Microsoft AZ-305 Online Practice Questions and Exam Preparation

Microsoft AZ-305 Online Questions & Answers

• Question 381:

  Your company has offices in North America and Europe.

  You plan to migrate to Azure.

  You need to recommend a networking solution for the new Azure infrastructure. The solution must meet the following requirements:

  The Point-to-Site (P2S) VPN connections of mobile users must connect automatically to the closest Azure region.

  The offices in each region must connect to their local Azure region by using an ExpressRoute circuit.

  Transitive routing between virtual networks and on-premises networks must be supported.

  The network traffic between virtual networks must be filtered by using FQDNs.

  What should you include in the recommendation?

  A. Azure Virtual WAN with a secured virtual hub
  B. virtual network peering and application security groups
  C. virtual network gateways and network security groups (NSGs)
  D. Azure Route Server and Azure Network Function Manager
  C. virtual network gateways and network security groups (NSGs)

  ---

  Explanation

  Network security groups

  A fully qualified domain name (FQDN) represents a domain name of a host or IP address(es). You can use FQDNs in network rules based on DNS resolution in Azure Firewall and Firewall policy. This capability allows you to filter outbound traffic with any TCP/UDP protocol (including NTP, SSH, RDP, and more).

  Use FQDN filtering in network rules

  A fully qualified domain name (FQDN) represents a domain name of a host or IP address(es). You can use FQDNs in network rules based on DNS resolution in Azure Firewall and Firewall policy. This capability allows you to filter outbound traffic with any TCP/UDP protocol (including NTP, SSH, RDP, and more).

  Virtual network gateways VPN gateways. A VPN gateway is a specific type of virtual network gateway that is used to send traffic between an Azure virtual network and an on-premises location over the public internet. You can also use a VPN gateway to send traffic between Azure virtual networks. Each virtual network can have at most one VPN gateway.

  Virtual network gateways support Point-to-Site (P2S) VPN connections.

  Gateway transit

  Virtual network peering and VPN Gateways can also coexist via gateway transit

  Gateway transit enables you to use a peered virtual network's gateway for connecting to on-premises, instead of creating a new gateway for connectivity. As you increase your workloads in Azure, you need to scale your networks across regions and virtual networks to keep up with the growth. Gateway transit allows you to share an ExpressRoute or VPN gateway with all peered virtual networks and lets you manage the connectivity in one place. Sharing enables cost-savings and reduction in management overhead.

  Incorrect:

  Not D: Azure Route Server and Azure Network Function Manager do not support FQDNs filtering.

  Note:

  Azure Route Server

  Azure Route Server simplifies dynamic routing between your network virtual appliance (NVA) and your virtual network. It allows you to exchange routing information directly through Border Gateway Protocol (BGP) routing protocol between any NVA that supports the BGP routing protocol and the Azure Software Defined Network (SDN) in the Azure Virtual Network (VNet) without the need to manually configure or maintain route tables. Azure Route Server is a fully managed service and is configured with high availability.

  Note:

  Number of routes that Azure Route Server can advertise to ExpressRoute or VPN gateway: 200

  Azure Network Function Manager

  Azure Network Function Manager offers an Azure Marketplace experience for deploying network functions such as mobile packet core, SD-WAN edge, and VPN services to your Azure Stack Edge device running in your on-premises environment. You can now rapidly deploy a private mobile network service or SD-WAN solution on your edge device directly from the Azure management portal

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overviewhttps://learn.microsoft.com/en-us/azure/firewall/fqdn-filtering-network-ruleshttps://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vnet-peeringhttps://learn.microsoft.com/en-us/azure/route-server/overviewhttps://learn.microsoft.com/en-us/azure/network-function-manager/overview

• Question 382:

  HOTSPOT

  You have a resource group named RG1 that contains the objects shown in the following table.

  

  You need to configure permissions so that App1 can copy all the secrets from KV1 to KV2. App1 currently has the Get permission for the secrets in KV1.

  Which additional permissions should you assign to App1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: List

  Get: Gets the specified Azure key vault.

  List: The List operation gets information about the vaults associated with the subscription.

  Box 2: Create

  Create Or Update: Create or update a key vault in the specified subscription.

• Question 383:

  A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with Microsoft Office 365 and an Azure subscription.

  Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory Domain Services (AD DS), and Azure AD Connect

  Contoso has a partnership with a company named Fabrikam, Inc. Fabrikam has an Active Directory forest and an Office 365 tenant. Fabrikam has the same on-premises identity infrastructure as Contoso.

  A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription of Contoso. The developers must be added to the Contributor role for a resource in the Contoso subscription.

  You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The solution must ensure that the Fabrikam developers use their existing credentials to access resources.

  What should you recommend?

  A. Configure a forest trust between the on-premises Active Directory forests of Contoso and Fabrikam.
  B. Configure an organization relationship between the Office 365 tenants of Fabrikam and Contoso.
  C. In the Azure AD tenant of Contoso, use MIM to create guest accounts for the Fabrikam developers.
  D. Configure an AD FS relying party trust between the fabrikam and Contoso AD FS infrastructures.
  A. Configure a forest trust between the on-premises Active Directory forests of Contoso and Fabrikam.

