Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 51:

  HOTSPOT

  You have the resources shown in the following table.

  

  You create a new resource group in Azure named RG2.

  You need to move the virtual machines to RG2.

  What should you use to move each virtual machine? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure Resource Mover

  To move Azure VMs to another region, Microsoft now recommends using Azure Resource Mover.

  Incorrect:

  Not Azure Migrate: We are not migrating, only moving a VM between resource groups.

  Box 2: Azure Migrate

  Azure Migrate provides a centralized hub to assess and migrate on-premises servers, infrastructure, applications, and data to Azure.

  Azure migrate includes Azure Migrate Server Migration: Migrate VMware VMs, Hyper-V VMs, physical servers, other virtualized servers, and public cloud VMs to

  Azure.

  Incorrect:

  Not Arc: Azure Migrate is adequate. No need to use Azure Arc.

  Not Data Migration Assistant: Data Migration Assistant is a stand-alone tool to assess SQL Servers.

  It is used to assess SQL Server databases for migration to Azure SQL Database, Azure SQL Managed Instance, or Azure VMs running SQL Server.

  Not Lighthouse: Azure Lighthouse enables multi-tenant management with scalability, higher automation, and enhanced governance across resources.

  With Azure Lighthouse, service providers can deliver managed services using comprehensive and robust tooling built into the Azure platform. Customers maintain control over who has access to their tenant, which resources they can access,

  and what actions can be taken.

  Reference:

  https://docs.microsoft.com/en-us/azure/resource-mover/overview

  https://docs.microsoft.com/en-us/azure/migrate/migrate-services-overview

  https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-migrate

• Question 52:

  HOTSPOT

  You have five .NET Core applications that run on 10 Azure virtual machines in the same subscription.

  You need to recommend a solution to ensure that the applications can authenticate by using the same Azure Active Directory (Azure AD) identity. The solution must meet the following requirements:

  1.

  Ensure that the applications can authenticate only when running on the 10 virtual machines.

  2.

  Minimize administrative effort.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Create a system-assigned Managed Identities for Azure resource The managed identities for Azure resources feature in Azure Active Directory (Azure AD) feature provides Azure services with an automatically managed identity in Azure AD. You can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code. A system-assigned managed identity is enabled directly on an Azure service instance. When the identity is enabled, Azure creates an identity for the instance in the Azure AD tenant that's trusted by the subscription of the instance. After the identity is created, the credentials are provisioned onto the instance.

  Box 2: An Azure Instance Metadata Service Identity See step 3 and 5 below. How a system-assigned managed identity works with an Azure VM

  1.

  Azure Resource Manager receives a request to enable the system-assigned managed identity on a VM.

  2.

  Azure Resource Manager creates a service principal in Azure AD for the identity of the VM. The service principal is created in the Azure AD tenant that's trusted by the subscription.

  3.

  Azure Resource Manager configures the identity on the VM by updating the Azure Instance Metadata Service identity endpoint with the service principal client ID and certificate.

  4.

  After the VM has an identity, use the service principal information to grant the VM access to Azure resources. To call Azure Resource Manager, use role-based access control (RBAC) in Azure AD to assign the appropriate role to the VM service principal. To call Key Vault, grant your code access to the specific secret or key in Key Vault.

  5.

  Your code that's running on the VM can request a token from the Azure Instance Metadata service endpoint, accessible only from within the VM

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

• Question 53:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant.

  You plan to use Azure Monitor to monitor user sign-ins and generate alerts based on specific user sign-in events.

  You need to recommend a solution to trigger the alerts based on the events.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: An Azure Log Analytics workspace

  To be able to create an alert we send the Azure AD logs to An Azure Log Analytics workspace.

  Note: You can forward your AAD logs and events to either an Azure Storage Account, an Azure Event Hub, Log Analytics, or a combination of all of these.

  Box 2: Log

  Ensure Resource Type is an analytics source like Log Analytics or Application Insights and signal type as Log.

• Question 54:

  HOTSPOT

  Your company deploys several Linux and Windows virtual machines (VMs) to Azure. The VMs are deployed with the Microsoft Dependency Agent and the Microsoft Monitoring Agent installed by using Azure VM extensions. On-premises connectivity has been enabled by using Azure ExpressRoute.

  You need to design a solution to monitor the VMs.

  Which Azure monitoring services should you use? To answer, select the appropriate Azure monitoring services in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure Network Watcher

  Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your

  Azure cloud. With traffic analytics, you can:

  Identify security threats to, and secure your network, with information such as open-ports, applications attempting internet access, and virtual machines (VM) connecting to rogue networks.

  Visualize network activity across your Azure subscriptions and identify hot spots.

  Understand traffic flow patterns across Azure regions and the internet to optimize your network deployment for performance and capacity.

  Pinpoint network misconfigurations leading to failed connections in your network.

  Box 2: Azure Service Map

  Service Map automatically discovers application components on Windows and Linux systems and maps the communication between services. With Service Map, you can view your servers in the way that you think of them: as interconnected

  systems that deliver critical services. Service Map shows connections between servers, processes, inbound and outbound connection latency, and ports across any TCP-connected architecture, with no configuration required other than the

  installation of an agent.

  Reference:

  https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics

  https://docs.microsoft.com/en-us/azure/azure-monitor/insights/service-map

• Question 55:

  HOTSPOT

  You have an Azure Load Balancer named LB1 that balances requests to five Azure virtual machines.

