Cisco®
Oracle
CompTIA
Checkpoint
ISC
EC-Council
EXIN
Fortinet
ITIL®
Juniper
Microsoft
VMware
Avaya
SAP
Google
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk®
All Vendors
  2. Home
  3. Exams
  4. Microsoft
  5. AZ-305

Free Microsoft AZ-305 Exam Questions (page: 6)

Page 6 of 42
PDF with 317 Questions

You plan to deploy an application named App1 that will run on five Azure virtual machines. Additional virtual machines will be deployed later to run App1.

You need to recommend a solution to meet the following requirements for the virtual machines that will run App1:

Ensure that the virtual machines can authenticate to Microsoft Entra ID to gain access to an Azure key vault,

Azure Logic Apps instances, and an Azure SQL database.
Avoid assigning new roles and permissions for Azure services when you deploy additional virtual machines.

Avoid storing secrets and certificates on the virtual machines.

Minimize administrative effort for managing identities.

Which type of identity should you include in the recommendation?

  1. a system-assigned managed identity
  2. a service principal that is configured to use a certificate
  3. a service principal that is configured to use a client secret
  4. a user-assigned managed identity

Answer(s): D

Explanation:

Managed identities provide an identity for applications to use when connecting to resources that support Microsoft Entra authentication.
A user-assigned managed identity:
Can be shared.
The same user-assigned managed identity can be associated with more than one Azure resource.
Common usage:
Workloads that run on multiple resources and can share a single identity.
For example, a workload where multiple virtual machines need to access the same resource.
Incorrect:
Not A: A system-assigned managed identity can’t be shared. It can only be associated with a single Azure resource.
Typical usage:
Workloads that are contained within a single Azure resource.
Workloads for which you need independent identities.
For example, an application that runs on a single virtual machine.


Reference:



You have the resources shown in the following table:



CDB1 hosts a container that stores continuously updated operational data.

You are designing a solution that will use AS1 to analyze the operational data daily.

You need to recommend a solution to analyze the data without affecting the performance of the operational data store.

What should you include in the recommendation?

  1. Azure Cosmos DB change feed
  2. Azure Data Factory with Azure Cosmos DB and Azure Synapse Analytics connectors
  3. Azure Synapse Link for Azure Cosmos DB
  4. Azure Synapse Analytics with PolyBase data loading

Answer(s): C

Explanation:

Azure Synapse Link for Azure Cosmos DB creates a tight integration between Azure Cosmos DB and Azure Synapse Analytics. It enables customers to run near real-time analytics over their operational data with full performance isolation from their transactional workloads and without an ETL pipeline.


Reference:



HOTSPOT (Drag and Drop is not supported)

You deploy several Azure SQL Database instances.

You plan to configure the Diagnostics settings on the databases as shown in the following exhibit.



Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: 90 days
As per exhibit.

Box 2: 730 days
How long is the data kept?
Raw data points (that is, items that you can query in Analytics and inspect in Search) are kept for up to 730 days.


Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/app/data-retention-privacy



You have an application that is used by 6,000 users to validate their vacation requests. The application manages its own credential store.

Users must enter a username and password to access the application. The application does not support identity federation.

You need to implement single sign-on (SSO) authentication by using a Microsoft Entra application registration.

Which SSO method should you use?

  1. header-based
  2. SAML
  3. password-based
  4. OpenID Connect

Answer(s): C

Explanation:

Password – On-premises applications can use a password-based method for SSO. This choice works when applications are configured for Application Proxy.
With password-based SSO, users sign in to the application with a username and password the first time they access it. After the first sign-on, Microsoft Entra ID provides the username and password to the application.
Password-based SSO enables secure application password storage and replay using a web browser extension or mobile app. This option uses the existing sign-in process provided by the application, enables an administrator to manage the passwords, and doesn’t require the user to know the password.
Incorrect:
Choosing an SSO method depends on how the application is configured for authentication. Cloud applications can use federation-based options, such as OpenID Connect, Oauth, and SAML.
Federation – When you set up SSO to work between multiple identity providers, it’s called federation.


Reference:



HOTSPOT (Drag and Drop is not supported)

You have an Azure subscription that contains a virtual network named VNET1 and 10 virtual machines. The virtual machines are connected to VNET1.

You need to design a solution to manage the virtual machines from the internet. The solution must meet the following requirements:

Incoming connections to the virtual machines must be authenticated by using Azure Multi-Factor

Authentication (MFA) before network connectivity is allowed. Incoming connections must use TLS and connect to TCP port 443.

The solution must support RDP and SSH.

What should you include in the solution? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:


  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: Just-in-time (JIT) VN access
Lock down inbound traffic to your Azure Virtual Machines with Microsoft Defender for Cloud’s just-in-time (JIT) virtual machine (VM) access feature. This reduces exposure to attacks while providing easy access when you need to connect to a VM.

Note: Threat actors actively hunt accessible machines with open management ports, like RDP or SSH. Your legitimate users also use these ports, so it’s not practical to keep them closed.
When you enable just-in-time VM access, you can select the ports on the VM to which inbound traffic will be blocked.
To solve this dilemma, Microsoft Defender for Cloud offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.

Box 2: A conditional Access policy that has Cloud Apps assignment set to Azure Windows VM Sign-In You can enforce Conditional Access policies such as multi-factor authentication or user sign-in risk check before authorizing access to Windows VMs in Azure that are enabled with Microsoft Entra sign in. To apply Conditional Access policy, you must select the “Azure Windows VM Sign-In” app from the cloud apps or actions assignment option and then use Sign-in risk as a condition and/or require multi-factor authentication as a grant access control.


Reference:

https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows



You are designing an Azure governance solution.

All Azure resources must be easily identifiable based on the following operational information: environment, owner, department and cost center.

You need to ensure that you can use the operational information when you generate reports for the Azure resources.

What should you include in the solution?

  1. an Azure data catalog that uses the Azure REST API as a data source
  2. an Azure management group that uses parent groups to create a hierarchy
  3. an Azure policy that enforces tagging rules
  4. Microsoft Entra administrative units

Answer(s): C

Explanation:

You apply tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and a value pair.
You use Azure Policy to enforce tagging rules and conventions. By creating a policy, you avoid the scenario of resources being deployed to your subscription that don’t have the expected tags for your organization. Instead of manually applying tags or searching for resources that aren’t compliant, you create a policy that automatically applies the needed tags during deployment.


Reference:



A company named Contoso, Ltd. Has a Microsoft Entra tenant that is integrated with Microsoft 365 and an Azure subscription.

Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory Domain Services (AD DS) and Microsoft Entra Connect.

Contoso has a partnership with a company named Fabrikam, Inc. Fabrikam has an Active Directory forest and a Microsoft 365 tenant. Fabrikam has the same on-premises identity infrastructure components as Contoso.

A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription of Contoso. The developers must be added to the Contributor role for a resource group in the Contoso subscription.

You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The solution must ensure that the Fabrikam developers use their existing credentials to access resources.

What should you recommend?

  1. In the Microsoft Entra tenant of Contoso, create cloud-only user accounts for the Fabrikam developers.
  2. Configure a forest trust between the on-premises Active Directory forests of Contoso and Fabrikam.
  3. Configure an organization relationship between the Microsoft 365 tenants of Fabrikam and Contoso.
  4. In the Microsoft Entra tenant of Contoso, create guest accounts for the Fabrikam developers.

Answer(s): D

Explanation:

You can use the capabilities in Microsoft Entra B2B to collaborate with external guest users and you can use Azure RBAC to grant just the permissions that guest users need in your environment.

Incorrect:
Not B: Forest trust is used for internal security, not external access.


Reference:



Your company has the divisions shown in the following table.



Sub1 contains an Azure App Service web app named App1. App1 uses Microsoft Entra ID for single-tenant user authentication. Users from contoso.com can authenticate to App1.

You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.

What should you recommend?

  1. Configure the Microsoft Entra provisioning service.
  2. Enable Microsoft Entra pass-through authentication and update the sign-in endpoint.
  3. Use Microsoft Entra entitlement management to govern external users.
  4. Configure Microsoft Entra join.

Answer(s): C

Explanation:

Correct:
* Use Microsoft Entra entitlement management to govern external users.
* Configure Supported account types in the application registration and update the sign-in endpoint.
Incorrect:
* Configure a Conditional Access policy.
* Configure assignments for the fabrikam.com users by using Microsoft Entra Privileged Identity Management (PIM).
* Configure Microsoft Entra ID Protection.
* Configure Microsoft Entra join.
* Configure the Microsoft Entra provisioning service
* Enable Microsoft Entra pass-through authentication and update the sign-in endpoint.
Note:
* Use Microsoft Entra entitlement management to govern external users.
Govern access for external users in Microsoft Entra entitlement management Microsoft Entra entitlement management uses Microsoft Entra business-to-business (B2B) to share access so you can collaborate with people outside your organization. With Microsoft Entra B2B, external users authenticate to their home directory, but have a representation in your directory. The representation in your directory enables the user to be assigned access to your resources.
* Configure Supported account types in the application registration and update the sign-in endpoint.
Identity and account types for single- and multi-tenant apps You, as a developer, can choose if your app allows only users from your Microsoft Entra tenant, any Microsoft Entra tenant, or users with personal Microsoft accounts. You can configure your app to be either single tenant or multitenant during app registration in Azure.

Note: A required part of application registration in Microsoft Entra ID is your selection of supported account types.
While IT Pros in administrator roles decide who can consent to apps in their tenant, you, as a developer, specify who can use your app based on account type.
When a tenant doesn’t allow you to register your application in Microsoft Entra ID, administrators will provide you with a way to communicate those details to them through another mechanism.
You’ll choose from the following supported account type options when registering your application.
Accounts in this organizational directory only (O365 only – Single tenant) Accounts in any organizational directory (Any Microsoft Entra directory – Multitenant) Accounts in any organizational directory (Any Microsoft Entra directory – Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)
Personal Microsoft accounts only
Incorrect:
* Configure Microsoft Entra ID Protection
Microsoft Entra ID Protection allows organizations to accomplish three key tasks: Automate the detection and remediation of identity-based risks. Investigate risks using data in the portal. Export risk detection data to other tools.


Reference:



Viewing page 6 of 42



Post your Comments and Discuss Microsoft AZ-305 exam prep with other Community members:

AZ-305 Exam Discussions & Posts