  ---

  Explanation

  Trust configurations - Configure trust from managed forests(s) or domain(s) to the administrative forest. A one-way trust is required from production environment to the admin forest. Selective authentication should be used to restrict accounts in the admin forest to only logging on to the appropriate production hosts.

  References:

  https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material

• Question 384:

  HOTSPOT

  You are designing an Azure web app.

  You plan to deploy the web app to the North Europe Azure region and the West Europe Azure region.

  You need to recommend a solution for the web app. The solution must meet the following requirements:

  1. Users must always access the web app from the North Europe region, unless the region fails.

  2. The web app must be available to users if an Azure region is unavailable.

  3. Deployment costs must be minimized.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 385:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure ExpressRoute has been deployed and configured for on-premises to Azure connectivity.

  Several VMs are exhibiting network connectivity issues.

  You need to analyze the network traffic to determine whether packets are being allowed or denied to the VMs.

  Solution: Install and configure the Microsoft Monitoring Agent and the Dependency Agent on all VMs. Use the Wire Data solution in Azure Monitor to analyze the network traffic.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead use Azure Network Watcher to run IP flow verify to analyze the network traffic.

  Note: Wire Data looks at network data at the application level, not down at the TCP transport layer. The solution doesn't look at individual ACKs and SYNs.

  References:

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overviewhttps://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

• Question 386:

  HOTSPOT

  You have an on-premises file server that stores 2 TB of data files.

  You plan to move the data files to Azure Blob Storage In the West Europe Azure region,

  You need to recommend a storage account type to store the data files and a replication solution for the storage account. The solution must meet the following requirements:

  1. Be available if a single Azure datacenter fails.

  2. Support storage tiers.

  3. Minimize cost.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Account Type: StorageV2

  Replication solution: Zone-redundant storage (ZRS)

  https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy

  https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy#supported-azure-storage-services

  https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview#types-of-storage-accountsDatamustbeavailableifasingleAzuredatacenterfails.ItmeansthestorageaccountmustsupportZRSreplication.Also,solutionshouldsupportstoragetiers.OnlyGeneral-purposeV2supportsZRSandstoragetiers.

  https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

• Question 387:

  The accounting department at your company migrates to a new financial accounting software.

  The accounting department must keep file-based database backups for seven years for compliance purposes. It is unlikely that the backups will be used to recover data.

  You need to move the backups to Azure. The solution must minimize costs.

  Where should you store the backups?

  A. Azure Blob storage that uses the Archive tier
  B. Azure SQL Database
  C. Azure Blob storage that uses the Cool tier
  D. a Recovery Services vault
  A. Azure Blob storage that uses the Archive tier

  ---

  Explanation

  Azure Front Door enables you to define, manage, and monitor the global routing for your web traffic by optimizing for best performance and instant global failover for high availability. With Front Door, you can transform your global (multi-region) consumer and enterprise applications into robust, high-performance personalized modern applications, APIs, and content that reaches a global audience with Azure.

  Front Door works at Layer 7 or HTTP/HTTPS layer and uses anycast protocol with split TCP and Microsoft's global network for improving global connectivity.

  Incorrect Answers:

  B: Azure Traffic Manager uses DNS (layer 3) to shape traffic. SSL works at Layer 6.

  Azure Traffic Manager can direct customers to their closest AKS cluster and application instance. For the best performance and redundancy, direct all application traffic through Traffic Manager before it goes to your AKS cluster.

  References:

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-overview

• Question 388:

  You plan to deploy multiple instances of an Azure web app across several Azure regions.

  You need to design an access solution for the app. The solution must meet the following replication requirements:

  1. Support rate limiting.

  2. Balance requests between all instances.

  3. Ensure that users can access the app in the event of a regional outage.

  Solution: You use Azure Front Door to provide access to the app.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  Azure Front Door meets the requirements. The Azure Web Application Firewall (WAF) rate limit rule for Azure Front Door controls the number of requests allowed from clients during a one-minute duration.

  References:

  https://www.nginx.com/blog/nginx-plus-and-azure-load-balancers-on-microsoft-azure/https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell

• Question 389:

  DRAG DROP

  Your company has an existing web app that runs on Azure virtual machines.

  You need to ensure that the app is protected from SQL injection attempts and uses a layer-7 load balancer. The solution must minimize disruptions to the code of the app.

  What should you recommend? To answer, drag the appropriate services to the correct targets. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: Azure Application Gateway

  The Azure Application Gateway Web Application Firewall (WAF) provides protection for web applications. These protections are provided by the Open Web Application Security Project (OWASP) Core Rule Set (CRS).

  Box 2: Web Application Firewall (WAF)

  References:

  https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-rules-portal

• Question 390:

  You plan to deploy multiple instances of an Azure web app across several Azure regions.

  You need to design an access solution for the app.

  The solution must meet the following replication requirements:

  1. Support rate limiting

  2. Balance requests between all instances.

  3. Ensure that users can access the app in the event of a regional outage

  Solution: You use Azure Load Balancer to provide access to the app.

  Does this meet the goal?

  A. Yes
  B. No
  B. No