Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 61:

  HOTSPOT

  You are planning an Azure Storage solution for sensitive data. The data will be accessed daily. The data set is less than 10 GB.

  You need to recommend a storage solution that meets the following requirements:

  1.

  All the data written to storage must be retained for five years.

  2.

  Once the data is written, the data can only be read. Modifications and deletion must be prevented.

  3.

  After five years, the data can be deleted, but never modified.

  4.

  Data access charges must be minimized.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: General purpose v2 with Archive acce3ss tier for blobs

  Archive - Optimized for storing data that is rarely accessed and stored for at least 180 days with flexible latency requirements, on the order of hours.

  Cool - Optimized for storing data that is infrequently accessed and stored for at least 30 days.

  Hot - Optimized for storing data that is accessed frequently.

  Box 2: Storage account resource lock

  As an administrator, you can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have.

  Note: You can set the lock level to CanNotDelete or ReadOnly. In the portal, the locks are called Delete and Read-only respectively.

  1.

  CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.

  2.

  ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.

  Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

• Question 62:

  HOTSPOT

  You plan to develop a new app that will store business critical data. The app must meet the following requirements:

  1.

  Prevent new data from being modified for one year.

  2.

  Minimize read latency.

  3.

  Maximize data resiliency.

  You need to recommend a storage solution for the app.

  What should you recommend? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  Correct Answer:

  

  Box 1:

  BlockBlobStorage

  Storage accounts with premium performance characteristics for block blobs and append blobs.

  Box 2:

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview

  https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy?toc=/azure/storage/blobs/toc.json

• Question 63:

  HOTSPOT

  You are designing an access policy for your company.

  Occasionally, the developers at the company must stop, start, and restart Azure virtual machines. The development team changes often.

  You need to recommend a solution to provide the developers with the required access to the virtual machines. The solution must meet the following requirements:

  1.

  Provide permissions only when needed.

  2.

  Use the principle of least privilege.

  3.

  Minimize costs.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 64:

  HOTSPOT

  You have the Free edition of a hybrid Azure Active Directory (Azure AD) tenant. The tenant uses password hash synchronization.

  You need to recommend a solution to meet the following requirements:

  1.

  Prevent Active Directory domain user accounts from being locked out as the result of brute force attacks targeting Azure AD user accounts.

  2.

  Block legacy authentication attempts to Azure AD integrated apps.

  3.

  Minimize costs.

  What should you recommend for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Smart lockout

  Smart lockout helps lock out bad actors that try to guess your users' passwords or use brute-force methods to get in. Smart lockout can recognize sign-ins that come from valid users and treat them differently than ones of attackers and other

  unknown sources. Attackers get locked out, while your users continue to access their accounts and be productive.

  Box 2: Conditional access policies

  If your environment is ready to block legacy authentication to improve your tenant's protection, you can accomplish this goal with Conditional Access.

  How can you prevent apps using legacy authentication from accessing your tenant's resources? The recommendation is to just block them with a Conditional Access policy. If necessary, you allow only certain users and specific network

  locations to use apps that are based on legacy authentication.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-smart-lockout

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication

• Question 65:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You plan to use Azure Backup and Azure Disk Encryption to protect the virtual machines. Which virtual machines are supported by each service? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 66:

  HOTSPOT

  You have an Azure web app named App1 and an Azure key vault named KV1.

  App1 stores database connection strings in KV1.

  App1 performs the following types of requests to KV1:

  1.

  Get

  2.

  List

  3.

  Wrap

  4.

  Delete

  5.

  Unwrap

  6.

  Backup

  7.

  Decrypt

  8. Encrypt

  You are evaluating the continuity of service for App1.

  You need to identify the following if the Azure region that hosts KV1 becomes unavailable:

  1.

  To where will KV1 fail over?

  2.

  During the failover, which request type will be unavailable?

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: A server in the same paired region

  The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets.

  Box 2: Delete

  During failover, your key vault is in read-only mode. Requests that are supported in this mode are:

  List certificates

  Get certificates

  List secrets

  Get secrets

  List keys

  Get (properties of) keys

  Encrypt

  Decrypt

  Wrap

  Unwrap

  Verify

  Sign

  Backup

  Reference:

  https://docs.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance

• Question 67:

  HOTSPOT

  You have an Azure subscription that contains a resource group named RG1.

  You have a group named Group1 that is assigned the Contributor role for RG1.

  You need to enhance security for the virtual machines in RG1 to meet the following requirements:

  1.

  Prevent Group1 from assigning external IP addresses to the virtual machines.

  2.

  Ensure that Group1 can establish an RDP connection to the virtual machines through a shared external IP address.

  What should you use to meet each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 68:

  HOTSPOT

  You have an Azure Resource Manager template named Template1 in the library as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-syntax

• Question 69:

  HOTSPOT

  You have an Azure logic app named App1 and an Azure Service Bus queue named Queue1.

  You need to ensure that App1 can read messages from Queue1. App1 must authenticate by using Azure Active Directory (Azure AD).

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  On App1: Turn on the managed identity

  To use Service Bus with managed identities, you need to assign the identity the role and the appropriate scope. The procedure in this section uses a simple application that runs under a managed identity and accesses Service Bus resources.

  Once the application is created, follow these steps:

  Go to Settings and select Identity.

  Select the Status to be On.

  Select Save to save the setting.

  On Queue1: Configure Access Control (IAM)

  Azure Active Directory (Azure AD) authorizes access rights to secured resources through role-based access control (RBAC). Azure Service Bus defines a set of built-in RBAC roles that encompass common sets of permissions used to access

  Service Bus entities and you can also define custom roles for accessing the data.

  Assign RBAC roles using the Azure portal

  In the Azure portal, navigate to your Service Bus namespace. Select Access Control (IAM) on the left menu to display access control settings for the namespace. If you need to create a Service Bus namespace.

  Select the Role assignments tab to see the list of role assignments. Select the Add button on the toolbar and then select Add role assignment.

  Reference:

  https://docs.microsoft.com/en-us/azure/service-bus-messaging/authenticate-application

  https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-managed-service-identity

• Question 70:

  HOTSPOT

  You need to design an authentication solution that will integrate on-premises Active Directory and Azure Active Directory (Azure AD). The solution must meet the following requirements:

  1.

  Active Directory users must not be able to sign in to Azure AD-integrated apps outside of the sign-in hours configured in the Active Directory user accounts.

  2.

  Active Directory users must authenticate by using multi-factor authentication (MFA) when they sign in to Azure AD-integrated apps.

  3.

  Administrators must be able to obtain Azure AD-generated reports that list the Active Directory users who have leaked credentials.

  4.

  The infrastructure required to implement and maintain the solution must be minimized.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Pass-through Authentication with Azure AD Seamless SSO

  Azure AD Seamless SSO versus Active Directory Federation Services

  Companies with a security requirement to immediately enforce on-premises user account states,

  password policies, and sign-in hours might use Azure AD Pass-through Authentication.

  You can combine Pass-through Authentication with the Seamless Single Sign-On feature.

  Note: Azure AD supports the following authentication methods for hybrid identity solutions.

  Azure AD password hash synchronization

  Azure AD Pass-through Authentication

  Box 2: Azure MFA

  One key benefit with Azure AD Pass-through Authentication is that it works seamlessly with Azure MFA.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn