Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 31:

  HOTSPOT

  You have an Azure AD tenant that contains a management group named MG1.

  You have the Azure subscriptions shown in the following table.

  

  The subscriptions contain the resource groups shown in the following table.

  

  The subscription contains the Azure AD security groups shown in the following table.

  

  The subscription contains the user accounts shown in the following table.

  

  You perform the following actions:

  Assign User3 the Contributor role for Sub1.

  Assign Group1 the Virtual Machine Contributor role for MG1.

  Assign Group3 the Contributor role for the Tenant Root Group.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  User1 is member of Group1.

  Group1 is assigned the Virtual Machine Contributor role for MG1.

  MG1 is in Sub1.

  RG1 is in Sub1.

  Virtual Machine Contributor

  Create and manage virtual machines, manage disks, install and run software, reset password of the root user of the virtual machine using VM extensions, and manage local user accounts using VM extensions. This role does not grant you

  management access to the virtual network or storage account the virtual machines are connected to. This role does not allow you to assign roles in Azure RBAC.

  Management groups are containers that help you manage access, policy, and compliance across multiple subscriptions. Create these containers to build an effective and efficient hierarchy that can be used with Azure Policy and Azure Role

  Based Access Controls.

  If your organization has many subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Azure management groups provide a level of scope above subscriptions. You organize

  subscriptions into containers called "management groups" and apply your governance conditions to the management groups. All subscriptions within a management group automatically inherit the conditions applied to the management group.

  Box 2: No

  User2 is a member of Group2.

  User2 has no special permissions to Group2.

  Box 3: Yes

  User3 is a member of Group3.

  Group3 is assigned the Contributor role for the Tenant Root Group.

  As a member of the Tenant Root Group User3 can create storage accounts in RG2.

  Note: Each Azure AD tenant is given a single top-level management group called the root management group. This root management group is built into the hierarchy to have all management groups and subscriptions fold up to it. This group allows global policies and Azure role assignments to be applied at the directory level.

  Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://learn.microsoft.com/en-us/azure/governance/management-groups/manage https://learn.microsoft.com/en-us/azure/defender-for-cloud/management-groups-roles

• Question 32:

  HOTSPOT

  You have an Azure subscription named Sub1 that is linked to an Azure AD tenant named contoso.com.

  You plan to implement two ASP.NET Core apps named App1 and App2 that will be deployed to 100 virtual machines in Sub1. Users will sign in to App1 and App2 by using their contoso.com credentials.

  App1 requires read permissions to access the calendar of the signed-m user. App2 requires write permissions to access the calendar of the signed-in user.

  You need to recommend an authentication and authorization solution for the apps. The solution must meet the following requirements:

  1.

  Use the principle of least privilege.

  2.

  Minimize administrative effort

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one pent.

  Hot Area:

  

  Correct Answer:

  

• Question 33:

  HOTSPOT

  You have several Azure App Service web apps that use Azure Key Vault to store data encryption keys. Several departments have the following requests to support the web app:

  

  Which service should you recommend for each department's request? To answer, configure the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 34:

  HOTSPOT

  You need to deploy an instance of SQL Server on Azure Virtual Machines. The solution must meet the following requirements:

  1.

  Support 15.000 disk IOPS.

  2.

  Support SR-IOV.

  3.

  Minimize costs.

  What should you include in the solution?

  To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point

  Hot Area:

  

  Correct Answer:

  

• Question 35:

  HOTSPOT

  You are designing an app that will be hosted on Azure virtual machines that run Ubuntu.

  The app will use a third-party email service to send email messages to users. The thirdparty email service requires that the app authenticate by using an API key.

  You need to recommend an Azure Key Vault solution for storing and accessing the API key. The solution must minimize administrative effort.

  What should you recommend using to store and access the key? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  1.

  Storage: Secret.

  API keys are typically stored as secrets in Azure Key Vault. The key vault can store and manage secrets like API keys, passwords, or database connection strings.

  2.

  Access: A managed service identity (MSI).

  A managed service identity (MSI) is used to give your VM access to the key vault. The advantage of using MSI is that you do not have to manage credentials yourself. Azure takes care of rolling the credentials and ensuring their lifecycle. The

  application running on your VM can use its managed service identity to get a token to Azure AD, and then use that token to authenticate to Azure Key Vault.

