Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 211:

  You are designing an Azure web app that will use Azure Active Directory (Azure AD) for authentication.

  You need to recommend a solution to provide users from multiple Azure AD tenants with access to App1.

  The solution must ensure that the users use Azure Multi-Factor Authentication (MFA) when they connect to App1.

  Which two types of objects should you include in the recommendation?

  Each correct answer presents part of the solution.

  NOTE: Each correct selection is world one point

  A. Azure AD conditional access policies

  B. Azure AD managed identities

  C. an Identity Experience Framework policy

  D. an Azure application security group

  E. a Microsoft Intune app protection policy

  F. Azure AD guest accounts

  Correct Answer: AC

  A: The Conditional Access feature in Azure Active Directory (Azure AD) offers one of several ways that you can use to secure your app and protect a service. Conditional Access enables developers and enterprise customers to protect

  services in a multitude of ways including:

  1.

  Multi-factor authentication

  2.

  Allowing only Intune enrolled devices to access specific services

  3.

  Restricting user locations and IP ranges

  B: Conditional Access policies are powerful tools, we recommend excluding the following accounts from your policy:

  Service accounts and service principals.If your organization has these accounts in use in scripts or code, consider replacing them with managed identities.

  Incorrect Answers:

  E: Application security groups enable you to configure network security as a natural extension of an application's structure, allowing you to group virtual machines and define network security policies based on those groups

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-conditional-access-dev-guide

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access- policy-azure-management

• Question 212:

  Your company plans to use a separate Azure subscription for each of its business units. You identify the following governance requirements:

  1.

  Each business unit will analyze costs for different workloads such as production, development, and testing.

  2.

  The company will analyze costs by business unit and workload. What should you use to meet the governance requirements?

  A. Azure Advisor alerts and Azure Logic Apps

  B. Microsoft Intune and compliance policies

  C. Azure management groups and RBAC

  D. tags and Azure Policy

  Correct Answer: D

• Question 213:

  You have an Azure subscription that contains two applications named App1 and App2.

  App1 is a sales processing application.

  When a transaction in App1 requires shipping, a message is added to an Azure Storage account queue, and then App2 listens to the queue (or relevant transactions.

  In the future, additional applications will be added that will process some of the shipping requests based on the specific details of the transactions.

  You need to recommend a replacement for the storage account queue to ensure that each additional application will be able to read the relevant transactions.

  What should you recommend?

  A. one Azure Service Bus queue

  B. one Azure Service Bus topic

  C. one Azure Data Factory pipeline

  D. multiple storage account queues

  Correct Answer: B

  A queue allows processing of a message by a single consumer. In contrast to queues, topics and subscriptions provide a one-to-many form of communication in a publish and subscribe pattern. It's useful for scaling to large numbers of recipients. Each published message is made available to each subscription registered with the topic. Publisher sends a message to a topic and one or more subscribers receive a copy of the message, depending on filter rules set on these subscriptions.

  Reference: https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-queues-topics-subscriptions

• Question 214:

  You have an Azure Cosmos DB account named Account1. Account1 includes a database named DB1 that contains a container named Container1. The partition key for Container1 is set to /city.

  You plan to change the partition key for Container1.

  What should you do first?

  A. Delete Container1.

  B. Create a new Azure Cosmos DB account.

  C. Implement the Azure Cosmos DB.NET.SDK.

  D. Regenerate the keys for Account1.

  Correct Answer: B

  The Change Feed Processor and Bulk Executor Library, in Azure Cosmos DB can be leveraged to achieve a live migration of your data from one container to another. This allows you to re-distribute your data to match the desired new partition key scheme, and make the relevant application changes afterwards, thus achieving the effect of "updating your partition key".

  Incorrect Answers:

  A: It is not possible to "update" your partition key in an existing container.

  Reference: https://devblogs.microsoft.com/cosmosdb/how-to-change-your-partition-key/

• Question 215:

  Your network contains an Active Directory domain named contoso.com that is federated to an Azure Active Directory (Azure AD) tenant. The on-premises domain contains a VPN server named Server1 that runs Windows Server 2016.

  You have a single on-premises location that uses an address space of 172.16.0.0/16.

  You need to implement two-factor authentication for users who establish VPN connections to Server1.

  What should you include in the implementation?

