AZ-305 practice questions 221–230

1. Question 221 · 232 in bank

   You need to recommend an App Service architecture that meets the requirements for App1. The solution must minimize costs. What should you recommend?

   • Aone App Service Environment (ASE) per availability zone
   • Bone App Service Environment (ASE) per region
   • Cone App Service plan per region
   • Done App Service plan per availability zone

   Show answer

   Answer: C

   Explanation

   C. one App Service plan per region An App Service Environment (ASE, option B) is a premium Azure App Service hosting offering that provides fully isolated and dedicated environments for securely running App Service apps at high scale. While it does meet the requirements for App1, it's a costly option compared to the App Service plan (option C). On the other hand, an App Service plan (option C) represents a set of compute resources that you allocate to host your apps. You can host multiple apps in the same App Service plan, sharing the resources and thereby reducing costs. For App1, which is planned to have three instances in each of two regions, it would be more cost-effective to use a single App Service plan per region. This would allow the multiple App1 instances in each region to share the resources of the single App Service plan.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 222 · 232 in bank

   HOTSPOT - You need to recommend a solution to ensure that App1 can access the third-party credentials and access strings. The solution must meet the security requirements. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Scenario: Security Requirement - All secrets used by Azure services must be stored in Azure Key Vault. Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services. Box 1: A system-assigned managed identity No one knows the credentials of managed identities. Managed Identities exist in two formats: * System assigned: in this scenario, the identity is linked to a single Azure Resource, eg a Virtual Machine, a Logic App, a Storage Account, Web App, Function,ג€¦ so almost anything. Next, they also ג€liveג€ with the Azure Resource, which means they get deleted when the Azure Resource gets deleted. * User Assigned Managed Identity (incorrect for this question), which means that you first have to create it as a stand-alone Azure resource by itself, after which it can be linked to multiple Azure Resources. Box 2: An access policy - Set up an access policy for the system-assigned managed identity. Note: Grant access - The managed identity needs to be granted access to read the secret that we'll store in the Key Vault. 1. Navigate to your newly created Key Vault 2. Select Access Policy from the menu on the left side. 3. Select Add Access Policy 4. Etc. Reference: https://devblogs.microsoft.com/devops/demystifying-service-principals-managed-identities/ https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad

   Source: Adapted from community discussion — Snownoodles

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 223 · 232 in bank

   HOTSPOT - You are evaluating the components of the migration to Azure that require you to provision an Azure Storage account. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - Online migration will work fine. It does not require an Azure Storage account. Box 2: No - Data for the web site can migrated to Azure app service. Box 3: Yes - Scenario: Database metrics for the production instance of WebApp1 must be available for analysis so that database administrators can optimize the performance settings. Reference: https://azure.microsoft.com/en-au/services/sql-server-stretch-database/

   Source: Adapted from community discussion — Greysi

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 224 · 232 in bank

   What should you include in the identity management strategy to support the planned changes?

   • ADeploy domain controllers for corp.fabrikam.com to virtual networks in Azure.
   • BMove all the domain controllers from corp.fabrikam.com to virtual networks in Azure.
   • CDeploy a new Azure AD tenant for the authentication of new R&D projects.
   • DDeploy domain controllers for the rd.fabrikam.com forest to virtual networks in Azure.

   Show answer

   Answer: A

   References

   • Microsoft Learn

   Next question

5. Question 225 · 232 in bank

   HOTSPOT - You plan to migrate App1 to Azure. You need to recommend a high-availability solution for App1. The solution must meet the resiliency requirements. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: 3 - Need three host groups to meet the third scenario requirement below. Scenario: App1 must meet the following requirements: Be hosted in an Azure region that supports availability zones. Be hosted on Azure virtual machines that support automatic scaling. Maintain availability if two availability zones in the local Azure region fail. Box 2: 3 - The availability setting of your host group should match your scale set. * The host group and the scale set must be using the same availability zone. * The fault domain count for the host group level should match the fault domain count for your scale set. Reference: https://docs.microsoft.com/en-us/azure/virtual-machines/dedicated-hosts

   Source: Adapted from community discussion — [Removed]

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 226 · 232 in bank

   HOTSPOT - You plan to migrate App1 to Azure. You need to recommend a storage solution for App1 that meets the security and compliance requirements. Which type of storage should you recommend, and how should you recommend configuring the storage? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Standard general-purpose v2 Standard general-purpose v2 supports Blob Storage. Azure Storage provides data protection for Blob Storage and Azure Data Lake Storage Gen2. Scenario: Litware identifies the following security and compliance requirements: ✑ Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years. ✑ On-premises users and services must be able to access the Azure Storage account that will host the data in App1. ✑ Access to the public endpoint of the Azure Storage account that will host the App1 data must be prevented. All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled. ✑ App1 must NOT share physical hardware with other workloads. Box 2: Hierarchical namespace - Scenario: Plan: Migrate App1 to Azure virtual machines. Azure Data Lake Storage Gen2 implements an access control model that supports both Azure role-based access control (Azure RBAC) and POSIX-like access control lists (ACLs). Data Lake Storage Gen2 and the Network File System (NFS) 3.0 protocol both require a storage account with a hierarchical namespace enabled. Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/data-protection-overview https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview

   Source: Adapted from community discussion — techrat

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 227 · 232 in bank

   You plan to migrate App1 to Azure. You need to recommend a network connectivity solution for the Azure Storage account that will host the App1 data. The solution must meet the security and compliance requirements. What should you include in the recommendation?

   • AMicrosoft peering for an ExpressRoute circuit
   • BAzure public peering for an ExpressRoute circuit
   • Ca service endpoint that has a service endpoint policy
   • Da private endpoint

   Show answer

   Answer: D

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

8. Question 228 · 232 in bank

   You need to implement the Azure RBAC role assignments for the Network Contributor role. The solution must meet the authentication and authorization requirements. What is the minimum number of assignments that you must use?

   • A1
   • B2
   • C5
   • D10
   • E15

   Show answer

   Answer: B

   Explanation

   Litware has two Azure tenants. One tenant with 10 subscriptions and one tenant with five subscriptions. We can organize the subscriptions of the two tenants in a management group each and assign users to the Network Contributor role or to Role1 at the management group level.

   Source: Adapted from community discussion — darren888

   References

   • Microsoft Learn

   Next question

9. Question 229 · 232 in bank

   DRAG DROP - You need to configure an Azure policy to ensure that the Azure SQL databases have Transparent Data Encryption (TDE) enabled. The solution must meet the security and compliance requirements. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Create an Azure policy definition that uses the deployIfNotExists The first step is to define the roles that deployIfNotExists and modify needs in the policy definition to successfully deploy the content of your included template. Step 2: Create an Azure policy assignment When creating an assignment using the portal, Azure Policy both generates the managed identity and grants it the roles defined in roleDefinitionIds. Step 3: Invoke a remediation task. Resources that are non-compliant to a deployIfNotExists or modify policy can be put into a compliant state through Remediation. Remediation is accomplished by instructing Azure Policy to run the deployIfNotExists effect or the modify operations of the assigned policy on your existing resources and subscriptions, whether that assignment is to a management group, a subscription, a resource group, or an individual resource. During evaluation, the policy assignment with deployIfNotExists or modify effects determines if there are non-compliant resources or subscriptions. When non- compliant resources or subscriptions are found, the details are provided on the Remediation page. Reference: https://docs.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources

   Source: Adapted from community discussion — VBK8579

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 230 · 232 in bank

    HOTSPOT - To meet the authentication requirements of Fabrikam, what should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: 1 - One single Azure AD tenant is needed as only the Corp tenant is migrated. Box 2: 1 - Box 3: 2 - One conditional access policy for Multi-Factor Authentication (MFA) will be used for administative access, and a second conditional access policy in order to prevent external access. Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-location https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa

    Source: Adapted from community discussion — RandomNickname

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-305 practice, question 221. 232 questions available.