• Question 36:

  HOTSPOT

  You have an Azure subscription that contains an Azure key vault named KV1 and a virtual machine named VM1. VM1 runs Windows Server 2022: Azure Edition.

  You plan to deploy an ASP.Net Core-based application named App1 to VM1.

  You need to configure App1 to use a system-assigned managed identity to retrieve secrets from KV1. The solution must minimize development effort.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Client Credentials flow Client Credentials flow - The only flow that does not require immediate user interaction, usually used when the OAuth client is acting on-behalf of itself, when user-consent doesn't make sense, or when authorization primitives could be configured out-of-band (for instance via Azure AD)

  Note: Authenticating to Azure Services Local machines don't support managed identities for Azure resources. As a result, the Microsoft.Azure.Services.AppAuthentication library uses your developer credentials to run in your local development environment. When the solution is deployed to Azure, the library uses a managed identity to switch to an OAuth 2.0 client credential grant flow. This approach means you can test the same code locally and remotely without worry.

  Incorrect:

  *

  Authorization code flow - Requires user interaction and consent, typically via the web browser, to get a code which is then used to issue an access token.

  *

  Implicit grant flow - Created for single page web / mobile webview apps, where token creation and handling is done entirely from the front end.

  Box 2: OAuth 2.0 access token endpoint of Azure AD

  Example: Issuing and inspecting our first OAuth token

  At this stage, we should be able to issue tokens to Service A, on behalf of Service B - let's see that in action.

  In Azure AD application registration blade, go to Service B (as shown in previous steps)

  In the Overview blade, Click on the ‘Endpoints

• Question 37:

  HOTSPOT

  You have an app that generates 50,000 events daily.

  You plan to Stream the events to an Azure event hub and use Event Hubs Capture to implement cold path processing Of the events Output Of Event Hubs Capture will be consumed by a reporting system.

  You reed to identify which type of Azure storage must be provisioned to support Event Hubs Capture, and which inbound data format the reporting system must support.

  What should you identity? To answer. select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  1.

  Storage Type: Azure Data Lake Storage Gen2

  Azure Event Hubs Capture allows captured data to be written either to Azure Blob Storage or Azure Data Lake Storage Gen2. Given the nature of the data and its use in reporting and analysis, Azure Data Lake Storage Gen2 is the more appropriate choice because it is designed for big data analytics.

  2.

  Data format: Avro Event Hubs Capture uses Avro format for the data it captures. Avro is a row-oriented format that is suitable for various data types, it's compact, fast, binary, and enables efficient and fast serialization of data. This makes it a good choice for

  Event Hubs Capture.

• Question 38:

  HOTSPOT

  You have an on-premises Microsoft SQL Server database named SQL1.

  You plan to migrate SQL 1 to Azure.

  You need to recommend a hosting solution for SQL1. The solution must meet the following requirements:

  1.

  Support the deployment of multiple secondary, read-only replicas.

  2.

  Support automatic replication between primary and secondary replicas.

  3.

  Support failover between primary and secondary replicas within a 15-minute recovery time objective (RTO).

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 39:

  HOTSPOT

  You are designing a data storage solution to support reporting.

  The solution will ingest high volumes of data in the JSON format by using Azure Event Hubs. As the data arrives, Event Hubs will write the data to storage. The solution must meet the following requirements:

  1.

  Organize data in directories by date and time.

  2.

  Allow stored data to be queried directly, transformed into summarized tables, and then stored in a data warehouse.

  3.

  Ensure that the data warehouse can store 50 TB of relational data and support between 200 and 300 concurrent read operations. Which service should you recommend for each type of data store? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 40:

  HOTSPOT

  You are designing a cost-optimized solution that uses Azure Batch to run two types of jobs on Linux nodes. The first job type will consist of short-running tasks for a development environment. The second job type will consist of long-running

  Message Passing Interface (MPI) applications for a production environment that requires timely job completion.

  You need to recommend the pool type and node type for each job type. The solution must minimize compute charges and leverage Azure Hybrid Benefit whenever possible.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer: