Microsoft AZ-305 Online Practice Questions and Exam Preparation

Microsoft AZ-305 Online Questions & Answers

• Question 241:

  You have a hybrid deployment of Azure Active Directory (Azure AD).

  You need to recommend a solution to ensure that the Azure AD tenant can be managed only from the computers on your on-premises network.

  What should you include in the recommendation?

  A. a conditional access policy
  B. Azure AD roles and administrators
  C. Azure AD Application Proxy
  D. Azure AD Privileged Identity Management
  A. a conditional access policy

• Question 242:

  DRAG DROP

  You are designing a network connectivity strategy for a new Azure subscription. You identify the following requirements:

  1. The Azure virtual machines on a subnet named Subnet1 must be accessible only from the computers in your London office.

  2. Engineers require access to the Azure virtual machines on a subnet named Subsnet2 over the Internet on a specific TCP/IP management port.

  3. The Azure virtual machines in the West Europe Azure region must be able to communicate on all ports to the Azure virtual machines in the North Europe Azure region.

  4. Azure virtual machines on Subnet1 and Subnet2 have public IP addresses.

  You need to recommend which components must be used to meet the requirements. The solution must minimize costs and administrative effort whenever possible.

  What should you include in the recommendation? To answer, drag the appropriate components to the correct requirements. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 243:

  You have an Azure subscription.

  You plan to deploy a monitoring solution that will include the following:

  Azure Monitor Network Insights

  Application Insights

  Microsoft Sentinel

  VM insights

  The monitoring solution will be managed by a single team.

  What is the minimum number of Azure Monitor workspaces required?

  A. 1
  B. 2
  C. 3
  D. 4
  C. 3

  ---

  Explanation

  1: A Log Analytics workspace is a unique environment for log data from Azure Monitor and other Azure services, such as Microsoft Sentinel and Microsoft Defender for Cloud. Each workspace has its own data repository and configuration but might combine data from multiple services.

  1: With workspace-based resources, Application Insights sends telemetry to a common Log Analytics workspace, providing full access to all the features of Log Analytics while keeping your application, infrastructure, and platform logs in a single consolidated location.

  1: VM insights collects its data from one or more Log Analytics workspaces in Azure Monitor. Prior to onboarding agents, you must create and configure a workspace. The only requirement of the workspace is that it must be located in a supported location and be configured with the VMInsights solution.

  References:

  https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/azure-monitor-workspace-overviewhttps://learn.microsoft.com/en-us/azure/azure-monitor/app/create-workspace-resourcehttps://learn.microsoft.com/en-us/azure/azure-monitor/vm/vminsights-configure-workspace

• Question 244:

  HOTSPOT

  You have the offices shown in the following table.

  

  You have an Azure Active Directory (Azure AD) tenant that contains three users named User1, User2, and User3.

  From the multifactor authentication page, you configure the trusted ips settings as shown in the following exhibit.

  

  The users are configured as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  Multifactor authentication requests are skipped for the Boston IP range.

  Note: On the multi-factor authentication service settings page, you can identify corporate intranet users by selecting Skip multi-factor authentication for requests from federated users on my intranet. This setting indicates that the inside corporate network claim, which is issued by AD FS, should be trusted and used to identify the user as being on the corporate network.

  Box 2: Yes

  MFA enabled for User2. Seattle region is not excluded.

  Box 3: No

  IP range is excluded.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

• Question 245:

  You are designing an Azure Cosmos DB solution that will host multiple writable replicas in multiple Azure regions.

  You need to recommend the strongest database consistency level for the design.

  The solution must meet the following requirements:

  1. Provide a latency-based Service Level Agreement (SLA) for writes.

  2. Support multiple regions.

  Which consistency level should you recommend?

  A. bounded staleness
  B. strong
  C. session
  D. consistent prefix
  A. bounded staleness

  ---

  Explanation

  References:

  https://azure.microsoft.com/en-us/support/legal/sla/cosmos-db/v1_3/https://docs.microsoft.com/en-us/azure/cosmos-db/consistency-levels#consistency-levels-and-latency

• Question 246:

  HOTSPOT

  You have an Azure subscription.

  You plan to deploy a high-throughput transactional workload that will use PostgreSQL.

  You need to recommend a managed solution for storing relational data. The solution must meet the following requirements:

  Support the horizontal scaling of transactional writes by using row-based sharding.

  Minimize administrative effort.

  

  

• Question 247:

  Your company has the infrastructure shown in the following table.

  

  The on-premises Active Directory domain syncs to Azure Active Directory (Azure AD).

  Server1 runs an application named Appl that uses LDAP queries to verify user identities in the on-premises Active Directory domain.

  You plan to migrate Server1 to a virtual machine in Subscription1.

  A company security policy states that the virtual machines and services deployed to Subscription1 must be prevented from accessing the on-premises network.

  You need to recommend a solution to ensure that App1 continues to function after the migration. The solution must meet the security policy.

  What should you include in the recommendation?

  A. Azure AD Domain Services (Azure AD DS)
  B. an Azure VPN gateway
  C. the Active Directory Domain Services role on a virtual machine
  D. Azure AD Application Proxy
  A. Azure AD Domain Services (Azure AD DS)

  ---

  Explanation

  Azure Active Directory Domain Services (Azure AD DS) provides managed domain services such as domain join, group policy, lightweight directory access protocol (LDAP), and Kerberos/NTLM authentication Azure AD Domain Services (Azure AD DS)-This one could work since AAD DS will bring in the existing accounts from Azure AD which in turn are synchronised from on-premise AD over AD connect. However, you would probably need to reconfigure the app and update the LDAP connection Azure Active Directory (Azure AD) supports LDAP Authentication via Azure AD Domain Services (AD DS).

  https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-ldap

  https://docs.microsoft.com/en-us/azure/active-directory-domain-services/synchronization

  https://docs.microsoft.com/en-us/azure/active-directory-domain-services/overview

• Question 248:

  Your company plans to use a separate Azure subscription for each of its business units. You identify the following governance requirements:

  1. Each business unit will analyze costs for different workloads such as production, development, and testing.

  2. The company will analyze costs by business unit and workload.

  What should you use to meet the governance requirements?

  A. Azure Advisor alerts and Azure Logic Apps
  B. Microsoft Intune and compliance policies
  C. Azure management groups and RBAC
  D. tags and Azure Policy
  D. tags and Azure Policy

• Question 249:

  HOTSPOT

  What should you implement to meet the identity requirements? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Requirements: Identity Requirements

  Contoso identifies the following requirements for managing Fabrikam access to resources: Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests.

  The solution must minimize development effort.

  Box 1: The Azure AD Privileged Identity Management (PIM)

  When should you use access reviews?

  Too many users in privileged roles: It's a good idea to check how many users have administrative access, how many of them are Global Administrators, and if there are any invited guests or partners that have not been removed after being assigned to do an administrative task. You can recertify the role assignment users in Azure AD roles such as Global Administrators, or Azure resources roles such as User Access Administrator in the Azure AD Privileged Identity Management (PIM) experience.

  Box 2: Access reviews

  Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only the right people have continued access.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

• Question 250:

  You have an Azure web app that uses an Azure key vault named KeyVault1 in the West US Azure region.

  You are designing a disaster recovery plan for KeyVault1.

  You plan to back up the keys in KeyVault1.

  You need to identify to where you can restore the backup.

  What should you identify?

  A. any region worldwide
  B. the same region only
  C. KeyVault1 only
  D. the same geography only
  D. the same geography only

  ---

  Explanation

  Using the backup and restore commands has two limitations: You can't back up a key vault in one geography and restore it into another geography.

  The backup command backs up all versions of each secret.

  Incorrect:

  Not A: Azure Key Vault does not allow you to move a key vault from one region to another. You can, however, create a key vault in the new region, manually copy each individual key, secret, or certificate from your existing key vault to the new key vault, and then remove the original key vault.

  References:

  https://docs.microsoft.com/en-us/azure/key-vault/general/move-region