Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 341:

  DRAG DROP

  You are planning an Azure solution that will host production databases for a high- performance application. The solution will include the following components:

  1.

  Two virtual machines that will run Microsoft SQL Server 2016, will be deployed to different data centers in the same Azure region, and will be part of an Always On availability group.

  2.

  SQL Server data that will be backed up by using the Automated Backup feature of the SQL Server IaaS Agent Extension (SQLIaaSExtension) You identify the storage priorities for various data types as shown in the following table.

  

  Which storage type should you recommend for each data type? To answer, drag the appropriate storage types to the correct data types. Each storage type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 342:

  DRAG DROP

  Your company identifies the following business continuity and disaster recovery objectives for virtual machines that host sales, finance, and reporting application in the company's on- premises data center.

  The finance application requires that data be retained for seven years. In the event of a disaster, the application must be able to run from Azure. The recovery in objective (RTO) is 10 minutes,

  The reporting application must be able to recover point in-time data al a daily granularity.

  The RTO is eight hours.

  The sales application must be able to fail over to second on-premises data center.

  You need to recommend which Azure services meet the business community and disaster recovery objectives. The solution must minimize costs.

  What should you recommend for each application? To answer, drag the appropriate services to the correct application. Each service may be used owe. More than once not at an You may need to drag the spin bar between panes or scroll 10

  view content.

  Select and Place:

  

  Correct Answer:

  

• Question 343:

  DRAG DROP

  You have an on-premises named App 1.

  Customers App1 to manage digital images.

  You plan to migrate App1 to Azure.

  You need to recommend a data storage solution for App1. The solution must meet the following image storage requirements:

  1.

  Encrypt images at rest.

  2.

  Allow files up to 50 MB.

  3.

  Manage access to the images by using Azure Web Application Firewall (WAF) on Azure Front Door.

  The solution must meet the following customer account requirements:

  1.

  Support automatic scale out of the storage.

  2.

  Maintain the availability of App1 if a datacenter fails.

  3.

  Support reading and writing data from multiple Azure regions.

  Which service should you include in the recommendation for each type of data? To answer, drag the appropriate services to the correct type of data. Each service may be used once, more than once, or not at all. You may need to drag the

  split bar between panes or scroll to view content.

  NOTE: Each correct answer is worth one point.

  Select and Place:

  

  Correct Answer:

  

  1.

  Azure Blob storage

  2.

  Azure Cosmos DB

  https://learn.microsoft.com/en-us/azure/frontdoor/scenario-storage-blobs Azure Front Door accelerates the delivery of static content from Azure Storage blobs, and enables a secure and scalable architecture. Static content delivery is useful for many different use cases, including website hosting and file delivery https://learn.microsoft.com/en-us/azure/cosmos-db/introduction#guaranteed-speed-at-any-scale

  - Multi-region writes and data distribution to any Azure region with just a button

• Question 344:

  DRAG DROP

  You have an Azure AD tenant that contains an administrative unit named MarketingAU. MarketingAU contains 100 users.

  You create two users named User1 and User2.

  You need to ensure that the users can perform the following actions in MarketingAU:

  User1 must be able to create user accounts.

  User2 must be able to reset user passwords.

  Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: User Administrator for the MarketingAU

  User1 must be able to create user accounts.

  User Administrator

  Can manage all aspects of users and groups, including resetting passwords for limited admins.

  Create users

  Etc.

  Roles that can be assigned with administrative unit scope

  The following Azure AD roles can be assigned with administrative unit scope.

  *

  Helpdesk Administrator

  *

  User Administrator

  *

  Etc.

  Box 2: Helpdesk Administrator for the MarketingAU

  User2 must be able to reset user passwords.

  Helpdesk Administrator

  Can reset passwords for non-administrators and Helpdesk Administrators.

  Administrative units restrict permissions in a role to any portion of your organization that you define. You could, for example, use administrative units to delegate the Helpdesk Administrator role to regional support specialists, so they can

  manage users only in the region that they support.

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference https://learn.microsoft.com/en-us/azure/active-directory/roles/admin-units-assign-roles

• Question 345:

  DRAG DROP

  You have two app registrations named App1 and App2 in Azure AD. App1 supports role-based access control (RBAC) and includes a role named Writer.

  You need to ensure that when App2 authenticates to access App1, the tokens issued by Azure AD include the Writer role claim.

  Which blade should you use to modify each app registration? To answer, drag the appropriate blades to the correct app registrations. Each blade may be used once, more than once, or not at all. You may need to drag the split bar between

  panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: App roles

  App1 supports role-based access control (RBAC) and includes a role named Writer.

  Implement role-based access control

  Define app roles

  The first step for implementing RBAC for an application is to define the app roles for it and assign users or groups to it. After defining the app roles and assigning users or groups to them, access the role assignments in the tokens coming into

  the application and act on them accordingly.

  Box 2: Token configuration

  You need to ensure that when App2 authenticates to access App1, the tokens issued by Azure AD include the Writer role claim.

  Configure optional claims

  You can configure optional claims for your application through the Azure portal or application manifest.

  Go to the Azure portal.

  Search for and select Azure Active Directory.

  Under Manage, select App registrations.

  Choose the application for which you want to configure optional claims based on your scenario and desired outcome.

  Under Manage, select Token configuration

  Etc.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-implement-rbac-for-apps

  https://learn.microsoft.com/en-us/azure/active-directory/develop/optional-claims

• Question 346:

  DRAG DROP

  You are designing a virtual machine that will run Microsoft SQL Server and contain two data disks. The first data disk will store log files, and the second data disk will store data. Both disks are P40 managed disks.

  You need to recommend a host caching method for each disk. The method must provide the best overall performance for the virtual machine while preserving the integrity of the SQL data and logs.

  Which host caching method should you recommend for each disk? To answer, drag the appropriate methods to the correct disks. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: None

  No data disk caching for the Log files.

  Box 2: ReadOnly

  Guidelines to optimize performance for your SQL Server on Azure Virtual Machines (VMs) include:

  Set host caching to read-only for data file disks.

  Set host caching to none for log file disks.

  Reference: https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-storage

• Question 347:

  DRAG DROP

  You plan to deploy an infrastructure solution that will contain the following configurations:

  1.

  External users will access the infrastructure by using Azure Front Door.

  2.

  External user access to the backend APIs hosted in Azure Kubernetes Service (AKS) will be controlled by using Azure API Management.

  3.

  External users will be authenticated by an Azure AD B2C tenant that uses OpenID Connect-based federation with a third-party identity provider.

  Which function does each service provide? To answer, drag the appropriate functions to the correct services. Each function may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view

  content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Validation of Azure AD B2C JSON web Tokens (JWTs) Front Door Protect backend APIs by using Azure API Management and Azure AD B2C Architecture Dataflow

  1.

  To gain access to an application, an API client authenticates by providing credentials such as username and password. The IdP is Azure AD B2C in this solution, but you can use a different one.

  2.

  The authentication request goes via Azure Front Door to Azure AD B2C, which is configured with a custom domain for sign-in. Azure AD B2C authenticates the user and returns a JSON Web Token (JWT) bearer token back to the user.

  3.

  The client triggers an event that accesses a backend API. This event could be a click of a button on a web application or on a mobile device, or a direct call to the endpoint of the backend API.

  4.

  The request goes through Azure Front Door, whose back end is mapped to the public endpoint of API Management. API Management intercepts the request and validates the bearer token against Azure AD B2C by using its validate-jwt policy. If the token isn't valid, API Management rejects the request by responding with a 401 code.

  5.

  If the token is valid, API Management forwards the request to the appropriate backend API.

  The diagram shows backend APIs running in three environments:

  App Service Environment

  Function Apps

  Azure Kubernetes Services (AKS)

  APIs running in on-premises and hybrid cloud environments can also be integrated with API Management if network connectivity is established between the APIs and API Management.

  Box 2: IP filtering on a per-API level

  Api Management

  Api Management keeps all your APIs behind a single static IP or domain, and help protect them with keys, tokens, and IP filtering.

  Note: Azure Application Gateway is a Layer 7 load balancer that manages traffic to web applications.

  API Management is a turnkey solution for publishing APIs to external and internal clients. It provides features that are useful for managing a public-facing API, including rate limiting, IP restrictions, and authentication that uses Azure AD or

  another IdP. API Management doesn't perform any load balancing, so you should use it with a load balancer such as Application Gateway or a reverse proxy.

  Reference: https://learn.microsoft.com/en-us/azure/architecture/solution-ideas/articles/protect-backend-apis-azure-management https://azure.microsoft.com/en-us/products/api-management/

• Question 348:

  DRAG DROP

  You have an on-premises datacenter named Site1. Site1 contains a VMware vSphere cluster named Cluster1 that hosts 100 virtual machines. Cluster1 is managed by using VMware vCenter.

  You have an Azure subscription named Sub1.

  You plan to migrate the virtual machines from Cluster1 to Sub1.

  You need to identify which resources are required to run the virtual machines in Azure. The solution must minimize administrative effort.

  What should you configure? To answer, drag the appropriate resources to the correct targets. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 349:

  DRAG DROP

  You plan to use Azure Storage to store data assets.

  You need to identify the procedure to fail over a general-purpose v2 account as part of a disaster recovery plan. The solution must meet the following requirements:

  1.

  Apps must be able to access the storage account after a failover.

  2.

  You must be able to fail back the storage account to the original location.

  3.

  Downtime must be minimized.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

• Question 350:

  DRAG DROP You need to recommend a solution that meets the file storage requirements for App2. What should you deploy to the Azure subscription and the on-premises network? To answer, drag the appropriate services to the correct locations. Each service may be used once, more than once, or not at all. You may need to drag the split

  bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Azure Files

  Scenario: App2 has the following file storage requirements:

  Save files to an Azure Storage account.

  Replicate files to an on-premises location.

  Ensure that on-premises clients can read the files over the LAN by using the SMB protocol.

  Box 2: Azure File Sync

  Use Azure File Sync to centralize your organization's file shares in Azure Files, while keeping the flexibility, performance, and compatibility of an on-premises file server. Azure File Sync transforms Windows Server into a quick cache of your

  Azure file share. You can use any protocol that's available on Windows Server to access your data locally, including SMB, NFS, and FTPS. You can have as many caches as you need across the world.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide