Free AZ-305 Dump

Question #21Topic 1

HOTSPOT –

You have an Azure subscription that contains the resources shown in the following table.

You create an Azure SQL database named DB1 that is hosted in the East US Azure region.

To DB1, you add a diagnostic setting named Settings1. Settings1 archive SQLInsights to storage1 and sends SQLInsights to Workspace1.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Hot Area:

Correct Answer: 

Box 1: Yes –

A single diagnostic setting can define no more than one of each of the destinations. If you want to send data to more than one of a particular destination type (for example, two different Log Analytics workspaces), then create multiple settings.

Each resource can have up to 5 diagnostic settings.

Note: This diagnostic telemetry can be streamed to one of the following Azure resources for analysis.

* Log Analytics workspace

* Azure Event Hubs

* Azure Storage

Box 2: Yes –

Box 3: Yes –

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure?tabs=azure-portal

Question #22Topic 1

You plan to deploy an Azure SQL database that will store Personally Identifiable Information (PII).

You need to ensure that only privileged users can view the PII.

What should you include in the solution?

• A. dynamic data masking
• B. role-based access control (RBAC)
• C. Data Discovery & Classification
• D. Transparent Data Encryption (TDE)

Correct Answer: A

Dynamic data masking limits sensitive data exposure by masking it to non-privileged users.

Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal impact on the application layer. It’s a policy-based security feature that hides the sensitive data in the result set of a query over designated database fields, while the data in the database is not changed.

Reference:

https://docs.microsoft.com/en-us/azure/azure-sql/database/dynamic-data-masking-overview

Community vote distribution

A (100%)

Question #23Topic 1

You plan to deploy an app that will use an Azure Storage account.

You need to deploy the storage account. The storage account must meet the following requirements:

✑ Store the data for multiple users.

✑ Encrypt each user’s data by using a separate key.

✑ Encrypt all the data in the storage account by using customer-managed keys.

What should you deploy?

• A. files in a premium file share storage account
• B. blobs in a general purpose v2 storage account
• C. blobs in an Azure Data Lake Storage Gen2 account
• D. files in a general purpose v2 storage account

Correct Answer: B

You can specify a customer-provided key on Blob storage operations. A client making a read or write request against Blob storage can include an encryption key on the request for granular control over how blob data is encrypted and decrypted.

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption

Community vote distribution

B (93%)

 

Question #24Topic 1

HOTSPOT –

You have an Azure App Service web app that uses a system-assigned managed identity.

You need to recommend a solution to store the settings of the web app as secrets in an Azure key vault. The solution must meet the following requirements:

✑ Minimize changes to the app code.

✑ Use the principle of least privilege.

What should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer: 

Box 1: Key Vault references in Application settings

Source Application Settings from Key Vault.

Key Vault references can be used as values for Application Settings, allowing you to keep secrets in Key Vault instead of the site config. Application Settings are securely encrypted at rest, but if you need secret management capabilities, they should go into Key Vault.

To use a Key Vault reference for an app setting, set the reference as the value of the setting. Your app can reference the secret through its key as normal. No code changes are required.

Box 2: Secrets: Get –

In order to read secrets from Key Vault, you need to have a vault created and give your app permission to access it.

1. Create a key vault by following the Key Vault quickstart.

2. Create a managed identity for your application.

3. Key Vault references will use the app’s system assigned identity by default, but you can specify a user-assigned identity.

4. Create an access policy in Key Vault for the application identity you created earlier. Enable the “Get” secret permission on this policy.

Reference:

https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references

Question #25Topic 1

You plan to deploy an application named App1 that will run on five Azure virtual machines. Additional virtual machines will be deployed later to run App1.

You need to recommend a solution to meet the following requirements for the virtual machines that will run App1:

✑ Ensure that the virtual machines can authenticate to Azure Active Directory (Azure AD) to gain access to an Azure key vault, Azure Logic Apps instances, and an Azure SQL database.

✑ Avoid assigning new roles and permissions for Azure services when you deploy additional virtual machines.

✑ Avoid storing secrets and certificates on the virtual machines.

✑ Minimize administrative effort for managing identities.

Which type of identity should you include in the recommendation?

• A. a system-assigned managed identity
• B. a service principal that is configured to use a certificate
• C. a service principal that is configured to use a client secret
• D. a user-assigned managed identity

Correct Answer: D

Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication.

A user-assigned managed identity:

Can be shared.

The same user-assigned managed identity can be associated with more than one Azure resource.

Common usage:

Workloads that run on multiple resources and can share a single identity.

For example, a workload where multiple virtual machines need to access the same resource.

Incorrect:

Not A: A system-assigned managed identity can’t be shared. It can only be associated with a single Azure resource.

Typical usage:

Workloads that are contained within a single Azure resource.

Workloads for which you need independent identities.

For example, an application that runs on a single virtual machine.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

Community vote distribution

D (100%)

Question #26Topic 1

You have the resources shown in the following table:

CDB1 hosts a container that stores continuously updated operational data.

You are designing a solution that will use AS1 to analyze the operational data daily.

You need to recommend a solution to analyze the data without affecting the performance of the operational data store.

What should you include in the recommendation?

• A. Azure Cosmos DB change feed
• B. Azure Data Factory with Azure Cosmos DB and Azure Synapse Analytics connectors
• C. Azure Synapse Link for Azure Cosmos DB
• D. Azure Synapse Analytics with PolyBase data loading

Correct Answer: C

Azure Synapse Link for Azure Cosmos DB creates a tight integration between Azure Cosmos DB and Azure Synapse Analytics. It enables customers to run near real-time analytics over their operational data with full performance isolation from their transactional workloads and without an ETL pipeline.

Reference:

https://docs.microsoft.com/en-us/azure/cosmos-db/synapse-link-frequently-asked-questions

Community vote distribution

C (100%)

Question #27Topic 1

HOTSPOT –

You deploy several Azure SQL Database instances.

You plan to configure the Diagnostics settings on the databases as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer: 

Box 1: 90 days –

As per exhibit.

Box 2: 730 days –

How long is the data kept?

Raw data points (that is, items that you can query in Analytics and inspect in Search) are kept for up to 730 days.

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/app/data-retention-privacy

Question #28Topic 1

You have an application that is used by 6,000 users to validate their vacation requests. The application manages its own credential store.

Users must enter a username and password to access the application. The application does NOT support identity providers.

You plan to upgrade the application to use single sign-on (SSO) authentication by using an Azure Active Directory (Azure AD) application registration.

Which SSO method should you use?

• A. header-based
• B. SAML
• C. password-based
• D. OpenID Connect

Correct Answer: C

Password – On-premises applications can use a password-based method for SSO. This choice works when applications are configured for Application Proxy.

With password-based SSO, users sign in to the application with a username and password the first time they access it. After the first sign-on, Azure AD provides the username and password to the application. Password-based SSO enables secure application password storage and replay using a web browser extension or mobile app. This option uses the existing sign-in process provided by the application, enables an administrator to manage the passwords, and doesn’t require the user to know the password.

Incorrect:

Choosing an SSO method depends on how the application is configured for authentication. Cloud applications can use federation-based options, such as OpenID

Connect, OAuth, and SAML.

Federation – When you set up SSO to work between multiple identity providers, it’s called federation.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on

Community vote distribution

C (100%)

Question #29Topic 1

HOTSPOT –

You have an Azure subscription that contains a virtual network named VNET1 and 10 virtual machines. The virtual machines are connected to VNET1.

You need to design a solution to manage the virtual machines from the internet. The solution must meet the following requirements:

✑ Incoming connections to the virtual machines must be authenticated by using Azure Multi-Factor Authentication (MFA) before network connectivity is allowed.

✑ Incoming connections must use TLS and connect to TCP port 443.

✑ The solution must support RDP and SSH.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer: 

Box 1: Just-in-time (JIT) VN access

Lock down inbound traffic to your Azure Virtual Machines with Microsoft Defender for Cloud’s just-in-time (JIT) virtual machine (VM) access feature. This reduces exposure to attacks while providing easy access when you need to connect to a VM.

Note: Threat actors actively hunt accessible machines with open management ports, like RDP or SSH. Your legitimate users also use these ports, so it’s not practical to keep them closed.

When you enable just-in-time VM access, you can select the ports on the VM to which inbound traffic will be blocked.

To solve this dilemma, Microsoft Defender for Cloud offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.

