Your company has IT, security, and finance departments.You need to implement a new Azure deployment that will include multiple Azure subscriptions and management groups. The solution must meet the following requirements:Ensure that all policies are assigned at the management group level.Ensure that all the finance department resources have specific encryption policies applied.Ensure that only users in the IT department can create virtual machines in any Azure region.Ensure that users in the finance department can create virtual machines in only the East US Azure region.What is the minimum number of management groups you can create for the planned deployment?
Answer(s): B
One for the finance department, and one for the IT department.Note: If your organization has many Azure subscriptions, you might need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. When you organize subscriptions into management groups, the governance conditions that you apply cascade by inheritance to all associated subscriptions.Management groups give you enterprise-grade management at scale, no matter what type of subscriptions you might have. However, all subscriptions within a single management group must trust the same Microsoft Entra tenant.For example, you can apply a policy to a management group that limits the regions available for virtual machine (VM) creation. This policy would be applied to all nested management groups, subscriptions, and resources to allow VM creation only in authorized regions.
https://learn.microsoft.com/en-us/azure/governance/management-groups/overview
You have an Azure subscription.You need to implement a policy to ensure that all new resource groups include a value for a tag named Department. The solution must ensure that if a value is NOT entered for the Department tag, a resource group is created.Which effect should you use?
Answer(s): D
Azure Policy definitions deployIfNotExists effectDeployIfNotExists evaluation deployIfNotExists runs after a configurable delay when a Resource Provider handles a create or update subscription or resource request and returned a success status code. A template deployment occurs if there are no related resources or if the resources defined by existenceCondition don’t evaluate to true. The duration of the deployment depends on the complexity of resources included in the template.During an evaluation cycle, policy definitions with a DeployIfNotExists effect that match resources are marked as non-compliant, but no action is taken on that resource.
https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-deploy-if-not-exists
HOTSPOT (Drag and Drop is not supported)You have an on-premises network.You have an Azure subscription.You plan to centralize the collection and analytics of Azure and on-premises resources by using Log Analytics.You are evaluating the cost implications of using the Basic log data plan versus the Analytics log data plan.What will increase costs by using the Basic log data plan, and what will reduce costs by using the Basic log data plan? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Log queriesIncrease costThe diagram and table below compare the Analytics, and Basic table plans.Box 2: IngestionReduce cost
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-platform-logs
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. The solution must minimize the development effort.What should you include in the recommendation?
The Azure Activity Log provides detailed information about the creation, modification, and deletion of resources in your Azure subscription. This log captures all Azure Resource Manager (ARM) resource deployments, making it the ideal solution for generating a monthly report of new deployments.Azure Activity Log captures resource changes, such as deployments, updates, and deletions, which aligns perfectly with the need to monitor new resource deployments.You can set up custom queries and export the logs to a storage account or integrate with a monitoring tool like Azure Monitor Logs for easier reporting.
You have a Microsoft Entra tenant named contoso.com.You have a partner organization that has a Microsoft Entra tenant named fabrikam.com.You plan to provide the users in fabrikam.com with access to the resources in contoso.com by using access packages.You need to ensure that contoso.com users assigned the Access package assignment manager role can only assign access packages to the fabrikam.com users.What should you do first in the Microsoft Entra admin center?
To enable users from a partner organization (in this case, fabrikam.com) to access resources in your organization (contoso.com) using access packages, you need to first set up a connected organization in Microsoft Entra ID.A connected organization represents an external entity, such as a partner organization, whose users will be granted access to your resources through entitlement management and access packages.By creating a connected organization in the Entitlement management settings under Identity Governance, you can specify users from fabrikam.com and allow the Access package assignment manager role to only assign access packages to the users from this connected organization.This setup enables you to manage the relationship with external users, controlling who can request and be assigned access.
Post your Comments and Discuss Microsoft AZ-305 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-305 content, but please register or login to continue.