[ { "seq": 1, "pdfId": 1, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/1" }, "markersInGap": [], "questionText": "You need to recommend a solution to verify whether the Fabrikam developers still require permissions to\nApplication1. The solution must meet the following requirements:\n✑\n To the manager of the developers, send a monthly email message that lists the access permissions to\nApplication1.\n✑\n If the manager does not verify an access permission, automatically revoke that permission.\n✑\n Minimize development effort.\nWhat should you recommend?\nA.\nIn Azure Active Directory (Azure AD), create an access review of Application1.\nB.\nCreate an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.\nC.\nIn Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for\nthe Application1 resources.\nD.\nCreate an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.", "stem": "You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1. The solution must meet the following requirements: ✑ To the manager of the developers, send a monthly email message that lists the access permissions to Application1. ✑ If the manager does not verify an access permission, automatically revoke that permission. ✑ Minimize development effort. What should you recommend", "options": [ { "key": "A", "text": "In Azure Active Directory (Azure AD), create an access review of Application1." }, { "key": "B", "text": "Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet." }, { "key": "C", "text": "In Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources." }, { "key": "D", "text": "Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. In Azure Active Directory (Azure AD), create an access review of Application1.\nAzure AD Access Reviews allow organizations to periodically review and confirm whether users still need\naccess to specific resources.\nYou can configure monthly access reviews for Application1 and assign the manager of the Fabrikam\ndevelopers as the reviewer.\nIf the manager does not verify an access permission within the review period, Azure AD can automatically\nrevoke the permission.\nThis solution minimizes development effort because it is a built-in feature of Azure AD and does not require\ncustom scripting or automation.\nWhy Not the Other Options?\nB. Azure Automation runbook with Get-AzRoleAssignment: This would require custom scripting to retrieve\nrole assignments, send emails, and revoke permissions, increasing development effort.\nC. Azure AD Privileged Identity Management (PIM) custom role assignment: PIM is useful for managing just-\nin-time access but does not provide automated periodic reviews and revocation based on manager\nverification.\nD. Azure Automation runbook with Get-AzureADUserAppRoleAssignment: Similar to option B, this would\nrequire significant custom development to handle email notifications and revocation.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 2, "pdfId": 2, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/2" }, "markersInGap": [ 1, 2 ], "questionText": "You have an Azure subscription. The subscription has a blob container that contains multiple blobs.\nTen users in the finance department of your company plan to access the blobs during the month of April.\nYou need to recommend a solution to enable access to the blobs during the month of April only.\nWhich security solution should you include in the recommendation?\n A.\nshared access signatures (SAS)\nB.\nConditional Access policies\nC.\ncertificates\nD.\naccess keys", "stem": "You have an Azure subscription. The subscription has a blob container that contains multiple blobs. Ten users in the finance department of your company plan to access the blobs during the month of April. You need to recommend a solution to enable access to the blobs during the month of April only. Which security solution should you include in the recommendation", "options": [ { "key": "A", "text": "shared access signatures (SAS)" }, { "key": "B", "text": "Conditional Access policies" }, { "key": "C", "text": "certificates" }, { "key": "D", "text": "access keys" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Shared Access Signatures (SAS) allows for limited-time fine grained access control to resources. So you can\ngenerate URL, specify duration (for month of April) and disseminate URL to 10 team members. On May 1, the\nSAS token is automatically invalidated, denying team members continued access.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview" ], "note": "Each correct selection is worth one point.\nA.\nAzure AD Application Proxy\nB.\nAzure AD Privileged Identity Management (PIM)\nC.\nConditional Access policies\nD.\nAzure Arc\nE.\nAzure AD enterprise applications\nF.\nAzure Application Gateway", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 3, "pdfId": 3, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/3" }, "markersInGap": [], "questionText": "You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain.\nYou have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows\nauthentication.\nSome users work remotely and do NOT have VPN access to the on-premises network.\nYou need to provide the remote users with single sign-on (SSO) access to WebApp1.\nWhich two features should you include in the solution? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nAzure AD Application Proxy\nB.\nAzure AD Privileged Identity Management (PIM)\nC.\nConditional Access policies\nD.\nAzure Arc\nE.\nAzure AD enterprise applications\nF.\nAzure Application Gateway", "stem": "You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain. You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication. Some users work remotely and do NOT have VPN access to the on-premises network. You need to provide the remote users with single sign-on (SSO) access to WebApp1. Which two features should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Azure AD Application Proxy" }, { "key": "B", "text": "Azure AD Privileged Identity Management (PIM)" }, { "key": "C", "text": "Conditional Access policies" }, { "key": "D", "text": "Azure Arc" }, { "key": "E", "text": "Azure AD enterprise applications" }, { "key": "F", "text": "Azure Application Gateway" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from\na remote client. Application Proxy includes both the\nApplication Proxy service which runs in the cloud, and the Application Proxy connector which runs on an on-\npremises server.\nYou can configure single sign-on to an Application Proxy application.\nE: Add an on-premises app to Azure AD\nNow that you've prepared your environment and installed a connector, you're ready to add on-premises\napplications to Azure AD.\n1. Sign in as an administrator in the Azure portal.\n2. In the left navigation panel, select Azure Active Directory.\n3. Select Enterprise applications, and then select New application.\n4. Select Add an on-premises application button which appears about halfway down the page in the On-\npremises applications section. Alternatively, you can select Create your own application at the top of the page\nand then select Configure Application Proxy for secure remote access to an on-premise application.\n5. In the Add your own on-premises application section, provide the following information about your\napplication.\n6. Etc.\nIncorrect:\nNot C: Conditional Access policies are not required.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-\napplication", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 4, "pdfId": 4, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/4" }, "markersInGap": [], "questionText": "You have an Azure Active Directory (Azure AD) tenant named contoso.com that has a security group named Group1.\nGroup1 is configured for assigned membership. Group1 has 50 members, including 20 guest users.\nYou need to recommend a solution for evaluating the membership of Group1. The solution must meet the following\nrequirements:\n✑\n The evaluation must be repeated automatically every three months.\n✑\n Every member must be able to report whether they need to be in Group1.\n✑\n Users who report that they do not need to be in Group1 must be removed from Group1 automatically.\n✑\n Users who do not report whether they need to be in Group1 must be removed from Group1 automatically.\nWhat should you include in the recommendation?\nA.\nImplement Azure AD Identity Protection.\nB.\nChange the Membership type of Group1 to Dynamic User.\nC.\nCreate an access review.\nD.\nImplement Azure AD Privileged Identity Management (PIM).", "stem": "You have an Azure Active Directory (Azure AD) tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned membership. Group1 has 50 members, including 20 guest users. You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements: ✑ The evaluation must be repeated automatically every three months. ✑ Every member must be able to report whether they need to be in Group1. ✑ Users who report that they do not need to be in Group1 must be removed from Group1 automatically. ✑ Users who do not report whether they need to be in Group1 must be removed from Group1 automatically. What should you include in the recommendation", "options": [ { "key": "A", "text": "Implement Azure AD Identity Protection." }, { "key": "B", "text": "Change the Membership type of Group1 to Dynamic User." }, { "key": "C", "text": "Create an access review." }, { "key": "D", "text": "Implement Azure AD Privileged Identity Management (PIM)." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group\nmemberships, access to enterprise applications, and role assignments. User's access can be reviewed on a\nregular basis to make sure only the right people have continued access.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 5, "pdfId": 5, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/5" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Premium -\nPremium Databricks SKU is required for credential passhtrough.\nBox 2: Credential passthrough -\nAthenticate automatically to Azure Data Lake Storage Gen1 (ADLS Gen1) and Azure Data Lake Storage Gen2\n(ADLS Gen2) from Azure Databricks clusters using the same Azure Active Directory (Azure AD) identity that\nyou use to log into Azure Databricks. When you enable Azure Data Lake Storage credential passthrough for\nyour cluster, commands that you run on that cluster can read and write data in Azure Data Lake Storage\nwithout requiring you to configure service principal credentials for access to storage.", "reference": "https://docs.microsoft.com/en-us/azure/databricks/security/credential-passthrough/adls-passthrough", "references": [ "https://docs.microsoft.com/en-us/azure/databricks/security/credential-passthrough/adls-passthrough" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 6, "pdfId": 6, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/6" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: An Azure AD app registration\nAzure active directory (AD) provides cloud based directory and identity management services.You can use\nazure AD to manage users of your application and authenticate access to your applications using azure active\ndirectory.\nYou register your application with Azure active directory tenant.\nBox 2: A conditional access policy\nConditional Access policies at their simplest are if-then statements, if a user wants to access a resource, then\nthey must complete an action.\nBy using Conditional Access policies, you can apply the right access controls when needed to keep your\norganization secure and stay out of your user's way when not needed.", "reference": "https://codingcanvas.com/using-azure-active-directory-authentication-in-your-web-application/\nhttps://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview", "references": [ "https://codingcanvas.com/using-azure-active-directory-authentication-in-your-web-application/", "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 7, "pdfId": 7, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/7" }, "markersInGap": [ 7 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYour company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and\nconfigured for on-premises to Azure connectivity.\nSeveral virtual machines exhibit network connectivity issues.\nYou need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual\nmachines.\nSolution: Use Azure Traffic Analytics in Azure Network Watcher to analyze the network traffic.\nDoes this meet the goal?\n A.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Traffic Analytics in Azure Network Watcher to analyze the network traffic. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "(Traffic Analytics) under (Network Watcher) gives you statistical data and traffic visualization like total\ninbound and outbound flows and the number of deployed NSGs. However, it doesn't give you information if\npackets are allows of denied. Check screenshot in the following reference: https://docs.microsoft.com/en-\nus/azure/network-watcher/traffic-analytics\n(IP Flow Verify) under (Network Watcher) gives you option to verify if traffic is allowed or denied. Check\nscreenshot in the following reference: https://docs.microsoft.com/en-us/azure/network-watcher/network-\nwatcher-ip-flow-verify-overview\nCorrect answer is B.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 8, "pdfId": 8, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/8" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYour company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and\nconfigured for on-premises to Azure connectivity.\nSeveral virtual machines exhibit network connectivity issues.\nYou need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual\nmachines.\nSolution: Use Azure Advisor to analyze the network traffic.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Advisor to analyze the network traffic. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead use Azure Network Watcher IP Flow Verify, which allows you to detect traffic filtering issues at a VM\nlevel.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview" ], "note": "IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information\nconsists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a\nsecurity group, the name of the rule that denied the packet is returned. While any source or destination IP can\nbe chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and\nfrom or to the on-premises environment.\nReference:\nhttps://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 9, "pdfId": 9, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/9" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYour company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and\nconfigured for on-premises to Azure connectivity.\nSeveral virtual machines exhibit network connectivity issues.\nYou need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual\nmachines.\nSolution: Use Azure Network Watcher to run IP flow verify to analyze the network traffic.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Network Watcher to run IP flow verify to analyze the network traffic. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Network Watcher IP Flow Verify allows you to detect traffic filtering issues at a VM level.\nIP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of\ndirection, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group,\nthe name of the rule that denied the packet is returned. While any source or destination IP can be chosen,\nIP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to\nthe on-premises environment.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview" ], "note": "Each correct selection is worth one point.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 10, "pdfId": 10, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/10" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Events from Windows event logs:\nEvent.\nThe Event table in Azure Monitor stores Windows event log data.\nThese logs are collected from Windows machines that are connected to Azure Monitor.\nIt includes entries like System, Application, and Security logs from the Windows Event Viewer.\nEvents from Linux system logging:\nSyslog.\nThe Syslog table stores Linux log data, which are generated by the Syslog daemon on Linux systems.\nThese can include logs from services, kernel messages, and other system components typical of Linux\nenvironments.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events", "https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog" ], "note": "Each correct selection is worth one point.\nA.\nAzure Active Directory (Azure AD) administrative units\nB.\nAzure Active Directory (Azure AD) tenants\nC.\nsubscriptions\nD.\ncompute resources\nE.\nresource groups\nF.\nmanagement groups", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 11, "pdfId": 11, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/11" }, "markersInGap": [], "questionText": "You are designing a large Azure environment that will contain many subscriptions.\nYou plan to use Azure Policy as part of a governance solution.\nTo which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution.\nNOTE: Each correct selection is worth one point.\nA.\nAzure Active Directory (Azure AD) administrative units\nB.\nAzure Active Directory (Azure AD) tenants\nC.\nsubscriptions\nD.\ncompute resources\nE.\nresource groups\nF.\nmanagement groups", "stem": "You are designing a large Azure environment that will contain many subscriptions. You plan to use Azure Policy as part of a governance solution. To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Azure Active Directory (Azure AD) administrative units" }, { "key": "B", "text": "Azure Active Directory (Azure AD) tenants" }, { "key": "C", "text": "subscriptions" }, { "key": "D", "text": "compute resources" }, { "key": "E", "text": "resource groups" }, { "key": "F", "text": "management groups" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Policy evaluates resources in Azure by comparing the properties of those resources to business rules.\nOnce your business rules have been formed, the policy definition or initiative is assigned to any scope of\nresources that Azure supports, such as management groups, subscriptions, resource groups, or individual\nresources.", "reference": "https://docs.microsoft.com/en-us/azure/governance/policy/overview", "references": [ "https://docs.microsoft.com/en-us/azure/governance/policy/overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 12, "pdfId": 12, "exam": "AZ-305", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/12" }, "markersInGap": [ 11, 12 ], "questionText": "DRAG DROP -\nYour on-premises network contains a server named Server1 that runs an ASP.NET application named App1.\nYou have a hybrid deployment of Azure Active Directory (Azure AD).\nYou need to recommend a solution to ensure that users sign in by using their Azure AD account and Azure Multi-\nFactor Authentication (MFA) when they connect to App1 from the internet.\nWhich three features should you recommend be deployed and configured in sequence? To answer, move the\nappropriate features from the list of features to the answer area and arrange them in the correct order.\nSelect and Place:", "stem": "Your on-premises network contains a server named Server1 that runs an ASP.NET application named App1. You have a hybrid deployment of Azure Active Directory (Azure AD). You need to recommend a solution to ensure that users sign in by using their Azure AD account and Azure Multi- Factor Authentication (MFA) when they connect to App1 from the internet. Which three features should you recommend be deployed and configured in sequence? To answer, move the appropriate features from the list of features to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Step 1: Azure AD Application Proxy.\nStart by enabling communication to Azure data centers to prepare your environment for Azure AD Application\nProxy.\nStep 2: an Azure AD enterprise application.\nRepresents an application integrated with Azure AD for identity and access management.\nStep 3: A Conditional Access Policy.\nEnforces access controls like multi-factor authentication (MFA) based on user conditions.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-\napplication", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 14, "pdfId": 13, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/13" }, "markersInGap": [ 13, 14 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYour company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and\nconfigured for on-premises to Azure connectivity.\nSeveral virtual machines exhibit network connectivity issues.\nYou need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual\nmachines.\nSolution: Install and configure the Azure Monitoring agent and the Dependency Agent on all the virtual machines.\nUse VM insights in Azure Monitor to analyze the network traffic.\nDoes this meet the goal?\nA.\nYes\n B.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Install and configure the Azure Monitoring agent and the Dependency Agent on all the virtual machines. Use VM insights in Azure Monitor to analyze the network traffic. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Use the Azure Monitor agent if you need to:\nCollect guest logs and metrics from any machine in Azure, in other clouds, or on-premises.\nUse the Dependency agent if you need to:\nUse the Map feature VM insights or the Service Map solution.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#dependency-agent", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview", "https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#dependency-agent" ], "note": "Instead use Azure Network Watcher IP Flow Verify allows you to detect traffic filtering issues at a VM\nlevel.\nIP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of\ndirection, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group,\nthe name of the rule that denied the packet is returned. While any source or destination IP can be chosen,\nIP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to\nthe on-premises environment.\nReference:\nhttps://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#dependency-agent", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 13, "pdfId": 14, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/14" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nAzure Activity Log\nB.\nAzure Advisor\nC.\nAzure Analysis Services\nD.\nAzure Monitor action groups", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Activity Log" }, { "key": "B", "text": "Azure Advisor" }, { "key": "C", "text": "Azure Analysis Services" }, { "key": "D", "text": "Azure Monitor action groups" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't more\nthan 90 days in the past.\nThrough activity logs, you can determine:\n✑\n what operations were taken on the resources in your subscription\n✑\n who started the operation\n✑\n when the operation occurred\n✑\n the status of the operation\n✑\n the values of other properties that might help you research the operation", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 15, "pdfId": 15, "exam": "AZ-305", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/15" }, "markersInGap": [ 15 ], "questionText": "DRAG DROP -\nYou need to design an architecture to capture the creation of users and the assignment of roles. The captured data\nmust be stored in Azure Cosmos DB.\nWhich services should you include in the design? To answer, drag the appropriate services to the correct targets.\nEach service may be used once, more than once, or not at all. You may need to drag the split bar between panes or\nscroll to view content.\nNOTE: Each correct selection is worth one point.\nSelect and Place:", "stem": "You need to design an architecture to capture the creation of users and the assignment of roles. The captured data must be stored in Azure Cosmos DB. Which services should you include in the design? To answer, drag the appropriate services to the correct targets. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure Event Hubs -\nYou can route Azure Active Directory (Azure AD) activity logs to several endpoints for long term retention and\ndata insights.\nThe Event Hub is used for streaming.\nBox 2: Azure Function -\nUse an Azure Function along with a cosmos DB change feed, and store the data in Cosmos DB.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-activity-logs-azure-\nmonitor\nYour company, named Contoso, Ltd., implements several Azure logic apps that have HTTP triggers. The logic apps\nprovide access to an on-premises web service.", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-activity-logs-azure-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 16, "pdfId": 16, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/16" }, "markersInGap": [ 16 ], "questionText": "Contoso establishes a partnership with another company named Fabrikam, Inc.\nFabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0\nidentity management to authenticate its users.\nDevelopers at Fabrikam plan to use a subset of the logic apps to build applications that will integrate with the on-\npremises web service of Contoso.\n You need to design a solution to provide the Fabrikam developers with access to the logic apps. The solution must\nmeet the following requirements:\n✑\n Requests to the logic apps from the developers must be limited to lower rates than the requests from the users\nat Contoso.\n✑\n The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps.\n✑\n The solution must NOT require changes to the logic apps.\n✑\n The solution must NOT use Azure AD guest accounts.\nWhat should you include in the solution?\nA.\nAzure Front Door\nB.\nAzure AD Application Proxy\nC.\nAzure AD business-to-business (B2B)\nD.\nAzure API Management", "stem": "Contoso establishes a partnership with another company named Fabrikam, Inc. Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0 identity management to authenticate its users. Developers at Fabrikam plan to use a subset of the logic apps to build applications that will integrate with the on- premises web service of Contoso. You need to design a solution to provide the Fabrikam developers with access to the logic apps. The solution must meet the following requirements: ✑ Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso. ✑ The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps. ✑ The solution must NOT require changes to the logic apps. ✑ The solution must NOT use Azure AD guest accounts. What should you include in the solution", "options": [ { "key": "A", "text": "Azure Front Door" }, { "key": "B", "text": "Azure AD Application Proxy" }, { "key": "C", "text": "Azure AD business-to-business (B2B)" }, { "key": "D", "text": "Azure API Management" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Many APIs support OAuth 2.0 to secure the API and ensure that only valid users have access, and they can\nonly access resources to which they're entitled. To use Azure API Management's interactive developer\nconsole with such APIs, the service allows you to configure your service instance to work with your OAuth 2.0\nenabled API.\nIncorrect:\nAzure AD business-to-business (B2B) uses guest accounts.\nAzure AD Application Proxy is for on-premises scenarios.", "reference": "https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-oauth2", "references": [ "https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-oauth2" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 17, "pdfId": 17, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/17" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: A Log Analytics workspace\nSend resource logs to a Log Analytics workspace to enable the features of Azure Monitor Logs.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#azure-monitor-agent", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs", "https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#azure-monitor-agent" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 18, "pdfId": 18, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/18" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure AD Privileged Identity Management\nPrivileged Identity Management provides time-based and approval-based role activation to mitigate the risks\nof excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of\nthe key features of Privileged Identity Management:\nProvide just-in-time privileged access to Azure AD and Azure resources\nAssign time-bound access to resources using start and end dates\nRequire approval to activate privileged roles\nEnforce multi-factor authentication to activate any role\nUse justification to understand why users activate\nGet notifications when privileged roles are activated\nConduct access reviews to ensure users still need roles\nDownload audit history for internal or external audit\nPrevents removal of the last active Global Administrator role assignment\nBox 2: Azure Managed Identity -\nManaged identities provide an identity for applications to use when connecting to resources that support\nAzure Active Directory (Azure AD) authentication.\nApplications may use the managed identity to obtain Azure AD tokens. With Azure Key Vault, developers can\nuse managed identities to access resources. Key\nVault stores credentials in a secure manner and gives access to storage accounts.\nBox 3: Azure AD Privileged Identity Management\nPrivileged Identity Management provides time-based and approval-based role activation to mitigate the risks\nof excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of\nthe key features of Privileged Identity Management:\nProvide just-in-time privileged access to Azure AD and Azure resources\nAssign time-bound access to resources using start and end dates", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure\nhttps://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure", "https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 19, "pdfId": 19, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/19" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Management Groups (2):\nOne management group per tenant to organize the subscriptions within each tenant.