Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 281:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is being deployed and configured for on-premises to Azure connectivity.

  Several virtual machines exhibit network connectivity issues.

  You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.

  Solution: Use Azure Traffic Analytics in Azure Network Watcher to analyze the network traffic.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use Azure Network Watcher IP Flow Verify, which allows you to detect traffic filtering issues at a VM level.

  Note: IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

  Reference: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics

• Question 282:

  You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain.

  You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication.

  Some users work remotely and do NOT have VPN access to the on-premises network.

  You need to provide the remote users with single sign-on (SSO) access to WebApp1.

  Which two features should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Azure AD Application Proxy

  B. Azure AD Privileged Identity Management (PIM)

  C. Conditional Access policies

  D. Azure Arc

  E. Azure AD enterprise applications

  F. Azure Application Gateway

  Correct Answer: AC

  A: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client. Application Proxy includes both the Application Proxy service which runs in the cloud, and the Application Proxy

  connector which runs on an on-premises server.

  You can configure single sign-on to an Application Proxy application.

  C: Microsoft recommends using Application Proxy with pre-authentication and Conditional Access policies for remote access from the internet. An approach to provide Conditional Access for intranet use is to modernize applications so they

  can directly authenticate with AAD.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-config-sso-how-to

  https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-deployment-plan

• Question 283:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.

  The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.

  You need to recommend a solution to meet the regulatory requirement.

  Solution: You recommend using an Azure policy initiative to enforce the location.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Azure Resource Policy Definitions can be used which can be applied to a specific Resource Group with the App Service instances.

  Reference: https://docs.microsoft.com/en-us/azure/governance/policy/overview

• Question 284:

  You need to recommend a strategy for migrating the database content of WebApp1 to Azure. What should you include in the recommendation?

  A. Use Azure Site Recovery to replicate the SQL servers to Azure.

  B. Use SQL Server transactional replication.

  C. Copy the BACPAC file that contains the Azure SQL database file to Azure Blob storage.

  D. Copy the VHD that contains the Azure SQL database files to Azure Blob storage

  Correct Answer: D

  Before you upload a Windows virtual machine (VM) from on-premises to Azure, you must prepare the virtual hard disk (VHD or VHDX).

  Scenario: WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database tier that runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual machines that run on Hyper-V.

  Reference:

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhdimage

• Question 285:

  You need to recommend a strategy for the web tier of WebApp1. The solution must minimize What should you recommend?

  A. Create a runbook that resizes virtual machines automatically to a smaller size outside of business hours.

  B. Configure the Scale Up settings for a web app.

  C. Deploy a virtual machine scale set that scales out on a 75 percent CPU threshold.

  D. Configure the Scale Out settings for a web app.

  Correct Answer: A

• Question 286:

  You need to recommend a data storage strategy for WebApp1. What should you include in in the recommendation?

  A. an Azure SQL Database elastic pool

  B. a vCore-based Azure SQL database

  C. an Azure virtual machine that runs SQL Server

  D. a fixed-size DTU AzureSQL database.

  Correct Answer: B

• Question 287:

  You need to recommend a notification solution for the IT Support distribution group. What should you include in the recommendation?

  A. Azure Network Watcher

  B. an action group

  C. a SendGrid account with advanced reporting

  D. Azure AD Connect Health

  Correct Answer: D

  References: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-healthoperations

• Question 288:

  You need to implement the Azure RBAC role assignments for the Network Contributor role. The solution must meet the authentication and authorization requirements. What is the minimum number of assignments that you must use?

  A. 1

  B. 2

  C. 5

  D. 10

  E. 15

  Correct Answer: A

  Scenario: The Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for all the virtual networks in all the Azure subscriptions. RBAC roles must be applied at the highest level possible.

• Question 289:

  After you migrate App1 to Azure, you need to enforce the data modification requirements to meet the security and compliance requirements. What should you do?

  A. Create an access policy for the blob service.

  B. Implement Azure resource locks.

  C. Create Azure RBAC assignments.

  D. Modify the access level of the blob service.

  Correct Answer: A

  Scenario: Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.

  As an administrator, you can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

• Question 290:

  You plan to migrate App1 to Azure.

  You need to recommend a network connectivity solution for the Azure Storage account that will host the App1 data. The solution must meet the security and compliance requirements.

  What should you include in the recommendation?

  A. Microsoft peering for an ExpressRoute circuit

  B. Azure public peering for an ExpressRoute circuit

  C. a service endpoint that has a service endpoint policy

  D. a private endpoint

  Correct Answer: D

  Private Endpoint securely connect to storage accounts from on-premises networks that connect to the VNet using VPN or ExpressRoutes with private-peering. Private Endpoint also secure your storage account by configuring the storage firewall to block all connections on the public endpoint for the storage service. Incorrect Answers:

  A: Microsoft peering provides access to Azure public services via public endpoints with public IP addresses, which should not be allowed.

  B: Azure public peering has been deprecated.

  C: By default, Service Endpoints are enabled on subnets configured in Azure virtual networks. Endpoints can't be used for traffic from your premises to Azure services.

  Reference: https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuit-peerings