AZ-305 practice questions 31–40

1. Question 31 · 232 in bank

   You have an Azure Active Directory (Azure AD) tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned membership. Group1 has 50 members, including 20 guest users. You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements: ✑ The evaluation must be repeated automatically every three months. ✑ Every member must be able to report whether they need to be in Group1. ✑ Users who report that they do not need to be in Group1 must be removed from Group1 automatically. ✑ Users who do not report whether they need to be in Group1 must be removed from Group1 automatically. What should you include in the recommendation?

   • AImplement Azure AD Identity Protection.
   • BChange the Membership type of Group1 to Dynamic User.
   • CCreate an access review.
   • DImplement Azure AD Privileged Identity Management (PIM).

   Show answer

   Answer: C

   Explanation

   Here's why: - An access review is an Azure AD feature that enables administrators to review group memberships and application assignments, and allows group members to confirm whether they still require access. This enables every member to report whether they need to be in Group1, and if they do not, the access review can be configured to remove them automatically. - An access review can be set up to repeat automatically every three months, as required by the scenario. - Changing the Membership type of Group1 to Dynamic User is not a suitable solution for evaluating the membership of a security group with assigned membership. Dynamic user groups are based on rules and criteria, and do not include manually assigned members. - Implementing Azure AD Identity Protection is not relevant to evaluating the membership of a security group. - Implementing Azure AD Privileged Identity Management (PIM) is used for managing access to privileged roles in Azure AD, and is not relevant to the scenario.

   Source: Adapted from community discussion — NotMeAnyWay

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 32 · 232 in bank

   HOTSPOT - You have an Azure subscription that contains an Azure key vault named KV1 and a virtual machine named VM1. VM1 runs Windows Server 2022: Azure Edition. You plan to deploy an ASP.Net Core-based application named App1 to VM1. You need to configure App1 to use a system-assigned managed identity to retrieve secrets from KV1. The solution must minimize development effort. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   the second answer is no correct. The correct answers are these 1. Client credentials grant flows 2. Azure Instance Metadata (IMDS) endpoint The key difference in this scenario is that we are using a Managed Identity, which is a feature of Azure AD, and in that case, access tokens are obtained through the Azure Instance Metadata Service (IMDS) API. The managed identity is responsible for managing the lifecycle of these credentials. Therefore, for the case of an application in an Azure VM that uses a managed identity to authenticate with Key Vault, the IMDS would be used, not an OAuth 2.0 endpoint directly. https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http

   Source: Adapted from community discussion — sieira

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 33 · 232 in bank

   Your company has the divisions shown in the following table.

   

   Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend?

   • AConfigure Azure AD join.
   • BConfigure Azure AD Identity Protection.
   • CConfigure a Conditional Access policy.
   • DConfigure Supported account types in the application registration and update the sign-in endpoint.

   Show answer

   Answer: D

   Explanation

   This question is repeated 5th time but this time the answers are different D. Configure Supported account types in the application registration and update the sign-in endpoint.

   Source: Adapted from community discussion — OPT_001122

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 34 · 232 in bank

   You have an Azure AD tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned memberships. Group1 has 50 members, including 20 guest users. You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements: • The evaluation must be repeated automatically every three months. • Every member must be able to report whether they need to be in Group1. • Users who report that they do not need to be in Group1 must be removed from Group1 automatically. • Users who do not report whether they need to be in Group1 must be removed from Group1 automatically. What should you include in the recommendation?

   • AImplement Azure AD Identity Protection.
   • BChange the Membership type of Group1 to Dynamic User.
   • CCreate an access review.
   • DImplement Azure AD Privileged Identity Management (PIM).

   Show answer

   Answer: C

   Explanation

   Based on the requirements below: The evaluation must be repeated automatically every three months. • Every member must be able to report whether they need to be in Group1. • Users who report that they do not need to be in Group1 must be removed from Group1 automatically. • Users who do not report whether they need to be in Group1 must be removed from Group1 automatically. The correct answer should be - C. Create an access. review. https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

   Source: Adapted from community discussion — darthfodio

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 35 · 232 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that is linked to an Azure AD tenant named contoso.com. You plan to implement two ASP.NET Core apps named App1 and App2 that will be deployed to 100 virtual machines in Sub1. Users will sign in to App1 and App2 by using their contoso.com credentials. App1 requires read permissions to access the calendar of the signed-in user. App2 requires write permissions to access the calendar of the signed-in user. You need to recommend an authentication and authorization solution for the apps. The solution must meet the following requirements: • Use the principle of least privilege. • Minimize administrative effort. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Important point here is that both apps are deployed to the same machines. So Managed identitied will violate the principle of least privelege. As a user/system managed identity will have to be assigned both read and write permission to user's calendar. App registeration will provide ability to use the service principal per app to set the correct permission required for the app. Use delegated permissions to access user's data as admin allowed/forces users to delegate the permission to the app. answer: App registration Delegated permissions

   Source: Adapted from community discussion — pkkalra

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 36 · 232 in bank

   Your company has the divisions shown in the following table.