\nBlueprint Definitions (2):\nSince Blueprints are tenant-scoped, you need one Blueprint definition per tenant (East and West).\nBlueprint Assignments (4):\nAssign the Blueprint to each subscription individually (Sub1, Sub2, Sub3, Sub4) because resource\ndeployments (resource groups, web apps, Cosmos DB accounts) require subscription-level assignments.\nEven though you might use the same Blueprint definition within a tenant, you need separate assignments for", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 20, "pdfId": 20, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/20" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Modify -\nModify is used to add, update, or remove properties or tags on a subscription or resource during creation or\nupdate. A common example is updating tags on resources such as costCenter. Existing non-compliant\nresources can be remediated with a remediation task. A single Modify rule can have any number of operations.\nPolicy assignments with effect set as Modify require a managed identity to do remediation.\nIncorrect:\n* The following effects are deprecated: EnforceOPAConstraint EnforceRegoPolicy\n* Append is used to add additional fields to the requested resource during creation or update. A common\nexample is specifying allowed IPs for a storage resource.\nAppend is intended for use with non-tag properties. While Append can add tags to a resource during a create\nor update request, it's recommended to use the\nModify effect for tags instead.\nBox 2: A managed identity with the Contributor role\nThe managed identity needs to be granted the appropriate roles required for remediating resources to grant\nthe managed identity.\nContributor - Can create and manage all types of Azure resources but can't grant access to others.\nIncorrect:\nUser Access Administrator: lets you manage user access to Azure resources.", "reference": "https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects https://docs.microsoft.com/en-\nus/azure/governance/policy/how-to/remediate-resources https://docs.microsoft.com/en-us/azure/role-based-\naccess-control/built-in-roles", "references": [ "https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects", "https://docs.microsoft.com/en-", "https://docs.microsoft.com/en-us/azure/role-based-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 21, "pdfId": 21, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/21" }, "markersInGap": [], "questionText": "HOTSPOT -\nYou have an Azure subscription that contains the resources shown in the following table.\nYou create an Azure SQL database named DB1 that is hosted in the East US Azure region.\nTo DB1, you add a diagnostic setting named Settings1. Settings1 archive SQLInsights to storage1 and sends\nSQLInsights to Workspace1.\nFor each of the following statements, select Yes if the statement is true. Otherwise, select No.\nHot Area:", "stem": "You have an Azure subscription that contains the resources shown in the following table. You create an Azure SQL database named DB1 that is hosted in the East US Azure region. To DB1, you add a diagnostic setting named Settings1. Settings1 archive SQLInsights to storage1 and sends SQLInsights to Workspace1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes -\nA single diagnostic setting can define no more than one of each of the destinations. If you want to send data\nto more than one of a particular destination type (for example, two different Log Analytics workspaces), then\ncreate multiple settings.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings\nhttps://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-\nexport-configure?tabs=azure-portal", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings", "https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-" ], "note": "This diagnostic telemetry can be streamed to one of the following Azure resources for analysis.\n* Log Analytics workspace\n* Azure Event Hubs\n* Azure Storage\nBox 2: Yes\nSending logs to a Log Analytics workspace is a core functionality of diagnostic settings. This allows deeper\nlog analysis with Kusto Query Language (KQL).\nWorkspace2 is another workspace, and as long as it's correctly configured, SQLInsights logs can be routed to\nit.\nBox 3: Yes .\nHub1 is likely an Event Hub. Diagnostic settings support sending logs to Event Hubs, often used for\nintegration with third-party SIEM or custom logging pipelines.\nThus, sending SQLInsights logs to Hub1 is valid.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings\nhttps://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-\nexport-configure?tabs=azure-portal", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 22, "pdfId": 22, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/22" }, "markersInGap": [], "questionText": "You plan to deploy an Azure SQL database that will store Personally Identifiable Information (PII).\nYou need to ensure that only privileged users can view the PII.\nWhat should you include in the solution?\nA.\ndynamic data masking\nB.\nrole-based access control (RBAC)\nC.\nData Discovery & Classification\nD.\nTransparent Data Encryption (TDE)", "stem": "You plan to deploy an Azure SQL database that will store Personally Identifiable Information (PII). You need to ensure that only privileged users can view the PII. What should you include in the solution", "options": [ { "key": "A", "text": "dynamic data masking" }, { "key": "B", "text": "role-based access control (RBAC)" }, { "key": "C", "text": "Data Discovery & Classification" }, { "key": "D", "text": "Transparent Data Encryption (TDE)" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Dynamic data masking limits sensitive data exposure by masking it to non-privileged users.\nDynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to\ndesignate how much of the sensitive data to reveal with minimal impact on the application layer. It's a policy-\nbased security feature that hides the sensitive data in the result set of a query over designated database\nfields, while the data in the database is not changed.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-sql/database/dynamic-data-masking-overview", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 23, "pdfId": 23, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/23" }, "markersInGap": [], "questionText": "You plan to deploy an app that will use an Azure Storage account.\nYou need to deploy the storage account. The storage account must meet the following requirements:\n✑\n Store the data for multiple users.\n✑\n Encrypt each user's data by using a separate key.\n✑\n Encrypt all the data in the storage account by using customer-managed keys.\nWhat should you deploy?\nA.\nfiles in a premium file share storage account\nB.\nblobs in a general purpose v2 storage account\nC.\nblobs in an Azure Data Lake Storage Gen2 account\nD.\nfiles in a general purpose v2 storage account", "stem": "You plan to deploy an app that will use an Azure Storage account. You need to deploy the storage account. The storage account must meet the following requirements: ✑ Store the data for multiple users. ✑ Encrypt each user's data by using a separate key. ✑ Encrypt all the data in the storage account by using customer-managed keys. What should you deploy", "options": [ { "key": "A", "text": "files in a premium file share storage account" }, { "key": "B", "text": "blobs in a general purpose v2 storage account" }, { "key": "C", "text": "blobs in an Azure Data Lake Storage Gen2 account" }, { "key": "D", "text": "files in a general purpose v2 storage account" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You can specify a customer-provided key on Blob storage operations. A client making a read or write request\nagainst Blob storage can include an encryption key on the request for granular control over how blob data is\nencrypted and decrypted.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 24, "pdfId": 24, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/24" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Key Vault references in Application settings.\nSource Application Settings from Key Vault.\nKey Vault references can be used as values for Application Settings, allowing you to keep secrets in Key\nVault instead of the site config. Application Settings are securely encrypted at rest, but if you need secret\nmanagement capabilities, they should go into Key Vault.\nTo use a Key Vault reference for an app setting, set the reference as the value of the setting. Your app can\nreference the secret through its key as normal. No code changes are required.\nBox 2: Secrets: Get .\nIn order to read secrets from Key Vault, you need to have a vault created and give your app permission to\naccess it.\n1. Create a key vault by following the Key Vault quickstart.\n2. Create a managed identity for your application.\n3. Key Vault references will use the app's system assigned identity by default, but you can specify a user-\nassigned identity.\n4. Create an access policy in Key Vault for the application identity you created earlier. Enable the \"Get\" secret\npermission on this policy.", "reference": "https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references\nhttps://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references", "references": [ "https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references", "https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 25, "pdfId": 25, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/25" }, "markersInGap": [ 25 ], "questionText": "You plan to deploy an application named App1 that will run on five Azure virtual machines. Additional virtual\nmachines will be deployed later to run App1.\nYou need to recommend a solution to meet the following requirements for the virtual machines that will run App1:\n✑\n Ensure that the virtual machines can authenticate to Azure Active Directory (Azure AD) to gain access to an\nAzure key vault, Azure Logic Apps instances, and an Azure SQL database.\n✑\n Avoid assigning new roles and permissions for Azure services when you deploy additional virtual machines.\n✑\n Avoid storing secrets and certificates on the virtual machines.\n ✑\n Minimize administrative effort for managing identities.\nWhich type of identity should you include in the recommendation?\nA.\na system-assigned managed identity\nB.\na service principal that is configured to use a certificate\nC.\na service principal that is configured to use a client secret\nD.\na user-assigned managed identity", "stem": "You plan to deploy an application named App1 that will run on five Azure virtual machines. Additional virtual machines will be deployed later to run App1. You need to recommend a solution to meet the following requirements for the virtual machines that will run App1: ✑ Ensure that the virtual machines can authenticate to Azure Active Directory (Azure AD) to gain access to an Azure key vault, Azure Logic Apps instances, and an Azure SQL database. ✑ Avoid assigning new roles and permissions for Azure services when you deploy additional virtual machines. ✑ Avoid storing secrets and certificates on the virtual machines. ✑ Minimize administrative effort for managing identities. Which type of identity should you include in the recommendation", "options": [ { "key": "A", "text": "a system-assigned managed identity" }, { "key": "B", "text": "a service principal that is configured to use a certificate" }, { "key": "C", "text": "a service principal that is configured to use a client secret" }, { "key": "D", "text": "a user-assigned managed identity" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Managed identities provide an identity for applications to use when connecting to resources that support\nAzure Active Directory (Azure AD) authentication.\nA user-assigned managed identity:\nCan be shared.\nThe same user-assigned managed identity can be associated with more than one Azure resource.\nCommon usage:\nWorkloads that run on multiple resources and can share a single identity.\nFor example, a workload where multiple virtual machines need to access the same resource.\nIncorrect:\nNot A: A system-assigned managed identity can't be shared. It can only be associated with a single Azure\nresource.\nTypical usage:\nWorkloads that are contained within a single Azure resource.\nWorkloads for which you need independent identities.\nFor example, an application that runs on a single virtual machine.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 26, "pdfId": 26, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/26" }, "markersInGap": [ 26 ], "questionText": "You have the resources shown in the following table:\nCDB1 hosts a container that stores continuously updated operational data.\nYou are designing a solution that will use AS1 to analyze the operational data daily.\nYou need to recommend a solution to analyze the data without affecting the performance of the operational data\nstore.\nWhat should you include in the recommendation?\n A.\nAzure Cosmos DB change feed\nB.\nAzure Data Factory with Azure Cosmos DB and Azure Synapse Analytics connectors\nC.\nAzure Synapse Link for Azure Cosmos DB\nD.\nAzure Synapse Analytics with PolyBase data loading", "stem": "You have the resources shown in the following table: CDB1 hosts a container that stores continuously updated operational data. You are designing a solution that will use AS1 to analyze the operational data daily. You need to recommend a solution to analyze the data without affecting the performance of the operational data store. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Cosmos DB change feed" }, { "key": "B", "text": "Azure Data Factory with Azure Cosmos DB and Azure Synapse Analytics connectors" }, { "key": "C", "text": "Azure Synapse Link for Azure Cosmos DB" }, { "key": "D", "text": "Azure Synapse Analytics with PolyBase data loading" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Synapse Link for Azure Cosmos DB creates a tight integration between Azure Cosmos DB and Azure\nSynapse Analytics. It enables customers to run near real-time analytics over their operational data with full\nperformance isolation from their transactional workloads and without an ETL pipeline.", "reference": "https://docs.microsoft.com/en-us/azure/cosmos-db/synapse-link-frequently-asked-questions", "references": [ "https://docs.microsoft.com/en-us/azure/cosmos-db/synapse-link-frequently-asked-questions" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 27, "pdfId": 27, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/27" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 90 days -\nAs per exhibit.\nBox 2: 730 days -", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/app/data-retention-privacy", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/app/data-retention-privacy" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 28, "pdfId": 28, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/28" }, "markersInGap": [ 28 ], "questionText": "You have an application that is used by 6,000 users to validate their vacation requests. The application manages its\nown credential store.\nUsers must enter a username and password to access the application. The application does NOT support identity\nproviders.\nYou plan to upgrade the application to use single sign-on (SSO) authentication by using an Azure Active Directory\n(Azure AD) application registration.\nWhich SSO method should you use?\nA.\nheader-based\nB.\nSAML\nC.\npassword-based\n D.\nOpenID Connect", "stem": "You have an application that is used by 6,000 users to validate their vacation requests. The application manages its own credential store. Users must enter a username and password to access the application. The application does NOT support identity providers. You plan to upgrade the application to use single sign-on (SSO) authentication by using an Azure Active Directory (Azure AD) application registration. Which SSO method should you use", "options": [ { "key": "A", "text": "header-based" }, { "key": "B", "text": "SAML" }, { "key": "C", "text": "password-based" }, { "key": "D", "text": "OpenID Connect" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Password - On-premises applications can use a password-based method for SSO. This choice works when\napplications are configured for Application Proxy.\nWith password-based SSO, users sign in to the application with a username and password the first time they\naccess it. After the first sign-on, Azure AD provides the username and password to the application. Password-\nbased SSO enables secure application password storage and replay using a web browser extension or mobile\napp. This option uses the existing sign-in process provided by the application, enables an administrator to\nmanage the passwords, and doesn't require the user to know the password.\nIncorrect:\nChoosing an SSO method depends on how the application is configured for authentication. Cloud applications\ncan use federation-based options, such as OpenID\nConnect, OAuth, and SAML.\nFederation - When you set up SSO to work between multiple identity providers, it's called federation.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 29, "pdfId": 29, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/29" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Azure Bastion .\nAzure Bastion provides secure RDP and SSH connectivity to Azure VMs over SSL, directly in the Azure portal\n— without exposing the VMs to the public internet.\nIt eliminates the need for a public IP address and reduces exposure to threats like port scanning.\nIdeal for environments like VNET1 where secure, managed access is needed.\nConditional Access Policy that has the cloud apps assignment set to Microsoft Azure management.\nAzure bastion client access is authorized and authenticated when trying to log into the Azure portal. You can\nenable MFA on the Azure portal access by using the Conditional access policy for Microsoft Azure\nManagement. We use this currently at work, it works very well!\nAzure bastion proxies the web portal requests via https to the servers running in the VNET.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 30, "pdfId": 30, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/30" }, "markersInGap": [], "questionText": "You are designing an Azure governance solution.\nAll Azure resources must be easily identifiable based on the following operational information: environment,\nowner, department and cost center.\nYou need to ensure that you can use the operational information when you generate reports for the Azure\nresources.\nWhat should you include in the solution?\nA.\nan Azure data catalog that uses the Azure REST API as a data source\nB.\nan Azure management group that uses parent groups to create a hierarchy\nC.\nan Azure policy that enforces tagging rules\nD.\nAzure Active Directory (Azure AD) administrative units", "stem": "You are designing an Azure governance solution. All Azure resources must be easily identifiable based on the following operational information: environment, owner, department and cost center. You need to ensure that you can use the operational information when you generate reports for the Azure resources. What should you include in the solution", "options": [ { "key": "A", "text": "an Azure data catalog that uses the Azure REST API as a data source" }, { "key": "B", "text": "an Azure management group that uses parent groups to create a hierarchy" }, { "key": "C", "text": "an Azure policy that enforces tagging rules" }, { "key": "D", "text": "Azure Active Directory (Azure AD) administrative units" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "You apply tags to your Azure resources, resource groups, and subscriptions to logically organize them into a\ntaxonomy. Each tag consists of a name and a value pair.\nYou use Azure Policy to enforce tagging rules and conventions. By creating a policy, you avoid the scenario of\nresources being deployed to your subscription that don't have the expected tags for your organization.\nInstead of manually applying tags or searching for resources that aren't compliant, you create a policy that\nautomatically applies the needed tags during deployment.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 31, "pdfId": 31, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/31" }, "markersInGap": [], "questionText": "A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with Microsoft\n365 and an Azure subscription.\nContoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory\nDomain Services (AD DS) and Azure AD Connect.\nContoso has a partnership with a company named Fabrikam. Inc. Fabrikam has an Active Directory forest and a\nMicrosoft 365 tenant. Fabrikam has the same on- premises identity infrastructure components as Contoso.\nA team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription\nof Contoso. The developers must be added to the Contributor role for a resource group in the Contoso subscription.\nYou need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The\nsolution must ensure that the Fabrikam developers use their existing credentials to access resources\nWhat should you recommend?\nA.\nIn the Azure AD tenant of Contoso. create cloud-only user accounts for the Fabrikam developers.\nB.\nConfigure a forest trust between the on-premises Active Directory forests of Contoso and Fabrikam.\nC.\nConfigure an organization relationship between the Microsoft 365 tenants of Fabrikam and Contoso.\nD.\nIn the Azure AD tenant of Contoso, create guest accounts for the Fabnkam developers.", "stem": "A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with Microsoft 365 and an Azure subscription. Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory Domain Services (AD DS) and Azure AD Connect. Contoso has a partnership with a company named Fabrikam. Inc. Fabrikam has an Active Directory forest and a Microsoft 365 tenant. Fabrikam has the same on- premises identity infrastructure components as Contoso. A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription of Contoso. The developers must be added to the Contributor role for a resource group in the Contoso subscription. You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The solution must ensure that the Fabrikam developers use their existing credentials to access resources What should you recommend", "options": [ { "key": "A", "text": "In the Azure AD tenant of Contoso. create cloud-only user accounts for the Fabrikam developers." }, { "key": "B", "text": "Configure a forest trust between the on-premises Active Directory forests of Contoso and Fabrikam." }, { "key": "C", "text": "Configure an organization relationship between the Microsoft 365 tenants of Fabrikam and Contoso." }, { "key": "D", "text": "In the Azure AD tenant of Contoso, create guest accounts for the Fabnkam developers." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "You can use the capabilities in Azure Active Directory B2B to collaborate with external guest users and you\ncan use Azure RBAC to grant just the permissions that guest users need in your environment.\nIncorrect:\nNot B: Forest trust is used for internal security, not external access.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-external-users", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-external-users" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 32, "pdfId": 32, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/32" }, "markersInGap": [ 31, 32 ], "questionText": "Your company has the divisions shown in the following table.\nSub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.\nYou need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nConfigure the Azure AD provisioning service.\nB.\nEnable Azure AD pass-through authentication and update the sign-in endpoint.\n C.\nUse Azure AD entitlement management to govern external users.\nD.\nConfigure Azure AD join.", "stem": "Your company has the divisions shown in the following table. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Configure the Azure AD provisioning service." }, { "key": "B", "text": "Enable Azure AD pass-through authentication and update the sign-in endpoint." }, { "key": "C", "text": "Use Azure AD entitlement management to govern external users." }, { "key": "D", "text": "Configure Azure AD join." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "The app is single tenant authentication so users must be present in contoso directory.\nhttps://docs.microsoft.com/en-us/azure/active-directory/develop/single-and-multi-tenant-apps\nWith Azure AD B2B, external users authenticate to their home directory, but have a representation in your\ndirectory.\nhttps://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-\nusers\nA is wrong because its to automate provisioning to third party SaaS app.\nhttps://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/how-provisioning-works?\nsource=recommendations\nB. is wrong because the application would need to switch to multi tenant..\nhttps://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 33, "pdfId": 33, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/33" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure AD -\nGrant permissions in Azure AD.\nBox 2: Azure API Management -\nConfigure a JWT validation policy to pre-authorize requests.\nPre-authorize requests in API Management with the Validate JWT policy, by validating the access tokens of", "reference": "https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad", "references": [ "https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 34, "pdfId": 34, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/34" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nAzure Log Analytics\nB.\nAzure Arc\nC.\nAzure Analysis Services\nD.\nApplication Insights", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Log Analytics" }, { "key": "B", "text": "Azure Arc" }, { "key": "C", "text": "Azure Analysis Services" }, { "key": "D", "text": "Application Insights" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The Activity log is a platform log in Azure that provides insight into subscription-level events. Activity log\nincludes such information as when a resource is modified or when a virtual machine is started.\nActivity log events are retained in Azure for 90 days and then deleted.\nFor more functionality, you should create a diagnostic setting to send the Activity log to one or more of these\nlocations for the following reasons: to Azure Monitor Logs for more complex querying and alerting, and longer\nretention (up to two years) to Azure Event Hubs to forward outside of Azure to Azure Storage for cheaper,\nlong-term archiving", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log\nYour company has the divisions shown in the following table.\nSub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log" ], "note": "Azure Monitor builds on top of Log Analytics, the platform service that gathers log and metrics data\nfrom all your resources. The easiest way to think about it is that Azure Monitor is the marketing name,\nwhereas Log Analytics is the technology that powers it.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 35, "pdfId": 35, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/35" }, "markersInGap": [], "questionText": "You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nConfigure the Azure AD provisioning service.\nB.\nConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).\nC.\nUse Azure AD entitlement management to govern external users.\nD.\nConfigure Azure AD Identity Protection.", "stem": "You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Configure the Azure AD provisioning service." }, { "key": "B", "text": "Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM)." }, { "key": "C", "text": "Use Azure AD entitlement management to govern external users." }, { "key": "D", "text": "Configure Azure AD Identity Protection." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Entitlement management is an identity governance capability that enables organizations to manage identity\nand access lifecycle at scale by automating access request workflows, access assignments, reviews, and\nexpiration. Entitlement management allows delegated non-admins to create access packages that external\nusers from other organizations can request access to. One and multi-stage approval workflows can be\nconfigured to evaluate requests, and provision users for time-limited access with recurring reviews.\nEntitlement management enables policy-based provisioning and deprovisioning of external accounts.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/6-secure-access-entitlement-\nmanagment https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/how-provisioning-\nworks https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-\nconfigure\nYou are developing an app that will read activity logs for an Azure subscription by using Azure Functions.", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/6-secure-access-entitlement-", "https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/how-provisioning-", "https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-" ], "note": "Access Packages -\nAn access package is the foundation of entitlement management. Access packages are groupings of policy-\ngoverned resources a user needs to collaborate on a project or do other tasks. For example, an access\npackage might include: access to specific SharePoint sites. enterprise applications including your custom in-\nhouse and SaaS apps like Salesforce.\nMicrosoft Teams.\nMicrosoft 365 Groups.\nIncorrect:\nNot A: Automatic provisioning refers to creating user identities and roles in the cloud applications that users\nneed access to. In addition to creating user identities, automatic provisioning includes the maintenance and\nremoval of user identities as status or roles change.\nNot B: Privileged Identity Management provides time-based and approval-based role activation to mitigate the\nrisks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are\nsome of the key features of Privileged Identity Management:\nProvide just-in-time privileged access to Azure AD and Azure resources\nAssign time-bound access to resources using start and end dates\nEtc.