Microsoft Microsoft Certifications AZ-305 Questions & Answers

• Question 71:

  HOTSPOT

  You plan to implement an access review to meet the following requirements:

  The access review must be enforced until otherwise configured. Each user or group that has access to the Azure environment must be in the scope of the access review.

  The access review must be completed within two weeks. A lack of response must not cause changes in the operational environment.

  An administrator creates the access review shown in the answer area.

  Which two sections of the access review should you modify to meet the requirements? To answer, select the appropriate sections in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Area 1: Start date..End Date

  The access review must be enforced until otherwise configured. We set End: Never

  The access review must be completed within two weeks. We set Duration (in days) to 14

  Area 2: Upon completion settings

  A lack of response must not cause changes in the operational environment. We set 'If reviewers don't respond: No change (which leave user's access unchanged)

• Question 72:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  You create an Azure Cosmos DB account as shown in the exhibit. (Click the Exhibit tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Connectivity Method: Private Network

  Box 2: Yes

  Private endpoint: Endpoint1 (Core (SQL)) (Vnet1)

  VM1 is in Vnet1.

  Box 3: No

  VM2 is not in Vnet1.

  Reference:

  https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-cosmosdb-portal

• Question 73:

  HOTSPOT

  You have an Azure subscription that contains 20 virtual machines. The virtual machines run Windows Server 2019.

  You need to enable Update Management and deploy the required agents to the virtual machines.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/automation/update-management/enable-from-automation-account

• Question 74:

  HOTSPOT

  You have Azure subscription that contains a virtual network named VNet1. VNet1 includes a VPN gateway, uses an IP address space of 10.0.0.0/16 and contains the subnets in the following table.

  

  Subnet1 contains a virtual appliance named VM1 that operates as a router.

  You create a routing table named RT1.

  You need to route all inbound traffic from the VPN gateway to VNet1 through VM1.

  How should you configure RT1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 75:

  HOTSPOT

  You have the offices shown in the following table.

  

  You have an Azure Active Directory (Azure AD) tenant that contains three users named User1, User2, and User3.

  From the multifactor authentication page, you configure the trusted ips settings as shown in the following exhibit.

  

  The users are configured as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Multifactor authentication requests are skipped for the Boston IP range.

  Note: On the multi-factor authentication service settings page, you can identify corporate intranet users by selecting Skip multi-factor authentication for requests from federated users on my intranet. This setting indicates that the inside

  corporate network claim, which is issued by AD FS, should be trusted and used to identify the user as being on the corporate network.

  Box 2: Yes

  MFA enabled for User2. Seattle region is not excluded.

  Box 3: No

  IP range is excluded.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

• Question 76:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to recommend an authorization mechanism for controlling access to blob1. The solution must ensure that access to blob1 can be configured without affecting the other resources in storage1. What should you recommend? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  Correct Answer:

  

  Box 1: A stored access policy and a service shared access signature (SAS)

  A stored access policy provides an additional level of control over service-level shared access signatures (SAS) on the server side. Establishing a stored access policy serves to group shared access signatures and to provide additional

  restrictions for signatures that are bound by the policy.

  The following storage resources support stored access policies:

  1.

  Blob containers

  2.

  File shares

  3.

  Queues

  4.

  Tables

  Box 2: Modify the stored access signature (SAS)

  You can use a stored access policy to change the start time, expiry time, or permissions for a signature, or to revoke it after it has been issued.

  Reference:

  https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy

• Question 77:

  HOTSPOT

  You have an Azure subscription that contains 300 Azure virtual machines that run Windows Server 2016.

  You need to centrally monitor all warning events in the System logs of the virtual machines.

  What should you include in the solutions? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  References: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows

• Question 78:

  HOTSPOT

  You have an Azure subscription that contains the web apps shown in the following table.

  

  App Service plans use the premium service tier.

  Which web apps support WebJobs, and which web apps support deployment slots? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: App1 and App4 only.

  The version 3.x of the WebJobs SDK supports both .NET Core and .NET Framework console apps.

  WebJobs is not yet supported for App Service on Linux

  Box 2: App1 and App2.

  When you deploy your web app, web app on Linux, mobile back end, or API app to Azure App Service, you can use a separate deployment slot instead of the default production slot when you're running in the Standard, Premium, or Isolated

  App Service plan tier.

  Azure Functions deployment slots allow your function app to run different instances called "slots". Slots are different environments exposed via a publicly available endpoint.

  Reference:

  https://docs.microsoft.com/en-us/azure/app-service/webjobs-create

  https://medium.com/@vedkoditkar/deploy-azure-web-job-on-docker-c2d91e5ad68f

  https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots

• Question 79:

  HOTSPOT

  You need to design an Azure policy that will implement the following functionality:

  1.

  For new resources, assign tags and values that match the tags and values of the resource group to which the resources are deployed.

  2.

  For existing resources, identify whether the tags and values match the tags and values of the resource group that contains the resources.

  3.

  For any non-compliant resources, trigger auto-generated remediation tasks to create missing tags and values.

  The solution must use the principle of least privilege.

  What should you include in the design? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Modify Modify is used to add, update, or remove properties or tags on a resource during creation or update. A common example is updating tags on resources such as costCenter. Existing non-compliant resources can be remediated with a remediation task. A single Modify rule can have any number of operations.

  Box 2: A managed identity with the Contributor role Managed identity How remediation security works: When Azure Policy runs the template in the deployIfNotExists policy definition, it does so using a managed identity. Azure Policy creates a managed identity for each assignment, but must have details about what roles to grant the managed identity.

• Question 80:

  HOTSPOT

  You have an Azure App Service web app that uses a system-assigned managed identity.

  You need to recommend a solution to store their settings of the web app as secrets in an Azure key vault The solution must meet the following requirements:

  1.

  Minimize changes to the app code,

  2.

  Use the principle of least privilege.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Key Vault references in Application settings

  Source Application Settings from Key Vault.

  Key Vault references can be used as values for Application Settings, allowing you to keep secrets in Key Vault instead of the site config. Application Settings are securely encrypted at rest, but if you need secret management capabilities, they

  should go into Key Vault.

  To use a Key Vault reference for an app setting, set the reference as the value of the setting. Your app can reference the secret through its key as normal. No code changes are required.

  Box 2: Secrets: Get

  In order to read secrets from Key Vault, you need to have a vault created and give your app permission to access it.

  1.

  Create a key vault by following the Key Vault quickstart.

  2.

  Create a managed identity for your application.

  3.

  Key Vault references will use the app's system assigned identity by default, but you can specify a user-assigned identity.

  4.

  Create an access policy in Key Vault for the application identity you created earlier. Enable the "Get" secret permission on this policy.

  Reference: https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references