Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 271:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:

  1.

  Provide access to the full .NET framework.

  2.

  Provide redundancy if an Azure region fails.

  3.

  Grant administrators access to the operating system to install custom application dependencies.

  Solution: You deploy two Azure virtual machines to two Azure regions, and you create a Traffic Manager profile.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions, while providing high availability and responsiveness. https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview

• Question 272:

  You have an Azure subscription that contains two applications named App1 and App2. App1 is a sales processing application. When a transaction in App1 requires shipping, a message is added to an Azure Storage account queue, and then

  App2 listens to the queue for relevant transactions.

  In the future, additional applications will be added that will process some of the shipping requests based on the specific details of the transactions.

  You need to recommend a replacement for the storage account queue to ensure that each additional application will be able to read the relevant transactions

  What should you recommend?

  A. one Azure Service Bus queue

  B. one Azure Service Bus topic

  C. one Azure Data Factory pipeline

  D. multiple storage account queues

  Correct Answer: B

  A queue allows processing of a message by a single consumer. In contrast to queues, topics and subscriptions provide a one-to-many form of communication in a publish and subscribe pattern. It's useful for scaling to large numbers of recipients. Each published message is made available to each subscription registered with the topic. Publisher sends a message to a topic and one or more subscribers receive a copy of the message, depending on filter rules set on these subscriptions.

  Reference: https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-queues-topics-subscriptions

• Question 273:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure ExpressRoute has been deployed and configured for on-premises to Azure connectivity.

  Several VMs are exhibiting network connectivity issues.

  You need to analyze the network traffic to determine whether packets are being allowed or denied to the VMs.

  Solution: Install and configure the Microsoft Monitoring Agent and the Dependency Agent on all VMs. Use the Wire Data solution in Azure Monitor to analyze the network traffic.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use Azure Network Watcher to run IP flow verify to analyze the network traffic.

  Note: Wire Data looks at network data at the application level, not down at the TCP transport layer. The solution doesn't look at individual ACKs and SYNs.

  Reference: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

• Question 274:

  You have an Azure subscription. The subscription has a blob container that contains multiple blobs. Ten users in the finance department of your company plan to access the blobs during the month of April. You need to recommend a solution to enable access to the blobs during the month of April only.

  Which security solution should you include in the recommendation?

  A. shared access signatures (SAS)

  B. access keys

  C. conditional access policies

  D. certificates

  Correct Answer: A

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

  This allows for limited-time fine grained access control to resources. So you can generate URL, specify duration (for month of April) and disseminate URL to 10 team members. On May 1, the SAS token is automatically invalidated, denying

  team members continued access.

• Question 275:

  You have the Azure resources shown in the following table.

  

  You need to deploy a new Azure Firewall policy that will contain mandatory rules for all Azure Firewall deployments. The new policy will be configured as a parent policy for the existing policies. What is the minimum number of additional Azure Firewall policies you should create?

  A. 0

  B. 1

  C. 2

  D. 3

  Correct Answer: B

  Firewall policies work across regions and subscriptions. Place all your global configurations in the parent policy.

  Note: Policies can be created in a hierarchy. You can create a parent/global policy that will contain configurations and rules that will apply to all/a number of firewall instances. Then you create a child policy that inherits from the parent; note that rules changes in the parent instantly appear in the child. The child is associated with a firewall and applies configurations/rules from the parent policy and the child policy instantly to the firewall.

  Reference: https://aidanfinn.com/?p=22006

• Question 276:

  You have an Azure subscription that contains an Azure Blob storage account named store1.

  You have an on-premises file server named Setver1 that runs Windows Sewer 2016.Server1 stores 500 GB of company files.

  You need to store a copy of the company files from Server 1 in store1.

  Which two possible Azure services achieve this goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point

  A. an Azure Batch account

  B. an integration account

  C. an On-premises data gateway

  D. an Azure Import/Export job

  E. Azure Data factory

  Correct Answer: DE

  https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-data-from-blobs https://docs.microsoft.com/en-us/answers/questions/31113/fastest-method-to-copy-500gb-table-from-on-premise.html

• Question 277:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.

  The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.

  You need to recommend a solution to meet the regulatory requirement.

  Solution: You recommend using the Regulatory compliance dashboard in Azure Security Center.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The Regulatory compliance dashboard in Azure Security Center is not used for regional compliance.

  Note: Instead Azure Resource Policy Definitions can be used which can be applied to a specific Resource Group with the App Service instances.

  Note 2: In the Azure Security Center regulatory compliance blade, you can get an overview of key portions of your compliance posture with respect to a set of supported standards. Currently supported standards are Azure CIS, PCI DSS 3.2,

  ISO 27001, and SOC TSP.

  Reference:

  https://docs.microsoft.com/en-us/azure/governance/policy/overview

  https://azure.microsoft.com/en-us/blog/regulatory-compliance-dashboard-in-azure-security-center-now-available/

• Question 278:

  You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:

  1.

  Provide access to the full .NET framework.

  2.

  Provide redundancy if an Azure region fails.

  3.

  Grant administrators access to the operating system to install custom application dependencies.

  Solution: You deploy an Azure virtual machine to two Azure regions, and you deploy an Azure Application Gateway.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  You need to deploy two Azure virtual machines to two Azure regions, but also create a Traffic Manager profile.

• Question 279:

  You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:

  1.

  Provide access to the full .NET framework.

  2.

  Provide redundancy if an Azure region fails.

  3.

  Grant administrators access to the operating system to install custom application dependencies.

  Solution: You deploy a Azure virtual machine scale set that uses autoscaling.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead, you should deploy two Azure virtual machines to two Azure regions, and you create a Traffic Manager profile.

• Question 280:

  You are designing a microservices architecture that will be hosted in an Azure Kubernetes Service (AKS) cluster. Apps that will consume the microservices will be hosted on Azure virtual machines. The virtual machines and the AKS cluster will reside on the same virtual network.

  You need to design a solution to expose the microservices to the consumer apps. The solution must meet the following requirements:

  1.

  Ingress access to the microservices must be restricted to a single private IP address and protected by using mutual TLS authentication.

  2.

  The number of incoming microservice calls must be rate-limited.

  3.

  Costs must be minimized. What should you include in the solution?

  A. Azure API Management Premium tier with virtual network connection

  B. Azure Front Door with Azure Web Application Firewall (WAF)

  C. Azure API Management Standard tier with a service endpoint

  D. Azure App Gateway with Azure Web Application Firewall (WAF)

  Correct Answer: A

  One option is to deploy APIM (API Management) inside the cluster VNet. The AKS cluster and the applications that consume the microservices might reside within the same VNet, hence there is no reason to expose the cluster publicly as all API traffic will remain within the VNet. For these scenarios, you can deploy API Management into the cluster VNet. API Management Premium tier supports VNet deployment.

  Reference: https://docs.microsoft.com/en-us/azure/api-management/api-management-kubernetes