  A. In Azure AD, create a conditional access policy and a trusted named location

  B. Install and configure Azure MFA Server on-premises

  C. Configure an Active Directory Federation Services (AD FS) server on-premises

  D. In Azure AD, configure the authentication methods. From the multi-factor authentication (MFA) service settings, create a trusted IP range

  Correct Answer: B

  You need to download, install and configure the MFA Server.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfaserver-deploy

• Question 216:

  You have Azure virtual machines that run a custom Iine-business web application. You plan to use a third- party solution to parse event logs from the virtual machine stored in an Azure storage account. You need to recommend a so to save the event logs from the virtual. What should you include in recommendation?

  A. Azure VM Diagnostics Extension

  B. Azure Monitor

  C. Azure log Analytics

  D. event log subscriptions

  Correct Answer: A

  References: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-diagnostics

• Question 217:

  You have an Azure Storage v2 account named storage1.

  You plan to archive data to storage1.

  You need to ensure that the archived data cannot be deleted for five years. The solution must prevent administrators from deleting the data.

  What should you do?

  A. You create an Azure Blob storage container, and you configure a legal hold access policy.

  B. You create a file share and snapshots.

  C. You create a file share, and you configure an access policy.

  D. You create an Azure Blob storage container, and you configure a time-based retention policy and lock the policy.

  Correct Answer: D

  Time-based retention policy support: Users can set policies to store data for a specified interval. When a time-based retention policy is set, blobs can be created and read, but not modified or deleted. After the retention period has expired,

  blobs can be deleted but not overwritten.

  Note:

  Immutable storage for Azure Blob storage enables users to store business-critical data objects in a WORM (Write Once, Read Many) state. This state makes the data non-erasable and non-modifiable for a user- specified interval. For the

  duration of the retention interval, blobs can be created and read, but cannot be modified or deleted. Immutable storage is available for general-purpose v2 and Blob storage accounts in all Azure regions.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage

• Question 218:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an app named App1 that uses data from two on-premises Microsoft SQL Server databases named DB1 and DB2.

  You plan to move DB1 and DB2 to Azure.

  You need to implement Azure services to host DB1 and DB2. The solution must support server-side transactions across DB1 and DB2.

  Solution: You deploy DB1 and DB2 as Azure SQL databases on the same Azure SQL Database server.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead deploy DB1 and DB2 to SQL Server on an Azure virtual machine.

  Note: Understanding distributed transactions.

  When both the database management system and client are under the same ownership (e.g. when SQL Server is deployed to a virtual machine), transactions are available and the lock duration can be controlled.

  Reference:

  https://docs.particular.net/nservicebus/azure/understanding-transactionality-in-azure

• Question 219:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage an Active Directory domain named contoso.local.

  You install Azure AD Connect and connect to an Azure Active Directory (Azure AD) tenant named contoso.com without syncing any accounts.

  You need to ensure that only users who have a UPN suffix of contoso.com in the contoso.local domain sync to Azure AD.

  Solution: You use the Synchronization Service Manager to modify the Metaverse Designer tab.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use Synchronization Rules Editor to create a synchronization rule.

  Note: Filtering what objects are synced to Azure AD is a common request and there are many instances where filtering by OU just doesn't cut it. One option is to filter users by their UPN suffix so that only users with the public FQDN as their

  UPN suffix are synced to Azure AD (e.g., [email protected] would be synced while [email protected] would not).

  Filtering can be configured using either the GUI (Synchronization Rules Editor) or PowerShell.

  Reference:

  https://www.sidekicktech.com/blog/field-notes/2019/upn-suffix-filtering-ad-connect/

• Question 220:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an app named App1 that uses data from two on-premises Microsoft SQL Server databases named DB1 and DB2.

  You plan to move DB1 and DB2 to Azure.

  You need to implement Azure services to host DB1 and DB2. The solution must support server-side transactions across DB1 and DB2.

  Solution: You deploy DB1 and DB2 to an Azure SQL Database managed instance.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead deploy DB1 and DB2 to SQL Server on an Azure virtual machine.

  Note: Understanding distributed transactions.

  When both the database management system and client are under the same ownership (e.g. when SQL Server is deployed to a virtual machine), transactions are available and the lock duration can be controlled.

  Reference:

  https://docs.particular.net/nservicebus/azure/understanding-transactionality-in-azure