\nReference:\nhttps://docs.microsoft.com/en-us/azure/active-directory/fundamentals/6-secure-access-entitlement-\nmanagment https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/how-provisioning-\nworks https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-\nconfigure", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 36, "pdfId": 36, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/36" }, "markersInGap": [], "questionText": "You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative\neffort.\nWhat should you include in the recommendation?\nA.\nan enterprise application in Azure AD\nB.\nsystem-assigned managed identities\nC.\nshared access signatures (SAS)\nD.\napplication registration in Azure AD", "stem": "You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative effort. What should you include in the recommendation", "options": [ { "key": "A", "text": "an enterprise application in Azure AD" }, { "key": "B", "text": "system-assigned managed identities" }, { "key": "C", "text": "shared access signatures (SAS)" }, { "key": "D", "text": "application registration in Azure AD" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. System-assigned managed identities\n- System-assigned managed identities allow Azure Functions to securely authenticate to Azure services\nwithout requiring credentials.\n- Azure automatically manages the identity lifecycle, eliminating the need for manual secret management.\n- The managed identity can be granted permissions to read Azure Activity Logs via Azure RBAC.\n- This solution minimizes administrative effort because there are no credentials to store, rotate, or manage.\nWhy Not the Other Options?\n- A. Enterprise application in Azure AD\n→\n Used for user authentication in applications, but not ideal for Azure\nFunctions accessing Azure resources.\n- C. Shared Access Signatures (SAS)\n→\n SAS tokens are used for storage access and require manual\nmanagement, making them less secure and more complex.\n- D. Application registration in Azure AD\n→\n Requires manual secret management and certificate rotation,\nincreasing administrative overhead.", "reference": "https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts?tabs=v4\nhttps://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization", "references": [ "https://learn.microsoft.com/en-us/azure/azure-functions/security-concepts?tabs=v4", "https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 37, "pdfId": 37, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/37" }, "markersInGap": [ 36, 37 ], "questionText": "Your company has the divisions shown in the following table.\n Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.\nYou need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nConfigure Azure AD join.\nB.\nUse Azure AD entitlement management to govern external users.\nC.\nEnable Azure AD pass-through authentication and update the sign-in endpoint.\nD.\nConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).", "stem": "Your company has the divisions shown in the following table. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Configure Azure AD join." }, { "key": "B", "text": "Use Azure AD entitlement management to govern external users." }, { "key": "C", "text": "Enable Azure AD pass-through authentication and update the sign-in endpoint." }, { "key": "D", "text": "Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM)." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Use Azure AD Entitlement Management to govern external users.\nAzure AD Entitlement Management allows organizations to manage access for external users (such as those\nfrom fabrikam.com) without requiring manual user creation.\n- It enables self-service access requests, automated approvals, and access reviews.\n- This solution is ideal for cross-tenant authentication while maintaining security and governance.\nWhy Not the Other Options?\n- A. Configure Azure AD join\n→\n Azure AD join is used for device management, not for enabling authentication\nfor external users.\n- C. Enable Azure AD pass-through authentication and update the sign-in endpoint\n→\n Pass-through\nauthentication is used for on-premises authentication, not for external tenant users.\n- D. Configure assignments for fabrikam.com users using Azure AD Privileged Identity Management (PIM)\n→\nPIM is used for privileged role assignments, not for general authentication of external users.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 38, "pdfId": 38, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/38" }, "markersInGap": [ 38 ], "questionText": "Your company has the divisions shown in the following table.\nSub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.\nYou need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nConfigure Azure AD join.\n B.\nConfigure Azure AD Identity Protection.\nC.\nUse Azure AD entitlement management to govern external users.\nD.\nConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).", "stem": "Your company has the divisions shown in the following table. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Configure Azure AD join." }, { "key": "B", "text": "Configure Azure AD Identity Protection." }, { "key": "C", "text": "Use Azure AD entitlement management to govern external users." }, { "key": "D", "text": "Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM)." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Use Azure AD Entitlement Management to govern external users.\nAzure AD Entitlement Management allows organizations to manage access for external users (such as those\nfrom fabrikam.com) without requiring manual user creation.\n- It enables self-service access requests, automated approvals, and access reviews.\n- This solution is ideal for cross-tenant authentication while maintaining security and governance.\nWhy Not the Other Options?\n- A. Configure Azure AD join\n→\n Azure AD join is used for device management, not for enabling authentication\nfor external users.\n- B. Configure Azure AD Identity Protection\n→\n Identity Protection is used for detecting and mitigating identity\nrisks, not for enabling authentication for external users.\n- D. Configure assignments for fabrikam.com users using Azure AD Privileged Identity Management (PIM)\n→\nPIM is used for privileged role assignments, not for general authentication of external users.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 39, "pdfId": 39, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/39" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nAzure Activity Log\nB.\nAzure Arc\nC.\nAzure Analysis Services\nD.\nAzure Monitor metrics", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Activity Log" }, { "key": "B", "text": "Azure Arc" }, { "key": "C", "text": "Azure Analysis Services" }, { "key": "D", "text": "Azure Monitor metrics" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Azure Activity Log.\n- Azure Activity Log records all ARM resource deployments, including who deployed the resource, when it was\ndeployed, and its status.\n- You can query the Activity Log using Azure Monitor Logs and Kusto Query Language (KQL).\n- Reports can be scheduled monthly using Azure Monitor Workbooks or Log Analytics.\n- This solution provides detailed insights into resource deployments without requiring additional services.\nWhy Not the Other Options?\n- B. Azure Arc\n→\n Used for managing hybrid and multi-cloud resources, not for tracking ARM deployments.\n- C. Azure Analysis Services\n→\n Used for business intelligence and data modeling, not for logging Azure\ndeployments.\n- D. Azure Monitor metrics\n→\n Tracks performance metrics (CPU, memory, etc.), but does not log ARM\ndeployments.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 40, "pdfId": 40, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/40" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Client credentials grant flows .\nThe client credentials grant flow is used for server-to-server communication — where the app authenticates\nas itself (no user interaction involved).\nThis flow is commonly used for background services, daemons, or APIs that need to access resources or APIs\non behalf of themselves, not a user.\nApp1 in this context appears to be an application (likely a daemon or service) accessing Azure services, so\nclient credentials grant is appropriate.\nOAuth 2.0 access token endpoint of Azure AD .\nTo get a token using the client credentials flow, the app needs to call the token endpoint of Azure Active\nDirectory (Azure AD).\nThe OAuth 2.0 access token endpoint of Azure AD is specifically designed to issue tokens for Azure-secured\nresources, like Microsoft Graph, custom APIs, or Azure services.\nThis is the standard endpoint for apps registered in Azure AD.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 41, "pdfId": 41, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/41" }, "markersInGap": [], "questionText": "Your company has the divisions shown in the following table.\nSub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.\nYou need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nConfigure Azure AD join.\nB.\nConfigure Azure AD Identity Protection.\nC.\nConfigure a Conditional Access policy.\nD.\nConfigure Supported account types in the application registration and update the sign-in endpoint.", "stem": "Your company has the divisions shown in the following table. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Configure Azure AD join." }, { "key": "B", "text": "Configure Azure AD Identity Protection." }, { "key": "C", "text": "Configure a Conditional Access policy." }, { "key": "D", "text": "Configure Supported account types in the application registration and update the sign-in endpoint." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Configure Supported account types in the application registration and update the sign-in endpoint.", "reference": "https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types\nhttps://learn.microsoft.com/en-us/azure/active-directory/develop/howto-modify-supported-accounts\nYou have an Azure AD tenant named contoso.com that has a security group named Group1. Group1 is configured\nfor assigned memberships. Group1 has 50 members, including 20 guest users.", "references": [ "https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types", "https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-modify-supported-accounts" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 42, "pdfId": 42, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/42" }, "markersInGap": [], "questionText": "You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following\nrequirements:\n• The evaluation must be repeated automatically every three months.\n• Every member must be able to report whether they need to be in Group1.\n• Users who report that they do not need to be in Group1 must be removed from Group1 automatically.\n• Users who do not report whether they need to be in Group1 must be removed from Group1 automatically.\nWhat should you include in the recommendation?\nA.\nImplement Azure AD Identity Protection.\nB.\nChange the Membership type of Group1 to Dynamic User.\nC.\nCreate an access review.\nD.\nImplement Azure AD Privileged Identity Management (PIM).", "stem": "You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements: • The evaluation must be repeated automatically every three months. • Every member must be able to report whether they need to be in Group1. • Users who report that they do not need to be in Group1 must be removed from Group1 automatically. • Users who do not report whether they need to be in Group1 must be removed from Group1 automatically. What should you include in the recommendation", "options": [ { "key": "A", "text": "Implement Azure AD Identity Protection." }, { "key": "B", "text": "Change the Membership type of Group1 to Dynamic User." }, { "key": "C", "text": "Create an access review." }, { "key": "D", "text": "Implement Azure AD Privileged Identity Management (PIM)." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Based on the requirements below:\nThe evaluation must be repeated automatically every three months.\n• Every member must be able to report whether they need to be in Group1.\n• Users who report that they do not need to be in Group1 must be removed from Group1 automatically.\n• Users who do not report whether they need to be in Group1 must be removed from Group1 automatically.\nThe correct answer should be - C. Create an access. review.\nhttps://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 43, "pdfId": 43, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/43" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: A user-assigned managed identity\nBox 2: Delegated permissions\nThe question states that we have to minimize the administrative effort and managed identities do just that.\nAdditionally we have 100 VMs so user-assigned managed identity can be used as it can be shared unlike\nsystem-assigned one. I researched a bit and found one helpful article which contains this sentence:\n\"Previously, when we did not have managed identities, we created an application registration for the resource.\nUsing a secret or certificate to authenticate with Azure. This created a lot of overhead, as it required secret\nmanagement, key rotation, etc. With managed identities, Azure takes care of this for us.\"\nalthough app registration could be used, it wouldn't reduce admin effort as much as Managed Identity.\nhttps://adatum.no/azure/azure-active-directory/azure-application-registrations-enterprise-app-managed-\nidentities", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 44, "pdfId": 44, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/44" }, "markersInGap": [], "questionText": "Your company has the divisions shown in the following table.\nSub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.\nYou need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nEnable Azure AD pass-through authentication and update the sign-in endpoint.\nB.\nUse Azure AD entitlement management to govern external users.\nC.\nConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).\nD.\nConfigure Azure AD Identity Protection.", "stem": "Your company has the divisions shown in the following table. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Enable Azure AD pass-through authentication and update the sign-in endpoint." }, { "key": "B", "text": "Use Azure AD entitlement management to govern external users." }, { "key": "C", "text": "Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM)." }, { "key": "D", "text": "Configure Azure AD Identity Protection." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-\noverview#what-can-i-do-with-entitlement-management\nHere are some of capabilities of entitlement management:\n- Select connected organizations whose users can request access. When a user who isn't yet in your directory\nrequests access, and is approved, they're automatically invited into your directory and assigned access. When\ntheir access expires, if they have no other access package assignments, their B2B account in your directory\ncan be automatically removed.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 45, "pdfId": 45, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/45" }, "markersInGap": [ 44, 45 ], "questionText": "Your company has the divisions shown in the following table.\n Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.\nYou need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nConfigure the Azure AD provisioning service.\nB.\nEnable Azure AD pass-through authentication and update the sign-in endpoint.\nC.\nConfigure Supported account types in the application registration and update the sign-in endpoint.\nD.\nConfigure Azure AD join.", "stem": "Your company has the divisions shown in the following table. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Configure the Azure AD provisioning service." }, { "key": "B", "text": "Enable Azure AD pass-through authentication and update the sign-in endpoint." }, { "key": "C", "text": "Configure Supported account types in the application registration and update the sign-in endpoint." }, { "key": "D", "text": "Configure Azure AD join." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Configure Supported account types in the application registration and update the sign-in endpoint.\n- When registering App1 in Azure AD, you can configure the Supported account types to allow authentication\nfrom external tenants like fabrikam.com.\n- You should set the application to allow \"Accounts in any Azure AD directory (multitenant)\" or \"Accounts in\nany Azure AD directory and personal Microsoft accounts\".\n- Updating the sign-in endpoint ensures that users from fabrikam.com can authenticate properly.\nWhy Not the Other Options?\n- A. Configure the Azure AD provisioning service\n→\n Used for automating user account creation and\nsynchronization, but does not directly enable authentication for external users.\n- B. Enable Azure AD pass-through authentication and update the sign-in endpoint\n→\n Pass-through\nauthentication is used for on-premises authentication, not for external tenant users.\n- D. Configure Azure AD join\n→\n Azure AD join is used for device management, not for enabling authentication\nfor external users.", "reference": "https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types", "references": [ "https://learn.microsoft.com/en-us/security/zero-trust/develop/identity-supported-account-types" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 46, "pdfId": 46, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/46" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Since Group 1 is assigned VM contributor to MG1, it will be able to create a new VM in RG1.User 2 is not able to\ngrant permission to Group 2 because it is just a member with contributor role.Since Group 3 has Contributor\nrole for the Tenant Root Group, User3 can create storage account in RG2", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 47, "pdfId": 47, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/47" }, "markersInGap": [ 47 ], "questionText": "Your company has the divisions shown in the following table.\nSub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.\nYou need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nConfigure Azure AD Identity Protection.\nB.\nConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).\nC.\nConfigure Supported account types in the application registration and update the sign-in endpoint.\nD.\nConfigure a Conditional Access policy.", "stem": "Your company has the divisions shown in the following table. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Configure Azure AD Identity Protection." }, { "key": "B", "text": "Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM)." }, { "key": "C", "text": "Configure Supported account types in the application registration and update the sign-in endpoint." }, { "key": "D", "text": "Configure a Conditional Access policy." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Configure Supported account types in the application registration and update the sign-in endpoint.\n- When registering App1 in Azure AD, you can configure the Supported account types to allow authentication\nfrom external tenants like fabrikam.com.\n- You should set the application to allow \"Accounts in any Azure AD directory (multitenant)\" or \"Accounts in\nany Azure AD directory and personal Microsoft accounts\".\n- Updating the sign-in endpoint ensures that users from fabrikam.com can authenticate properly.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 48, "pdfId": 48, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/48" }, "markersInGap": [], "questionText": "Your company has the divisions shown in the following table.\nSub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.\nYou need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nUse Azure AD entitlement management to govern external users.\nB.\nEnable Azure AD pass-through authentication and update the sign-in endpoint.\nC.\nConfigure a Conditional Access policy.\nD.\nConfigure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).", "stem": "Your company has the divisions shown in the following table. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Use Azure AD entitlement management to govern external users." }, { "key": "B", "text": "Enable Azure AD pass-through authentication and update the sign-in endpoint." }, { "key": "C", "text": "Configure a Conditional Access policy." }, { "key": "D", "text": "Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM)." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "This has been repeated many times and has two answers based on the provided possibilities: Its either Use\nAzure AD entitlement management to govern external usersOrConfigure Supported account types in the\napplication registration and update the sign-in endpointBoth answers will lead you to the same solution.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 49, "pdfId": 49, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/49" }, "markersInGap": [ 48, 49 ], "questionText": "You have an Azure subscription that contains 1,000 resources.\nYou need to generate compliance reports for the subscription. The solution must ensure that the resources can be\ngrouped by department.\n What should you use to organize the resources?\nA.\napplication groups and quotas\nB.\nAzure Policy and tags\nC.\nadministrative units and Azure Lighthouse\nD.\nresource groups and role assignments", "stem": "You have an Azure subscription that contains 1,000 resources. You need to generate compliance reports for the subscription. The solution must ensure that the resources can be grouped by department. What should you use to organize the resources", "options": [ { "key": "A", "text": "application groups and quotas" }, { "key": "B", "text": "Azure Policy and tags" }, { "key": "C", "text": "administrative units and Azure Lighthouse" }, { "key": "D", "text": "resource groups and role assignments" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Azure Policy and tags.\nAzure Policy helps enforce governance rules across resources, ensuring compliance with organizational\nstandards.\nTags allow you to organize and categorize resources by applying metadata (e.g., environment, department,\ncost center).\nTogether, Azure Policy and tags provide a structured way to manage and organize resources efficiently.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 50, "pdfId": 50, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/50" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nAzure Arc\nB.\nAzure Monitor metrics\nC.\nAzure Advisor\nD.\nAzure Log Analytics", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Arc" }, { "key": "B", "text": "Azure Monitor metrics" }, { "key": "C", "text": "Azure Advisor" }, { "key": "D", "text": "Azure Log Analytics" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Azure Log Analytics\n- Azure Log Analytics collects and analyzes logs from various Azure services, including Azure Activity Logs,", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 51, "pdfId": 51, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/51" }, "markersInGap": [ 50, 51 ], "questionText": "which track deployments, security events, and operational data.\n- You can query logs using Kusto Query Language (KQL) and generate custom reports.\n- It integrates with Azure Monitor to provide detailed insights into resource performance and usage.\nYou need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\n A.\nAzure Monitor action groups\nB.\nAzure Arc\nC.\nAzure Monitor metrics\nD.\nAzure Activity Log", "stem": "which track deployments, security events, and operational data. - You can query logs using Kusto Query Language (KQL) and generate custom reports. - It integrates with Azure Monitor to provide detailed insights into resource performance and usage. You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Monitor action groups" }, { "key": "B", "text": "Azure Arc" }, { "key": "C", "text": "Azure Monitor metrics" }, { "key": "D", "text": "Azure Activity Log" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Azure Activity Log\n- Azure Activity Log records all ARM resource deployments, including who deployed the resource, when it was\ndeployed, and its status.\n- You can query the Activity Log using Azure Monitor Logs and Kusto Query Language (KQL).\n- Reports can be scheduled monthly using Azure Monitor Workbooks or Log Analytics.\n- This solution provides detailed insights into resource deployments without requiring additional services.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 52, "pdfId": 52, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/52" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "User Administrator for MarketingAU\nThe User Administrator role allows:\nCreating and managing users.\nResetting passwords.\nAssigning users to groups.\nManaging certain user attributes.\nBecause the role is scoped to MarketingAU, User1 can perform these actions only on users within the\nMarketingAU administrative unit, not across the entire tenant.\nHelpdesk Administrator for MarketingAU\nThe Helpdesk Administrator role allows:\nResetting passwords for non-admin users.\nReading basic user information.\nSince the role is scoped to MarketingAU, User2 can reset passwords only for users in the MarketingAU unit\nand only if they are non-administrators.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 53, "pdfId": 53, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/53" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nAzure Arc\nB.\nAzure Log Analytics\nC.\nApplication insights\nD.\nAzure Monitor action groups", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Arc" }, { "key": "B", "text": "Azure Log Analytics" }, { "key": "C", "text": "Application insights" }, { "key": "D", "text": "Azure Monitor action groups" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Azure Log Analytics\n- Azure Log Analytics collects and analyzes logs from various Azure services, including Azure Activity Logs,\nwhich track all ARM resource deployments.\n- You can query deployment events using Kusto Query Language (KQL) in Azure Monitor Logs.\n- Reports can be scheduled monthly using Azure Monitor Workbooks or Log Analytics queries.\n- This solution provides detailed insights into resource deployments and allows for custom filtering.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 54, "pdfId": 54, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/54" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. Storage: c. Secret. API keys are typically stored as secrets in Azure Key Vault. The key vault can store and\nmanage secrets like API keys, passwords, or database connection strings.2. Access: b. A managed service\nidentity (MSI). A managed service identity (MSI) is used to give your VM access to the key vault. The\nadvantage of using MSI is that you do not have to manage credentials yourself. Azure takes care of rolling the\ncredentials and ensuring their lifecycle. The application running on your VM can use its managed service\nidentity to get a token to Azure AD, and then use that token to authenticate to Azure Key Vault.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 55, "pdfId": 55, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/55" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "App1: App Roleshttps://learn.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-\napps#app-roles-uiApp2: Api Permissionshttps://learn.microsoft.com/en-us/azure/active-\ndirectory/develop/howto-add-app-roles-in-apps#assign-app-roles-to-applications", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 56, "pdfId": 56, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/56" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nApplication Insights\nB.\nAzure Arc\nC.\nAzure Log Analytics\nD.\nAzure Monitor metrics", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Application Insights" }, { "key": "B", "text": "Azure Arc" }, { "key": "C", "text": "Azure Log Analytics" }, { "key": "D", "text": "Azure Monitor metrics" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Azure Log Analytics\n- Azure Log Analytics collects and analyzes logs from various Azure services, including Azure Activity Logs,", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 57, "pdfId": 57, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/57" }, "markersInGap": [ 56, 57 ], "questionText": "which track deployments, security events, and operational data.\n- You can query logs using Kusto Query Language (KQL) and generate custom reports.\n- It integrates with Azure Monitor to provide detailed insights into resource performance and usage.\nYou have an Azure subscription.\nYou plan to deploy a monitoring solution that will include the following:\n•Azure Monitor Network Insights\n•Application Insights\n•Microsoft Sentinel\n •VM insights\nThe monitoring solution will be managed by a single team.\nWhat is the minimum number of Azure Monitor workspaces required?\nA.\n1\nB.\n2\nC.\n3\nD.\n4", "stem": "which track deployments, security events, and operational data. - You can query logs using Kusto Query Language (KQL) and generate custom reports. - It integrates with Azure Monitor to provide detailed insights into resource performance and usage. You have an Azure subscription. You plan to deploy a monitoring solution that will include the following: •Azure Monitor Network Insights •Application Insights •Microsoft Sentinel •VM insights The monitoring solution will be managed by a single team. What is the minimum number of Azure Monitor workspaces required", "options": [], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "1. A. 1You only need a single Azure Monitor Log Analytics workspace for all these monitoring solutions. Here's\nwhy:- Azure Monitor Network Insights, Application Insights, Microsoft Sentinel, and VM insights, all of these\ncomponents can send their data to a Log Analytics workspace. - The workspace is a unique environment for\nAzure Monitor log data. Each workspace has its own data repository and configuration, and data sources and\nsolutions are configured to store their data in a workspace.Therefore, a single Azure Monitor Log Analytics\nworkspace can be utilized to collect and analyze data from all the components of the monitoring solution. This\nwill also enable a unified management and analysis of the collected data.