Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 311:

  HOTSPOT

  What should you implement to meet the identity requirements? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Requirements: Identity Requirements

  Contoso identifies the following requirements for managing Fabrikam access to resources:

  Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests.

  The solution must minimize development effort.

  Box 1: The Azure AD Privileged Identity Management (PIM)

  When should you use access reviews?

  Too many users in privileged roles: It's a good idea to check how many users have administrative access, how many of them are Global Administrators, and if there are any invited guests or partners that have not been removed after being

  assigned to do an administrative task. You can recertify the role assignment users in Azure AD roles such as Global Administrators, or Azure resources roles such as User Access Administrator in the Azure AD Privileged Identity Management

  (PIM) experience.

  Box 2: Access reviews

  Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only

  the right people have continued access.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

• Question 312:

  HOTSPOT

  You need to recommend a solution to ensure that App1 can access the third-party credentials and access strings. The solution must meet the security requirements.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Scenario: Security Requirement

  All secrets used by Azure services must be stored in Azure Key Vault.

  Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services.

  Box 1: A service principal

  A service principal is a type of security principal that identifies an application or service, which is to say, a piece of code rather than a user or group. A service principal's object ID is known as its client ID and acts like its username. The service

  principal's client secret acts like its password.

  Note: Authentication with Key Vault works in conjunction with Azure Active Directory (Azure AD), which is responsible for authenticating the identity of any given security principal.

  A security principal is an object that represents a user, group, service, or application that's requesting access to Azure resources. Azure assigns a unique object ID to every security principal.

  Box 2: A role assignment

  You can provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control.

  Reference:

  https://docs.microsoft.com/en-us/azure/key-vault/general/authentication

• Question 313:

  HOTSPOT

  You are evaluating whether to use Azure Traffic Manager and Azure Application Gateway to meet the connection requirements for App1.

  What is the minimum numbers of instances required for each service? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 1

  App1 will only be accessible from the internet. App1 has the following connection requirements:

  1.

  Connections to App1 must be active-active load balanced between instances.

  2.

  All connections to App1 from North America must be directed to the East US region.

  3.

  All other connections must be directed to the West Europe region.

  App1 will have six instances: three in the East US Azure region and three in the West Europe Azure region.

  Note: Azure Traffic Manager is a DNS-based traffic load balancer. This service allows you to distribute traffic to your public facing applications across the global Azure regions.

  Box 2: 2

  For production workloads, run at least two gateway instances.

  A single Application Gateway deployment can run multiple instances of the gateway.

  Use one Application Gateway in East US Region, and one in the West Europe region.

  Reference:

  https://docs.microsoft.com/en-us/azure/architecture/high-availability/reference-architecture-traffic-manager-application-gateway

• Question 314:

  HOTSPOT

  You design a solution for the web tier of WebApp1 as shown in the exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  Any new deployments to Azure must be redundant in case an Azure region fails.

  Traffic Manager uses DNS to direct client requests to the most appropriate service endpoint based on a traffic-routing method and the health of the endpoints. An endpoint is any Internet-facing service hosted inside or outside of Azure. Traffic

  Manager provides a range of traffic-routing methods and endpoint monitoring options to suit different application

  needs and automatic failover models. Traffic Manager is resilient to failure, including the failure of an entire Azure region.

  Box 2: Yes

  Recent changes in Azure brought some significant changes in autoscaling options for Azure Web Apps (i.e. Azure App Service to be precise as scaling happens on App Service plan level and has effect on all Web Apps running in that App

  Service plan).

  Box 3: No

  Traffic Manager provides a range of traffic-routing methods and endpoint monitoring options to suit different application needs and automatic failover models. Traffic Manager is resilient to failure, including the failure of an entire Azure region.

• Question 315:

  HOTSPOT

  To meet the authentication requirements of Fabrikam, what should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 316:

  HOTSPOT

  You are evaluating the components of the migration to Azure that require you to provision an Azure Storage account. For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 317:

  HOTSPOT

  You plan to migrate App1 to Azure.

