Practice Mode

AZ-305

Loading...

AZ-305 — 20 free practice questions

Preview the exam for free. Unlock all 241 questions →

Question 1

You have an Azure subscription that contains a custom application named Application1. Application1 was developed by an external company named Fabrikam, Ltd. Developers at Fabrikam were assigned role-based access control (RBAC) permissions to the Application1 components. All users are licensed for the Microsoft 365 E5 plan. You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1. The solution must meet the following requirements: ✑ To the manager of the developers, send a monthly email message that lists the access permissions to Application1. ✑ If the manager does not verify an access permission, automatically revoke that permission. ✑ Minimize development effort. What should you recommend?
  • A. In Azure Active Directory (Azure AD), create an access review of Application1. Correct
  • B. Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.
  • C. In Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources.
  • D. Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.

Explanation

Access reviews in Azure Active Directory enable administr administrators to verify user access permissions on a regular basis. By set setting up an access review for Application1, the manager can receive month monthly email notifications listing all access permissions and automaticall automatically revoke unverified permissions, meeting the requirements with minimal development effort.

Question 2

You have an Azure subscription. The subscription has a blob container that contains multiple blobs. Ten users in the finance department of your company plan to access the blobs during the month of April. You need to recommend a solution to enable access to the blobs during the month of April only. Which security solution should you include in the recommendation?
  • A. shared access signatures (SAS) Correct
  • B. Conditional Access policies
  • C. certificates
  • D. access keys

Explanation

Shared Access Signatures (SAS) provide a secure way to gr grant limited access to specific resources for a set period, making them id ideal for enabling the finance department users to access blobs only during during April. SAS tokens can be configured with an expiration date, ensurin ensuring that after April, these tokens will no longer grant access.

Question 3

You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain. You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication. Some users work remotely and do NOT have VPN access to the on-premises network. You need to provide the remote users with single sign-on (SSO) access to WebApp1. Which two features should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
  • A. Azure AD Application Proxy Correct
  • B. Azure AD Privileged Identity Management (PIM)
  • C. Conditional Access policies
  • D. Azure Arc
  • E. Azure AD enterprise applications Correct
  • F. Azure Application Gateway

Explanation

Azure AD Application Proxy (Option A) allows remote users users to access on-premises web apps without a VPN by proxying the requests requests through Azure. Azure AD enterprise applications (Option E) enable configuring single sign-on for WebApp1, allowing seamless authentication vi via Azure AD credentials.

Question 4

You have an Azure Active Directory (Azure AD) tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned membership. Group1 has 50 members, including 20 guest users. You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements: ✑ The evaluation must be repeated automatically every three months. ✑ Every member must be able to report whether they need to be in Group1. ✑ Users who report that they do not need to be in Group1 must be removed from Group1 automatically. ✑ Users who do not report whether they need to be in Group1 must be removed from Group1 automatically. What should you include in the recommendation?
  • A. Implement Azure AD Identity Protection.
  • B. Change the Membership type of Group1 to Dynamic User.
  • C. Create an access review. Correct
  • D. Implement Azure AD Privileged Identity Management (PIM).

Explanation

Access reviews in Azure AD allow administra administrators to review group memberships regularly and automatically. Mem Members can report whether they need access, which meets the requirement fo for automatic removal if not confirmed or reported by members every three m months.

Question 5

You plan to deploy Azure Databricks to support a machine learning application. Data engineers will mount an Azure Data Lake Storage account to the Databricks file system. Permissions to folders are granted directly to the data engineers. You need to recommend a design for the planned Databrick deployment. The solution must meet the following requirements: ✑ Ensure that the data engineers can only access folders to which they have permissions. ✑ Minimize development effort. ✑ Minimize costs. What should you include in the recommendation? To answer, select the appropriate options in the

Explanation

The Premium SKU of Azure Databricks supports cloud storag storage access and credential passthrough, which are essential for ensuring ensuring that data engineers can only access folders to which they have per permissions. Credential passthrough minimizes development effort by allowin allowing users to authenticate directly using their Azure AD credentials wi without needing additional configurations.

