AZ-305 practice questions 11–20

1. Question 11 · 232 in bank

   HOTSPOT - Your company has the divisions shown in the following table.

   

   You plan to deploy a custom application to each subscription. The application will contain the following: ✑ A resource group ✑ An Azure web app ✑ Custom role assignments ✑ An Azure Cosmos DB account You need to use Azure Blueprints to deploy the application to each subscription. What is the minimum number of objects required to deploy the application? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: 2 - One management group for each Azure AD tenant Azure management groups provide a level of scope above subscriptions. All subscriptions within a management group automatically inherit the conditions applied to the management group. All subscriptions within a single management group must trust the same Azure Active Directory tenant. Box 2: 1 - One single blueprint definition can be assigned to different existing management groups or subscriptions. When creating a blueprint definition, you'll define where the blueprint is saved. Blueprints can be saved to a management group or subscription that you have Contributor access to. If the location is a management group, the blueprint is available to assign to any child subscription of that management group. Box 3: 2 - Blueprint assignment - Each Published Version of a blueprint can be assigned (with a max name length of 90 characters) to an existing management group or subscription. Assigning a blueprint definition to a management group means the assignment object exists at the management group. The deployment of artifacts still targets a subscription. Reference: https://docs.microsoft.com/en-us/azure/governance/management-groups/overview https://docs.microsoft.com/en-us/azure/governance/blueprints/overview

   Source: Adapted from community discussion — Snownoodles

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 12 · 232 in bank

   You have an Azure subscription. The subscription has a blob container that contains multiple blobs. Ten users in the finance department of your company plan to access the blobs during the month of April. You need to recommend a solution to enable access to the blobs during the month of April only. Which security solution should you include in the recommendation?

   • Ashared access signatures (SAS)
   • BConditional Access policies
   • Ccertificates
   • Daccess keys

   Show answer

   Answer: A

   Explanation

   Here's why: To enable access to blobs in a container during the month of April only, use shared access signatures (SAS). SAS tokens can be generated with an expiration time and can be scoped to provide granular access control. SAS tokens can easily be generated and distributed to the ten finance department users who need access to the blobs during the month of April. SAS tokens will no longer be valid once they expire, fulfilling the requirement to restrict access to the blobs during the month of April only. Conditional Access policies and certificates/access keys are not suitable for this task.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 13 · 232 in bank

   HOTSPOT - You need to design an Azure policy that will implement the following functionality: ✑ For new resources, assign tags and values that match the tags and values of the resource group to which the resources are deployed. ✑ For existing resources, identify whether the tags and values match the tags and values of the resource group that contains the resources. ✑ For any non-compliant resources, trigger auto-generated remediation tasks to create missing tags and values. The solution must use the principle of least privilege. What should you include in the design? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Modify - Modify is used to add, update, or remove properties or tags on a subscription or resource during creation or update. A common example is updating tags on resources such as costCenter. Existing non-compliant resources can be remediated with a remediation task. A single Modify rule can have any number of operations. Policy assignments with effect set as Modify require a managed identity to do remediation. Incorrect: * The following effects are deprecated: EnforceOPAConstraint EnforceRegoPolicy * Append is used to add additional fields to the requested resource during creation or update. A common example is specifying allowed IPs for a storage resource. Append is intended for use with non-tag properties. While Append can add tags to a resource during a create or update request, it's recommended to use the Modify effect for tags instead. Box 2: A managed identity with the Contributor role The managed identity needs to be granted the appropriate roles required for remediating resources to grant the managed identity. Contributor - Can create and manage all types of Azure resources but can't grant access to others. Incorrect: User Access Administrator: lets you manage user access to Azure resources. Reference: https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects https://docs.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 14 · 232 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You create an Azure SQL database named DB1 that is hosted in the East US Azure region. To DB1, you add a diagnostic setting named Settings1. Settings1 archive SQLInsights to storage1 and sends SQLInsights to Workspace1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes - A single diagnostic setting can define no more than one of each of the destinations. If you want to send data to more than one of a particular destination type (for example, two different Log Analytics workspaces), then create multiple settings. Each resource can have up to 5 diagnostic settings. Note: This diagnostic telemetry can be streamed to one of the following Azure resources for analysis. * Log Analytics workspace * Azure Event Hubs * Azure Storage Box 2: Yes - Box 3: Yes - Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure?tabs=azure-portal

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   

   Next question

5. Question 15 · 232 in bank

   You plan to deploy an Azure SQL database that will store Personally Identifiable Information (PII). You need to ensure that only privileged users can view the PII. What should you include in the solution?

   • Adynamic data masking
   • Brole-based access control (RBAC)
   • CData Discovery & Classification
   • DTransparent Data Encryption (TDE)

   Show answer

   Answer: A

   Explanation

   A. dynamic data masking Dynamic Data Masking (DDM) is a feature in Azure SQL Database that helps you protect sensitive data by obfuscating it from non-privileged users. DDM allows you to define masking rules on specific columns, so that the data in those columns is automatically replaced with a masked value when queried by users without the appropriate permissions. This ensures that only privileged users can view the actual Personally Identifiable Information (PII), while other users will see the masked data.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 16 · 232 in bank

   You plan to deploy an app that will use an Azure Storage account. You need to deploy the storage account. The storage account must meet the following requirements: ✑ Store the data for multiple users. ✑ Encrypt each user's data by using a separate key. ✑ Encrypt all the data in the storage account by using customer-managed keys. What should you deploy?