   

   Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend?

   • AEnable Azure AD pass-through authentication and update the sign-in endpoint.
   • BUse Azure AD entitlement management to govern external users.
   • CConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).
   • DConfigure Azure AD Identity Protection.

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview#what-can-i-do-with-entitlement-management Here are some of capabilities of entitlement management: - Select connected organizations whose users can request access. When a user who isn't yet in your directory requests access, and is approved, they're automatically invited into your directory and assigned access. When their access expires, if they have no other access package assignments, their B2B account in your directory can be automatically removed.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

7. Question 37 · 232 in bank

   HOTSPOT - You have an Azure AD tenant that contains a management group named MG1. You have the Azure subscriptions shown in the following table.

   

   The subscriptions contain the resource groups shown in the following table.

   

   The subscription contains the Azure AD security groups shown in the following table.

   

   The subscription contains the user accounts shown in the following table.

   

   You perform the following actions: Assign User3 the Contributor role for Sub1. Assign Group1 the Virtual Machine Contributor role for MG1. Assign Group3 the Contributor role for the Tenant Root Group. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answers are correct. Since Group 1 is assigned VM contributor to MG1, it will be able to create a new VM in RG1. User 2 is not able to grant permission to Group 2 because it is just a member with contributor role. Since Group 3 has Contributor role for the Tenant Root Group, User3 can create storage account in RG2

   Source: Adapted from community discussion — JBTC

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 38 · 232 in bank

   Your company has the divisions shown in the following table.

   

   Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend?

   • AConfigure Azure AD Identity Protection.
   • BConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).
   • CConfigure Supported account types in the application registration and update the sign-in endpoint.
   • DConfigure a Conditional Access policy.

   Show answer

   Answer: C

   Explanation

   C. Configure Supported account types in the application registration and update the sign-in endpoint. Same Question and answer as Question 45. https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types

   Source: Adapted from community discussion — fred356

   References

   • Microsoft Learn

   Next question

9. Question 39 · 232 in bank

   You have an Azure subscription that contains 1,000 resources. You need to generate compliance reports for the subscription. The solution must ensure that the resources can be grouped by department. What should you use to organize the resources?

   • Aapplication groups and quotas
   • BAzure Policy and tags
   • Cadministrative units and Azure Lighthouse
   • Dresource groups and role assignments

   Show answer

   Answer: B

   Explanation

   Olabiba.ai says B. “ To organize the resources in your Azure subscription and generate compliance reports, you should use Azure Policy and tags. Azure Policy allows you to define and enforce rules and regulations for your resources, ensuring compliance with organizational standards and industry regulations. You can create policies that specify the required tags for resources, such as department, and enforce their usage across the subscription. This will help you categorize and group resources based on departments. Tags, on the other hand, are key-value pairs that you can assign to resources. By assigning tags to resources with the department information, you can easily filter and group resources based on departments when generating compliance reports. Therefore, the correct answer is B. Azure Policy and tags.”

   Source: Adapted from community discussion — Jackhemo

   Next question

10. Question 40 · 232 in bank

    HOTSPOT - You plan to deploy Azure Databricks to support a machine learning application. Data engineers will mount an Azure Data Lake Storage account to the Databricks file system. Permissions to folders are granted directly to the data engineers. You need to recommend a design for the planned Databrick deployment. The solution must meet the following requirements: ✑ Ensure that the data engineers can only access folders to which they have permissions. ✑ Minimize development effort. ✑ Minimize costs. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: Premium - Premium Databricks SKU is required for credential passhtrough. Box 2: Credential passthrough - Athenticate automatically to Azure Data Lake Storage Gen1 (ADLS Gen1) and Azure Data Lake Storage Gen2 (ADLS Gen2) from Azure Databricks clusters using the same Azure Active Directory (Azure AD) identity that you use to log into Azure Databricks. When you enable Azure Data Lake Storage credential passthrough for your cluster, commands that you run on that cluster can read and write data in Azure Data Lake Storage without requiring you to configure service principal credentials for access to storage. Reference: https://docs.microsoft.com/en-us/azure/databricks/security/credential-passthrough/adls-passthrough

    Source: Adapted from community discussion — Tyler2021

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-305 practice, question 31. 232 questions available.