Microsoft AZ-305 Online Practice Questions and Exam Preparation

Microsoft AZ-305 Online Questions & Answers

• Question 51:

  HOTSPOT

  You have an Azure AD tenant that contains a management group named MG1.

  You have the Azure subscriptions shown in the following table.

  

  The subscriptions contain the resource groups shown in the following table.

  

  The subscription contains the Azure AD security groups shown in the following table.

  

  The subscription contains the user accounts shown in the following table.

  

  You perform the following actions:

  Assign User3 the Contributor role for Sub1.

  Assign Group1 the Virtual Machine Contributor role for MG1.

  Assign Group3 the Contributor role for the Tenant Root Group.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  User1 is member of Group1.

  Group1 is assigned the Virtual Machine Contributor role for MG1.

  MG1 is in Sub1.

  RG1 is in Sub1.

  Virtual Machine Contributor

  Create and manage virtual machines, manage disks, install and run software, reset password of the root user of the virtual machine using VM extensions, and manage local user accounts using VM extensions. This role does not grant you management access to the virtual network or storage account the virtual machines are connected to. This role does not allow you to assign roles in Azure RBAC.

  Management groups are containers that help you manage access, policy, and compliance across multiple subscriptions. Create these containers to build an effective and efficient hierarchy that can be used with Azure Policy and Azure Role Based Access Controls.

  If your organization has many subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Azure management groups provide a level of scope above subscriptions. You organize subscriptions into containers called "management groups" and apply your governance conditions to the management groups. All subscriptions within a management group automatically inherit the conditions applied to the management group.

  Box 2: No

  User2 is a member of Group2.

  User2 has no special permissions to Group2.

  Box 3: Yes

  User3 is a member of Group3.

  Group3 is assigned the Contributor role for the Tenant Root Group.

  As a member of the Tenant Root Group User3 can create storage accounts in RG2.

  Note: Each Azure AD tenant is given a single top-level management group called the root management group. This root management group is built into the hierarchy to have all management groups and subscriptions fold up to it. This group allows global policies and Azure role assignments to be applied at the directory level.

  References:

  https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roleshttps://learn.microsoft.com/en-us/azure/governance/management-groups/managehttps://learn.microsoft.com/en-us/azure/defender-for-cloud/management-groups-roles

• Question 52:

  Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.

  Several virtual machines exhibit network connectivity issues.

  You need to analyze the network traffic to identify whether packets are being allowed or denied from Azure to the virtual machines.

  Solution: Install and configure the Azure Monitoring agent and the Dependency Agent on all the virtual machines. Use VM insights in Azure Monitor to analyze the network traffic.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

• Question 53:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You plan to use Azure Backup and Azure Disk Encryption to protect the virtual machines.

  Which virtual machines are supported by each service? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 54:

  You have an Azure SQL database named DB1.

  You plan to create the following four tables in DB1 by using the following code:

  

  A. Table 1
  B. Table 2
  C. Table 3
  D. Table 4
  B. Table 2

• Question 55:

  You are developing an app that will read activity logs for an Azure subscription by using Azure Functions.

  You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative effort.

  What should you include in the recommendation?

  A. an enterprise application in Azure AD
  B. system-assigned managed identities
  C. shared access signatures (SAS)
  D. application registration in Azure AD
  B. system-assigned managed identities

  ---

  Explanation

  Azure App Service provides built-in authentication and authorization capabilities (sometimes referred to as "Easy Auth"), so you can sign in users and access data by writing minimal or no code in your web app, RESTful API, and mobile back end, and also Azure Functions.

  Azure App Service provides built-in authentication and authorization capabilities (sometimes referred to as "Easy Auth"), so you can sign in users and access data by writing minimal or no code in your web app, RESTful API, and mobile back end, and also Azure Functions. Microsoft Identity Platform Facebook Google Twitter Any OpenID Connect provider

  Note:

  A managed identity from Azure Active Directory (Azure AD) allows your app to easily access other Azure AD-protected resources such as Azure Key Vault. The identity is managed by the Azure platform and does not require you to provision or rotate any secrets. For more about managed identities in Azure AD, see Managed identities for Azure resources.

  Your application can be granted two types of identities:

  A system-assigned identity is tied to your application and is deleted if your app is deleted. An app can only have one system-assigned identity. A user-assigned identity is a standalone Azure resource that can be assigned to your app. An app can have multiple user-assigned identities.

  References:

  https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorizationhttps://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity

• Question 56:

  DRAG DROP

  You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016 and Linux.

  You need to use Azure Monitor to design an alerting strategy for security-related events.

  Which Azure Monitor Logs tables should you query? To answer, drag the appropriate tables to the correct log types. Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-eventshttps://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog

• Question 57:

  You have an Azure subscription.

  You plan to deploy an app named App1 that will be hosted on multiple virtual machines. App1 requires a service-level agreement (SLA) of 99.99%.

  You need to recommend a high-availability solution for the virtual machines.

  What should you include in the recommendation?

  A. application groups
  B. availability zones
  C. availability sets
  D. Azure Site Recovery
  B. availability zones

• Question 58:

  HOTSPOT

  You have a Microsoft Entra tenant that uses Microsoft Entra Connect Sync to sync with an on-premises Active Directory Domain Services (AD DS) domain. The domain contains several member servers.

  You have a custom human resources (HR) application named App1 that stores employee records.

  You are designing a solution to automate the management of user accounts. The solution must meet the following requirements:

  When employees are added to App1, the user accounts of the employees must be provisioned to the AD DS domain and the Microsoft Entra tenant automatically.

  New employee records must be read from a CSV file that is exported from App1 daily.

  You need to recommend a Microsoft Entra Identity Governance provisioning method and a target endpoint for creating new user accounts.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 59:

  Your network contains an Active Directory domain named contoso.com that is federated to an Azure Active Directory (Azure AD) tenant. The on-premises domain contains a VPN server named Server1 that runs Windows Server 2016.

  You have a single on-premises location that uses an address space of 172.16.0.0/16.

  You need to implement two-factor authentication for users who establish VPN connections to Server1.

  What should you include in the implementation?

  A. In Azure AD, create a conditional access policy and a trusted named location
  B. Install and configure Azure MFA Server on-premises
  C. Configure an Active Directory Federation Services (AD FS) server on-premises
  D. In Azure AD, configure the authentication methods. From the multi-factor authentication (MFA) service settings, create a trusted IP range
  B. Install and configure Azure MFA Server on-premises

  ---

  Explanation

  You need to download, install and configure the MFA Server.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfaserver-deploy

• Question 60:

  HOTSPOT

  You have an Azure subscription named Subscription1 that is linked to a hybrid Azure Active Directory (Azure AD) tenant.

  You have an on-premises datacenter that does NOT have a VPN connection to Subscription1. The datacenter contains a computer named Server1 that has Microsoft SQL Server 2016 installed. Server1 is prevented from accessing the internet.

  An Azure logic app named LogicApp1 requires write access to a database on Server1.

  You need to recommend a solution to provide LogicApp1 with the ability to access Server1.

  What should you recommend deploying on-premises and in Azure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: An on-premises data gateway

  For logic apps in global, multi-tenant Azure that connect to on-premises SQL Server, you need to have the on-premises data gateway installed on a local computer and a data gateway resource that's already created in Azure.

  Box 2: A connection gateway resource

  References:

  https://docs.microsoft.com/en-us/azure/connectors/connectors-create-api-sqlazure