Box 2: A conditional Access policy that has Cloud Apps assignment set to Azure Windows VM Sign-In

You can enforce Conditional Access policies such as multi-factor authentication or user sign-in risk check before authorizing access to Windows VMs in Azure that are enabled with Azure AD sign in. To apply Conditional Access policy, you must select the “Azure Windows VM Sign-In” app from the cloud apps or actions assignment option and then use Sign-in risk as a condition and/or require multi-factor authentication as a grant access control.

Reference:

https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows

Question #30Topic 1

You are designing an Azure governance solution.

All Azure resources must be easily identifiable based on the following operational information: environment, owner, department and cost center.

You need to ensure that you can use the operational information when you generate reports for the Azure resources.

What should you include in the solution?

• A. an Azure data catalog that uses the Azure REST API as a data source
• B. an Azure management group that uses parent groups to create a hierarchy
• C. an Azure policy that enforces tagging rules
• D. Azure Active Directory (Azure AD) administrative units

Correct Answer: C

You apply tags to your Azure resources, resource groups, and subscriptions to logically organize them into a taxonomy. Each tag consists of a name and a value pair.

You use Azure Policy to enforce tagging rules and conventions. By creating a policy, you avoid the scenario of resources being deployed to your subscription that don’t have the expected tags for your organization. Instead of manually applying tags or searching for resources that aren’t compliant, you create a policy that automatically applies the needed tags during deployment.

Reference:

https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies

Community vote distribution

C (100%)

Question #31Topic 1

A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with Microsoft 365 and an Azure subscription.

Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory Domain Services (AD DS) and Azure AD Connect.

Contoso has a partnership with a company named Fabrikam. Inc. Fabrikam has an Active Directory forest and a Microsoft 365 tenant. Fabrikam has the same on- premises identity infrastructure components as Contoso.

A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription of Contoso. The developers must be added to the Contributor role for a resource group in the Contoso subscription.

You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The solution must ensure that the Fabrikam developers use their existing credentials to access resources

What should you recommend?

• A. In the Azure AD tenant of Contoso. create cloud-only user accounts for the Fabrikam developers.
• B. Configure a forest trust between the on-premises Active Directory forests of Contoso and Fabrikam.
• C. Configure an organization relationship between the Microsoft 365 tenants of Fabrikam and Contoso.
• D. In the Azure AD tenant of Contoso, create guest accounts for the Fabnkam developers.

Correct Answer: D

You can use the capabilities in Azure Active Directory B2B to collaborate with external guest users and you can use Azure RBAC to grant just the permissions that guest users need in your environment.

Incorrect:

Not B: Forest trust is used for internal security, not external access.

Reference:

https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-external-users

Community vote distribution

D (93%)

4%

Question #32Topic 1

Your company has the divisions shown in the following table.

Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.

You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.

What should you recommend?

• A. Configure the Azure AD provisioning service.
• B. Enable Azure AD pass-through authentication and update the sign-in endpoint.
• C. Use Azure AD entitlement management to govern external users.
• D. Configure Azure AD join.

Correct Answer: A

You can enable automatic user provisioning for your multi-tenant application in Azure Active Directory.

Automatic user provisioning is the process of automating the creation, maintenance, and removal of user identities in target systems like your software-as-a- service applications.

Azure AD provides several integration paths to enable automatic user provisioning for your application.

* The Azure AD Provisioning Service manages the provisioning and deprovisioning of users from Azure AD to your application (outbound provisioning) and from your application to Azure AD (inbound provisioning). The service connects to the System for Cross-Domain Identity Management (SCIM) user management API endpoints provided by your application.

* Microsoft Graph

* The Security Assertion Markup Language Just in Time (SAML JIT) user provisioning.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/isv-automatic-provisioning-multi-tenant-apps

Community vote distribution

C (100%)

Question #33Topic 1

HOTSPOT –

Your company has 20 web APIs that were developed in-house.

The company is developing 10 web apps that will use the web APIs. The web apps and the APIs are registered in the company s Azure Active Directory (Azure

AD) tenant. The web APIs are published by using Azure API Management.

You need to recommend a solution to block unauthorized requests originating from the web apps from reaching the web APIs. The solution must meet the following requirements:

✑ Use Azure AD-generated claims.

Minimize configuration and management effort.

What should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer: 

Box 1: Azure AD –

Grant permissions in Azure AD.

Box 2: Azure API Management –

Configure a JWT validation policy to pre-authorize requests.

