Practice Free AZ-305 Exam Online Questions

HOTSPOT

You have an Azure subscription.

You plan to deploy an app that requires an Azure Data Lake Storage Gen2 account.

You need to recommend which settings to modify during the storage account deployment. The solution must ensure that the data in the account is protected if an attacker gains access to the physical disk that stores the data.

Which two settings should you recommend? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

HOTSPOT

You need to design an Azure policy that will implement the following functionality:

• For new resources, assign tags and values that match the tags and values of the resource group to which the resources are deployed.

• For existing resources, identify whether the tags and values match the tags and values of the resource group that contains the resources.

• For any non-compliant resources, trigger auto-generated remediation tasks to create missing tags and values.

The solution must use the principle of least privilege.

What should you include in the design? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Box 1: Modify

Modify is used to add, update, or remove properties or tags on a resource during creation or update. A common example is updating tags on resources such as costCenter. Existing non-compliant resources can be remediated with a remediation task. A single Modify rule can have any number of operations.

Box 2: A managed identity with the Contributor role Managed identity

How remediation security works: When Azure Policy runs the template in the deployIfNotExists policy definition, it does so using a managed identity. Azure Policy creates a managed identity for each assignment, but must have details about what roles to grant the managed identity.

Contributor role

The Contributor role grants the required access to apply tags to any entity.

Reference:

https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects

https://docs.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources

https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources

https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects#modify

Your company has an on-premises Hyper-V cluster that contains 20 virtual machines. Some of the virtual machines are based on Windows and some in Linux. You have to migrate the virtual machines onto Azure.

You have to recommend a solution that would be used to replicate the disks of the virtual machines to Azure. The solution needs to ensure that the virtual machines remain available when the migration of the disks is in progress.

You decide to create an Azure storage account and then run AzCopy Would this fulfill the requirement?

Reveal Solution Hide Solution

You have an on-premises Microsoft SQL Server 2016 database named DB1.

You have an Azure subscription.

You need to migrate DB1 to an Azure SQL database by using the Azure SQL Migration extension for Azure Data Studio.

What should you do first?

Reveal Solution Hide Solution

HOTSPOT

You need to recommend a solution to ensure that App1 can access the third-party credentials and access strings. The solution must meet the security requirements.

What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Scenario: Security Requirement

All secrets used by Azure services must be stored in Azure Key Vault.

Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services.

Box 1: A service principal

A service principal is a type of security principal that identifies an application or service, which is to say, a piece of code rather than a user or group. A service principal’s object ID is known as its client ID and acts like its username. The service principal’s client secret acts like its password.

Note: Authentication with Key Vault works in conjunction with Azure Active Directory (Azure AD), which is responsible for authenticating the identity of any given security principal.

A security principal is an object that represents a user, group, service, or application that’s requesting access to Azure resources. Azure assigns a unique object ID to every security principal.

Box 2: A role assignment

You can provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control.

Reference: https://docs.microsoft.com/en-us/azure/key-vault/general/authentication

You are designing a large Azure environment that will contain many subscriptions.

You plan to use Azure Policy as part of a governance solution.

To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

You are designing an Azure Cosmos DB solution that will host multiple writable replicas in multiple Azure regions.

You need to recommend the strongest database consistency level for the design.

The solution must meet the following requirements:

✑ Provide a latency-based Service Level Agreement (SLA) for writes.

✑ Support multiple regions.

Which consistency level should you recommend?

Reveal Solution Hide Solution

DRAG DROP

You have an on-premises named App 1.

Customers App1 to manage digital images.

You plan to migrate App1 to Azure.

You need to recommend a data storage solution for Appl.

The solution must meet the following image storage requirements:

✑ Encrypt images at rest.

✑ Allow files up to 50M

Reveal Solution Hide Solution

Correct Answer:

Your company has the infrastructure shown in the following table.

The on-premises Active Directory domain syncs to Azure Active Directory (Azure AD).

Server1 runs an application named Appl that uses LDAP queries to verify user identities in the on-premises Active Directory domain.

You plan to migrate Server1 to a virtual machine in Subscription1.

A company security policy states that the virtual machines and services deployed to Subscription1 must be prevented from accessing the on-premises network.

You need to recommend a solution to ensure that Appl continues to function after the migration. The solution must meet the security policy.

What should you include in the recommendation?

Reveal Solution Hide Solution

Your on-premises datacenter contains a server that runs Linux and hosts a Java app named Appl.

App1 has the following characteristics:

• App1 is an interactive app that users access by using HTTPS connections.

• The number of connections to App1 changes significantly throughout the day.

• App1 runs multiple concurrent instances.

• App1 requires major changes to run in a container. You plan to migrate App1 to Azure.

You need to recommend a compute solution for Appl.

The solution must meet the following requirements:

• The solution must run multiple instances of Appl.

• The number of instances must be managed automatically depending on the load.

• Administrative effort must be minimized.

What should you include in the recommendation?

Reveal Solution Hide Solution