AZ-305 practice questions 21–30

1. Question 21 · 232 in bank

   You have an application that is used by 6,000 users to validate their vacation requests. The application manages its own credential store. Users must enter a username and password to access the application. The application does NOT support identity providers. You plan to upgrade the application to use single sign-on (SSO) authentication by using an Azure Active Directory (Azure AD) application registration. Which SSO method should you use?

   • Aheader-based
   • BSAML
   • Cpassword-based
   • DOpenID Connect

   Show answer

   Answer: C

   Explanation

   C is the answer. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/plan-sso-deployment#single-sign-on-options Password-based - Choose password-based when the application has an HTML sign-in page. Password-based SSO is also known as password vaulting. Password-based SSO enables you to manage user access and passwords to web applications that don't support identity federation. It's also useful where several users need to share a single account, such as to your organization's social media app accounts. Password-based SSO supports applications that require multiple sign-in fields for applications that require more than just username and password fields to sign in. You can customize the labels of the username and password fields your users see on My Apps when they enter their credentials.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

2. Question 22 · 232 in bank

   HOTSPOT - You have an Azure subscription that contains a virtual network named VNET1 and 10 virtual machines. The virtual machines are connected to VNET1. You need to design a solution to manage the virtual machines from the internet. The solution must meet the following requirements: ✑ Incoming connections to the virtual machines must be authenticated by using Azure Multi-Factor Authentication (MFA) before network connectivity is allowed. ✑ Incoming connections must use TLS and connect to TCP port 443. ✑ The solution must support RDP and SSH. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Just-in-time (JIT) VN access Lock down inbound traffic to your Azure Virtual Machines with Microsoft Defender for Cloud's just-in-time (JIT) virtual machine (VM) access feature. This reduces exposure to attacks while providing easy access when you need to connect to a VM. Note: Threat actors actively hunt accessible machines with open management ports, like RDP or SSH. Your legitimate users also use these ports, so it's not practical to keep them closed. When you enable just-in-time VM access, you can select the ports on the VM to which inbound traffic will be blocked. To solve this dilemma, Microsoft Defender for Cloud offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed. Box 2: A conditional Access policy that has Cloud Apps assignment set to Azure Windows VM Sign-In You can enforce Conditional Access policies such as multi-factor authentication or user sign-in risk check before authorizing access to Windows VMs in Azure that are enabled with Azure AD sign in. To apply Conditional Access policy, you must select the "Azure Windows VM Sign-In" app from the cloud apps or actions assignment option and then use Sign-in risk as a condition and/or require multi-factor authentication as a grant access control. Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows

   Source: Adapted from community discussion — Gowind

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 23 · 232 in bank

   Select 2

   You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain. You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication. Some users work remotely and do NOT have VPN access to the on-premises network. You need to provide the remote users with single sign-on (SSO) access to WebApp1. Which two features should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAzure AD Application Proxy
   • BAzure AD Privileged Identity Management (PIM)
   • CConditional Access policies
   • DAzure Arc
   • EAzure AD enterprise applications
   • FAzure Application Gateway

   Show answer

   Answer: AE

   Explanation

   It's required to download connector under (Application Proxy) and create a new application under (Enterprise Application), however for (Pre Authentication) option, you can choose "Passthrough" or "Azure Active Directory", and both will work, but it's recommended to use "Azure Active Directory" so you can take advantage of using conditional access and MFA. Answer is (A) & (E) as they're both required as part of the solution to work, where as (C) is just an optional feature. Reference: https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-application

   Source: Adapted from community discussion — itmaster

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 24 · 232 in bank

   You are designing an Azure governance solution. All Azure resources must be easily identifiable based on the following operational information: environment, owner, department and cost center. You need to ensure that you can use the operational information when you generate reports for the Azure resources. What should you include in the solution?

   • Aan Azure data catalog that uses the Azure REST API as a data source
   • Ban Azure management group that uses parent groups to create a hierarchy
   • Can Azure policy that enforces tagging rules
   • DAzure Active Directory (Azure AD) administrative units

   Show answer

   Answer: C

   Explanation

   C is the answer. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies You use Azure Policy to enforce tagging rules and conventions. By creating a policy, you avoid the scenario of resources being deployed to your subscription that don't have the expected tags for your organization. Instead of manually applying tags or searching for resources that aren't compliant, you create a policy that automatically applies the needed tags during deployment. Tags can also now be applied to existing resources with the new Modify effect and a remediation task.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

5. Question 25 · 232 in bank

   A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with Microsoft 365 and an Azure subscription. Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory Domain Services (AD DS) and Azure AD Connect. Contoso has a partnership with a company named Fabrikam. Inc. Fabrikam has an Active Directory forest and a Microsoft 365 tenant. Fabrikam has the same on- premises identity infrastructure components as Contoso. A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription of Contoso. The developers must be added to the Contributor role for a resource group in the Contoso subscription. You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The solution must ensure that the Fabrikam developers use their existing credentials to access resources What should you recommend?

   • AIn the Azure AD tenant of Contoso. create cloud-only user accounts for the Fabrikam developers.
   • BConfigure a forest trust between the on-premises Active Directory forests of Contoso and Fabrikam.
   • CConfigure an organization relationship between the Microsoft 365 tenants of Fabrikam and Contoso.
   • DIn the Azure AD tenant of Contoso, create guest accounts for the Fabnkam developers.

   Show answer

   Answer: D

   Explanation

   Answer is correct: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b Collaborate with any partner using their identities With Azure AD B2B, the partner uses their own identity management solution, so there is no external administrative overhead for your organization. Guest users sign in to your apps and services with their own work, school, or social identities. The partner uses their own identities and credentials, whether or not they have an Azure AD account. You don't need to manage external accounts or passwords. You don't need to sync accounts or manage account lifecycles.

   Source: Adapted from community discussion — Gowind

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 26 · 232 in bank

   Your company has the divisions shown in the following table.

   

   Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend?

   • AConfigure the Azure AD provisioning service.
   • BEnable Azure AD pass-through authentication and update the sign-in endpoint.
   • CUse Azure AD entitlement management to govern external users.
   • DConfigure Azure AD join.

   Show answer

   Answer: C

   Explanation

   Answer is C The app is single tenant authentication so users must be present in contoso directory. https://docs.microsoft.com/en-us/azure/active-directory/develop/single-and-multi-tenant-apps With Azure AD B2B, external users authenticate to their home directory, but have a representation in your directory. https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-users A is wrong because its to automate provisioning to third party SaaS app. https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/how-provisioning-works?source=recommendations B. is wrong because the application would need to switch to multi tenant.. https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant

   Source: Adapted from community discussion — Gowind

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 27 · 232 in bank

   HOTSPOT - Your company has 20 web APIs that were developed in-house. The company is developing 10 web apps that will use the web APIs. The web apps and the APIs are registered in the company s Azure Active Directory (Azure AD) tenant. The web APIs are published by using Azure API Management. You need to recommend a solution to block unauthorized requests originating from the web apps from reaching the web APIs. The solution must meet the following requirements: ✑ Use Azure AD-generated claims. Minimize configuration and management effort.

   

   What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Azure AD - Grant permissions in Azure AD. Box 2: Azure API Management - Configure a JWT validation policy to pre-authorize requests. Pre-authorize requests in API Management with the Validate JWT policy, by validating the access tokens of each incoming request. If a request does not have a valid token, API Management blocks it. Reference: https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad

   Source: Adapted from community discussion — Gowind

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 28 · 232 in bank

   Your company has the divisions shown in the following table.

   

   Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend?

   • AConfigure the Azure AD provisioning service.
   • BConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).
   • CUse Azure AD entitlement management to govern external users.
   • DConfigure Azure AD Identity Protection.

   Show answer

   Answer: C

   Explanation

   Correct Application is single tenant so users must be in the same directory as the home tenant https://docs.microsoft.com/en-us/azure/active-directory/develop/single-and-multi-tenant-apps https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-users Azure AD entitlement management uses Azure AD business-to-business (B2B) to share access so you can collaborate with people outside your organization. With Azure AD B2B, external users authenticate to their home directory, but have a representation in your directory. A is for populated users to SaaS applications (third party like Dropbox or Salesforce), but the users must first be in the directory....

   Source: Adapted from community discussion — Gowind

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 29 · 232 in bank

   You are developing an app that will read activity logs for an Azure subscription by using Azure Functions. You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative effort. What should you include in the recommendation?

   • Aan enterprise application in Azure AD
   • Bsystem-assigned managed identities
   • Cshared access signatures (SAS)
   • Dapplication registration in Azure AD

   Show answer

   Answer: B

   Explanation

   B. System-assigned managed identities System-assigned managed identities provide a way for Azure Functions to authenticate to other Azure services, such as Activity Logs, without the need for storing or managing secrets. This approach minimizes administrative effort because the identity is tied directly to the Azure Functions service and is automatically managed by Azure. When the Azure Functions instance is deleted, the associated managed identity will also be removed. This simplifies the authentication process and helps improve the security posture of your app.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 30 · 232 in bank

    Your company has the divisions shown in the following table.

    

    Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend?

    • AConfigure Azure AD join.
    • BUse Azure AD entitlement management to govern external users.
    • CEnable Azure AD pass-through authentication and update the sign-in endpoint.
    • DConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).

    Show answer

    Answer: B

    Explanation

    B is the answer. https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview#what-can-i-do-with-entitlement-management Here are some of capabilities of entitlement management: - Select connected organizations whose users can request access. When a user who isn't yet in your directory requests access, and is approved, they're automatically invited into your directory and assigned access. When their access expires, if they have no other access package assignments, their B2B account in your directory can be automatically removed.

    Source: Adapted from community discussion — zellck

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-305 practice, question 21. 232 questions available.