Pre-authorize requests in API Management with the Validate JWT policy, by validating the access tokens of each incoming request. If a request does not have a valid token, API Management blocks it.

Reference:

https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad

Question #34Topic 1

You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.

What should you include in the recommendation?

• A. Azure Log Analytics
• B. Azure Arc
• C. Azure Analysis Services
• D. Application Insights

Correct Answer: A

The Activity log is a platform log in Azure that provides insight into subscription-level events. Activity log includes such information as when a resource is modified or when a virtual machine is started.

Activity log events are retained in Azure for 90 days and then deleted.

For more functionality, you should create a diagnostic setting to send the Activity log to one or more of these locations for the following reasons: to Azure Monitor Logs for more complex querying and alerting, and longer retention (up to two years) to Azure Event Hubs to forward outside of Azure to Azure Storage for cheaper, long-term archiving

Note: Azure Monitor builds on top of Log Analytics, the platform service that gathers log and metrics data from all your resources. The easiest way to think about it is that Azure Monitor is the marketing name, whereas Log Analytics is the technology that powers it.

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log

Community vote distribution

A (100%)

Question #35Topic 1

Your company has the divisions shown in the following table.

Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.

You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.

What should you recommend?

• A. Configure the Azure AD provisioning service.
• B. Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).
• C. Use Azure AD entitlement management to govern external users.
• D. Configure Azure AD Identity Protection.

Correct Answer: C

Entitlement management is an identity governance capability that enables organizations to manage identity and access lifecycle at scale by automating access request workflows, access assignments, reviews, and expiration. Entitlement management allows delegated non-admins to create access packages that external users from other organizations can request access to. One and multi-stage approval workflows can be configured to evaluate requests, and provision users for time-limited access with recurring reviews. Entitlement management enables policy-based provisioning and deprovisioning of external accounts.

Note: Access Packages –

An access package is the foundation of entitlement management. Access packages are groupings of policy-governed resources a user needs to collaborate on a project or do other tasks. For example, an access package might include: access to specific SharePoint sites. enterprise applications including your custom in-house and SaaS apps like Salesforce.

Microsoft Teams.

Microsoft 365 Groups.

Incorrect:

Not A: Automatic provisioning refers to creating user identities and roles in the cloud applications that users need access to. In addition to creating user identities, automatic provisioning includes the maintenance and removal of user identities as status or roles change.

Not B: Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management:

Provide just-in-time privileged access to Azure AD and Azure resources

Assign time-bound access to resources using start and end dates

Etc.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/6-secure-access-entitlement-managment https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/how-provisioning-works https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

Community vote distribution

C (100%)

Question #36Topic 1

You are developing an app that will read activity logs for an Azure subscription by using Azure Functions.

You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative effort.

What should you include in the recommendation?

• A. an enterprise application in Azure AD
• B. system-assigned managed identities
• C. shared access signatures (SAS)
• D. application registration in Azure AD

Correct Answer: B

Community vote distribution

B (100%)

Question #37Topic 1

Your company has the divisions shown in the following table.

Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.

You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.

What should you recommend?

• A. Configure Azure AD join.
• B. Use Azure AD entitlement management to govern external users.
• C. Enable Azure AD pass-through authentication and update the sign-in endpoint.
• D. Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).

Correct Answer: B

Community vote distribution

B (100%)

Question #38Topic 1

Your company has the divisions shown in the following table.

Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.

You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.

What should you recommend?

• A. Configure Azure AD join.
• B. Configure Azure AD Identity Protection.
• C. Use Azure AD entitlement management to govern external users.
• D. Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).

Correct Answer: C

Community vote distribution

C (100%)

Question #39Topic 1

You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.

What should you include in the recommendation?

• A. Azure Activity Log
• B. Azure Arc
• C. Azure Analysis Services
• D. Azure Monitor metrics

Correct Answer: A

Community vote distribution

A (100%)

Question #40Topic 1

HOTSPOT

–

You have an Azure subscription that contains an Azure key vault named KV1 and a virtual machine named VM1. VM1 runs Windows Server 2022: Azure Edition.

You plan to deploy an ASP.Net Core-based application named App1 to VM1.

You need to configure App1 to use a system-assigned managed identity to retrieve secrets from KV1. The solution must minimize development effort.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Correct Answer: