Microsoft AZ-305 Online Practice Questions and Exam Preparation

Microsoft AZ-305 Online Questions & Answers

• Question 221:

  HOTSPOT

  You are designing an app that will be hosted on Azure virtual machines that run Ubuntu.

  The app will use a third-party email service to send email messages to users. The thirdparty email service requires that the app authenticate by using an API key.

  You need to recommend an Azure Key Vault solution for storing and accessing the API key. The solution must minimize administrative effort.

  What should you recommend using to store and access the key? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1. Storage: Secret.

  API keys are typically stored as secrets in Azure Key Vault. The key vault can store and manage secrets like API keys, passwords, or database connection strings.

  2. Access: A managed service identity (MSI).

  A managed service identity (MSI) is used to give your VM access to the key vault. The advantage of using MSI is that you do not have to manage credentials yourself. Azure takes care of rolling the credentials and ensuring their lifecycle. The application running on your VM can use its managed service identity to get a token to Azure AD, and then use that token to authenticate to Azure Key Vault.

• Question 222:

  You have a Microsoft Entra tenant named contoso.com.

  You have a partner organization that has a Microsoft Entra tenant named fabrikam.com.

  You plan to provide the users in fabrikam.com with access to the resources in contoso.com by using access packages.

  You need to ensure that contoso.com users assigned the Access package assignment manager role can only assign access packages to the fabrikam.com users.

  What should you do first in the Microsoft Entra admin center?

  A. From the Entitlement management settings in Identity Governance, create a new connected organization.
  B. From the Cross-tenant access settings in External Identities, create a new organization.
  C. From the Cross-tenant synchronization settings, create a new configuration.
  D. From the All identity providers settings in External Identities, create a new SAML/WS Fed IdP identity provider.
  A. From the Entitlement management settings in Identity Governance, create a new connected organization.

• Question 223:

  HOTSPOT

  You plan to migrate on-premises Microsoft SQL Server databases to Azure.

  You need to recommend a deployment and resiliency solution that meets the following requirements:

  1. Supports user-initiated backups

  2. Supports multiple automatically replicated instances across Azure regions

  3. Minimizes administrative effort to implement and maintain business continuity

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: An Azure SQL Database single database.

  SQL Server Managed instance versus SQL Server Virtual Machines

  Active geo-replication is not supported by Azure SQL Managed Instance.

  Box 2: Active geo-replication

  Active geo-replication is a feature that lets you to create a continuously synchronized readable secondary database for a primary database. The readable secondary database may be in the same Azure region as the primary, or, more commonly, in a different region. This kind of readable secondary databases are also known as geo-secondaries, or geo-replicas.

  Incorrect Answers:

  A Zone-redundant deployment is within a single region.

  Auto-failover groups support geo-replication of all databases in the group to only one secondary server or instance in a different region. If you need to create multiple Azure SQL Database geo-secondary replicas (in the same or different regions) for the same primary replica, use active geo-replication.

  References:

  https://docs.microsoft.com/en-us/azure/azure-sql/database/active-geo-replication-overview

• Question 224:

  You have an Azure subscription that contains an Azure SQL database.

  You are evaluating whether to use Azure reservations on the Azure SQL database.

  Which tool should you use to estimate the potential savings?

  A. The Purchase reservations blade in the Azure portal
  B. The Advisor blade in the Azure portal
  C. The SQL database blade in the Azure portal
  A. The Purchase reservations blade in the Azure portal

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/azure-sql/database/reserved-capacity-overview

• Question 225:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.

  The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.

  You need to recommend a solution to meet the regulatory requirement.

  Solution: You recommend using an Azure Policy initiative to enforce the location of resource groups.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  A security initiative is a collection of Azure Policy definitions, or rules, are grouped together towards a specific goal or purpose. Security initiatives simplify management of your policies by grouping a set of policies together, logically, as a single item.

  As an example, you could define a policy initiative definition to limit the locations of resources in the various included policy definitions. A parameter for that policy initiative definition could be allowedLocations. The parameter is then available to each included policy definition and defined during assignment of the policy initiative.

  Note:

  Azure Policy initiative definition structure

  Initiatives enable you to group several related policy definitions to simplify assignments and management because you work with a group as a single item. For example, you can group related tagging policy definitions into a single initiative.

  Rather than assigning each policy individually, you apply the initiative.

  You use JSON to create a policy initiative definition. The policy initiative definition contains elements for: display name description metadata parameters policy definitions policy groups

  References:

  https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure

• Question 226:

  HOTSPOT

  You are designing a software as a service (SaaS) application that will enable Azure Active Directory (Azure AD) users to create and publish online surveys. The SaaS application will have a front-end web app and a back-end web API. The web app will rely on the web API to handle updates to customer surveys.