Question 6

You plan to deploy an Azure web app named App1 that will use Azure Active Directory (Azure AD) authentication. App1 will be accessed from the internet by the users at your company. All the users have computers that run Windows 10 and are joined to Azure AD. You need to recommend a solution to ensure that the users can connect to App1 without being prompted for authentication and can access App1 only from company-owned computers. What should you recommend for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Explanation

An Azure AD app registration is necessary for integrating integrating App1 with Azure AD, enabling Single Sign-On (SSO) and seamless authentication without prompting users to log in again. A Conditional Acces Access policy ensures that access to App1 is restricted to company-owned co computers by setting conditions based on device compliance or membership.

Question 7

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Traffic Analytics in Azure Network Watcher to analyze the network traffic. Does this meet the goal?
  • A. Yes
  • B. No Correct

Explanation

Azure Traffic Analytics provides statistical data and tra traffic visualization but does not give information on whether packets are allowed or denied to specific virtual machines. To identify if packets are being allowed or denied, one should use IP Flow Verify under Azure Network Watcher.

Question 8

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Advisor to analyze the network traffic. Does this meet the goal?
  • A. Yes
  • B. No Correct

Explanation

Azure Advisor provides recommendations for improving cost management, security, operations, and reliability in Azure b but does not analyze network traffic directly. To identify whether packets are being allowed or denied to the virtual machines, tools like Azure Netwo Network Watcher's IP Flow Verify feature should be used instead.

Question 9

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Network Watcher to run IP flow verify to analyze the network traffic. Does this meet the goal?
  • A. Yes Correct
  • B. No

Explanation

The solution meets the goal because Azure N Network Watcher's IP flow verify feature allows you to check if a packet is is allowed or denied to or from a virtual machine, which helps in analyzing analyzing network traffic issues.

Question 10

You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016 and Linux. You need to use Azure Monitor to design an alerting strategy for security-related events. Which Azure Monitor Logs tables should you query? To answer, drag the appropriate tables to the correct log types. Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Explanation

For Windows operating systems, security-related events ar are stored in the Event table within Azure Monitor Logs. For Linux systems, systems, similar information is logged and can be queried from the Syslog t table. This distinction ensures that alerts can be tailored to the specific specific log structures of each operating system.

Question 11

You are designing a large Azure environment that will contain many subscriptions. You plan to use Azure Policy as part of a governance solution. To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
  • A. Azure Active Directory (Azure AD) administrative units
  • B. Azure Active Directory (Azure AD) tenants
  • C. subscriptions Correct
  • D. compute resources
  • E. resource groups Correct
  • F. management groups Correct

Explanation

Azure Policy can be assigned at the scope levels of subsc subscriptions (C), resource groups (E), and management groups (F). These sc scopes allow for varying degrees of control over resources within your Azur Azure environment, from individual resource groups up to multiple subscript subscriptions managed under a single group.

Question 12

Your on-premises network contains a server named Server1 that runs an ASP.NET application named App1. You have a hybrid deployment of Azure Active Directory (Azure AD). You need to recommend a solution to ensure that users sign in by using their Azure AD account and Azure Multi-Factor Authentication (MFA) when they connect to App1 from the internet. Which three features should you recommend be deployed and configured in sequence? To answer, move the appropriate features from the list of features to the

Explanation

First, an Azure AD enterprise application must be created created to represent the on-premises App1 in Azure AD. Then, Azure AD Appli Application Proxy should be configured to enable secure remote access to th this application from the internet. Finally, a Conditional Access policy en ensures that users authenticate using their Azure AD account and MFA when a accessing App1.

Question 13

You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation?
  • A. Azure Activity Log Correct
  • B. Azure Advisor
  • C. Azure Analysis Services
  • D. Azure Monitor action groups

Explanation

The Azure Activity Log provides insights into subscriptio subscription-level events, including when new resources are deployed. By us using the Azure Activity Log, you can track all ARM resource deployments an and generate a monthly report based on these logs.

Question 14

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Install and configure the Azure Monitoring agent and the Dependency Agent on all the virtual machines. Use VM insights in Azure Monitor to analyze the network traffic. Does this meet the goal?
  • A. Yes
  • B. No Correct

Explanation

The solution proposed does not meet the goa goal because installing and configuring the Azure Monitoring agent and Depe Dependency Agent on virtual machines allows for performance monitoring but does not provide packet-level network traffic analysis. To achieve the stat stated goal, a tool like Azure Network Watcher's IP Flow Verify should be u used to detect whether packets are being allowed or denied at the VM level. level.

