HOTSPOT (Drag and Drop is not supported)You have an Azure subscription.You plan to deploy five storage accounts that will store block blobs and five storage accounts that will host file shares. The file shares will be accessed by using the SMB protocol.You need to recommend an access authorization solution for the storage accounts. The solution must meet the following requirements:Maximize security.Prevent the use of shared keys.Whenever possible, support time-limited access.What should you include in the solution? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: A shared access signature (SAS) and a stored access policy BlobsSee note below.User delegation SASA user delegation SAS is secured with Microsoft Entra credentials and also by the permissions specified for the SAS. A user delegation SAS applies to Blob storage only.A shared access signature can take one of the following two forms:Ad hoc SAS. When you create an ad hoc SAS, the start time, expiry time, and permissions are specified in the SAS URI. Any type of SAS can be an ad hoc SAS.Service SAS with stored access policy. A stored access policy is defined on a resource container, which can be a blob container, table, queue, or file share. The stored access policy can be used to manage constraints for one or more service shared access signatures. When you associate a service SAS with a stored access policy, the SAS inherits the constraints–the start time, expiry time, and permissions–defined for the stored access policy.NoteA user delegation SAS or an account SAS must be an ad hoc SAS. Stored access policies are not supported for the user delegation SAS or the account SAS.Box 2: Microsoft Entra credentialsFile sharesUser delegation SASA user delegation SAS is secured with Microsoft Entra credentials and also by the permissions specified for the SAS. A user delegation SAS applies to Blob storage only.Note: A shared access signature (SAS) provides secure delegated access to resources in your storage account. With a SAS, you have granular control over how a client can access your data. For example:What resources the client may access.What permissions they have to those resources.How long the SAS is valid.Types of shared access signaturesAzure Storage supports three types of shared access signatures:User delegation SASService SASAccount SAS
https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription. The subscription contains 100 virtual machines that run Windows Server 2022 and have the Azure Monitor Agent installed.You need to recommend a solution that meets the following requirements:Forwards JSON-formatted logs from the virtual machines to a Log Analytics workspaceTransforms the logs and stores the data in a table in the Log Analytics workspaceWhat should you include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: An Azure Monitor data collection endpointForwards JSON-formatted logs from the virtual machines to a Log Analytics workspaceData collection endpoints (DCEs) provide a connection for certain data sources of Azure Monitor.Data sources that use DCEsThe following data sources currently use DCEs:Azure Monitor Agent when network isolation is requiredLogs ingestion APILogs Ingestion API in Azure MonitorThe Logs Ingestion API in Azure Monitor lets you send data to a Log Analytics workspace using either a REST API call or client libraries. By using this API, you can send data to supported Azure tables or to custom tables that you create. You can even extend the schema of Azure tables with custom columns to accept additional data.Basic operationYour application sends data to a data collection endpoint (DCE), which is a unique connection point for your subscription. The payload of your API call includes the source data formatted in JSON. The call:Specifies a data collection rule (DCR) that understands the format of the source data. Potentially filters and transforms the data for the target table. Directs the data to a specific table in a specific workspace. You can modify the target table and workspace by modifying the DCR without any change to the API call or source data.Incorrect:* A linked storage account for the Log Analytics workspaceBox 2: A KQL queryTransforms the logs and stores the data in a table in the Log Analytics workspaceTransformations in Azure Monitor allow you to filter or modify incoming data before it’s stored in a Log Analytics workspace. They are implemented as a Kusto Query Language (KQL) statement in a data collection rule (DCR).Transformation structureThe KQL statement is applied individually to each entry in the data source. It must understand the format of the incoming data and create output in the structure of the target table. The input stream is represented by a virtual table named source with columns matching the input data stream definition. Following is a typical example of a transformation. This example includes the following functionality:Filters the incoming data with a where statementAdds a new column using the extend operatorFormats the output to match the columns of the target table using the project operatorKusto| where severity == “Critical”| extend Properties = parse_json(properties)| projectTimeGenerated = todatetime([“time”]),Category = category,StatusDescription = StatusDescription,EventName = name,EventId = tostring(Properties.EventId)
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-endpoint-overview https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-transformations-structure
HOTSPOT (Drag and Drop is not supported)You have five Azure subscriptions. Each subscription is linked to a separate Microsoft Entra tenant and contains virtual machines that run Windows Server 2022.You plan to collect Windows security events from the virtual machines and send them to a single Log Analytics workspace.You need to recommend a solution that meets the following requirements:Collects event logs from multiple subscriptionsSupports the use of data collection rules (DCRs) to define which events to collectWhat should you recommend for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Azure Event GridTo collect the event logs:Incorrect:* Azure LighthouseAzure Lighthouse helps service providers efficiently build and deliver managed services.Box 2: The Azure Monitor AgentTo support the DCRs:You collect events and performance counters from virtual machines with Azure Monitor Agent.You can define a data collection rule to send data from multiple machines to multiple Log Analytics workspaces, including workspaces in a different region or tenant. Create the data collection rule in the same region as your Log Analytics workspace.How can I collect Windows security events by using Azure Monitor Agent? There are two ways you can collect Security events using the new agent, when sending to a Log Analytics workspace:You can use Azure Monitor Agent to natively collect Security Events, same as other Windows Events. These flow to the ‘Event’ table in your Log Analytics workspace.If you have Microsoft Sentinel enabled on the workspace, the security events flow via Azure Monitor Agent into the SecurityEvent table instead (the same as using the Log Analytics agent). This scenario always requires the solution to be enabled first.
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent https://learn.microsoft.com/en-us/azure/event-grid/enable-diagnostic-logs-topic
HOTSPOT (Drag and Drop is not supported)You have the Azure management groups shown in the following table.You have the Azure subscriptions shown in the following table.You have the virtual machines shown in the following table.You have the resource groups shown in the following table.You have the Azure policies shown in the following table.You perform the following actions:Assign PA1 to MG1.Modify PA2 and configure the resource selector to include only Microsoft.Compute/virtualMachines in theEast US Azure region.Modify PA3 and add an exclusion for Sub1.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: NoNo – PA1 will only evaluate the resources in Sub2.PA1 is assigned to the MG1 management group.Sub2 and Sub4 is in MG1.PA1 will evaluated resources in Sub4 as well (though no further information is available on resources in Sub4).Box 2: YesYes – PA2 will evaluate all the virtual machines deployed to the East US region.Modify PA2 and configure the resource selector to include only Microsoft.Compute/virtualMachines in the East US Azure region.Box 3: NoNo – PA3 will evaluate VM3.Modify PA3 and add an exclusion for Sub1.Sub1 includes VM3.
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription. The subscription contains 100 virtual machine that run Windows Server.You need to recommend a solution that will provide monitoring and an audit trail of the following modifications:Changes to the Windows registry on the virtual machinesChanges to the DNS settings of the virtual machinesThe solution must minimize administrative effortWhat should you recommend using for each change? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Azure Automation Change TrackingChanges to the Windows registry on the virtual machinesChange Tracking and Inventory in Azure AutomationThis feature tracks changes in virtual machines hosted in Azure, on-premises, and other cloud environments to help you pinpoint operational and environmental issues with software managed by the Distribution Package Manager. Items that are tracked by Change Tracking and Inventory include:Windows softwareLinux software (packages)Windows and Linux files*-> Windows registry keysWindows servicesLinux daemonsBox 2: Azure Monitor for VM InsightsChanges to the DNS settings of the virtual machinesVM insights provides a quick and easy method for getting started monitoring the client workloads on your virtual machines and virtual machine scale sets. It displays an inventory of your existing VMs and provides a guided experience to enable base monitoring for them.Note: VM Insights can monitor the health and performance of:Azure virtual machines.Azure Virtual Machine Scale Sets.Hybrid virtual machines connected with Azure Arc.On-premises virtual machines.Virtual machines hosted in another cloud environment.Incorrect:* Azure Monitor Change AnalysisChange Analysis in Azure MonitorWhile standard monitoring solutions might alert you to a live site issue, outage, or component failure, they often don’t explain the cause. Let’s say your site worked five minutes ago, and now it’s broken. What changed in the last five minutes?Change Analysis is designed to answer that question in Azure Monitor.Building on the power of Azure Resource Graph, Change Analysis:Provides insights into your Azure application changes.Increases observability.Reduces mean time to repair (MTTR).
https://learn.microsoft.com/en-us/azure/automation/change-tracking/overview https://learn.microsoft.com/en-us/azure/azure-monitor/vm/vminsights-overview https://learn.microsoft.com/en-us/azure/azure-monitor/change/change-analysis
Post your Comments and Discuss Microsoft AZ-305 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-305 content, but please register or login to continue.