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": true } }, { "seq": 58, "pdfId": 58, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/58" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nApplication Insights\nB.\nAzure Analysis Services\nC.\nAzure Advisor\nD.\nAzure Activity Log", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Application Insights" }, { "key": "B", "text": "Azure Analysis Services" }, { "key": "C", "text": "Azure Advisor" }, { "key": "D", "text": "Azure Activity Log" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Azure Activity Log\n- Azure Activity Log records all ARM resource deployments, including who deployed the resource, when it was\ndeployed, and its status.\n- You can query the Activity Log using Azure Monitor Logs and Kusto Query Language (KQL).\n- Reports can be scheduled monthly using Azure Monitor Workbooks or Log Analytics.\n- This solution provides detailed insights into resource deployments without requiring additional services.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 59, "pdfId": 59, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/59" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Minimum number of Azure AD tenants: 1\nAn Azure AD tenant represents a single instance of Azure Active Directory and typically aligns with an\norganization.\nMost solutions can be designed within one tenant using administrative units, conditional access, and role-\nbased access control.\nCreating multiple tenants increases complexity and is usually avoided unless there is a hard separation\nneeded (e.g., legally independent subsidiaries or isolated identity environments).\nMinimum number of conditional access policies to create: 2\nConditional Access (CA) policies are rules that control how users authenticate and access cloud apps. You\nmight need more than one CA policy depending on the goals. For example:\nPolicy 1: Enforce MFA for Admins\nTargets roles like Global Administrator.\nCommon best practice.\nPolicy 2: Require compliant devices for general users\nTargets standard users and enforces access only from compliant or hybrid Azure AD-joined devices.\nThese policies are often split because they apply to different user groups, applications, or access conditions.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 60, "pdfId": 60, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/60" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains 10 web apps. The apps are integrated with Azure AD and are\naccessed by users on different project teams.\nThe users frequently move between projects.\nYou need to recommend an access management solution for the web apps. The solution must meet the following\nrequirements:\n•The users must only have access to the app of the project to which they are assigned currently.\n•Project managers must verify which users have access to their project’s app and remove users that are no longer\nassigned to their project.\n•Once every 30 days, the project managers must be prompted automatically to verify which users are assigned to\ntheir projects.\nWhat should you include in the recommendation?\nA.\nAzure AD Identity Protection\nB.\nMicrosoft Defender for Identity\nC.\nMicrosoft Entra Permissions Management\nD.\nAzure AD Identity Governance", "stem": "You have an Azure subscription that contains 10 web apps. The apps are integrated with Azure AD and are accessed by users on different project teams. The users frequently move between projects. You need to recommend an access management solution for the web apps. The solution must meet the following requirements: •The users must only have access to the app of the project to which they are assigned currently. •Project managers must verify which users have access to their project’s app and remove users that are no longer assigned to their project. •Once every 30 days, the project managers must be prompted automatically to verify which users are assigned to their projects. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure AD Identity Protection" }, { "key": "B", "text": "Microsoft Defender for Identity" }, { "key": "C", "text": "Microsoft Entra Permissions Management" }, { "key": "D", "text": "Azure AD Identity Governance" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Azure AD Identity Governance in the recommendation. Azure AD Identity Governance provides a\ncomprehensive solution for managing identity and access lifecycle, ensuring that access is granted in line\nwith the principle of least privilege and is revoked when no longer needed1. It allows project managers to\nverify which users have access to their project’s app and remove users that are no longer assigned to their\nproject.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 61, "pdfId": 61, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/61" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "DeployIfNotExists.\nThe DeployIfNotExists effect is used in Azure Policy when you want to ensure that a specific resource or\nconfiguration is deployed automatically if it’s missing.\nIt is often used for remediation—for example, ensuring that monitoring agents or diagnostic settings are\napplied.\nThe identity required to perform the remediation task.\nFor the DeployIfNotExists effect to work, Azure must have permission to deploy the missing resource.\nThis requires defining a managed identity in the policy definition that will carry out the deployment.\nThe identity must have sufficient RBAC permissions to perform the remediation tasks (e.g., deploy a\nmonitoring agent).", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 62, "pdfId": 62, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/62" }, "markersInGap": [], "questionText": "You have an Azure subscription. The subscription contains a tiered app named App1 that is distributed across\nmultiple containers hosted in Azure Container Instances.\nYou need to deploy an Azure Monitor monitoring solution for App. The solution must meet the following\nrequirements:\n•Support using synthetic transaction monitoring to monitor traffic between the App1 components.\n•Minimize development effort.\nWhat should you include in the solution?\nA.\nNetwork insights\nB.\nApplication Insights\nC.\nContainer insights\nD.\nLog Analytics Workspace insights", "stem": "You have an Azure subscription. The subscription contains a tiered app named App1 that is distributed across multiple containers hosted in Azure Container Instances. You need to deploy an Azure Monitor monitoring solution for App. The solution must meet the following requirements: •Support using synthetic transaction monitoring to monitor traffic between the App1 components. •Minimize development effort. What should you include in the solution", "options": [ { "key": "A", "text": "Network insights" }, { "key": "B", "text": "Application Insights" }, { "key": "C", "text": "Container insights" }, { "key": "D", "text": "Log Analytics Workspace insights" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Application Insights.\n- Application Insights provides synthetic transaction monitoring, allowing you to simulate user interactions\nand test application performance.\n- It includes availability tests, which can monitor traffic between App1 components by sending periodic\nrequests and measuring response times.\n- Minimal development effort is required since Application Insights offers built-in monitoring tools without\nneeding custom scripts.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 63, "pdfId": 63, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/63" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Workspace 1\nChange to a commitment pricing tier.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\nbudgets\nB.\nresource tags\nC.\ncustom role-based access control (RBAC) roles\nD.\nmanagement groups\nE.\nAzure boards", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 64, "pdfId": 64, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/64" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "1. Resource Tags (B): Tagging is an easy way to classify assets. That metadata can be used to classify the\nasset based on various data points. When tags are used to classify assets as part of a cost management\neffort, companies often need tags such as project. Azure Cost Management + Billing can use these tags to\ncreate different views of cost data.Budgets (A): Budgets in Azure Cost Management + Billing help you plan for\nand drive organizational accountability. With budgets, you can account for the Azure services you consume or\nsubscribe to during a specific period, and proactively notify teams about how they’re tracking against their\nspending targets.\n2. To monitor costs on a per project basis using Microsoft Cost Management, you should include the following\ncomponents in your solution:A. Budgets: Azure Cost Management + Billing allows you to create and manage\nbudgets, which can help you monitor costs proactively1.B. Resource Tags: Tagging is an easy way to classify\nassets. Tagging associates metadata to an asset, which can be used to classify the asset based on various\ndata points. When tags are used to classify assets as part of a cost management effort, companies often need\ntags such as project, business unit, department, billing code, geography, environment, and workload or\napplication categorization2. Azure Cost Management + Billing can use these tags to create different views of\ncost data2.So the correct answers are A. budgets and B. resource tags.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 65, "pdfId": 65, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/65" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "HOTSPOT - You have an Azure subscription. You plan to deploy five storage accoun", "keys": [ "HOTSPOT - You have an Azure subscription. You plan to deploy five storage accoun" ] }, "explanation": "1. For the blobs - a user delegation SAS only To maximize security it's better to use a user delegation\nSAS:From docs: As a security best practice, we recommend that you use Azure AD credentials when possible,\nrather than the account key, which can be more easily compromised. When your application design requires\nshared access signatures, use Azure AD credentials to create a user delegation SAS to help ensure better\nsecurity. This also prevents using shared keys & supports time-limited access. Note: user delegation SAS do\nnot support stored access policies.\n2. For the file shares - Azure AD credentials It fulfills the requirement to maximize security (the most secure\nway recommended by Microsoft), but doesn't support time-limited access, which is optional and has lower\npriority than security.", "reference": "https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas.", "references": [ "https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas." ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 66, "pdfId": 66, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/66" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box1 - An Azure Monitor data collection endpoint.\nBox2 - An x path query.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 67, "pdfId": 67, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/67" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure Lighthouse.\nTo send data across tenants, you must first enable Azure Lighthouse.\nBox 2: The Log Analytics agent.", "reference": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#install-the-agent-and-\nconfigure-data-collection", "references": [ "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#install-the-agent-and-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 68, "pdfId": 68, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/68" }, "markersInGap": [], "questionText": "You have 100 servers that run Windows Server 2012 R2 and host Microsoft SQL Server 2014 instances. The\ninstances host databases that have the following characteristics:\n✑\n Stored procedures are implemented by using CLR.\n✑\n The largest database is currently 3 TB. None of the databases will ever exceed 4 TB.\nYou plan to move all the data from SQL Server to Azure.\nYou need to recommend a service to host the databases. The solution must meet the following requirements:\n✑\n Whenever possible, minimize management overhead for the migrated databases.\n✑\n Ensure that users can authenticate by using Azure Active Directory (Azure AD) credentials.\n✑\n Minimize the number of database changes required to facilitate the migration.\nWhat should you include in the recommendation?\nA.\nAzure SQL Database elastic pools\nB.\nAzure SQL Managed Instance\nC.\nAzure SQL Database single databases\nD.\nSQL Server 2016 on Azure virtual machines", "stem": "You have 100 servers that run Windows Server 2012 R2 and host Microsoft SQL Server 2014 instances. The instances host databases that have the following characteristics: ✑ Stored procedures are implemented by using CLR. ✑ The largest database is currently 3 TB. None of the databases will ever exceed 4 TB. You plan to move all the data from SQL Server to Azure. You need to recommend a service to host the databases. The solution must meet the following requirements: ✑ Whenever possible, minimize management overhead for the migrated databases. ✑ Ensure that users can authenticate by using Azure Active Directory (Azure AD) credentials. ✑ Minimize the number of database changes required to facilitate the migration. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure SQL Database elastic pools" }, { "key": "B", "text": "Azure SQL Managed Instance" }, { "key": "C", "text": "Azure SQL Database single databases" }, { "key": "D", "text": "SQL Server 2016 on Azure virtual machines" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "SQL Managed Instance allows existing SQL Server customers to lift and shift their on-premises applications\nto the cloud with minimal application and database changes. At the same time, SQL Managed Instance\npreserves all PaaS capabilities (automatic patching and version updates, automated backups, high\navailability) that drastically reduce management overhead and TCO.", "reference": "https://docs.microsoft.com/en-us/azure/sql-database/sql-database-managed-instance", "references": [ "https://docs.microsoft.com/en-us/azure/sql-database/sql-database-managed-instance" ], "note": "Each correct selection is worth one point.\nA.\nan Azure Logic Apps integration account\nB.\nan Azure Import/Export job\nC.\nAzure Data Factory\nD.\nan Azure Analysis services On-premises data gateway\nE.\nan Azure Batch account", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 69, "pdfId": 69, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/69" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains an Azure Blob Storage account named store1.\nYou have an on-premises file server named Server1 that runs Windows Server 2016. Server1 stores 500 GB of\ncompany files.\nYou need to store a copy of the company files from Server1 in store1.\nWhich two possible Azure services achieve this goal? Each correct answer presents a complete solution.\nNOTE: Each correct selection is worth one point.\nA.\nan Azure Logic Apps integration account\nB.\nan Azure Import/Export job\nC.\nAzure Data Factory\nD.\nan Azure Analysis services On-premises data gateway\nE.\nan Azure Batch account", "stem": "You have an Azure subscription that contains an Azure Blob Storage account named store1. You have an on-premises file server named Server1 that runs Windows Server 2016. Server1 stores 500 GB of company files. You need to store a copy of the company files from Server1 in store1. Which two possible Azure services achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "an Azure Logic Apps integration account" }, { "key": "B", "text": "an Azure Import/Export job" }, { "key": "C", "text": "Azure Data Factory" }, { "key": "D", "text": "an Azure Analysis services On-premises data gateway" }, { "key": "E", "text": "an Azure Batch account" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B: You can use the Azure Import/Export service to securely export large amounts of data from Azure Blob\nstorage. The service requires you to ship empty drives to the Azure datacenter. The service exports data from\nyour storage account to the drives and then ships the drives back.\nC: Big data requires a service that can orchestrate and operationalize processes to refine these enormous\nstores of raw data into actionable business insights.\nAzure Data Factory is a managed cloud service that's built for these complex hybrid extract-transform-load\n(ETL), extract-load-transform (ELT), and data integration projects.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-data-from-blobs\nhttps://docs.microsoft.com/en-us/azure/data-factory/introduction", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-data-from-blobs", "https://docs.microsoft.com/en-us/azure/data-factory/introduction" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 70, "pdfId": 70, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/70" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains two applications named App1 and App2. App1 is a sales processing\napplication. When a transaction in App1 requires shipping, a message is added to an Azure Storage account queue,\nand then App2 listens to the queue for relevant transactions.\nIn the future, additional applications will be added that will process some of the shipping requests based on the\nspecific details of the transactions.\nYou need to recommend a replacement for the storage account queue to ensure that each additional application\nwill be able to read the relevant transactions.\nWhat should you recommend?\nA.\none Azure Data Factory pipeline\nB.\nmultiple storage account queues\nC.\none Azure Service Bus queue\nD.\none Azure Service Bus topic", "stem": "You have an Azure subscription that contains two applications named App1 and App2. App1 is a sales processing application. When a transaction in App1 requires shipping, a message is added to an Azure Storage account queue, and then App2 listens to the queue for relevant transactions. In the future, additional applications will be added that will process some of the shipping requests based on the specific details of the transactions. You need to recommend a replacement for the storage account queue to ensure that each additional application will be able to read the relevant transactions. What should you recommend", "options": [ { "key": "A", "text": "one Azure Data Factory pipeline" }, { "key": "B", "text": "multiple storage account queues" }, { "key": "C", "text": "one Azure Service Bus queue" }, { "key": "D", "text": "one Azure Service Bus topic" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "A queue allows processing of a message by a single consumer. In contrast to queues, topics and subscriptions\nprovide a one-to-many form of communication in a publish and subscribe pattern. It's useful for scaling to\nlarge numbers of recipients. Each published message is made available to each subscription registered with\nthe topic. Publisher sends a message to a topic and one or more subscribers receive a copy of the message,\ndepending on filter rules set on these subscriptions.", "reference": "https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-queues-topics-subscriptions", "references": [ "https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-queues-topics-subscriptions" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 71, "pdfId": 71, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/71" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: BlockBlobStorage -\nBlock Blob is a premium storage account type for block blobs and append blobs. Recommended for scenarios\nwith high transactions rates, or scenarios that use smaller objects or require consistently low storage latency.\nBox 2: Blob -\nThe Archive tier is an offline tier for storing blob data that is rarely accessed. The Archive tier offers the\nlowest storage costs, but higher data retrieval costs and latency compared to the online tiers (Hot and Cool).\nData must remain in the Archive tier for at least 180 days or be subject to an early deletion charge.", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/archive-blob", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/archive-blob" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 72, "pdfId": 72, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/72" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Storage1 and storage3 only\nNeed to use Standard accounts.\nData stored in a premium block blob storage account cannot be tiered to hot, cool, or archive using Set Blob\nTier or using Azure Blob Storage lifecycle management\nBox 2: Storage1 and storage4 only\nAzure File shares requires Premium accounts. Only Storage1 and storage4 are premium.", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview#feature-support\nhttps://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-create-file-share?tabs=azure-\nportal#basics", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview#feature-support", "https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-create-file-share?tabs=azure-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 73, "pdfId": 73, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/73" }, "markersInGap": [], "questionText": "You are designing an application that will be hosted in Azure.\nThe application will host video files that range from 50 MB to 12 GB. The application will use certificate-based\nauthentication and will be available to users on the internet.\nYou need to recommend a storage option for the video files. The solution must provide the fastest read\nperformance and must minimize storage costs.\nWhat should you recommend?\nA.\nAzure Files\nB.\nAzure Data Lake Storage Gen2\nC.\nAzure Blob Storage\nD.\nAzure SQL Database", "stem": "You are designing an application that will be hosted in Azure. The application will host video files that range from 50 MB to 12 GB. The application will use certificate-based authentication and will be available to users on the internet. You need to recommend a storage option for the video files. The solution must provide the fastest read performance and must minimize storage costs. What should you recommend", "options": [ { "key": "A", "text": "Azure Files" }, { "key": "B", "text": "Azure Data Lake Storage Gen2" }, { "key": "C", "text": "Azure Blob Storage" }, { "key": "D", "text": "Azure SQL Database" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Blob Storage: Stores large amounts of unstructured data, such as text or binary data, that can be accessed\nfrom anywhere in the world via HTTP or HTTPS. You can use Blob storage to expose data publicly to the\nworld, or to store application data privately.\nMax file in Blob Storage. 4.77 TB.", "reference": "https://docs.microsoft.com/en-us/azure/architecture/solution-ideas/articles/digital-media-video", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/solution-ideas/articles/digital-media-video" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 74, "pdfId": 74, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/74" }, "markersInGap": [], "questionText": "You are designing a SQL database solution. The solution will include 20 databases that will be 20 GB each and\nhave varying usage patterns.\nYou need to recommend a database platform to host the databases. The solution must meet the following\nrequirements:\n✑\n The solution must meet a Service Level Agreement (SLA) of 99.99% uptime.\n✑\n The compute resources allocated to the databases must scale dynamically.\n✑\n The solution must have reserved capacity.\nCompute charges must be minimized.\nWhat should you include in the recommendation?\nA.\nan elastic pool that contains 20 Azure SQL databases\nB.\n20 databases on a Microsoft SQL server that runs on an Azure virtual machine in an availability set\nC.\n20 databases on a Microsoft SQL server that runs on an Azure virtual machine\nD.\n20 instances of Azure SQL Database serverless", "stem": "You are designing a SQL database solution. The solution will include 20 databases that will be 20 GB each and have varying usage patterns. You need to recommend a database platform to host the databases. The solution must meet the following requirements: ✑ The solution must meet a Service Level Agreement (SLA) of 99.99% uptime. ✑ The compute resources allocated to the databases must scale dynamically. ✑ The solution must have reserved capacity. Compute charges must be minimized. What should you include in the recommendation", "options": [ { "key": "A", "text": "an elastic pool that contains 20 Azure SQL databases" }, { "key": "B", "text": "20 databases on a Microsoft SQL server that runs on an Azure virtual machine in an availability set" }, { "key": "C", "text": "20 databases on a Microsoft SQL server that runs on an Azure virtual machine" }, { "key": "D", "text": "20 instances of Azure SQL Database serverless" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The compute and storage redundancy is built in for business critical databases and elastic pools, with a SLA\nof 99.99%.\nReserved capacity provides you with the flexibility to temporarily move your hot databases in and out of\nelastic pools (within the same region and performance tier) as part of your normal operations without losing\nthe reserved capacity benefit.", "reference": "https://azure.microsoft.com/en-us/blog/understanding-and-leveraging-azure-sql-database-sla/", "references": [ "https://azure.microsoft.com/en-us/blog/understanding-and-leveraging-azure-sql-database-sla/" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 75, "pdfId": 75, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/75" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure SQL Database -\nAzure SQL Database:\nDatabase size always depends on the underlying service tiers (e.g. Basic, Business Critical, Hyperscale).\nIt supports databases of up to 100 TB with Hyperscale service tier model.\nActive geo-replication is a feature that lets you to create a continuously synchronized readable secondary\ndatabase for a primary database. The readable secondary database may be in the same Azure region as the\nprimary, or, more commonly, in a different region. This kind of readable secondary databases are also known\nas geo-secondaries, or geo-replicas.\nAzure SQL Database and SQL Managed Instance enable you to dynamically add more resources to your\ndatabase with minimal downtime.\nBox 2: Hyperscale -\nIncorrect Answers:\n✑\n SQL Server on Azure VM: geo-replication not supported.\n✑\n Azure Synapse Analytics is not optimized for online transaction processing (OLTP).\n✑\n Azure SQL Managed Instance max database size is up to currently available instance size (depending on the\nnumber of vCores).\nMax instance storage size (reserved) - 2 TB for 4 vCores\n- 8 TB for 8 vCores\n- 16 TB for other sizes", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/database/active-geo-replication-overview\nhttps://medium.com/awesome-azure/azure-difference-between-azure-sql-database-and-sql-server-on-vm-\ncomparison-azure-sql-vs-sql-server-vm-cf02578a1188", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/database/active-geo-replication-overview", "https://medium.com/awesome-azure/azure-difference-between-azure-sql-database-and-sql-server-on-vm-" ], "note": "Each correct selection is worth one point.\nA.\nAzure Table Storage\nB.\nAzure Event Grid\nC.\nAzure Cosmos DB SQL API\nD.\nAzure Time Series Insights", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 76, "pdfId": 76, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/76" }, "markersInGap": [], "questionText": "You are planning an Azure IoT Hub solution that will include 50,000 IoT devices.\nEach device will stream data, including temperature, device ID, and time data. Approximately 50,000 records will\nbe written every second. The data will be visualized in near real time.\nYou need to recommend a service to store and query the data.\nWhich two services can you recommend? Each correct answer presents a complete solution.\nNOTE: Each correct selection is worth one point.\nA.\nAzure Table Storage\nB.\nAzure Event Grid\nC.\nAzure Cosmos DB SQL API\nD.\nAzure Time Series Insights", "stem": "You are planning an Azure IoT Hub solution that will include 50,000 IoT devices. Each device will stream data, including temperature, device ID, and time data. Approximately 50,000 records will be written every second. The data will be visualized in near real time. You need to recommend a service to store and query the data. Which two services can you recommend? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Azure Table Storage" }, { "key": "B", "text": "Azure Event Grid" }, { "key": "C", "text": "Azure Cosmos DB SQL API" }, { "key": "D", "text": "Azure Time Series Insights" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "D: Time Series Insights is a fully managed service for time series data. In this architecture, Time Series\nInsights performs the roles of stream processing, data store, and analytics and reporting. It accepts streaming\ndata from either IoT Hub or Event Hubs and stores, processes, analyzes, and displays the data in near real\ntime.\nC: The processed data is stored in an analytical data store, such as Azure Data Explorer, HBase, Azure Cosmos\nDB, Azure Data Lake, or Blob Storage.", "reference": "https://docs.microsoft.com/en-us/azure/architecture/data-guide/scenarios/time-series", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/data-guide/scenarios/time-series" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 77, "pdfId": 77, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/77" }, "markersInGap": [], "questionText": "You are designing an application that will aggregate content for users.\nYou need to recommend a database solution for the application. The solution must meet the following\nrequirements:\n✑\n Support SQL commands.\n✑\n Support multi-master writes.\n✑\n Guarantee low latency read operations.\nWhat should you include in the recommendation?\nA.\nAzure Cosmos DB SQL API\nB.\nAzure SQL Database that uses active geo-replication\nC.\nAzure SQL Database Hyperscale\nD.\nAzure Database for PostgreSQL", "stem": "You are designing an application that will aggregate content for users. You need to recommend a database solution for the application. The solution must meet the following requirements: ✑ Support SQL commands. ✑ Support multi-master writes. ✑ Guarantee low latency read operations. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Cosmos DB SQL API" }, { "key": "B", "text": "Azure SQL Database that uses active geo-replication" }, { "key": "C", "text": "Azure SQL Database Hyperscale" }, { "key": "D", "text": "Azure Database for PostgreSQL" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "With Cosmos DB's novel multi-region (multi-master) writes replication protocol, every region supports both\nwrites and reads. The multi-region writes capability also enables:\nUnlimited elastic write and read scalability.\n99.999% read and write availability all around the world.\nGuaranteed reads and writes served in less than 10 milliseconds at the 99th percentile.", "reference": "https://docs.microsoft.com/en-us/azure/cosmos-db/distribute-data-globally", "references": [ "https://docs.microsoft.com/en-us/azure/cosmos-db/distribute-data-globally" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 78, "pdfId": 78, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/78" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes -\nAuditing works fine for a Standard account.\nBox 2: No -\nAuditing limitations: Premium storage is currently not supported.\nBox 3: No -\nAuditing limitations: Premium storage is currently not supported.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview#auditing-limitations", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview#auditing-limitations" ], "note": "Each correct selection is worth one point.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 79, "pdfId": 79, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/79" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Data Migration Assistant -\nThe Data Migration Assistant (DMA) helps you upgrade to a modern data platform by detecting compatibility\nissues that can impact database functionality in your new version of SQL Server or Azure SQL Database. DMA\nrecommends performance and reliability improvements for your target environment and allows you to move\nyour schema, data, and uncontained objects from your source server to your target server.\nIncorrect:\nAzCopy is a command-line utility that you can use to copy blobs or files to or from a storage account.\nBox 2: Azure Cosmos DB Data Migration Tool\nAzure Cosmos DB Data Migration Tool can used to migrate a SQL Server Database table to Azure Cosmos.", "reference": "https://docs.microsoft.com/en-us/sql/dma/dma-overview\nhttps://docs.microsoft.com/en-us/azure/cosmos-db/cosmosdb-migrationchoices\nYou store web access logs data in Azure Blob Storage.", "references": [ "https://docs.microsoft.com/en-us/sql/dma/dma-overview", "https://docs.microsoft.com/en-us/azure/cosmos-db/cosmosdb-migrationchoices" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 80, "pdfId": 80, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/80" }, "markersInGap": [], "questionText": "You plan to generate monthly reports from the access logs.\nYou need to recommend an automated process to upload the data to Azure SQL Database every month.\nWhat should you include in the recommendation?\nA.\nMicrosoft SQL Server Migration Assistant (SSMA)\nB.\nData Migration Assistant (DMA)\nC.\nAzCopy\nD.\nAzure Data Factory", "stem": "You plan to generate monthly reports from the access logs. You need to recommend an automated process to upload the data to Azure SQL Database every month. What should you include in the recommendation", "options": [ { "key": "A", "text": "Microsoft SQL Server Migration Assistant (SSMA)" }, { "key": "B", "text": "Data Migration Assistant (DMA)" }, { "key": "C", "text": "AzCopy" }, { "key": "D", "text": "Azure Data Factory" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "You can create Data Factory pipelines that copies data from Azure Blob Storage to Azure SQL Database. The\nconfiguration pattern applies to copying from a file- based data store to a relational data store.\nRequired steps:\nCreate a data factory.\nCreate Azure Storage and Azure SQL Database linked services.\nCreate Azure Blob and Azure SQL Database datasets.\nCreate a pipeline contains a Copy activity.\nStart a pipeline run.\nMonitor the pipeline and activity runs.", "reference": "https://docs.microsoft.com/en-us/azure/data-factory/tutorial-copy-data-dot-net", "references": [ "https://docs.microsoft.com/en-us/azure/data-factory/tutorial-copy-data-dot-net" ], "note": "Each correct selection is worth one point.\nA.\nCreate an Azure Blob Storage account that is configured for the Cool default access tier. Create a blob\ncontainer, copy the files to the blob container, and set each file to the Archive access tier.\nB.\nCreate a general-purpose v1 storage account. Create a blob container and copy the files to the blob\ncontainer.\nC.\nCreate a general-purpose v2 storage account that is configured for the Cool default access tier. Create a file\nshare in the storage account and copy the files to the file share.\nD.\nCreate a general-purpose v2 storage account that is configured for the Hot default access tier. Create a blob\ncontainer, copy the files to the blob container, and set each file to the Archive access tier.\nE.\nCreate a general-purpose v1 storage account. Create a fie share in the storage account and copy the files to\nthe file share.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 82, "pdfId": 81, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/81" }, "markersInGap": [], "questionText": "You have an app named App1 that uses two on-premises Microsoft SQL Server databases named DB1 and DB2.\nYou plan to migrate DB1 and DB2 to Azure\nYou need to recommend an Azure solution to host DB1 and DB2. The solution must meet the following\nrequirements:\n✑\n Support server-side transactions across DB1 and DB2.\n✑\n Minimize administrative effort to update the solution.\nWhat should you recommend?\nA.\ntwo Azure SQL databases in an elastic pool\nB.\ntwo databases on the same Azure SQL managed instance\nC.\ntwo databases on the same SQL Server instance on an Azure virtual machine\nD.\ntwo Azure SQL databases on different Azure SQL Database servers", "stem": "You have an app named App1 that uses two on-premises Microsoft SQL Server databases named DB1 and DB2. You plan to migrate DB1 and DB2 to Azure You need to recommend an Azure solution to host DB1 and DB2. The solution must meet the following requirements: ✑ Support server-side transactions across DB1 and DB2. ✑ Minimize administrative effort to update the solution. What should you recommend", "options": [ { "key": "A", "text": "two Azure SQL databases in an elastic pool" }, { "key": "B", "text": "two databases on the same Azure SQL managed instance" }, { "key": "C", "text": "two databases on the same SQL Server instance on an Azure virtual machine" }, { "key": "D", "text": "two Azure SQL databases on different Azure SQL Database servers" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Elastic database transactions for Azure SQL Database and Azure SQL Managed Instance allow you to run\ntransactions that span several databases.\nSQL Managed Instance enables system administrators to spend less time on administrative tasks because the\nservice either performs them for you or greatly simplifies those tasks.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/database/elastic-transactions-overview?view=azuresql", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/database/elastic-transactions-overview?view=azuresql" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 81, "pdfId": 82, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/82" }, "markersInGap": [ 81, 82 ], "questionText": "You have an Azure subscription.\nYour on-premises network contains a file server named Server1. Server1 stores 5\n׀\n�\n׀\nof company files that are\naccessed rarely.\nYou plan to copy the files to Azure Storage.\nYou need to implement a storage solution for the files that meets the following requirements:\n✑\n The files must be available within 24 hours of being requested.\n✑\n Storage costs must be minimized.\nWhich two possible storage solutions achieve this goal? Each correct answer presents a complete solution.\nNOTE: Each correct selection is worth one point.\nA.\nCreate an Azure Blob Storage account that is configured for the Cool default access tier. Create a blob\ncontainer, copy the files to the blob container, and set each file to the Archive access tier.\nB.\nCreate a general-purpose v1 storage account. Create a blob container and copy the files to the blob\ncontainer.\nC.\nCreate a general-purpose v2 storage account that is configured for the Cool default access tier. Create a file\nshare in the storage account and copy the files to the file share.\nD.\nCreate a general-purpose v2 storage account that is configured for the Hot default access tier. Create a blob\ncontainer, copy the files to the blob container, and set each file to the Archive access tier.\nE.\nCreate a general-purpose v1 storage account. Create a fie share in the storage account and copy the files to\nthe file share.", "stem": "You have an Azure subscription. Your on-premises network contains a file server named Server1. Server1 stores 5 ׀ � ׀ of company files that are accessed rarely. You plan to copy the files to Azure Storage. You need to implement a storage solution for the files that meets the following requirements: ✑ The files must be available within 24 hours of being requested. ✑ Storage costs must be minimized. Which two possible storage solutions achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Create an Azure Blob Storage account that is configured for the Cool default access tier. Create a blob container, copy the files to the blob container, and set each file to the Archive access tier." }, { "key": "B", "text": "Create a general-purpose v1 storage account. Create a blob container and copy the files to the blob container." }, { "key": "C", "text": "Create a general-purpose v2 storage account that is configured for the Cool default access tier. Create a file share in the storage account and copy the files to the file share." }, { "key": "D", "text": "Create a general-purpose v2 storage account that is configured for the Hot default access tier. Create a blob container, copy the files to the blob container, and set each file to the Archive access tier." }, { "key": "E", "text": "Create a general-purpose v1 storage account. Create a fie share in the storage account and copy the files to the file share." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "To minimize costs: The Archive tier is optimized for storing data that is rarely accessed and stored for at least\n180 days with flexible latency requirements (on the order of hours).", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 83, "pdfId": 83, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/83" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n✑\n Failover between replicas of the database must occur without any data loss.\n✑\n The database must remain available in the event of a zone outage.\n✑\n Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Hyperscale\nB.\nAzure SQL Database Premium\nC.\nAzure SQL Database Basic\nD.\nAzure SQL Managed Instance General Purpose", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: ✑ Failover between replicas of the database must occur without any data loss. ✑ The database must remain available in the event of a zone outage. ✑ Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Hyperscale" }, { "key": "B", "text": "Azure SQL Database Premium" }, { "key": "C", "text": "Azure SQL Database Basic" }, { "key": "D", "text": "Azure SQL Managed Instance General Purpose" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure SQL Database Premium tier supports multiple redundant replicas for each database that are\nautomatically provisioned in the same datacenter within a region. This design leverages the SQL Server\nAlwaysON technology and provides resilience to server failures with 99.99% availability SLA and RPO=0.\nWith the introduction of Azure Availability Zones, we are happy to announce that SQL Database now offers\nbuilt-in support of Availability Zones in its Premium service tier.\nIncorrect:\nNot A: Hyperscale is more expensive than Premium.\nNot C: Need Premium for Availability Zones.\nNot D: Zone redundant configuration that is free on Azure SQL Premium is not available on Azure SQL\nManaged Instance.", "reference": "https://azure.microsoft.com/en-us/blog/azure-sql-database-now-offers-zone-redundant-premium-databases-\nand-elastic-pools/", "references": [ "https://azure.microsoft.com/en-us/blog/azure-sql-database-now-offers-zone-redundant-premium-databases-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 84, "pdfId": 84, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/84" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: General purpose v2 with Hot access tier for blobs", "reference": null, "references": [], "note": "* All the data written to storage must be retained for five years.\n* Data access charges must be minimized\nHot tier has higher storage costs, but lower access and transaction costs.\nIncorrect:\nNot Archive: Lowest storage costs, but highest access, and transaction costs.\nNot Cool: Lower storage costs, but higher access and transaction costs.\nBox 2:\nContainer access policy.\nThe Container access policy is indeed the place to configure Azure's Immutable Blob Storage to ensure data\nis retained without modifications or deletions for a specified amount of time, which suits your needs. The\nAzure Blob Storage's Immutable Blob Storage feature provides a WORM (Write Once, Read Many) capability", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 280, "pdfId": 85, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/85" }, "markersInGap": [], "questionText": "automatically provisioned in the same datacenter within a region. This design leverages the SQL Server\nAlwaysON technology and provides resilience to server failures with 99.99% availability SLA and RPO=0.\nWith the introduction of Azure Availability Zones, we are happy to announce that SQL Database now offers\nbuilt-in support of Availability Zones in its Premium service tier.\nIncorrect:\nNot A: Hyperscale is more expensive than Premium.\nNot C: Need Premium for Availability Zones.\nNot D: Zone redundant configuration that is free on Azure SQL Premium is not available on Azure SQL\nManaged Instance.\nReference:\nhttps://azure.microsoft.com/en-us/blog/azure-sql-database-now-offers-zone-redundant-premium-databases-\nand-elastic-pools/\nHOTSPOT -\nYou are planning an Azure Storage solution for sensitive data. The data will be accessed daily. The dataset is less\nthan 10 GB.\nYou need to recommend a storage solution that meets the following requirements:\n✑\n All the data written to storage must be retained for five years.\n✑\n Once the data is written, the data can only be read. Modifications and deletion must be prevented.\n✑\n After five years, the data can be deleted, but never modified.\n✑\n Data access charges must be minimized.\nWhat should you recommend? To answer, select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:\nAnswer:", "stem": "automatically provisioned in the same datacenter within a region. This design leverages the SQL Server AlwaysON technology and provides resilience to server failures with 99.99% availability SLA and RPO=0. With the introduction of Azure Availability Zones, we are happy to announce that SQL Database now offers built-in support of Availability Zones in its Premium service tier. Incorrect: Not A: Hyperscale is more expensive than Premium. Not C: Need Premium for Availability Zones. Not D: Zone redundant configuration that is free on Azure SQL Premium is not available on Azure SQL Managed Instance. Reference: https://azure.microsoft.com/en-us/blog/azure-sql-database-now-offers-zone-redundant-premium-databases- and-elastic-pools/ You are planning an Azure Storage solution for sensitive data. The data will be accessed daily. The dataset is less than 10 GB. You need to recommend a storage solution that meets the following requirements: ✑ All the data written to storage must be retained for five years. ✑ Once the data is written, the data can only be read. Modifications and deletion must be prevented. ✑ After five years, the data can be deleted, but never modified. ✑ Data access charges must be minimized. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": null, "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": true, "missingOptions": false, "recoveredFromMarkerSplit": true } }, { "seq": 85, "pdfId": 86, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/86" }, "markersInGap": [ 86 ], "questionText": "which aligns with your requirements perfectly.\nHOTSPOT -\nYou are designing a data storage solution to support reporting.\nThe solution will ingest high volumes of data in the JSON format by using Azure Event Hubs. As the data arrives,\nEvent Hubs will write the data to storage. The solution must meet the following requirements:\n✑\n Organize data in directories by date and time.\n✑\n Allow stored data to be queried directly, transformed into summarized tables, and then stored in a data\nwarehouse.\n✑\n Ensure that the data warehouse can store 50 TB of relational data and support between 200 and 300 concurrent\nread operations.\nWhich service should you recommend for each type of data store? To answer, select the appropriate options in the\nanswer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "which aligns with your requirements perfectly. You are designing a data storage solution to support reporting. The solution will ingest high volumes of data in the JSON format by using Azure Event Hubs. As the data arrives, Event Hubs will write the data to storage. The solution must meet the following requirements: ✑ Organize data in directories by date and time. ✑ Allow stored data to be queried directly, transformed into summarized tables, and then stored in a data warehouse. ✑ Ensure that the data warehouse can store 50 TB of relational data and support between 200 and 300 concurrent read operations. Which service should you recommend for each type of data store? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure Data Lake Storage Gen2\nAzure Data Explorer integrates with Azure Blob Storage and Azure Data Lake Storage (Gen1 and Gen2),\nproviding fast, cached, and indexed access to data stored in external storage. You can analyze and query data\nwithout prior ingestion into Azure Data Explorer. You can also query across ingested and uningested external\ndata simultaneously.\nAzure Data Lake Storage is optimized storage for big data analytics workloads.\nUse cases: Batch, interactive, streaming analytics and machine learning data such as log files, IoT data, click\nstreams, large datasets\nBox 2: Azure SQL Database Hyperscale\nAzure SQL Database Hyperscale is optimized for OLTP and high throughput analytics workloads with storage\nup to 100TB.\nA Hyperscale database supports up to 100 TB of data and provides high throughput and performance, as well\nas rapid scaling to adapt to the workload requirements. Connectivity, query processing, database engine\nfeatures, etc. work like any other database in Azure SQL Database.\nHyperscale is a multi-tiered architecture with caching at multiple levels. Effective IOPS will depend on the\nworkload.\nCompare to:\nGeneral purpose: 500 IOPS per vCore with 7,000 maximum IOPS\nBusiness critical: 5,000 IOPS with 200,000 maximum IOPS\nIncorrect:\n* Azure Synapse Analytics Dedicated SQL pool.\nMax database size: 240 TB -\nA maximum of 128 concurrent queries will execute and remaining queries will be queued.", "reference": "https://docs.microsoft.com/en-us/azure/data-explorer/data-lake-query-data https://docs.microsoft.com/en-\nus/azure/azure-sql/database/service-tier-hyperscale https://docs.microsoft.com/en-us/azure/synapse-\nanalytics/sql-data-warehouse/sql-data-warehouse-service-capacity-limits", "references": [ "https://docs.microsoft.com/en-us/azure/data-explorer/data-lake-query-data", "https://docs.microsoft.com/en-", "https://docs.microsoft.com/en-us/azure/synapse-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 86, "pdfId": 87, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/87" }, "markersInGap": [], "questionText": "You have an app named App1 that uses an on-premises Microsoft SQL Server database named DB1.\nYou plan to migrate DB1 to an Azure SQL managed instance.\nYou need to enable customer managed Transparent Data Encryption (TDE) for the instance. The solution must\nmaximize encryption strength.\nWhich type of encryption algorithm and key length should you use for the TDE protector?\nA.\nRSA 3072\nB.\nAES 256\nC.\nRSA 4096\nD.\nRSA 2048", "stem": "You have an app named App1 that uses an on-premises Microsoft SQL Server database named DB1. You plan to migrate DB1 to an Azure SQL managed instance. You need to enable customer managed Transparent Data Encryption (TDE) for the instance. The solution must maximize encryption strength. Which type of encryption algorithm and key length should you use for the TDE protector", "options": [ { "key": "A", "text": "RSA 3072" }, { "key": "B", "text": "AES 256" }, { "key": "C", "text": "RSA 4096" }, { "key": "D", "text": "RSA 2048" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "TDE 3072 TDE protector can only be an asymmetric, RSA, or RSA HSM key. The supported key lengths are\n2048 bytes and 3072 bytes. The key activation date (if set) must be a date and time in the past. Requirements\nfor configuring TDE protector TDE protector can only be an asymmetric, RSA, or RSA HSM key. The supported\nkey lengths are 2048 bytes and 3072 bytes.", "reference": "https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview?\nview=azuresql", "references": [ "https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview?" ], "note": "Each correct selection is worth one point.\nA.\nAzure Table Storage\nB.\nAzure Event Grid\nC.\nAzure Cosmos DB for NoSQL\nD.\nAzure Time Series Insights", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 87, "pdfId": 88, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/88" }, "markersInGap": [ 87, 88 ], "questionText": "You are planning an Azure IoT Hub solution that will include 50,000 IoT devices.\nEach device will stream data, including temperature, device ID, and time data. Approximately 50,000 records will\nbe written every second. The data will be visualized in near real time.\nYou need to recommend a service to store and query the data.\n Which two services can you recommend? Each correct answer presents a complete solution.\nNOTE: Each correct selection is worth one point.\nA.\nAzure Table Storage\nB.\nAzure Event Grid\nC.\nAzure Cosmos DB for NoSQL\nD.\nAzure Time Series Insights", "stem": "You are planning an Azure IoT Hub solution that will include 50,000 IoT devices. Each device will stream data, including temperature, device ID, and time data. Approximately 50,000 records will be written every second. The data will be visualized in near real time. You need to recommend a service to store and query the data. Which two services can you recommend? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Azure Table Storage" }, { "key": "B", "text": "Azure Event Grid" }, { "key": "C", "text": "Azure Cosmos DB for NoSQL" }, { "key": "D", "text": "Azure Time Series Insights" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Real-time access with fast read and write latencies globally, and throughput and consistency all backed by\nSLAs\nhttps://learn.microsoft.com/en-us/azure/cosmos-db/introduction\nAzure Time Series Insights is a fully managed analytics, storage, and visualization service that makes it simple\nto explore and analyze billions of IoT events simultaneously.\nhttps://learn.microsoft.com/en-us/azure/time-series-insights/time-series-insights-explorer", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 88, "pdfId": 89, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/89" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. Storage account type:\n General purpose v2 with hot access tier for blobs\nThe hot access tier provides lower data access costs compared to the cool access tier, making it more\nsuitable for minimizing charges when data is accessed daily. Although the cool tier has lower storage costs,\nthe data access charges are higher, which would not be ideal for your scenario. Premium block blobs are\nmeant for high-performance scenarios and are not necessary for a small dataset of less than 10 GB.\n2.Configuration to prevent modifications and deletions:\nContainer access policy\nYou can create a container access policy with specific permissions (in this case, read-only) and set an expiry\ntime of five years. This policy prevents modifications and deletions, while still allowing the data to be read.\nAfter five years, the policy will expire, and the data can be deleted but not modified. Storage account\nresource locks and container access level settings don't offer the same granularity of control over the data as\nthe container access policy.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 89, "pdfId": 90, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/90" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Azure Synapse Analytics (also named SQL Data Warehouse) is a cloud-based analytics service that allows you\nto analyze large amounts of data using a combination of on-demand and provisioned resources. It offers\nseveral different options for working with data, including:\n- Dedicated SQL pool: It's best for big and complex tasks.\n- Serverless Apache Spark pool: It's best for big data analysis and machine learning tasks using Spark SQL\nand Spark DataFrames.\n- Serverless SQL pool: This is a service that automatically adjusts the amount of resources you use based on\nyour needs. You only pay for what you use. It's best for small to medium-sized tasks and tasks that change\noften.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 90, "pdfId": 91, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/91" }, "markersInGap": [], "questionText": "You have an on-premises storage solution.\nYou need to migrate the solution to Azure. The solution must support Hadoop Distributed File System (HDFS).\nWhat should you use?\nA.\nAzure Data Lake Storage Gen2\nB.\nAzure NetApp Files\nC.\nAzure Data Share\nD.\nAzure Table storage", "stem": "You have an on-premises storage solution. You need to migrate the solution to Azure. The solution must support Hadoop Distributed File System (HDFS). What should you use", "options": [ { "key": "A", "text": "Azure Data Lake Storage Gen2" }, { "key": "B", "text": "Azure NetApp Files" }, { "key": "C", "text": "Azure Data Share" }, { "key": "D", "text": "Azure Table storage" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Data Lake Storage Gen2: This is a fully managed, cloud-native data lake that supports the HDFS\nprotocol. It allows you to store and analyze large amounts of data in its native format, without the need to\nmove or transform the data.", "reference": null, "references": [], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 91, "pdfId": 92, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/92" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. Azure Blob storage\n2. Azure Cosmos DB\nhttps://learn.microsoft.com/en-us/azure/frontdoor/scenario-storage-blobs\nAzure Front Door accelerates the delivery of static content from Azure Storage blobs, and enables a secure\nand scalable architecture. Static content delivery is useful for many different use cases, including website\nhosting and file delivery\nhttps://learn.microsoft.com/en-us/azure/cosmos-db/introduction#guaranteed-speed-at-any-scale\n- Multi-region writes and data distribution to any Azure region with just a button", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 92, "pdfId": 93, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/93" }, "markersInGap": [ 93 ], "questionText": "You are designing an application that will aggregate content for users.\nYou need to recommend a database solution for the application. The solution must meet the following\nrequirements:\n • Support SQL commands.\n• Support multi-master writes.\n• Guarantee low latency read operations.\nWhat should you include in the recommendation?\nA.\nAzure Cosmos DB for NoSQL\nB.\nAzure SQL Database that uses active geo-replication\nC.\nAzure SQL Database Hyperscale\nD.\nAzure Cosmos DB for PostgreSQL", "stem": "You are designing an application that will aggregate content for users. You need to recommend a database solution for the application. The solution must meet the following requirements: • Support SQL commands. • Support multi-master writes. • Guarantee low latency read operations. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Cosmos DB for NoSQL" }, { "key": "B", "text": "Azure SQL Database that uses active geo-replication" }, { "key": "C", "text": "Azure SQL Database Hyperscale" }, { "key": "D", "text": "Azure Cosmos DB for PostgreSQL" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "cosmos for the multi writerpostgre is not good at reading", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 93, "pdfId": 94, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/94" }, "markersInGap": [], "questionText": "You plan to migrate on-premises MySQL databases to Azure Database for MySQL Flexible Server.