Question 15

You need to design an architecture to capture the creation of users and the assignment of roles. The captured data must be stored in Azure Cosmos DB. Which services should you include in the design? To answer, drag the appropriate services to the correct targets. Each service may be used once, more than once, or not at all. **Data Flow:** Azure Active Directory audit log ↓ [Drop Zone 1] ↓ [Drop Zone 2] ↓ Cosmos DB

Explanation

Azure Event Hubs captures the Azure Active Directory audi audit logs, which include user creation and role assignment events. Azure F Functions then processes these events from Event Hubs and stores them into Azure Cosmos DB, making this sequence correct for the given scenario.

Question 16

Your company, named Contoso, Ltd., implements several Azure logic apps that have HTTP triggers. The logic apps provide access to an on-premises web service. Contoso establishes a partnership with another company named Fabrikam, Inc. Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0 identity management to authenticate its users. Developers at Fabrikam plan to use a subset of the logic apps to build applications that will integrate with the on-premises web service of Contoso. You need to design a solution to provide the Fabrikam developers with access to the logic apps. The solution must meet the following requirements: ✑ Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso. ✑ The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps. ✑ The solution must NOT require changes to the logic apps. ✑ The solution must NOT use Azure AD guest accounts. What should you include in the solution?
  • A. Azure Front Door
  • B. Azure AD Application Proxy
  • C. Azure AD business-to-business (B2B)
  • D. Azure API Management Correct

Explanation

Azure API Management allows integrating OAu OAuth 2.0 for authentication without changing the logic apps and enables ra rate limiting based on keys, meeting all specified requirements including i integration with Fabrikam's third-party identity management system.

Question 17

You have an Azure subscription that contains 300 virtual machines that run Windows Server 2019. You need to centrally monitor all warning events in the System logs of the virtual machines. What should you include in the solution? To answer, select the appropriate options in the

Explanation

To centrally monitor all warning events in the System log logs of the virtual machines, you need to create a Log Analytics workspace where the log data can be stored and analyzed. Additionally, installing the the Azure Monitor agent on each VM ensures that the relevant event logs are are collected and sent to the Log Analytics workspace for monitoring.

Question 18

You have several Azure App Service web apps that use Azure Key Vault to store data encryption keys. Several departments have the following requests to support the web app: Which service should you recommend for each department's request? To answer, configure the appropriate options in the

Explanation

Azure AD Privileged Identity Management (PIM) is appropri appropriate for managing and monitoring access to sensitive resources, whic which aligns well with the needs of the first and third departments. For th the second department's request, Azure Managed Identity offers a secure way way to manage identities without needing to manage credentials directly, ma making it the correct choice.

Question 19

Your company has the divisions shown in the following table. You plan to deploy a custom application to each subscription. The application will contain the following: ✑ A resource group ✑ An Azure web app ✑ Custom role assignments ✑ An Azure Cosmos DB account You need to use Azure Blueprints to deploy the application to each subscription. What is the minimum number of objects required to deploy the application? To answer, select the appropriate options in the

Explanation

You need 2 Management Groups, one for each Azure AD tenan tenant. Since Blueprints are tenant-scoped, you require 2 Blueprint Definit Definitions, one per tenant. Finally, there should be 4 Blueprint Assignmen Assignments, one for each subscription to deploy the application.

Question 20

You need to design an Azure policy that will implement the following functionality: ✑ For new resources, assign tags and values that match the tags and values of the resource group to which the resources are deployed. ✑ For existing resources, identify whether the tags and values match the tags and values of the resource group that contains the resources. ✑ For any non-compliant resources, trigger auto-generated remediation tasks to create missing tags and values. The solution must use the principle of least privilege. What should you include in the design? To answer, select the appropriate options in the

Explanation

The 'Modify' effect in Azure Policy allows for the additi addition or update of tags on resources, which is necessary to align them w with the resource group's tags. A managed identity with the Contributor rol role ensures that the policy has sufficient permissions to modify and remed remediate non-compliant resources while adhering to the principle of least privilege.

Verifying access...