of application registration in Azure AD is your selection of supported account types. While IT Pros in administrator roles decide who can consent to apps in their tenant, you, as a developer, specify who can use your app based on account type. When a tenant doesn't allow you to register your application in Azure AD, administrators will provide you with a way to communicate those details to them through another mechanism.

  You'll choose from the following supported account type options when registering your application.

  Accounts in this organizational directory only (O365 only - Single tenant)

  Accounts in any organizational directory (Any Azure AD directory - Multitenant)

  Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) Personal Microsoft accounts only

  Incorrect:

  Configure Azure AD join.

  Azure AD joined devices are signed in to using an organizational Azure AD account. Access to resources can be controlled based on Azure AD account and Conditional Access policies applied to the device.

  Configure Azure AD Identity Protection

  Identity Protection allows organizations to accomplish three key tasks: Automate the detection and remediation of identity-based risks. Investigate risks using data in the portal. Export risk detection data to other tools.

  References:

  https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types

• Question 108:

  HOTSPOT

  Your company deploys several Linux and Windows virtual machines (VMs) to Azure. The VMs are deployed with the Microsoft Dependency Agent and the Microsoft Monitoring Agent installed by using Azure VM extensions. On-premises connectivity has been enabled by using Azure ExpressRoute.

  You need to design a solution to monitor the VMs.

  Which Azure monitoring services should you use? To answer, select the appropriate Azure monitoring services in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure Network Watcher

  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With traffic analytics, you can: Identify security threats to, and secure your network, with information such as open-ports, applications attempting internet access, and virtual machines (VM) connecting to rogue networks.

  Visualize network activity across your Azure subscriptions and identify hot spots.

  Understand traffic flow patterns across Azure regions and the internet to optimize your network deployment for performance and capacity.

  Pinpoint network misconfigurations leading to failed connections in your network.

  Box 2: Azure Service Map

  Service Map automatically discovers application components on Windows and Linux systems and maps the communication between services. With Service Map, you can view your servers in the way that you think of them: as interconnected systems that deliver critical services. Service Map shows connections between servers, processes, inbound and outbound connection latency, and ports across any TCP-connected architecture, with no configuration required other than the installation of an agent.

  References:

  https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analyticshttps://docs.microsoft.com/en-us/azure/azure-monitor/insights/service-map

• Question 109:

  A company needs a datastore created in Azure for an application. Below are the key requirements for the data store.

  1. Ability to store JSON based items

  2. Ability to use SQL like queries on the datastore

  3. Ability to provide low latency access to data items

  Which of the following would you consider as the data store?

  A. Azure BLOB storage
  B. Azure CosmosDB
  C. Azure HDInsight
  D. Azure Redis
  B. Azure CosmosDB

• Question 110:

  You need to recommend a storage solution for the records of a mission critical application. The solution must provide a Service Level Agreement (SLA) for the latency of write operations and the throughput.

  What should you include in the recommendation?

  A. Azure Data Lake Storage Gen2
  B. Azure Blob Storage
  C. Azure SQL
  D. Azure Cosmos DB
  D. Azure Cosmos DB

  ---

  Explanation

  Azure Cosmos DB is Microsoft's fast NoSQL database with open APIs for any scale. It offers turnkey global distribution across any number of Azure regions by transparently scaling and replicating your data wherever your users are. The service offers comprehensive 99.99% SLAs which covers the guarantees for throughput, consistency, availability and latency for the Azure Cosmos DB Database Accounts scoped to a single Azure region configured with any of the five Consistency Levels or Database Accounts spanning multiple Azure regions, configured with any of the four relaxed Consistency Levels. Azure Cosmos DB allows configuring multiple Azure regions as writable endpoints for a Database Account. In this configuration, Azure Cosmos DB offers 99.999% SLA for both read and write availability.

  References:

  https://azure.microsoft.com/en-us/support/legal/sla/cosmos-db/v1_3/