  You need to recommend a storage solution for App1 that meets the security and compliance requirements.

  Which type of storage should you recommend, and how should you recommend configuring the storage? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Standard general-purpose v2

  Standard general-purpose v2 supports Blob Storage.

  Azure Storage provides data protection for Blob Storage and Azure Data Lake Storage Gen2.

  Scenario:

  Litware identifies the following security and compliance requirements:

  Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.

  On-premises users and services must be able to access the Azure Storage account that will host the data in App1.

  Access to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.

  All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.

  App1 must NOT share physical hardware with other workloads.

  Box 2: NFSv3

  Scenario: Plan: Migrate App1 to Azure virtual machines.

  Blob storage now supports the Network File System (NFS) 3.0 protocol. This support provides Linux file system compatibility at object storage scale and prices and enables Linux clients to mount a container in Blob storage from an Azure

  Virtual Machine (VM) or a computer on-premises.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/blobs/data-protection-overview

• Question 318:

  HOTSPOT

  You plan to migrate App1 to Azure.

  You need to estimate the compute costs for App1 in Azure. The solution must meet the security and compliance requirements.

  What should you use to estimate the costs, and what should you implement to minimize the costs? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: The Azure Total Cost of Ownership (TCO) Calculator

  The Total Cost of Ownership (TCO) Calculator estimates the cost savings you can realize by migrating your workloads to Azure.

  Note: The TCO Calculator recommends a set of equivalent services in Azure that will support your applications. Our analysis will show each cost area with an estimate of your on-premises spend versus your spend in Azure. There are several

  cost categories that either decrease or go away completely when you move workloads to the cloud.

  Box 2: Azure Hybrid Benefit

  Azure Hybrid Benefit is a licensing benefit that helps you to significantly reduce the costs of running your workloads in the cloud. It works by letting you use your on-premises Software Assurance-enabled Windows Server and SQL Server

  licenses on Azure. And now, this benefit applies to RedHat and SUSE Linux subscriptions, too.

  Scenario:

  Litware identifies the following security and compliance requirements:

  1.

  Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.

  2.

  On-premises users and services must be able to access the Azure Storage account that will host the data in App1.

  3.

  Access to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.

  4.

  All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.

  5.

  App1 must not share physical hardware with other workloads.

• Question 319:

  HOTSPOT

  You plan to migrate App1 to Azure.

  You need to recommend a high-availability solution for App1. The solution must meet the resiliency requirements.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 3

  Scenario: App1 must meet the following requirements:

  1.

  Be hosted in an Azure region that supports availability zones.

  2.

  Maintain availability if two availability zones in the local Azure region fail.

  A host group is a resource that represents a collection of dedicated hosts. You create a host group in a region and an availability zone, and add hosts to it.

  Use Availability Zones for fault isolation

  Availability zones are unique physical locations within an Azure region. Each zone is made up of one or more datacenters equipped with independent power, cooling, and networking.

  A host group is created in a single availability zone. Once created, all hosts will be placed within that zone. To achieve high availability across zones, you need to create multiple host groups (one per zone) and spread your hosts accordingly.

  Box 2: 1

  Scenario: App1 must meet the following requirements:

  Be hosted on Azure virtual machines that support automatic scaling.

  An Azure virtual machine scale set can automatically increase or decrease the number of VM instances that run your application. This automated and elastic behavior reduces the management overhead to monitor and optimize the

  performance of your application.

• Question 320:

  HOTSPOT

  You need to ensure that users managing the production environment are registered for Azure MFA and must authenticate by using Azure MFA when they sign in to the Azure portal.

  The solution must meet the authentication and authorization requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  1: Azure AD Identity Protection Litware.com has Conditional Access Policy. Don't enable or enforce per-user Azure AD Multi-Factor Authentication if you use Conditional Access policies. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates Therefor it should NOT be Per user MFA

  2: Grant control in capolicy1 Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users. Conditional Access is an Azure AD Premium P1 or P2 feature that lets you apply rules to require MFA as needed in certain scenarios. Grant Control is one step in process to enable MFA in Conditional Access Policy.