   • Afiles in a premium file share storage account
   • Bblobs in a general purpose v2 storage account
   • Cblobs in an Azure Data Lake Storage Gen2 account
   • Dfiles in a general purpose v2 storage account

   Show answer

   Answer: B

   Explanation

   B. blobs in a general purpose v2 storage account A General Purpose v2 (GPv2) storage account can store blobs, files, queues, and tables, making it a versatile option for a wide range of applications. It supports customer-managed keys for encryption, allowing you to maintain control over the encryption keys. To encrypt each user's data with a separate key, you can use Azure Blob Storage Service Encryption with customer-managed keys, storing each user's data in separate containers, and then configuring separate encryption keys for each container.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 17 · 232 in bank

   HOTSPOT - You have an Azure App Service web app that uses a system-assigned managed identity. You need to recommend a solution to store the settings of the web app as secrets in an Azure key vault. The solution must meet the following requirements: ✑ Minimize changes to the app code. ✑ Use the principle of least privilege. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Key Vault references in Application settings Source Application Settings from Key Vault. Key Vault references can be used as values for Application Settings, allowing you to keep secrets in Key Vault instead of the site config. Application Settings are securely encrypted at rest, but if you need secret management capabilities, they should go into Key Vault. To use a Key Vault reference for an app setting, set the reference as the value of the setting. Your app can reference the secret through its key as normal. No code changes are required. Box 2: Secrets: Get - In order to read secrets from Key Vault, you need to have a vault created and give your app permission to access it. 1. Create a key vault by following the Key Vault quickstart. 2. Create a managed identity for your application. 3. Key Vault references will use the app's system assigned identity by default, but you can specify a user-assigned identity. 4. Create an access policy in Key Vault for the application identity you created earlier. Enable the "Get" secret permission on this policy. Reference: https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 18 · 232 in bank

   You plan to deploy an application named App1 that will run on five Azure virtual machines. Additional virtual machines will be deployed later to run App1. You need to recommend a solution to meet the following requirements for the virtual machines that will run App1: ✑ Ensure that the virtual machines can authenticate to Azure Active Directory (Azure AD) to gain access to an Azure key vault, Azure Logic Apps instances, and an Azure SQL database. ✑ Avoid assigning new roles and permissions for Azure services when you deploy additional virtual machines. ✑ Avoid storing secrets and certificates on the virtual machines. ✑ Minimize administrative effort for managing identities. Which type of identity should you include in the recommendation?

   • Aa system-assigned managed identity
   • Ba service principal that is configured to use a certificate
   • Ca service principal that is configured to use a client secret
   • Da user-assigned managed identity

   Show answer

   Answer: D

   Explanation

   D. a user-assigned managed identity A user-assigned managed identity is the best choice for this scenario. User-assigned managed identities are standalone Azure Active Directory (Azure AD) identities that can be assigned to one or more Azure resources, such as virtual machines. They can be used to authenticate to other Azure services like Azure Key Vault, Azure Logic Apps instances, and Azure SQL Database without the need for storing secrets and certificates on the virtual machines. By using a user-assigned managed identity, you can easily assign the same identity to multiple virtual machines, which avoids assigning new roles and permissions when you deploy additional VMs. This also minimizes administrative effort in managing identities, as the managed identity is automatically managed by Azure AD.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 19 · 232 in bank

   You have the resources shown in the following table:

   

   CDB1 hosts a container that stores continuously updated operational data. You are designing a solution that will use AS1 to analyze the operational data daily. You need to recommend a solution to analyze the data without affecting the performance of the operational data store. What should you include in the recommendation?

   • AAzure Cosmos DB change feed
   • BAzure Data Factory with Azure Cosmos DB and Azure Synapse Analytics connectors
   • CAzure Synapse Link for Azure Cosmos DB
   • DAzure Synapse Analytics with PolyBase data loading

   Show answer

   Answer: C

   Explanation

   Correct Answer C Azure Synapse Link for Azure Cosmos DB creates a tight integration between Azure Cosmos DB and Azure Synapse Analytics. It enables customers to run near real-time analytics over their operational data with full performance isolation from their transactional workloads and without an ETL pipeline

   Source: Adapted from community discussion — pocky456

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 20 · 232 in bank

    HOTSPOT - You deploy several Azure SQL Database instances. You plan to configure the Diagnostics settings on the databases as shown in the following exhibit.

    

    Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: 90 days - As per exhibit. Box 2: 730 days - How long is the data kept? Raw data points (that is, items that you can query in Analytics and inspect in Search) are kept for up to 730 days. Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/app/data-retention-privacy

    Source: Adapted from community discussion — jellybiscuit

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-305 practice, question 11. 232 questions available.