\nYou need to recommend a solution for the Azure Database for MySQL Flexible Server configuration. The solution\nmust meet the following requirements:\n•The databases must be accessible if a datacenter fails.\n•Costs must be minimized.\nWhich compute tier should you recommend?\nA.\nBurstable\nB.\nGeneral Purpose\nC.\nMemory Optimized", "stem": "You plan to migrate on-premises MySQL databases to Azure Database for MySQL Flexible Server. You need to recommend a solution for the Azure Database for MySQL Flexible Server configuration. The solution must meet the following requirements: •The databases must be accessible if a datacenter fails. •Costs must be minimized. Which compute tier should you recommend", "options": [ { "key": "A", "text": "Burstable" }, { "key": "B", "text": "General Purpose" }, { "key": "C", "text": "Memory Optimized" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B is the answer.\nhttps://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-high-availability#limitationsHere are\nsome considerations to keep in mind when you use high availability:- High availability isn't supported in the\nburstable compute tier.\nHigh availability isn't supported in the burstable compute tier.\nhttps://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-high-availability#limitations", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 94, "pdfId": 95, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/95" }, "markersInGap": [ 94, 95 ], "questionText": "You are designing an app that will use Azure Cosmos DB to collate sales from multiple countries.\nYou need to recommend an API for the app. The solution must meet the following requirements:\n•Support SQL queries.\n•Support geo-replication.\n •Store and access data relationally.\nWhich API should you recommend?\nA.\nApache Cassandra\nB.\nPostgreSQL\nC.\nMongoDB\nD.\nNoSQL", "stem": "You are designing an app that will use Azure Cosmos DB to collate sales from multiple countries. You need to recommend an API for the app. The solution must meet the following requirements: •Support SQL queries. •Support geo-replication. •Store and access data relationally. Which API should you recommend", "options": [ { "key": "A", "text": "Apache Cassandra" }, { "key": "B", "text": "PostgreSQL" }, { "key": "C", "text": "MongoDB" }, { "key": "D", "text": "NoSQL" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Correct", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 95, "pdfId": 96, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/96" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-capture-overview", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 96, "pdfId": 97, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/97" }, "markersInGap": [ 97 ], "questionText": "You have the resources shown in the following table.\n CDB1 hosts a container that stores continuously updated operational data.\nYou are designing a solution that will use AS1 to analyze the operational data daily.\nYou need to recommend a solution to analyze the data without affecting the performance of the operational data\nstore.\nWhat should you include in the recommendation?\nA.\nAzure Data Factory with Azure Cosmos DB and Azure Synapse Analytics connectors\nB.\nAzure Synapse Analytics with PolyBase data loading\nC.\nAzure Synapse Link for Azure Cosmos DB\nD.\nAzure Cosmos DB change feed", "stem": "You have the resources shown in the following table. CDB1 hosts a container that stores continuously updated operational data. You are designing a solution that will use AS1 to analyze the operational data daily. You need to recommend a solution to analyze the data without affecting the performance of the operational data store. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Data Factory with Azure Cosmos DB and Azure Synapse Analytics connectors" }, { "key": "B", "text": "Azure Synapse Analytics with PolyBase data loading" }, { "key": "C", "text": "Azure Synapse Link for Azure Cosmos DB" }, { "key": "D", "text": "Azure Cosmos DB change feed" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "The correct answer is C. Azure Synapse Link for Azure Cosmos DB.Azure Synapse Link for Azure Cosmos DB\ncreates a tight integration between Azure Cosmos DB and Azure Synapse Analytics, allowing you to run near\nreal-time analytics over operational data in Azure Cosmos DB. It creates a \"no-ETL\" (Extract, Transform, Load)\nenvironment that allows you to analyze data directly without affecting the performance of the transactional\nworkload, which is exactly what is required in this scenario.A. Azure Data Factory with Azure Cosmos DB and\nAzure Synapse Analytics connectors would require ETL operations which might impact the performance of\nthe operational data store.B. Azure Synapse Analytics with PolyBase data loading is more appropriate for\nloading data from external data sources such as Azure Blob Storage or Azure Data Lake Storage. D. Azure\nCosmos DB change feed doesn't directly address the need for analytics without affecting the performance of\nthe operational data store", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 97, "pdfId": 98, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/98" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to\ndesignate how much of the sensitive data to reveal with minimal effect on the application layer.\nAlways Encrypted is a feature designed to protect sensitive data, such as credit card numbers or\nnational/regional identification numbers (for example, U.S. social security numbers), stored in Azure SQL\nDatabase, Azure SQL Managed Instance, and SQL Server databases.\nhttps://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-\nengine\nhttps://learn.microsoft.com/en-us/azure/azure-sql/database/dynamic-data-masking-overview", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 98, "pdfId": 99, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/99" }, "markersInGap": [], "questionText": "You plan to use an Azure Storage account to store data assets.\nYou need to recommend a solution that meets the following requirements:\n•Supports immutable storage\n•Disables anonymous access to the storage account\n•Supports access control list (ACL)-based Azure AD permissions\nWhat should you include in the recommendation?\nA.\nAzure Files\nB.\nAzure Data Lake Storage\nC.\nAzure NetApp Files\nD.\nAzure Blob Storage", "stem": "You plan to use an Azure Storage account to store data assets. You need to recommend a solution that meets the following requirements: •Supports immutable storage •Disables anonymous access to the storage account •Supports access control list (ACL)-based Azure AD permissions What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Files" }, { "key": "B", "text": "Azure Data Lake Storage" }, { "key": "C", "text": "Azure NetApp Files" }, { "key": "D", "text": "Azure Blob Storage" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "The Azure service that meets all your requirements is Azure Blob Storage. It supports immutable storage,", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 99, "pdfId": 100, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/100" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Data Explorer\nKQL.", "reference": "https://learn.microsoft.com/en-us/azure/data-lake-analytics/data-lake-analytics-overview", "references": [ "https://learn.microsoft.com/en-us/azure/data-lake-analytics/data-lake-analytics-overview" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 100, "pdfId": 101, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/101" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Reference:\n\"https://learn.microsoft.com/en-us/azure/azure-sql/database/serverless-tier-overview", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 101, "pdfId": 102, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/102" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Block\nThe change feed.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 102, "pdfId": 103, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/103" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Azure synapse Pipelines.\nAzure Data Share.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 103, "pdfId": 104, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/104" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Data Warehouse: Azure Synapse Analytics (formerly SQL Data Warehouse)Azure Synapse Analytics is a\nmassively parallel processing (MPP) data warehouse that can handle large amounts of data and provides a\nscalable solution for analytics Managed Serving Layer: Azure Analysis Services Azure Analysis Services\nprovides a fully managed platform-as-a-service (PaaS) solution for online analytical processing (OLAP) and\ndata modelling. It is suitable for serving analytical models to thousands of end users.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 104, "pdfId": 105, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/105" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "A Single Azure SQL database.\nHyperscale.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 105, "pdfId": 106, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/106" }, "markersInGap": [], "questionText": "You have an app named App1 that uses an Azure Blob Storage container named app1data.\nApp1 uploads a cumulative transaction log file named File1.txt to a block blob in app1data once every hour. File1.txt\nonly stores transaction data from the current day.\nYou need to ensure that you can restore the last uploaded version of File1.txt from any day for up to 30 days after\nthe file was overwritten. The solution must minimize storage space.\nWhat should you include in the solution?\nA.\ncontainer soft delete\nB.\nblob snapshots\nC.\nblob soft delete\nD.\nblob versioning", "stem": "You have an app named App1 that uses an Azure Blob Storage container named app1data. App1 uploads a cumulative transaction log file named File1.txt to a block blob in app1data once every hour. File1.txt only stores transaction data from the current day. You need to ensure that you can restore the last uploaded version of File1.txt from any day for up to 30 days after the file was overwritten. The solution must minimize storage space. What should you include in the solution", "options": [ { "key": "A", "text": "container soft delete" }, { "key": "B", "text": "blob snapshots" }, { "key": "C", "text": "blob soft delete" }, { "key": "D", "text": "blob versioning" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "The key here is that File1.txt is changed every hour. Theoretically, you can do this with B as well but you need\nto configure a given time when the snapshot is taken. With blob versioning, you have access to 24 versions,\nand you can restore for example a version that took place 6 hours ago as opposed to when the blob snapshot\ntook place (you will only have a single version, the one that the snapshot captured at the moment it was taken)\nD.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 106, "pdfId": 107, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/107" }, "markersInGap": [], "questionText": "You have 12 on-premises data sources that contain customer information and consist of Microsoft SQL Server,\nMySQL, and Oracle databases.\nYou have an Azure subscription.\nYou plan to create an Azure Data Lake Storage account that will consolidate the customer information for analysis\nand reporting.\nYou need to recommend a solution to automatically copy new information from the data sources to the Data Lake\nStorage account by using extract, transform and load (ETL). The solution must minimize administrative effort.\nWhat should you include in the recommendation?\nA.\nAzure Data Factory\nB.\nAzure Data Explorer\nC.\nAzure Data Share\nD.\nAzure Data Studio", "stem": "You have 12 on-premises data sources that contain customer information and consist of Microsoft SQL Server, MySQL, and Oracle databases. You have an Azure subscription. You plan to create an Azure Data Lake Storage account that will consolidate the customer information for analysis and reporting. You need to recommend a solution to automatically copy new information from the data sources to the Data Lake Storage account by using extract, transform and load (ETL). The solution must minimize administrative effort. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Data Factory" }, { "key": "B", "text": "Azure Data Explorer" }, { "key": "C", "text": "Azure Data Share" }, { "key": "D", "text": "Azure Data Studio" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Correct answer is A:Azure Data Factory.", "reference": "https://azure.microsoft.com/en-in/products/data-factory", "references": [ "https://azure.microsoft.com/en-in/products/data-factory" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 107, "pdfId": 108, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/108" }, "markersInGap": [], "questionText": "You have SQL Server on an Azure virtual machine. The databases are written to nightly as part of a batch process.\nYou need to recommend a disaster recovery solution for the data. The solution must meet the following\nrequirements:\n✑\n Provide the ability to recover in the event of a regional outage.\n✑\n Support a recovery time objective (RTO) of 15 minutes.\n✑\n Support a recovery point objective (RPO) of 24 hours.\n✑\n Support automated recovery.\n✑\n Minimize costs.\nWhat should you include in the recommendation?\nA.\nAzure virtual machine availability sets\nB.\nAzure Disk Backup\nC.\nan Always On availability group\nD.\nAzure Site Recovery", "stem": "You have SQL Server on an Azure virtual machine. The databases are written to nightly as part of a batch process. You need to recommend a disaster recovery solution for the data. The solution must meet the following requirements: ✑ Provide the ability to recover in the event of a regional outage. ✑ Support a recovery time objective (RTO) of 15 minutes. ✑ Support a recovery point objective (RPO) of 24 hours. ✑ Support automated recovery. ✑ Minimize costs. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure virtual machine availability sets" }, { "key": "B", "text": "Azure Disk Backup" }, { "key": "C", "text": "an Always On availability group" }, { "key": "D", "text": "Azure Site Recovery" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Replication with Azure Site Recover:\n✑\n RTO is typically less than 15 minutes.\n✑\n RPO: One hour for application consistency and five minutes for crash consistency.\nIncorrect Answers:\nB: Too slow.\nC: Always On availability group RPO: Because replication to the secondary replica is asynchronous, there's\nsome data loss.", "reference": "https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-sql", "references": [ "https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-sql" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 109, "pdfId": 109, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/109" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the\nfollowing requirements:\n✑\n Provide access to the full .NET framework.\nProvide redundancy if an Azure region fails.\n✑\n Grant administrators access to the operating system to install custom application dependencies.\nSolution: You deploy two Azure virtual machines to two Azure regions, and you create an Azure Traffic Manager\nprofile.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements: ✑ Provide access to the full .NET framework. Provide redundancy if an Azure region fails. ✑ Grant administrators access to the operating system to install custom application dependencies. Solution: You deploy two Azure virtual machines to two Azure regions, and you create an Azure Traffic Manager profile. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to\nservices across global Azure regions, while providing high availability and responsiveness.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 110, "pdfId": 110, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/110" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the\nfollowing requirements:\n✑\n Provide access to the full .NET framework.\n✑\n Provide redundancy if an Azure region fails.\n✑\n Grant administrators access to the operating system to install custom application dependencies.\nSolution: You deploy two Azure virtual machines to two Azure regions, and you deploy an Azure Application\nGateway.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements: ✑ Provide access to the full .NET framework. ✑ Provide redundancy if an Azure region fails. ✑ Grant administrators access to the operating system to install custom application dependencies. Solution: You deploy two Azure virtual machines to two Azure regions, and you deploy an Azure Application Gateway. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "App Gateway will balance the traffic between VMs deployed in the same region. Create an Azure Traffic\nManager profile instead.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 108, "pdfId": 111, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/111" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "36 MONTHS\n1 day", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 111, "pdfId": 112, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/112" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Premium -\nPremium: Premium file shares are backed by solid-state drives (SSDs) and provide consistent high\nperformance and low latency, within single-digit milliseconds for most IO operations, for IO-intensive\nworkloads.\nIncorrect Answers:\n✑\n Hot: Hot file shares offer storage optimized for general purpose file sharing scenarios such as team shares.\nHot file shares are offered on the standard storage hardware backed by HDDs.\n✑\n Transaction optimized: Transaction optimized file shares enable transaction heavy workloads that don't\nneed the latency offered by premium file shares.\nTransaction optimized file shares are offered on the standard storage hardware backed by hard disk drives\n(HDDs). Transaction optimized has historically been called \"standard\", however this refers to the storage\nmedia type rather than the tier itself (the hot and cool are also \"standard\" tiers, because they are on standard\nstorage hardware).\nBox 2: Zone-redundant storage (ZRS):\nPremium Azure file shares only support LRS and ZRS.\nZone-redundant storage (ZRS): With ZRS, three copies of each file stored, however these copies are\nphysically isolated in three distinct storage clusters in different Azure availability zones.", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-planning", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-planning" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 112, "pdfId": 113, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/113" }, "markersInGap": [ 113 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the\nfollowing requirements:\n ✑\n Provide access to the full .NET framework.\n✑\n Provide redundancy if an Azure region fails.\n✑\n Grant administrators access to the operating system to install custom application dependencies.\nSolution: You deploy an Azure virtual machine scale set that uses autoscaling.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements: ✑ Provide access to the full .NET framework. ✑ Provide redundancy if an Azure region fails. ✑ Grant administrators access to the operating system to install custom application dependencies. Solution: You deploy an Azure virtual machine scale set that uses autoscaling. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead, you should deploy two Azure virtual machines to two Azure regions, and you create a Traffic Manager\nprofile.", "reference": "https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview", "references": [ "https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview" ], "note": "Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic\noptimally to services across global Azure regions, while providing high availability and responsiveness.\nReference:\nhttps://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 113, "pdfId": 114, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/114" }, "markersInGap": [ 114 ], "questionText": "HOTSPOT -\nYou need to recommend an Azure Storage account configuration for two applications named Application1 and\nApplication2. The configuration must meet the following requirements:\n✑\n Storage for Application1 must provide the highest possible transaction rates and the lowest possible latency.\n✑\n Storage for Application2 must provide the lowest possible storage costs per GB.\n✑\n Storage for both applications must be available in an event of datacenter failure.\n✑\n Storage for both applications must be optimized for uploads and downloads.\nWhat should you recommend? To answer, select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You need to recommend an Azure Storage account configuration for two applications named Application1 and Application2. The configuration must meet the following requirements: ✑ Storage for Application1 must provide the highest possible transaction rates and the lowest possible latency. ✑ Storage for Application2 must provide the lowest possible storage costs per GB. ✑ Storage for both applications must be available in an event of datacenter failure. ✑ Storage for both applications must be optimized for uploads and downloads. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: BlobStorage with Premium Performance,\n�\nApplication1 requires high transaction rates and the lowest possible latency. We need to use Premium, not\nStandard.\nBox 2: General purpose v2 with Standard Performance,..\nGeneral Purpose v2 provides access to the latest Azure storage features, including Cool and Archive storage,\nwith pricing optimized for the lowest GB storage prices. These accounts provide access to Block Blobs, Page\nBlobs, Files, and Queues. Recommended for most scenarios using Azure Storage.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-upgrade", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-upgrade" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 114, "pdfId": 115, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/115" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Premium block blobs.\nBox 2: Zone-redundant storage (ZRS)\nZRS is more resilient compared to LRS.", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview#supported-account-\nconfigurations", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview#supported-account-" ], "note": "RA-GRS is even more resilient, but it is not an option here.\nReference:\nhttps://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview#supported-account-\nconfigurations", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 115, "pdfId": 116, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/116" }, "markersInGap": [ 116 ], "questionText": "You plan to deploy 10 applications to Azure. The applications will be deployed to two Azure Kubernetes Service\n(AKS) clusters. Each cluster will be deployed to a separate Azure region.\nThe application deployment must meet the following requirements:\n✑\n Ensure that the applications remain available if a single AKS cluster fails.\n✑\n Ensure that the connection traffic over the internet is encrypted by using SSL without having to configure SSL\non each container.\nWhich service should you include in the recommendation?\nA.\nAzure Front Door\nB.\nAzure Traffic Manager\n C.\nAKS ingress controller\nD.\nAzure Load Balancer", "stem": "You plan to deploy 10 applications to Azure. The applications will be deployed to two Azure Kubernetes Service (AKS) clusters. Each cluster will be deployed to a separate Azure region. The application deployment must meet the following requirements: ✑ Ensure that the applications remain available if a single AKS cluster fails. ✑ Ensure that the connection traffic over the internet is encrypted by using SSL without having to configure SSL on each container. Which service should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Front Door" }, { "key": "B", "text": "Azure Traffic Manager" }, { "key": "C", "text": "AKS ingress controller" }, { "key": "D", "text": "Azure Load Balancer" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Front Door is an application delivery network that provides global load balancing and site acceleration service\nfor web applications. It offers Layer 7 capabilities for your application like SSL offload, path-based routing,\nfast failover, caching, etc. to improve performance and high-availability of your applications.\nTraffic Manager does not provide SSL Offloading.\nAnd the other options are not global options (multi-region)", "reference": "https://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 116, "pdfId": 117, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/117" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Standard general-purpose v2\nStandard general-purpose v2 meets the requirements and minimizes the costs.\nBox 2: Zone-redundant storage (ZRS)\nZRS protects against a Datacenter failure, while minimizing the costs.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 117, "pdfId": 118, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/118" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: A server in the paired region\nThe contents of your key vault are replicated within the region and to a secondary region at least 150 miles\naway, but within the same geography to maintain high durability of your keys and secrets.\nRegions are paired for cross-region replication based on proximity and other factors.\nBox 2: Delete -\nDuring failover, your key vault is in read-only mode. Requests that are supported in this mode are:\nList certificates -\nGet certificates -\nList secrets -\nGet secrets -\nList keys -\nGet (properties of) keys -\nEncrypt -\nDecrypt -\nWrap -\nUnwrap -\nVerify -\nSign -\nBackup -", "reference": "https://docs.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance", "references": [ "https://docs.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance" ], "note": "Each correct selection is worth one point.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 118, "pdfId": 119, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/119" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure Site Recovery -\nAzure Site Recovery -\nCoordinates virtual-machine and physical-server replication, failover, and fullback.\nDR solutions have low Recovery point objectives; DR copy can be behind by a few seconds/minutes.\nDR needs only operational recovery data, which can take hours to a day. Using DR data for long-term retention\nis not recommended because of the fine-grained data capture.\nDisaster recovery solutions have smaller Recovery time objectives because they are more in sync with the\nsource.\nRemote monitor the health of machines and create customizable recovery plans.\nBox 2: Azure Site Recovery and Azure Backup\nBackup ensures that your data is safe and recoverable while Site Recovery keeps your workloads available\nwhen/if an outage occurs.\nBox 3: Azure Backup only -\nAzure Backup -\nBacks up data on-premises and in the cloud\nHave wide variability in their acceptable Recovery point objective. VM backups usually one day while\ndatabase backups as low as 15 minutes.\nBackup data is typically retained for 30 days or less. From a compliance view, data may need to be saved for\nyears. Backup data is ideal for archiving in such instances.\nBecause of a larger Recovery point objective, the amount of data a backup solution needs to process is\nusually much higher, which leads to a longer Recovery time objective.", "reference": "https://lighthousemsp.com/whats-the-difference-between-azure-backup-and-azure-site-recovery/", "references": [ "https://lighthousemsp.com/whats-the-difference-between-azure-backup-and-azure-site-recovery/" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 119, "pdfId": 120, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/120" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n✑\n Failover between replicas of the database must occur without any data loss.\n✑\n The database must remain available in the event of a zone outage.\n✑\n Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Managed Instance Business Critical\nB.\nAzure SQL Database Premium\nC.\nAzure SQL Database Basic\nD.\nAzure SQL Managed Instance General Purpose", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: ✑ Failover between replicas of the database must occur without any data loss. ✑ The database must remain available in the event of a zone outage. ✑ Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Managed Instance Business Critical" }, { "key": "B", "text": "Azure SQL Database Premium" }, { "key": "C", "text": "Azure SQL Database Basic" }, { "key": "D", "text": "Azure SQL Managed Instance General Purpose" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Zone-redundant configuration is not available in SQL Managed Instance. In SQL Database this feature is only\navailable when the Gen5 hardware is selected.\nTo prevent Data Loss, Premium/Business Critical is required:\nThe primary node constantly pushes changes to the secondary nodes in order and ensures that the data is\npersisted to at least one secondary replica before committing each transaction. This process guarantees that\nif the primary node crashes for any reason, there is always a fully synchronized node to fail over to.Azure SQL\nDatabase Premium is a highly available deployment option that meets the following requirements:\n✑\n Failover between replicas of the database must occur without any data loss. Azure SQL Database Premium\nuses active-passive replication, which ensures that the secondary replica is up to date with the primary replica\nand can take over with minimal data loss in case of a failover.