  You need to design an authorization flow for the SaaS application. The solution must meet the following requirements:

  1. To access the back-end web API, the web app must authenticate by using OAuth 2 bearer tokens.

  2. The web app must authenticate by using the identities of individual users.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/lb-lu/azure/architecture/multitenant-identity/web-apihttps://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-dotnet-webapi

• Question 227:

  You are designing a solution that calculates 3D geometry from height-map data.

  You need to recommend a solution that meets the following requirements:

  1. Performs calculations in Azure.

  2. Ensures that each node can communicate data to every other node.

  3. Maximizes the number of nodes to calculate multiple scenes as fast as possible.

  4. Minimizes the amount of effort to implement the solution.

  Which two actions should you include in the recommendation? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Enable parallel file systems on Azure.
  B. Create a render farm that uses virtual machines.
  C. Create a render farm that uses virtual machine scale sets.
  D. Create a render farm that uses Azure Batch.
  E. Enable parallel task execution on compute nodes.
  D. Create a render farm that uses Azure Batch.
  E. Enable parallel task execution on compute nodes.

  ---

  Explanation

  Multi-instance tasks allow you to run an Azure Batch task on multiple compute nodes simultaneously. These tasks enable high performance computing scenarios like Message Passing Interface (MPI) applications in Batch.

  You configure compute nodes for parallel task execution at the pool level.

  Azure Batch allows you to set task slots per node up to (4x) the number of node cores.

  References:

  https://docs.microsoft.com/en-us/azure/batch/batch-mpihttps://docs.microsoft.com/en-us/azure/batch/batch-parallel-node-tasks#enable-parallel-task-execution

• Question 228:

  HOTSPOT

  You have an Azure subscription.

  You plan to deploy five storage accounts that will store block blobs and five storage accounts that will host file shares. The file shares will be accessed by using the SMB protocol.

  You need to recommend an access authorization solution for the storage accounts. The solution must meet the following requirements:

  1. Maximize security.

  2. Prevent the use of shared keys.

  3. Whenever possible, support time-limited access.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: A shared access signature (SAS) and a stored access policy Blobs

  See note below.

  User delegation SAS

  A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS applies to Blob storage only.

  A shared access signature can take one of the following two forms:

  Ad hoc SAS. When you create an ad hoc SAS, the start time, expiry time, and permissions are specified in the SAS URI. Any type of SAS can be an ad hoc SAS.

  Service SAS with stored access policy. A stored access policy is defined on a resource container, which can be a blob container, table, queue, or file share. The stored access policy can be used to manage constraints for one or more service shared access signatures. When you associate a service SAS with a stored access policy, the SAS inherits the constraints-the start time, expiry time, and permissions-defined for the stored access policy.

  Note

  A user delegation SAS or an account SAS must be an ad hoc SAS. Stored access policies are not supported for the user delegation SAS or the account SAS.

  Box 2: Azure AD credentials

  File shares

  User delegation SAS

  A user delegation SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS applies to Blob storage only.

  Note: A shared access signature (SAS) provides secure delegated access to resources in your storage account. With a SAS, you have granular control over how a client can access your data. For example:

  What resources the client may access.

  What permissions they have to those resources.

  How long the SAS is valid.

  Types of shared access signatures Azure Storage supports three types of shared access signatures:

  User delegation SAS

  Service SAS

  Account SAS References:

  https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 229:

  You have an Azure AD tenant.

  You plan to deploy Azure Cosmos DB databases that will use the SQL API.

  You need to recommend a solution to provide specific Azure AD user accounts with read access to the Cosmos DB databases.

  What should you include in the recommendation?

  A. a resource token and an Access control (IAM) role assignment
  B. certificates and Azure Key Vault
  C. master keys and Azure Information Protection policies
  D. shared access signatures (SAS) and Conditional Access policies
  A. a resource token and an Access control (IAM) role assignment

• Question 230:

  DRAG DROP

  You are designing a virtual machine that will run Microsoft SQL Server and contain two data disks. The first data disk will store log files, and the second data disk will store data. Both disks are P40 managed disks.

  You need to recommend a host caching method for each disk. The method must provide the best overall performance for the virtual machine while preserving the integrity of the SQL data and logs.

  Which host caching method should you recommend for each disk? To answer, drag the appropriate methods to the correct disks. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: None

  No data disk caching for the Log files.

  Box 2: ReadOnly

  Guidelines to optimize performance for your SQL Server on Azure Virtual Machines (VMs) include: Set host caching to read-only for data file disks.

  Set host caching to none for log file disks.

  References:

  https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-storage