AZ-305 practice questions 1–10

1. Question 1 · 232 in bank

   You have an Azure subscription that contains a custom application named Application1. Application1 was developed by an external company named Fabrikam, Ltd. Developers at Fabrikam were assigned role-based access control (RBAC) permissions to the Application1 components. All users are licensed for the Microsoft 365 E5 plan. You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1. The solution must meet the following requirements: ✑ To the manager of the developers, send a monthly email message that lists the access permissions to Application1. ✑ If the manager does not verify an access permission, automatically revoke that permission. ✑ Minimize development effort. What should you recommend?

   • AIn Azure Active Directory (Azure AD), create an access review of Application1.
   • BCreate an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.
   • CIn Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources.
   • DCreate an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.

   Show answer

   Answer: A

   Explanation

   Here's why: An access review is a feature in Azure AD that enables an administrator to review the membership of a group or application role to ensure that only the right people have continued access. This aligns with the requirement to verify access permissions to Application1. Access reviews can be scheduled to run on a regular basis and can be configured to send email notifications to reviewers. This satisfies the requirement to send a monthly email message to the manager of the developers listing the access permissions to Application1. Access reviews also provide the option to automatically revoke access if the reviewer does not verify an access permission, which fulfills the requirement to automatically revoke permissions if the manager does not verify them. Implementing an access review in Azure AD requires minimal development effort and can be set up through the Azure portal with a few simple clicks.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 2 · 232 in bank

   DRAG DROP - You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016 and Linux. You need to use Azure Monitor to design an alerting strategy for security-related events. Which Azure Monitor Logs tables should you query? To answer, drag the appropriate tables to the correct log types. Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 3 · 232 in bank

   Select 3

   You are designing a large Azure environment that will contain many subscriptions. You plan to use Azure Policy as part of a governance solution. To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AAzure Active Directory (Azure AD) administrative units
   • BAzure Active Directory (Azure AD) tenants
   • Csubscriptions
   • Dcompute resources
   • Eresource groups
   • Fmanagement groups

   Show answer

   Answer: CEF

   Explanation

   the correct answer is C, E, F. If you go into the portal and look at the scope section when assigning a policy it gives you the options of management group, subscription and resource group

   Source: Adapted from community discussion — kenobiD

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 4 · 232 in bank

   DRAG DROP - Your on-premises network contains a server named Server1 that runs an ASP.NET application named App1. You have a hybrid deployment of Azure Active Directory (Azure AD). You need to recommend a solution to ensure that users sign in by using their Azure AD account and Azure Multi-Factor Authentication (MFA) when they connect to App1 from the internet. Which three features should you recommend be deployed and configured in sequence? To answer, move the appropriate features from the list of features to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Azure AD Application Proxy Start by enabling communication to Azure data centers to prepare your environment for Azure AD Application Proxy. Step 2: an Azure AD enterprise application Add an on-premises app to Azure AD. Now that you've prepared your environment and installed a connector, you're ready to add on-premises applications to Azure AD. 1. Sign in as an administrator in the Azure portal. 2. In the left navigation panel, select Azure Active Directory. 3. Select Enterprise applications, and then select New application. 4. Etc. Reference: https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-application

   Source: Adapted from community discussion — FrancisFerreira

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 5 · 232 in bank

   You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation?

   • AAzure Activity Log
   • BAzure Advisor
   • CAzure Analysis Services
   • DAzure Monitor action groups

   Show answer

   Answer: A

   Explanation

   A. Azure Activity Log The Azure Activity Log provides insights into subscription-level events that have occurred in Azure. It can be used to monitor the operations performed on resources in the subscription, including when resources are created or modified. You can create a Log Analytics workspace and configure a log query to retrieve the details of new resource deployments for a given time range. This query can then be scheduled to run monthly and generate a report of new ARM resource deployments.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn

   Next question

6. Question 6 · 232 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Install and configure the Azure Monitoring agent and the Dependency Agent on all the virtual machines. Use VM insights in Azure Monitor to analyze the network traffic. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   B. No Installing and configuring the Azure Monitoring agent and the Dependency Agent on virtual machines and using VM insights in Azure Monitor can help in analyzing the performance of the virtual machines, but it does not provide information about packet-level network traffic. To analyze the network traffic, you should use a network capture tool, such as Network Monitor or Wireshark, to capture the network traffic to and from the virtual machines. You can then use the captured data to analyze the network traffic and identify any issues with packet filtering or connectivity.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 7 · 232 in bank

   DRAG DROP - You need to design an architecture to capture the creation of users and the assignment of roles. The captured data must be stored in Azure Cosmos DB. Which services should you include in the design? To answer, drag the appropriate services to the correct targets. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Azure Event Hubs - You can route Azure Active Directory (Azure AD) activity logs to several endpoints for long term retention and data insights. The Event Hub is used for streaming. Box 2: Azure Function - Use an Azure Function along with a cosmos DB change feed, and store the data in Cosmos DB. Reference: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-activity-logs-azure-monitor

   Source: Adapted from community discussion — santi1975

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 8 · 232 in bank

   Your company, named Contoso, Ltd., implements several Azure logic apps that have HTTP triggers. The logic apps provide access to an on-premises web service. Contoso establishes a partnership with another company named Fabrikam, Inc. Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0 identity management to authenticate its users. Developers at Fabrikam plan to use a subset of the logic apps to build applications that will integrate with the on-premises web service of Contoso. You need to design a solution to provide the Fabrikam developers with access to the logic apps. The solution must meet the following requirements: ✑ Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso. ✑ The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps. ✑ The solution must NOT require changes to the logic apps. ✑ The solution must NOT use Azure AD guest accounts. What should you include in the solution?

   • AAzure Front Door
   • BAzure AD Application Proxy
   • CAzure AD business-to-business (B2B)
   • DAzure API Management

   Show answer

   Answer: D

   Explanation

   "Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso." - This requirement can be achieved using the 'Limit call rate by key' feature of the API management. https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#LimitCallRateByKey https://learn.microsoft.com/en-us/azure/api-management/api-management-sample-flexible-throttling#user-identity-throttling

   Source: Adapted from community discussion — Tightbot

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 9 · 232 in bank

   HOTSPOT - You have an Azure subscription that contains 300 virtual machines that run Windows Server 2019. You need to centrally monitor all warning events in the System logs of the virtual machines. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: A Log Analytics workspace Send resource logs to a Log Analytics workspace to enable the features of Azure Monitor Logs. You must create a diagnostic setting for each Azure resource to send its resource logs to a Log Analytics workspace to use with Azure Monitor Logs. Box 2: Install the Azure Monitor agent Use the Azure Monitor agent if you need to: Collect guest logs and metrics from any machine in Azure, in other clouds, or on-premises. Manage data collection configuration centrally Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#azure-monitor-agent

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 10 · 232 in bank

    HOTSPOT - You have several Azure App Service web apps that use Azure Key Vault to store data encryption keys. Several departments have the following requests to support the web app:

    

    Which service should you recommend for each department's request? To answer, configure the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: Azure AD Privileged Identity Management Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management: Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged roles Enforce multi-factor authentication to activate any role Use justification to understand why users activate Get notifications when privileged roles are activated Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator role assignment Box 2: Azure Managed Identity - Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication. Applications may use the managed identity to obtain Azure AD tokens. With Azure Key Vault, developers can use managed identities to access resources. Key Vault stores credentials in a secure manner and gives access to storage accounts. Box 3: Azure AD Privileged Identity Management Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management: Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Reference: https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

    Source: Adapted from community discussion — One111

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-305 practice, question 1. 232 questions available.