Microsoft Microsoft Azure AZ-305 Questions & Answers

• Question 21:

  HOTSPOT

  You are evaluating whether to use Azure Traffic Manager and Azure Application Gateway to meet the connection requirements for App1.

  What is the minimum numbers of instances required for each service? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 1

  App1 will only be accessible from the internet. App1 has the following connection requirements:

  1.

  Connections to App1 must be active-active load balanced between instances.

  2.

  All connections to App1 from North America must be directed to the East US region.

  3.

  All other connections must be directed to the West Europe region.

  App1 will have six instances: three in the East US Azure region and three in the West Europe Azure region.

  Note: Azure Traffic Manager is a DNS-based traffic load balancer. This service allows you to distribute traffic to your public facing applications across the global Azure regions.

  Box 2: 2

  For production workloads, run at least two gateway instances.

  A single Application Gateway deployment can run multiple instances of the gateway.

  Use one Application Gateway in East US Region, and one in the West Europe region.

  Reference:

  https://docs.microsoft.com/en-us/azure/architecture/high-availability/reference-architecture-traffic-manager-application-gateway

• Question 22:

  HOTSPOT

  You need to recommend a solution to ensure that App1 can access the third-party credentials and access strings. The solution must meet the security requirements.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Scenario: Security Requirement

  All secrets used by Azure services must be stored in Azure Key Vault.

  Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services.

  Box 1: A service principal

  A service principal is a type of security principal that identifies an application or service, which is to say, a piece of code rather than a user or group. A service principal's object ID is known as its client ID and acts like its username. The service

  principal's client secret acts like its password.

  Note: Authentication with Key Vault works in conjunction with Azure Active Directory (Azure AD), which is responsible for authenticating the identity of any given security principal.

  A security principal is an object that represents a user, group, service, or application that's requesting access to Azure resources. Azure assigns a unique object ID to every security principal.

  Box 2: A role assignment

  You can provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control.

  Reference:

  https://docs.microsoft.com/en-us/azure/key-vault/general/authentication

• Question 23:

  HOTSPOT

  You need to deploy an instance of SQL Server on Azure Virtual Machines. The solution must meet the following requirements:

  1.

  Support 15.000 disk IOPS.

  2.

  Support SR-IOV.

  3.

  Minimize costs.

  What should you include in the solution?

  To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point

  Hot Area:

  

  Correct Answer:

  

• Question 24:

  HOTSPOT

  What should you implement to meet the identity requirements? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Requirements: Identity Requirements

  Contoso identifies the following requirements for managing Fabrikam access to resources:

  Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests.

  The solution must minimize development effort.

  Box 1: The Azure AD Privileged Identity Management (PIM)

  When should you use access reviews?

  Too many users in privileged roles: It's a good idea to check how many users have administrative access, how many of them are Global Administrators, and if there are any invited guests or partners that have not been removed after being

  assigned to do an administrative task. You can recertify the role assignment users in Azure AD roles such as Global Administrators, or Azure resources roles such as User Access Administrator in the Azure AD Privileged Identity Management

  (PIM) experience.

  Box 2: Access reviews

  Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only

  the right people have continued access.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

• Question 25:

  HOTSPOT

  You have an Azure subscription named Sub1 that is linked to an Azure AD tenant named contoso.com.

  You plan to implement two ASP.NET Core apps named App1 and App2 that will be deployed to 100 virtual machines in Sub1. Users will sign in to App1 and App2 by using their contoso.com credentials.

  App1 requires read permissions to access the calendar of the signed-m user. App2 requires write permissions to access the calendar of the signed-in user.

  You need to recommend an authentication and authorization solution for the apps. The solution must meet the following requirements:

  1.

  Use the principle of least privilege.

  2.

  Minimize administrative effort

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one pent.

  Hot Area:

  

  Correct Answer:

  

• Question 26:

  HOTSPOT

  You have several Azure App Service web apps that use Azure Key Vault to store data encryption keys. Several departments have the following requests to support the web app:

  

  Which service should you recommend for each department's request? To answer, configure the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 27:

  HOTSPOT

  You are designing a cost-optimized solution that uses Azure Batch to run two types of jobs on Linux nodes. The first job type will consist of short-running tasks for a development environment. The second job type will consist of long-running

  Message Passing Interface (MPI) applications for a production environment that requires timely job completion.

  You need to recommend the pool type and node type for each job type. The solution must minimize compute charges and leverage Azure Hybrid Benefit whenever possible.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 28:

  HOTSPOT

  Your company has 20 web APIs that were developed in-house.

  The company is developing 10 web apps that will use the web APIs. The web apps and the APIs are registered in the company s Azure AD tenant. The web APIs are published by using Azure API Management.

  You need to recommend a solution to block unauthorized requests originating from the web apps from reaching the web APIs. The solution must meet the following requirements:

  1.

  Use Azure AD-generated claims.

  2.

  Minimize configuration and management effort

  What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 29:

  HOTSPOT

  You have an on-premises Microsoft SQL Server database named SQL1.

  You plan to migrate SQL 1 to Azure.

  You need to recommend a hosting solution for SQL1. The solution must meet the following requirements:

  Support the deployment of multiple secondary, read-only replicas.

  Support automatic replication between primary and secondary replicas.

  Support failover between primary and secondary replicas within a 15-minute recovery time objective (RTO).

  Hot Area:

  

  Correct Answer:

  

• Question 30:

  HOTSPOT

  You are designing a data storage solution to support reporting.

  The solution will ingest high volumes of data in the JSON format by using Azure Event Hubs. As the data arrives, Event Hubs will write the data to storage. The solution must meet the following requirements:

  1.

  Organize data in directories by date and time.

  2.

  Allow stored data to be queried directly, transformed into summarized tables, and then stored in a data warehouse.

  3.

  Ensure that the data warehouse can store 50 TB of relational data and support between 200 and 300 concurrent read operations. Which service should you recommend for each type of data store? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer: