Microsoft AZ-305 Online Practice Questions and Exam Preparation

Microsoft AZ-305 Online Questions & Answers

• Question 311:

  HOTSPOT

  A company plans to implement an HTTP-based API to support a web app. The web app allows customers to check the status of their orders.

  The API must meet the following requirements:

  1. Implement Azure Functions

  2. Provide public read-only operations

  3. Do not allow write operations

  4. You need to recommend configuration options.

  What should you recommend? To answer, configure the appropriate options in the dialog box in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Allowed authentication methods: GET only

  Authorization level: Anonymous

  The option is Allow Anonymous requests. This option turns on authentication and authorization in App Service, but defers authorization decisions to your application code. For authenticated requests, App Service also passes along authentication information in the HTTP headers.

  This option provides more flexibility in handling anonymous requests.

  References:

  https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

• Question 312:

  You need to recommend a strategy for migrating the database content of WebApp1 to Azure.

  What should you include in the recommendation?

  A. Use Azure Site Recovery to replicate the SQL servers to Azure.
  B. Use SQL Server transactional replication.
  C. Copy the BACPAC file that contains the Azure SQL database file to Azure Blob storage.
  D. Copy the VHD that contains the Azure SQL database files to Azure Blob storage
  D. Copy the VHD that contains the Azure SQL database files to Azure Blob storage

  ---

  Explanation

  Before you upload a Windows virtual machine (VM) from on-premises to Azure, you must prepare the virtual hard disk (VHD or VHDX).

  Scenario: WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database tier that runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual machines that run on Hyper-V.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhdimage

• Question 313:

  HOTSPOT

  You are designing an application that will use Azure Linux virtual machines to analyze video files. The files will be uploaded from corporate offices that connect to Azure by using ExpressRoute.

  You plan to provision an Azure Storage account to host the files.

  You need to ensure that the storage account meets the following requirements:

  1. Supports video files of up to 7 TB

  2. Provides the highest availability possible

  3. Ensures that storage is optimized for the large video files

  4. Ensures that files from the on-premises network are uploaded by using ExpressRoute

  How should you configure the storage account? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 314:

  You manage an on-premises network and Azure virtual networks.

  You need to create a secure connection over a private network between the on-premises network and the Azure virtual networks. The connection must offer a redundant pair of cross connections to provide high availability.

  What should you recommend?

  A. Azure Load Balancer
  B. VPN Gateway
  C. ExpressRoute
  D. virtual network peering
  B. VPN Gateway

  ---

  Explanation

  Every Azure VPN gateway consists of two instances in an active-standby configuration. For any planned maintenance or unplanned disruption that happens to the active instance, the standby instance would take over (failover) automatically.

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

• Question 315:

  DRAG DROP

  You have two app registrations named App1 and App2 in Azure AD. App1 supports role-based access control (RBAC) and includes a role named Writer.

  You need to ensure that when App2 authenticates to access App1, the tokens issued by Azure AD include the Writer role claim.

  Which blade should you use to modify each app registration? To answer, drag the appropriate blades to the correct app registrations. Each blade may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: App roles

  App1 supports role-based access control (RBAC) and includes a role named Writer.

  Implement role-based access control

  Define app roles

  The first step for implementing RBAC for an application is to define the app roles for it and assign users or groups to it. After defining the app roles and assigning users or groups to them, access the role assignments in the tokens coming into the application and act on them accordingly.

  Box 2: Token configuration

  You need to ensure that when App2 authenticates to access App1, the tokens issued by Azure AD include the Writer role claim.

  Configure optional claims

  You can configure optional claims for your application through the Azure portal or application manifest.

  Go to the Azure portal.

  Search for and select Azure Active Directory.

  Under Manage, select App registrations.

  Choose the application for which you want to configure optional claims based on your scenario and desired outcome.

  Under Manage, select Token configuration

  Etc.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-implement-rbac-for-appshttps://learn.microsoft.com/en-us/azure/active-directory/develop/optional-claims

• Question 316:

  You have an Azure subscription. The subscription has a blob container that contains multiple blobs. Ten users in the finance department of your company plan to access the blobs during the month of April. You need to recommend a solution to enable access to the blobs during the month of April only.

  Which security solution should you include in the recommendation?

  A. shared access signatures (SAS)
  B. access keys
  C. conditional access policies
  D. certificates
  A. shared access signatures (SAS)

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overviewThisallowsforlimited-timefinegrainedaccesscontroltoresources.SoyoucangenerateURL,specifyduration(formonthofApril)anddisseminateURLto10teammembers.OnMay1,theSAStokenisautomaticallyinvalidated,denyingteammemberscontinuedaccess.

• Question 317:

  HOTSPOT

  Your company, named Contoso, Ltd., has an Azure subscription that contains the following resources:

  An Azure Synapse Analytics workspace named contosoworkspace1

  An Azure Data Lake Storage account named contosolake1

  An Azure SQL database named contososql1

  The product data of Contoso is copied from contososql1 to contosolake1.

  Contoso has a partner company named Fabrikam Inc. Fabrikam has an Azure subscription that contains the following resources:

  A virtual machine named FabrikamVM1 that runs Microsoft SQL Server 2019

  An Azure Storage account named fabrikamsa1

  Contoso plans to upload the research data on FabrikamVM1 to contosolake1. During the upload, the research data must be transformed to the data formats used by Contoso.

  The data in contosolake1 will be analyzed by using contosoworkspace1.

  You need to recommend a solution that meets the following requirements:

  Upload and transform the FabrikamVM1 research data.

  Provide Fabrikam with restricted access to snapshots of the data in contosoworkspace1.

  What should you recommend for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure Synapse pipelines

  Upload and transform the FabrikamVM1 research data.

  The lake database in Azure Synapse Analytics enables customers to bring together database design, meta information about the data that is stored and a possibility to describe how and where the data should be stored.

  Box 2: Azure Data Share

  Provide Fabrikam with restricted access to snapshots of the data in contosoworkspace 1.

  Azure Data Share enables organizations to securely share data with multiple customers and partners. Data providers are always in control of the data that they've shared and Azure Data Share makes it simple to manage and monitor what data was shared, when and by whom.

  Azure Data Share currently offers snapshot-based sharing and in-place sharing.

  Incorrect:

  Azure Data Box Gateway

  Azure Data Box Gateway is a storage solution that enables you to seamlessly send data to Azure.

  Use cases

  Data Box Gateway can be leveraged for transferring data to the cloud such as cloud archival, disaster recovery, or if there is a need to process your data at cloud scale. Here are the various scenarios where Data Box Gateway can be used for data transfer.

  Cloud archival - Copy hundreds of TBs of data to Azure storage using Data Box Gateway in a secure and efficient manner. The data can be ingested one time or an ongoing basis for archival scenarios.

  Continuous data ingestion - Continuously ingest data into the device to copy to the cloud, regardless of the data size. As the data is written to the gateway device, the device uploads the data to Azure Storage.

  Initial bulk transfer followed by incremental transfer - Use Data Box for the bulk transfer in an offline mode (initial seed) and Data Box Gateway for incremental transfers (ongoing feed) over the network.

  References:

  https://learn.microsoft.com/en-us/azure/synapse-analytics/database-designer/concepts-lake-databasehttps://learn.microsoft.com/en-us/azure/data-share/overview

• Question 318:

  You need to recommend a solution to meet the database retention requirements.

  What should you recommend?

  A. Configure a long-term retention policy for the database.
  B. Configure Azure Site Recovery.
  C. Use automatic Azure SQL Database backups.
  D. Configure geo-replication of the database.
  A. Configure a long-term retention policy for the database.

  ---

  Explanation

  In Azure SQL Database, you can configure a database with a long-term backup retention policy (LTR) to automatically retain the database backups in separate Azure Blob storage containers for up to 10 years

  https://docs.microsoft.com/en-us/azure/azure-sql/database/long-termretention-overview

• Question 319:

  Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

  After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

  Your company, Contoso, Ltd., has a Microsoft Entra tenant named contoso.com that uses Privileged Identity Management (PIM) and is linked to an Azure subscription named Sub1.

  You use Azure Backup to back up all the resources in Sub1 to a Recovery Services vault named Vault1.

  An external company, Fabrikam, Inc., provides security management services to Contoso. Fabrikam has a Microsoft Entra tenant named fabrikam.com and an Azure subscription.

  You need to prevent a compromised administrator account in contoso.com from modifying backup policies in Sub1 and from deleting backups from Sub1.

  Solution: In Vault1, you generate a security PIN for critical operations.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 320:

  HOTSPOT

  You configure OAuth2 authorization in API Management as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Web applications

  The Authorization Code Grant Type is used by both web apps and native apps to get an access token after a user authorizes an app.

  Note: The Authorization Code grant type is used by confidential and public clients to exchange an authorization code for an access token.

  After the user returns to the client via the redirect URL, the application will get the authorization code from the URL and use it to request an access token.