\n✑\n The database must remain available in the event of a zone outage. Azure SQL Database Premium uses zone-\nredundant architecture, which ensures that the database is available even if an entire zone goes offline.\n✑\n Costs must be minimized. Azure SQL Database Premium is a cost-effective option as it allows you to pay for\nthe resources you use and scale up or down as needed.\nAzure SQL Managed Instance Business Critical it is an option that comes with high availability and disaster\nrecovery but is more expensive than Azure SQL Database Premium.\nAzure SQL Database Basic and Azure SQL Managed Instance General Purpose do not provide the same high\navailability and disaster recovery options as Azure SQL Database Premium.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-\npowershell", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 121, "pdfId": 121, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/121" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the\nfollowing requirements:\n✑\n Provide access to the full .NET framework.\n✑\n Provide redundancy if an Azure region fails.\n✑\n Grant administrators access to the operating system to install custom application dependencies.\nSolution: You deploy a web app in an Isolated App Service plan.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements: ✑ Provide access to the full .NET framework. ✑ Provide redundancy if an Azure region fails. ✑ Grant administrators access to the operating system to install custom application dependencies. Solution: You deploy a web app in an Isolated App Service plan. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead: You deploy two Azure virtual machines to two Azure regions, and you create an Azure Traffic\nManager profile.", "reference": "https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview", "references": [ "https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview" ], "note": "Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic\noptimally to services across global Azure regions, while providing high availability and responsiveness.\nReference:\nhttps://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 120, "pdfId": 122, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/122" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n✑\n Failover between replicas of the database must occur without any data loss.\n✑\n The database must remain available in the event of a zone outage.\n✑\n Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Managed Instance Business Critical\nB.\nAzure SQL Database Premium\nC.\nAzure SQL Database Basic\nD.\nAzure SQL Database Hyperscale", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: ✑ Failover between replicas of the database must occur without any data loss. ✑ The database must remain available in the event of a zone outage. ✑ Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Managed Instance Business Critical" }, { "key": "B", "text": "Azure SQL Database Premium" }, { "key": "C", "text": "Azure SQL Database Basic" }, { "key": "D", "text": "Azure SQL Database Hyperscale" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure SQL Database Premium meets the requirements and is the least expensive.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla" ], "note": "There are two high availability architectural models:\n* Standard availability model that is based on a separation of compute and storage. It relies on high availability\nand reliability of the remote storage tier. This architecture targets budget-oriented business applications that\ncan tolerate some performance degradation during maintenance activities.\n* Premium availability model that is based on a cluster of database engine processes. It relies on the fact that\nthere is always a quorum of available database engine nodes. This architecture targets mission-critical", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 122, "pdfId": 123, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/123" }, "markersInGap": [ 122, 123 ], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n✑\n Failover between replicas of the database must occur without any data loss.\n✑\n The database must remain available in the event of a zone outage.\n✑\n Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Serverless\nB.\nAzure SQL Database Business Critical\n C.\nAzure SQL Database Basic\nD.\nAzure SQL Database Standard", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: ✑ Failover between replicas of the database must occur without any data loss. ✑ The database must remain available in the event of a zone outage. ✑ Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Serverless" }, { "key": "B", "text": "Azure SQL Database Business Critical" }, { "key": "C", "text": "Azure SQL Database Basic" }, { "key": "D", "text": "Azure SQL Database Standard" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Now your new and existing serverless Azure SQL Databases allow for zone redundant configuration. This\nfeature utilizes Azure Availability Zones to replicate databases across multiple physical locations within an\nAzure region. By selecting zone redundancy, you can make your serverless databases resilient to a much\nlarger set of failures, including catastrophic datacenter outages\"without any changes of the application logic.\nThe SQL Database serverless compute tier optimizes price-performance and simplifies performance\nmanagement for single databases with intermittent, unpredictable usage by auto-scaling compute and billing\nfor compute used per second.\nIncorrect:\nNot B: Azure SQL Database Business Critical is a more expensive solution.\nNot C: Azure SQL Database Basic does not provide zone redundancy.\nNot D: Azure SQL Database Standard is a more expensive solution.", "reference": "https://azure.microsoft.com/en-us/updates/public-preview-zone-redundant-configuration-for-azure-sql-\ndatabase-serverless-compute-tier/", "references": [ "https://azure.microsoft.com/en-us/updates/public-preview-zone-redundant-configuration-for-azure-sql-" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 123, "pdfId": 124, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/124" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Azure service or service tier \"Azure SQL Managed Instance\"\nReplication mechanism \"Auto failover groups\"\nAzure SQL Managed Instance is a fully managed, Azure-based version of SQL Server that can be used to host\nyour on-premises SQL Server database in the cloud. It supports the deployment of multiple secondary, read-\nonly replicas and can automatically replicate data between primary and secondary replicas. It also supports\nfailover between primary and secondary replicas within a 15-minute RTO, which meets the requirement for the\nsolution to have a recovery time objective of 15 minutes.\nAuto failover groups is a feature of Azure SQL Managed Instance that allows you to automatically failover\nbetween primary and secondary replicas in the event of an outage or failure. It supports the deployment of\nmultiple secondary, read-only replicas and can automatically replicate data between primary and secondary\nreplicas. It also supports failover between primary and secondary replicas within a 15-minute RTO, which\nmeets the requirement for the solution to have a recovery time objective of 15 minutes.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 124, "pdfId": 125, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/125" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Prepare For the migration by:\nA. Adding a secondary replica to AG1\nReason:\nCreating an Always On availability group on VM1 would not be necessary, as you already have an availability\ngroup (AG1) in place on your on-premises SQL Server instances.\nBy adding a secondary replica to AG1, you can provide a copy of DB1 that can be used for the migration. This\nwill allow you to minimize downtime on DB1 by performing the migration on the secondary replica, while the\nprimary replica remains available for use.\nPerform the migration by using:\nB. Azure migrate.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 125, "pdfId": 126, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/126" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. GP service tier and Serverless compute tier.\n2. Always Encrypted.\nhttps://learn.microsoft.com/en-us/azure/azure-sql/database/sql-database-paas-overview?\nview=azuresql#service-tiers\nThe General Purpose service tier is designed for common workloads. It offers budget-oriented balanced\ncompute and storage options.\nhttps://learn.microsoft.com/en-us/azure/azure-sql/database/sql-database-paas-overview?\nview=azuresql#compute-tiers\nServerless compute tier: auto-scales compute resources based on workload activity and bills for the amount\nof compute used, per second. The serverless compute tier is generally available in the General Purpose\nservice tier, and is currently in preview in the Hyperscale service tier.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 126, "pdfId": 127, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/127" }, "markersInGap": [], "questionText": "You plan to deploy an Azure Database for MySQL flexible server named Server1 to the East US Azure region.\nYou need to implement a business continuity solution for Server1. The solution must minimize downtime in the\nevent of a failover to a paired region.\nWhat should you do?\nA.\nCreate a read replica.\nB.\nStore the database files in Azure premium file shares.\nC.\nImplement Geo-redundant backup.\nD.\nConfigure native MySQL replication.", "stem": "You plan to deploy an Azure Database for MySQL flexible server named Server1 to the East US Azure region. You need to implement a business continuity solution for Server1. The solution must minimize downtime in the event of a failover to a paired region. What should you do", "options": [ { "key": "A", "text": "Create a read replica." }, { "key": "B", "text": "Store the database files in Azure premium file shares." }, { "key": "C", "text": "Implement Geo-redundant backup." }, { "key": "D", "text": "Configure native MySQL replication." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "High availability seems only avaliable in the same zonehttps://learn.microsoft.com/en-\nus/azure/mysql/flexible-server/concepts-high-availabilityTo failover to another region, you would use a geo-\nredunant backuphttps://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-business-continuity\nYou have an Azure subscription that contains the resources shown in the following table.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 127, "pdfId": 128, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/128" }, "markersInGap": [], "questionText": "You need to recommend a load balancing solution that will distribute incoming traffic for VMSS1 across NVA1 and\nNVA2. The solution must minimize administrative effort.\nWhat should you include in the recommendation?\nA.\nGateway Load Balancer\nB.\nAzure Front Door\nC.\nAzure Application Gateway\nD.\nAzure Traffic Manager", "stem": "You need to recommend a load balancing solution that will distribute incoming traffic for VMSS1 across NVA1 and NVA2. The solution must minimize administrative effort. What should you include in the recommendation", "options": [ { "key": "A", "text": "Gateway Load Balancer" }, { "key": "B", "text": "Azure Front Door" }, { "key": "C", "text": "Azure Application Gateway" }, { "key": "D", "text": "Azure Traffic Manager" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Gateway Load Balancer seems the best option.\" One of the main advantages of this NVA injection method is\nthat Source Network Address Translation (SNAT) isn't required to guarantee traffic symmetry. Another\nbenefit of this design option is that the same NVAs can be used to inspect traffic to/from different V Nets,\nthus achieving multitenancy from the NVA perspective. No V Net peering is required between the NVA V Net\nand the workload V Net(s), and no User-Defined Routes are required in the workload V Net, which dramatically\nsimplifies the configuration.\n\"https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 128, "pdfId": 129, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/129" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "HOTSPOT - You have 10 on-premises servers that run Windows Server. You need to p", "keys": [ "HOTSPOT - You have 10 on-premises servers that run Windows Server. You need to p" ] }, "explanation": "Box 1: Azure Front Door\nBoth Azure Front Door and Traffic Manager are global load balancer. However, recommended traffic for Azure\nFront Door is HTTP(S), and recommended traffic for Traffic Manager is Non-HTTP(S).\nBox 2: Azure Application Gateway\nThe Application Gateway Ingress Controller (AGIC) is a Kubernetes application, which makes it possible for\nAzure Kubernetes Service (AKS) customers to leverage Azure's native Application Gateway L7 load-balancer\nto expose cloud software to the Internet.\nAGIC helps eliminate the need to have another load balancer/public IP address in front of the AKS cluster and\navoids multiple hops in your data path before requests reach the AKS cluster.", "reference": "https://learn.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview\nhttps://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview", "references": [ "https://learn.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview", "https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 129, "pdfId": 130, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/130" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1) enable soft delete for blobs.\n2)enable versioning for blobs.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 130, "pdfId": 131, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/131" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "To Run the Containerized Apps: Azure Container Instances (ACI).\nFor the Lifecycle Management and Storage of Container Images: Azure Container Registry.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 281, "pdfId": 132, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/132" }, "markersInGap": [], "questionText": "Explanation:\nBox 1: Azure Front Door\nBoth Azure Front Door and Traffic Manager are global load balancer. However, recommended traffic for Azure\nFront Door is HTTP(S), and recommended traffic for Traffic Manager is Non-HTTP(S).\nBox 2: Azure Application Gateway\nThe Application Gateway Ingress Controller (AGIC) is a Kubernetes application, which makes it possible for\nAzure Kubernetes Service (AKS) customers to leverage Azure's native Application Gateway L7 load-balancer\nto expose cloud software to the Internet.\nAGIC helps eliminate the need to have another load balancer/public IP address in front of the AKS cluster and\navoids multiple hops in your data path before requests reach the AKS cluster.\nReference:\nhttps://learn.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview\nhttps://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview\nHOTSPOT\n-\nYou have an Azure subscription.\nYou create a storage account that will store documents.\nYou need to configure the storage account to meet the following requirements:\n•Ensure that retention policies are standardized across the subscription.\n•Ensure that data can be purged if the data is copied to an unauthorized location.\nWhich two settings should you enable? To answer, select the appropriate settings in the answer area.\nNOTE: Each correct selection is worth one point.\nAnswer:\nExplanation:\n1) enable soft delete for blobs.\n2)enable versioning for blobs", "stem": "Explanation: Box 1: Azure Front Door Both Azure Front Door and Traffic Manager are global load balancer. However, recommended traffic for Azure Front Door is HTTP(S), and recommended traffic for Traffic Manager is Non-HTTP(S). Box 2: Azure Application Gateway The Application Gateway Ingress Controller (AGIC) is a Kubernetes application, which makes it possible for Azure Kubernetes Service (AKS) customers to leverage Azure's native Application Gateway L7 load-balancer to expose cloud software to the Internet. AGIC helps eliminate the need to have another load balancer/public IP address in front of the AKS cluster and avoids multiple hops in your data path before requests reach the AKS cluster. Reference: https://learn.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview You have an Azure subscription. You create a storage account that will store documents. You need to configure the storage account to meet the following requirements: •Ensure that retention policies are standardized across the subscription. •Ensure that data can be purged if the data is copied to an unauthorized location. Which two settings should you enable? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1) enable soft delete for blobs.\n2)enable versioning for blobs", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false, "recoveredFromMarkerSplit": true } }, { "seq": 133, "pdfId": 133, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/133" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a storage account.\nAn application sometimes writes duplicate files to the storage account.\nYou have a PowerShell script that identifies and deletes duplicate files in the storage account. Currently, the script\nis run manually after approval from the operations manager.\nYou need to recommend a serverless solution that performs the following actions:\n✑\n Runs the script once an hour to identify whether duplicate files exist\n✑\n Sends an email notification to the operations manager requesting approval to delete the duplicate files\n✑\n Processes an email response from the operations manager specifying whether the deletion was approved\n✑\n Runs the script if the deletion was approved\nWhat should you include in the recommendation?\nA.\nAzure Logic Apps and Azure Event Grid\nB.\nAzure Logic Apps and Azure Functions\nC.\nAzure Pipelines and Azure Service Fabric\nD.\nAzure Functions and Azure Batch", "stem": "You have an Azure subscription that contains a storage account. An application sometimes writes duplicate files to the storage account. You have a PowerShell script that identifies and deletes duplicate files in the storage account. Currently, the script is run manually after approval from the operations manager. You need to recommend a serverless solution that performs the following actions: ✑ Runs the script once an hour to identify whether duplicate files exist ✑ Sends an email notification to the operations manager requesting approval to delete the duplicate files ✑ Processes an email response from the operations manager specifying whether the deletion was approved ✑ Runs the script if the deletion was approved What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Logic Apps and Azure Event Grid" }, { "key": "B", "text": "Azure Logic Apps and Azure Functions" }, { "key": "C", "text": "Azure Pipelines and Azure Service Fabric" }, { "key": "D", "text": "Azure Functions and Azure Batch" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You can schedule a powershell script with Azure Logic Apps.\nWhen you want to run code that performs a specific job in your logic apps, you can create your own function\nby using Azure Functions. This service helps you create Node.js, C#, and F# functions so you don't have to\nbuild a complete app or infrastructure to run code. You can also call logic apps from inside Azure functions.", "reference": "https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-azure-functions", "references": [ "https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-azure-functions" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 131, "pdfId": 134, "exam": "AZ-305", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/134" }, "markersInGap": [ 134 ], "questionText": "DRAG DROP\n-\nYou plan to use Azure Storage to store data assets.\nYou need to identify the procedure to fail over a general-purpose v2 account as part of a disaster recovery plan.\nThe solution must meet the following requirements:\n•Apps must be able to access the storage account after a failover.\n•You must be able to fail back the storage account to the original location.\n•Downtime must be minimized.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.", "stem": "You plan to use Azure Storage to store data assets. You need to identify the procedure to fail over a general-purpose v2 account as part of a disaster recovery plan. The solution must meet the following requirements: •Apps must be able to access the storage account after a failover. •You must be able to fail back the storage account to the original location. •Downtime must be minimized. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Before a Failover, Configure geo -redundant Storage (GRS) replication for the storage account.\nInitiate a Failover.\nAfter a Failover, configure geo-redundant Storage (GRS) replication for the storage account.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 132, "pdfId": 135, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/135" }, "markersInGap": [ 135 ], "questionText": "You have an Azure subscription that contains a Basic Azure virtual WAN named VirtualWAN1 and the virtual hubs\nshown in the following table.\nYou have an ExpressRoute circuit in the US East Azure region.\nYou need to create an ExpressRoute association to VirtualWAN1.\nWhat should you do first?\nA.\nUpgrade VirtualWAN1 to Standard.\nB.\nCreate a gateway on Hub1.\nC.\nEnable the ExpressRoute premium add-on.\nD.\nCreate a hub virtual network in US East.", "stem": "You have an Azure subscription that contains a Basic Azure virtual WAN named VirtualWAN1 and the virtual hubs shown in the following table. You have an ExpressRoute circuit in the US East Azure region. You need to create an ExpressRoute association to VirtualWAN1. What should you do first", "options": [ { "key": "A", "text": "Upgrade VirtualWAN1 to Standard." }, { "key": "B", "text": "Create a gateway on Hub1." }, { "key": "C", "text": "Enable the ExpressRoute premium add-on." }, { "key": "D", "text": "Create a hub virtual network in US East." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A basic Azure virtual WAN does not support express route. You have to upgrade to standard.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 135, "pdfId": 136, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/136" }, "markersInGap": [], "questionText": "You need to design a solution that will execute custom C# code in response to an event routed to Azure Event Grid.\nThe solution must meet the following requirements:\n✑\n The executed code must be able to access the private IP address of a Microsoft SQL Server instance that runs on\nan Azure virtual machine.\n✑\n Costs must be minimized.\nWhat should you include in the solution?\nA.\nAzure Logic Apps in the Consumption plan\nB.\nAzure Functions in the Premium plan\nC.\nAzure Functions in the Consumption plan\nD.\nAzure Logic Apps in the integrated service environment", "stem": "You need to design a solution that will execute custom C# code in response to an event routed to Azure Event Grid. The solution must meet the following requirements: ✑ The executed code must be able to access the private IP address of a Microsoft SQL Server instance that runs on an Azure virtual machine. ✑ Costs must be minimized. What should you include in the solution", "options": [ { "key": "A", "text": "Azure Logic Apps in the Consumption plan" }, { "key": "B", "text": "Azure Functions in the Premium plan" }, { "key": "C", "text": "Azure Functions in the Consumption plan" }, { "key": "D", "text": "Azure Logic Apps in the integrated service environment" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Virtual connectivity is included in the Premium plan.", "reference": "https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale#hosting-plans-comparison", "references": [ "https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale#hosting-plans-comparison" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 134, "pdfId": 137, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/137" }, "markersInGap": [ 136, 137 ], "questionText": "Your company has the infrastructure shown in the following table.\nThe on-premises Active Directory domain syncs with Azure Active Directory (Azure AD).\nServer1 runs an application named App1 that uses LDAP queries to verify user identities in the on-premises Active\nDirectory domain.\n You plan to migrate Server1 to a virtual machine in Subscription1.\nA company security policy states that the virtual machines and services deployed to Subscription1 must be\nprevented from accessing the on-premises network.\nYou need to recommend a solution to ensure that App1 continues to function after the migration. The solution must\nmeet the security policy.\nWhat should you include in the recommendation?\nA.\nAzure AD Application Proxy\nB.\nthe Active Directory Domain Services role on a virtual machine\nC.\nan Azure VPN gateway\nD.\nAzure AD Domain Services (Azure AD DS)", "stem": "Your company has the infrastructure shown in the following table. The on-premises Active Directory domain syncs with Azure Active Directory (Azure AD). Server1 runs an application named App1 that uses LDAP queries to verify user identities in the on-premises Active Directory domain. You plan to migrate Server1 to a virtual machine in Subscription1. A company security policy states that the virtual machines and services deployed to Subscription1 must be prevented from accessing the on-premises network. You need to recommend a solution to ensure that App1 continues to function after the migration. The solution must meet the security policy. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure AD Application Proxy" }, { "key": "B", "text": "the Active Directory Domain Services role on a virtual machine" }, { "key": "C", "text": "an Azure VPN gateway" }, { "key": "D", "text": "Azure AD Domain Services (Azure AD DS)" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Azure Active Directory Domain Services (Azure AD DS) provides managed domain services such as domain\njoin, group policy, lightweight directory access protocol (LDAP), and Kerberos/NTLM authentication.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory-domain-services/overview", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory-domain-services/overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 137, "pdfId": 138, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/138" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: An on-premises data gateway\nFor logic apps in global, multi-tenant Azure that connect to on-premises SQL Server, you need to have the on-\npremises data gateway installed on a local computer and a data gateway resource that's already created in\nAzure.\nBox 2: A connection gateway resource", "reference": "https://docs.microsoft.com/en-us/azure/connectors/connectors-create-api-sqlazure", "references": [ "https://docs.microsoft.com/en-us/azure/connectors/connectors-create-api-sqlazure" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 136, "pdfId": 139, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/139" }, "markersInGap": [ 138, 139 ], "questionText": "You have an on-premises network and an Azure subscription. The on-premises network has several branch offices.\nA branch office in Toronto contains a virtual machine named VM1 that is configured as a file server. Users access\nthe shared files on VM1 from all the offices.\nYou need to recommend a solution to ensure that the users can access the shared files as quickly as possible if the\nToronto branch office is inaccessible.\nWhat should you include in the recommendation?\nA.\na Recovery Services vault and Windows Server Backup\nB.\nAzure blob containers and Azure File Sync\n C.\na Recovery Services vault and Azure Backup\nD.\nan Azure file share and Azure File Sync", "stem": "You have an on-premises network and an Azure subscription. The on-premises network has several branch offices. A branch office in Toronto contains a virtual machine named VM1 that is configured as a file server. Users access the shared files on VM1 from all the offices. You need to recommend a solution to ensure that the users can access the shared files as quickly as possible if the Toronto branch office is inaccessible. What should you include in the recommendation", "options": [ { "key": "A", "text": "a Recovery Services vault and Windows Server Backup" }, { "key": "B", "text": "Azure blob containers and Azure File Sync" }, { "key": "C", "text": "a Recovery Services vault and Azure Backup" }, { "key": "D", "text": "an Azure file share and Azure File Sync" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Use Azure File Sync to centralize your organization's file shares in Azure Files, while keeping the flexibility,\nperformance, and compatibility of an on-premises file server. Azure File Sync transforms Windows Server into\na quick cache of your Azure file share.", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 138, "pdfId": 140, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/140" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Reference:\nhttps://docs.microsoft.com/en-us/azure/api-management/api-management-using-with-vnet", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 139, "pdfId": 141, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/141" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure Application Gateway\nThe Azure Application Gateway Web Application Firewall (WAF) provides protection for web applications.\nThese protections are provided by the Open Web\nApplication Security Project (OWASP) Core Rule Set (CRS).\nBox 2: Web Application Firewall (WAF)", "reference": "https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-\nrules-portal", "references": [ "https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-customize-waf-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 140, "pdfId": 142, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/142" }, "markersInGap": [], "questionText": "You are designing a microservices architecture that will be hosted in an Azure Kubernetes Service (AKS) cluster.