  You need to develop a monitoring solution for LB1. The solution must generate an alert when any of the following conditions are met:

  1.

  A virtual machine is unavailable.

  2.

  Connection attempts exceed 50,000 per minute.

  Which signal should you include in the solution for each condition? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Data path availability

  Standard Load Balancer continuously exercises the data path from within a region to the load balancer front end, all the way to the SDN stack that supports your VM. As long as healthy instances remain, the measurement follows the same

  path as your application's load-balanced traffic. The data path that your customers use is also validated. The measurement is invisible to your application and does not interfere with other operations.

  Note: Load balancer distributes inbound flows that arrive at the load balancer's front end to backend pool instances. These flows are according to configured load-balancing rules and health probes. The backend pool instances can be Azure

  Virtual Machines or instances in a virtual machine scale set.

  Box 2: SYN count

  SYN (synchronize) count: Standard Load Balancer does not terminate Transmission Control Protocol (TCP) connections or interact with TCP or UDP packet flows. Flows and their handshakes are always between the source and the VM

  instance. To better troubleshoot your TCP protocol scenarios, you can make use of SYN packets counters to understand how many TCP connection attempts are made. The metric reports the number of TCP SYN packets that were received.

  Incorrect Answers:

  Health probe status: Standard Load Balancer uses a distributed health-probing service that monitors your application endpoint's health according to your configuration settings. This metric provides an aggregate or per-endpoint filtered view of

  each instance endpoint in the load balancer pool. You can see how Load Balancer views the health of your application, as indicated by your health probe configuration.

  Packet count: Standard Load Balancer reports the packets processed per front end.

  Byte Count: Standard Load Balancer reports the data processed per front end. You may notice that the bytes are not distributed equally across the backend instances. This is expected as Azure's Load Balancer algorithm is based on flows

  Reference:

  https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics

• Question 56:

  HOTSPOT

  You are designing an Azure web app.

  You plan to deploy the web app to the North Europe Azure region and the West Europe Azure region.

  You need to recommend a solution for the web app. The solution must meet the following requirements:

  1.

  Users must always access the web app from the North Europe region, unless the region fails.

  2.

  The web app must be available to users if an Azure region is unavailable.

  3.

  Deployment costs must be minimized.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 57:

  HOTSPOT

  You have an Azure subscription named Subscription1 that is linked to a hybrid Azure Active Directory (Azure AD) tenant.

  You have an on-premises datacenter that does NOT have a VPN connection to Subscription1. The datacenter contains a computer named Server1 that has Microsoft SQL Server 2016 installed. Server1 is prevented from accessing the

  internet.

  An Azure logic app named LogicApp1 requires write access to a database on Server1.

  You need to recommend a solution to provide LogicApp1 with the ability to access Server1.

  What should you recommend deploying on-premises and in Azure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: An on-premises data gateway

  For logic apps in global, multi-tenant Azure that connect to on-premises SQL Server, you need to have the on-premises data gateway installed on a local computer and a data gateway resource that's already created in Azure.

  Box 2: A connection gateway resource

  Reference:

  https://docs.microsoft.com/en-us/azure/connectors/connectors-create-api-sqlazure

• Question 58:

  HOTSPOT

  You need to implement the Azure RBAC role assignment. The solution must meet the authentication and authorization requirements.

  How many assignment should you configure for the Network Contributor role for Role1? To answer, select appropriate in the answer area.

  Hot Area:

  

  Correct Answer:

  

• Question 59:

  HOTSPOT

  You plan to migrate on-premises Microsoft SQL Server databases to Azure.

  You need to recommend a deployment and resiliency solution that meets the following requirements:

  1.

  Supports user-initiated backups

  2.

  Supports multiple automatically replicated instances across Azure regions

  3.

  Minimizes administrative effort to implement and maintain business continuity What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: An Azure SQL Database single database.

  SQL Server Managed instance versus SQL Server Virtual Machines

  Active geo-replication is not supported by Azure SQL Managed Instance.

  Box 2: Active geo-replication

  Active geo-replication is a feature that lets you to create a continuously synchronized readable secondary database for a primary database. The readable secondary database may be in the same Azure region as the primary, or, more

  commonly, in a different region. This kind of readable secondary databases are also known as geo-secondaries, or geo-replicas.

  Incorrect Answers:

  A Zone-redundant deployment is within a single region.

  Auto-failover groups support geo-replication of all databases in the group to only one secondary server or instance in a different region. If you need to create multiple Azure SQL Database geo-secondary replicas (in the same or different

  regions) for the same primary replica, use active geo-replication.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-sql/database/active-geo-replication-overview

• Question 60:

  HOTSPOT

  You are designing a software as a service (SaaS) application that will enable Azure Active Directory (Azure AD) users to create and publish online surveys. The SaaS application will have a front-end web app and a back-end web API. The web app will rely on the web API to handle updates to customer surveys.

  You need to design an authorization flow for the SaaS application. The solution must meet the following requirements:

  1.

  To access the back-end web API, the web app must authenticate by using OAuth 2 bearer tokens.

  2.

  The web app must authenticate by using the identities of individual users.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/lb-lu/azure/architecture/multitenant-identity/web-api https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-dotnet-webapi