\nApps that will consume the microservices will be hosted on Azure virtual machines. The virtual machines and the\nAKS cluster will reside on the same virtual network.\nYou need to design a solution to expose the microservices to the consumer apps. The solution must meet the\nfollowing requirements:\n✑\n Ingress access to the microservices must be restricted to a single private IP address and protected by using\nmutual TLS authentication.\n✑\n The number of incoming microservice calls must be rate-limited.\n✑\n Costs must be minimized.\nWhat should you include in the solution?\nA.\nAzure App Gateway with Azure Web Application Firewall (WAF)\nB.\nAzure API Management Standard tier with a service endpoint\nC.\nAzure Front Door with Azure Web Application Firewall (WAF)\nD.\nAzure API Management Premium tier with virtual network connection", "stem": "You are designing a microservices architecture that will be hosted in an Azure Kubernetes Service (AKS) cluster. Apps that will consume the microservices will be hosted on Azure virtual machines. The virtual machines and the AKS cluster will reside on the same virtual network. You need to design a solution to expose the microservices to the consumer apps. The solution must meet the following requirements: ✑ Ingress access to the microservices must be restricted to a single private IP address and protected by using mutual TLS authentication. ✑ The number of incoming microservice calls must be rate-limited. ✑ Costs must be minimized. What should you include in the solution", "options": [ { "key": "A", "text": "Azure App Gateway with Azure Web Application Firewall (WAF)" }, { "key": "B", "text": "Azure API Management Standard tier with a service endpoint" }, { "key": "C", "text": "Azure Front Door with Azure Web Application Firewall (WAF)" }, { "key": "D", "text": "Azure API Management Premium tier with virtual network connection" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "One option is to deploy APIM (API Management) inside the cluster VNet.\nThe AKS cluster and the applications that consume the microservices might reside within the same VNet,\nhence there is no reason to expose the cluster publicly as all API traffic will remain within the VNet. For these\nscenarios, you can deploy API Management into the cluster VNet. API Management Premium tier supports\nVNet deployment.", "reference": "https://docs.microsoft.com/en-us/azure/api-management/api-management-kubernetes", "references": [ "https://docs.microsoft.com/en-us/azure/api-management/api-management-kubernetes" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 141, "pdfId": 143, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/143" }, "markersInGap": [], "questionText": "You have a .NET web service named Service1 that performs the following tasks:\n✑\n Reads and writes temporary files to the local file system.\n✑\n Writes to the Application event log.\nYou need to recommend a solution to host Service1 in Azure. The solution must meet the following requirements:\n✑\n Minimize maintenance overhead.\n✑\n Minimize costs.\nWhat should you include in the recommendation?\nA.\nan Azure App Service web app\nB.\nan Azure virtual machine scale set\nC.\nan App Service Environment (ASE)\nD.\nan Azure Functions app", "stem": "You have a .NET web service named Service1 that performs the following tasks: ✑ Reads and writes temporary files to the local file system. ✑ Writes to the Application event log. You need to recommend a solution to host Service1 in Azure. The solution must meet the following requirements: ✑ Minimize maintenance overhead. ✑ Minimize costs. What should you include in the recommendation", "options": [ { "key": "A", "text": "an Azure App Service web app" }, { "key": "B", "text": "an Azure virtual machine scale set" }, { "key": "C", "text": "an App Service Environment (ASE)" }, { "key": "D", "text": "an Azure Functions app" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "an Azure App Service web app would be the best solution as it provides low maintenance overhead and cost-\neffectiveness while being able to host .NET web services. Additionally, Azure App Service provides easy\nintegration with other Azure services, and it supports the reading and writing of files to the local file system.\nThe Application event log can also be written to using Azure Diagnostic Logs, which can be configured within\nthe Azure App Service.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 143, "pdfId": 144, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/144" }, "markersInGap": [], "questionText": "Your company has an app named App1 that uses data from the on-premises Microsoft SQL Server databases\nshown in the following table.\nApp1 and the data are used on the first day of the month only. The data is not expected to grow more than 3\npercent each year.\nThe company is rewriting App1 as an Azure web app and plans to migrate all the data to Azure.\nYou need to migrate the data to Azure SQL Database and ensure that the database is only available on the first day\nof each month.\nWhich service tier should you use?\nA.\nvCore-based General Purpose\nB.\nDTU-based Standard\nC.\nvCore-based Business Critical\nD.\nDTU-based Basic", "stem": "Your company has an app named App1 that uses data from the on-premises Microsoft SQL Server databases shown in the following table. App1 and the data are used on the first day of the month only. The data is not expected to grow more than 3 percent each year. The company is rewriting App1 as an Azure web app and plans to migrate all the data to Azure. You need to migrate the data to Azure SQL Database and ensure that the database is only available on the first day of each month. Which service tier should you use", "options": [ { "key": "A", "text": "vCore-based General Purpose" }, { "key": "B", "text": "DTU-based Standard" }, { "key": "C", "text": "vCore-based Business Critical" }, { "key": "D", "text": "DTU-based Basic" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Note: App1 and the data are used on the first day of the month only. See Serverless compute tier below.\nThe vCore based purchasing model.\nThe term vCore refers to the Virtual Core. In this purchasing model of Azure SQL Database, you can choose\nfrom the provisioned compute tier and serverless compute tier.\n* Provisioned compute tier: You choose the exact compute resources for the workload.\n* Serverless compute tier: Azure automatically pauses and resumes the database based on workload activity\nin the serverless tier. During the pause period, Azure does not charge you for the compute resources.", "reference": "https://www.sqlshack.com/dtu-and-vcore-based-models-for-azure-sql-databases/", "references": [ "https://www.sqlshack.com/dtu-and-vcore-based-models-for-azure-sql-databases/" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 142, "pdfId": 145, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/145" }, "markersInGap": [ 144, 145 ], "questionText": "You have the Azure resources shown in the following table.\nYou need to deploy a new Azure Firewall policy that will contain mandatory rules for all Azure Firewall\ndeployments. The new policy will be configured as a parent policy for the existing policies.\nWhat is the minimum number of additional Azure Firewall policies you should create?\nA.\n0\n B.\n1\nC.\n2\nD.\n3", "stem": "You have the Azure resources shown in the following table. You need to deploy a new Azure Firewall policy that will contain mandatory rules for all Azure Firewall deployments. The new policy will be configured as a parent policy for the existing policies. What is the minimum number of additional Azure Firewall policies you should create", "options": [], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Firewall policies work across regions and subscriptions.\nPlace all your global configurations in the parent policy.\nThe parent policy is required to be in the same region as the child policy.", "reference": "https://docs.microsoft.com/en-us/azure/firewall-manager/overview", "references": [ "https://docs.microsoft.com/en-us/azure/firewall-manager/overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": true } }, { "seq": 144, "pdfId": 146, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/146" }, "markersInGap": [], "questionText": "Your company has an app named App1 that uses data from the on-premises Microsoft SQL Server databases\nshown in the following table.\nApp1 and the data are used on the first day of the month only. The data is not expected to grow more than 3% each\nyear.\nThe company is rewriting App1 as an Azure web app and plans to migrate all the data to Azure.\nYou need to migrate the data to Azure SQL Database. The solution must minimize costs.\nWhich service tier should you use?\nA.\nvCore-based General Purpose\nB.\nDTU-based Standard\nC.\nvCore-based Business Critical\nD.\nDTU-based Basic", "stem": "Your company has an app named App1 that uses data from the on-premises Microsoft SQL Server databases shown in the following table. App1 and the data are used on the first day of the month only. The data is not expected to grow more than 3% each year. The company is rewriting App1 as an Azure web app and plans to migrate all the data to Azure. You need to migrate the data to Azure SQL Database. The solution must minimize costs. Which service tier should you use", "options": [ { "key": "A", "text": "vCore-based General Purpose" }, { "key": "B", "text": "DTU-based Standard" }, { "key": "C", "text": "vCore-based Business Critical" }, { "key": "D", "text": "DTU-based Basic" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "vCore tiers allow serverless and auto-pause, which matches perfect to \"only used first day of month\". Rest of\nthe month, the service is paused and does not generate compute costs.\nIn DTU service tier, you need to add min. 100 DTUs to get possibility for 400GB DB size. Below you only have\n250GB.\nBased on this, vCore General Purpose, Serverless is cheapest solution.\nYour company has 300 virtual machines hosted in a VMware environment. The virtual machines vary in size and\nhave various utilization levels.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 145, "pdfId": 147, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/147" }, "markersInGap": [], "questionText": "You plan to move all the virtual machines to Azure.\nYou need to recommend how many and what size Azure virtual machines will be required to move the current\nworkloads to Azure. The solution must minimize administrative effort.\nWhat should you use to make the recommendation?\nA.\nAzure Pricing calculator\nB.\nAzure Advisor\nC.\nAzure Migrate\nD.\nAzure Cost Management", "stem": "You plan to move all the virtual machines to Azure. You need to recommend how many and what size Azure virtual machines will be required to move the current workloads to Azure. The solution must minimize administrative effort. What should you use to make the recommendation", "options": [ { "key": "A", "text": "Azure Pricing calculator" }, { "key": "B", "text": "Azure Advisor" }, { "key": "C", "text": "Azure Migrate" }, { "key": "D", "text": "Azure Cost Management" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Migrate provides a centralized hub to assess and migrate on-premises servers, infrastructure,\napplications, and data to Azure. It provides the following:\nUnified migration platform: A single portal to start, run, and track your migration to Azure. Range of tools: A\nrange of tools for assessment and migration.", "reference": "https://docs.microsoft.com/en-us/azure/migrate/migrate-services-overview", "references": [ "https://docs.microsoft.com/en-us/azure/migrate/migrate-services-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 148, "pdfId": 148, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/148" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou plan to deploy multiple instances of an Azure web app across several Azure regions.\nYou need to design an access solution for the app. The solution must meet the following replication requirements:\n✑\n Support rate limiting.\n✑\n Balance requests between all instances.\n✑\n Ensure that users can access the app in the event of a regional outage.\nSolution: You use Azure Traffic Manager to provide access to the app.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You plan to deploy multiple instances of an Azure web app across several Azure regions. You need to design an access solution for the app. The solution must meet the following replication requirements: ✑ Support rate limiting. ✑ Balance requests between all instances. ✑ Ensure that users can access the app in the event of a regional outage. Solution: You use Azure Traffic Manager to provide access to the app. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Traffic Manager is a DNS-based traffic load balancer. This service allows you to distribute traffic to\nyour public facing applications across the global Azure regions. Traffic Manager also provides your public\nendpoints with high availability and quick responsiveness. It does not provide rate limiting.", "reference": "https://docs.microsoft.com/en-us/azure/app-service/web-sites-traffic-manager\nhttps://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview\nhttps://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/app-service/web-sites-traffic-manager", "https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview", "https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell" ], "note": "Azure Front Door would meet the requirements. The Azure Web Application Firewall (WAF) rate limit\nrule for Azure Front Door controls the number of requests allowed from clients during a one-minute duration.\nReference:\nhttps://docs.microsoft.com/en-us/azure/app-service/web-sites-traffic-manager\nhttps://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview\nhttps://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 149, "pdfId": 149, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/149" }, "markersInGap": [ 151, 152 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou plan to deploy multiple instances of an Azure web app across several Azure regions.\nYou need to design an access solution for the app. The solution must meet the following replication requirements:\n✑\n Support rate limiting.\n ✑\n Balance requests between all instances.\n✑\n Ensure that users can access the app in the event of a regional outage.\nSolution: You use Azure Load Balancer to provide access to the app.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You plan to deploy multiple instances of an Azure web app across several Azure regions. You need to design an access solution for the app. The solution must meet the following replication requirements: ✑ Support rate limiting. ✑ Balance requests between all instances. ✑ Ensure that users can access the app in the event of a regional outage. Solution: You use Azure Load Balancer to provide access to the app. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Application Gateway and Azure Load Balancer do not support rate or connection limits.", "reference": "https://www.nginx.com/blog/nginx-plus-and-azure-load-balancers-on-microsoft-azure/\nhttps://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://www.nginx.com/blog/nginx-plus-and-azure-load-balancers-on-microsoft-azure/", "https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell" ], "note": "Azure Front Door would meet the requirements. The Azure Web Application Firewall (WAF) rate limit\nrule for Azure Front Door controls the number of requests allowed from clients during a one-minute duration.\nReference:\nhttps://www.nginx.com/blog/nginx-plus-and-azure-load-balancers-on-microsoft-azure/\nhttps://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 150, "pdfId": 150, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/150" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou plan to deploy multiple instances of an Azure web app across several Azure regions.\nYou need to design an access solution for the app. The solution must meet the following replication requirements:\n✑\n Support rate limiting.\n✑\n Balance requests between all instances.\n✑\n Ensure that users can access the app in the event of a regional outage.\nSolution: You use Azure Application Gateway to provide access to the app.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You plan to deploy multiple instances of an Azure web app across several Azure regions. You need to design an access solution for the app. The solution must meet the following replication requirements: ✑ Support rate limiting. ✑ Balance requests between all instances. ✑ Ensure that users can access the app in the event of a regional outage. Solution: You use Azure Application Gateway to provide access to the app. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Application Gateway and Azure Load Balancer do not support rate or connection limits.", "reference": "https://www.nginx.com/blog/nginx-plus-and-azure-load-balancers-on-microsoft-azure/\nhttps://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell", "references": [ "https://www.nginx.com/blog/nginx-plus-and-azure-load-balancers-on-microsoft-azure/", "https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell" ], "note": "Azure Front Door would meet the requirements. The Azure Web Application Firewall (WAF) rate limit\nrule for Azure Front Door controls the number of requests allowed from clients during a one-minute duration.\nReference:\nhttps://www.nginx.com/blog/nginx-plus-and-azure-load-balancers-on-microsoft-azure/\nhttps://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 146, "pdfId": 151, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/151" }, "markersInGap": [], "questionText": "You plan to provision a High Performance Computing (HPC) cluster in Azure that will use a third-party scheduler.\nYou need to recommend a solution to provision and manage the HPC cluster node.\nWhat should you include in the recommendation?\nA.\nAzure Automation\nB.\nAzure CycleCloud\nC.\nAzure Purview\nD.\nAzure Lighthouse", "stem": "You plan to provision a High Performance Computing (HPC) cluster in Azure that will use a third-party scheduler. You need to recommend a solution to provision and manage the HPC cluster node. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Automation" }, { "key": "B", "text": "Azure CycleCloud" }, { "key": "C", "text": "Azure Purview" }, { "key": "D", "text": "Azure Lighthouse" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You can dynamically provision Azure HPC clusters with Azure CycleCloud.\nAzure CycleCloud is the simplest way to manage HPC workloads.", "reference": "https://docs.microsoft.com/en-us/azure/cyclecloud/overview", "references": [ "https://docs.microsoft.com/en-us/azure/cyclecloud/overview" ], "note": "Azure CycleCloud is an enterprise-friendly tool for orchestrating and managing High Performance\nComputing (HPC) environments on Azure. With\nCycleCloud, users can provision infrastructure for HPC systems, deploy familiar HPC schedulers, and\nautomatically scale the infrastructure to run jobs efficiently at any scale. Through CycleCloud, users can\ncreate different types of file systems and mount them to the compute cluster nodes to support HPC\nworkloads.\nReference:\nhttps://docs.microsoft.com/en-us/azure/cyclecloud/overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 147, "pdfId": 152, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/152" }, "markersInGap": [], "questionText": "You are designing an Azure App Service web app.\nYou plan to deploy the web app to the North Europe Azure region and the West Europe Azure region.\nYou need to recommend a solution for the web app. The solution must meet the following requirements:\n✑\n Users must always access the web app from the North Europe region, unless the region fails.\n✑\n The web app must be available to users if an Azure region is unavailable.\n✑\n Deployment costs must be minimized.\nWhat should you include in the recommendation? To answer, select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You are designing an Azure App Service web app. You plan to deploy the web app to the North Europe Azure region and the West Europe Azure region. You need to recommend a solution for the web app. The solution must meet the following requirements: ✑ Users must always access the web app from the North Europe region, unless the region fails. ✑ The web app must be available to users if an Azure region is unavailable. ✑ Deployment costs must be minimized. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: A Traffic Manager profile\nTo support load balancing across the regions we need a Traffic Manager.\nBox 2: Priority traffic routing -\nPriority traffic-routing method.\nOften an organization wants to provide reliability for their services. To do so, they deploy one or more backup\nservices in case their primary goes down. The\n'Priority' traffic-routing method allows Azure customers to easily implement this failover pattern.", "reference": "https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/multi-\nregion https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/app-service-web-app/multi-", "https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 152, "pdfId": 153, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/153" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Premium page blobs -\nThe maximum size for a page blob is 8 TiB.\nIncorrect:\nNot Premium file shares:\nMax file size for Standard and Premium file shares are 4 TB.\nBox 2: Geo-redundant storage (GRS)\nGRS provides additional redundancy for data storage compared to LRS or ZRS.\nBox 3: A private endpoint -\nAzure Private Link allows you to securely link Azure PaaS services to your virtual network using private\nendpoints. For many services, you just set up an endpoint per resource. This means you can connect your on-\npremises or multi-cloud servers with Azure Arc and send all traffic over an Azure ExpressRoute or site-to-site\nVPN connection instead of using public networks.", "reference": "https://docs.microsoft.com/en-us/rest/api/storageservices/understanding-block-blobs--append-blobs--and-\npage-blobs https://docs.microsoft.com/en-us/azure/storage/files/storage-files-scale-targets\nhttps://docs.microsoft.com/en-us/azure/azure-arc/servers/private-link-security", "references": [ "https://docs.microsoft.com/en-us/rest/api/storageservices/understanding-block-blobs--append-blobs--and-", "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-scale-targets", "https://docs.microsoft.com/en-us/azure/azure-arc/servers/private-link-security" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 151, "pdfId": 154, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/154" }, "markersInGap": [ 153, 154 ], "questionText": "HOTSPOT -\nYour company has two on-premises sites in New York and Los Angeles and Azure virtual networks in the East US\nAzure region and the West US Azure region.\nEach on-premises site has ExpressRoute Global Reach circuits to both regions.\nYou need to recommend a solution that meets the following requirements:\n✑\n Outbound traffic to the internet from workloads hosted on the virtual networks must be routed through the\n closest available on-premises site.\n✑\n If an on-premises site fails, traffic from the workloads on the virtual networks to the internet must reroute\nautomatically to the other site.\nWhat should you include in the recommendation? To answer, select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "Your company has two on-premises sites in New York and Los Angeles and Azure virtual networks in the East US Azure region and the West US Azure region. Each on-premises site has ExpressRoute Global Reach circuits to both regions. You need to recommend a solution that meets the following requirements: ✑ Outbound traffic to the internet from workloads hosted on the virtual networks must be routed through the closest available on-premises site. ✑ If an on-premises site fails, traffic from the workloads on the virtual networks to the internet must reroute automatically to the other site. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Border Gateway Protocol (BGP)\nAn on-premises network gateway can exchange routes with an Azure virtual network gateway using the\nborder gateway protocol (BGP). Using BGP with an Azure virtual network gateway is dependent on the type\nyou selected when you created the gateway. If the type you selected were:\nExpressRoute: You must use BGP to advertise on-premises routes to the Microsoft Edge router. You cannot\ncreate user-defined routes to force traffic to the\nExpressRoute virtual network gateway if you deploy a virtual network gateway deployed as type:\nExpressRoute. You can use user-defined routes for forcing traffic from the Express Route to, for example, a\nNetwork Virtual Appliance.\nBox 2: Border Gateway Protocol (BGP)\nIncorrect:\nMicrosoft does not support HSRP or VRRP for high availability configurations.", "reference": "https://docs.microsoft.com/ja-jp/azure/expressroute/designing-for-disaster-recovery-with-expressroute-\nprivatepeering https://docs.microsoft.com/en-us/azure/expressroute/expressroute-routing", "references": [ "https://docs.microsoft.com/ja-jp/azure/expressroute/designing-for-disaster-recovery-with-expressroute-", "https://docs.microsoft.com/en-us/azure/expressroute/expressroute-routing" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 153, "pdfId": 155, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/155" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: GET only -\nGet for read-only-\nBox 2: Anonymous -\nAnonymous for public operations.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 155, "pdfId": 156, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/156" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "You have data files in Azure Blob Storage. You plan to transform the files and m", "keys": [ "You have data files in Azure Blob Storage. You plan to transform the files and m" ] }, "explanation": "You can copy and transform data in Azure Data Lake Storage Gen2 using Azure Data Factory or Azure\nSynapse Analytics.", "reference": "https://docs.microsoft.com/en-us/azure/data-factory/connector-azure-data-lake-storage", "references": [ "https://docs.microsoft.com/en-us/azure/data-factory/connector-azure-data-lake-storage" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 154, "pdfId": 157, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/157" }, "markersInGap": [ 157 ], "questionText": "You have an Azure subscription.\nYou need to recommend a solution to provide developers with the ability to provision Azure virtual machines. The\nsolution must meet the following requirements:\n✑\n Only allow the creation of the virtual machines in specific regions.\n✑\n Only allow the creation of specific sizes of virtual machines.\nWhat should you include in the recommendation?\nA.\nAzure Resource Manager (ARM) templates\n B.\nAzure Policy\nC.\nConditional Access policies\nD.\nrole-based access control (RBAC)", "stem": "You have an Azure subscription. You need to recommend a solution to provide developers with the ability to provision Azure virtual machines. The solution must meet the following requirements: ✑ Only allow the creation of the virtual machines in specific regions. ✑ Only allow the creation of specific sizes of virtual machines. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Resource Manager (ARM) templates" }, { "key": "B", "text": "Azure Policy" }, { "key": "C", "text": "Conditional Access policies" }, { "key": "D", "text": "role-based access control (RBAC)" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Policies allows you to specify allowed locations, and allowed VM SKUs.", "reference": "https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage", "references": [ "https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage" ], "note": "Each correct selection is worth one point.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 156, "pdfId": 158, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/158" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou need to deploy an Azure Kubernetes Service (AKS) solution that will use Windows Server 2019 nodes. The\nsolution must meet the following requirements:\n✑\n Minimize the time it takes to provision compute resources during scale-out operations.\n✑\n Support autoscaling of Windows Server containers.\nWhich scaling option should you recommend?\nA.\nKubernetes version 1.20.2 or newer\nB.\nVirtual nodes with Virtual Kubelet ACI\nC.\ncluster autoscaler\nD.\nhorizontal pod autoscaler", "stem": "You have an Azure subscription. You need to deploy an Azure Kubernetes Service (AKS) solution that will use Windows Server 2019 nodes. The solution must meet the following requirements: ✑ Minimize the time it takes to provision compute resources during scale-out operations. ✑ Support autoscaling of Windows Server containers. Which scaling option should you recommend", "options": [ { "key": "A", "text": "Kubernetes version 1.20.2 or newer" }, { "key": "B", "text": "Virtual nodes with Virtual Kubelet ACI" }, { "key": "C", "text": "cluster autoscaler" }, { "key": "D", "text": "horizontal pod autoscaler" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Deployments can scale across AKS with no delay as cluster autoscaler deploys new nodes in your AKS\ncluster.", "reference": "https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler", "references": [ "https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler" ], "note": "AKS clusters can scale in one of two ways:\n* The cluster autoscaler watches for pods that can't be scheduled on nodes because of resource constraints.\nThe cluster then automatically increases the number of nodes.\n* The horizontal pod autoscaler uses the Metrics Server in a Kubernetes cluster to monitor the resource\ndemand of pods. If an application needs more resources, the number of pods is automatically increased to\nmeet the demand.\nIncorrect:\nNot D: If your application needs to rapidly scale, the horizontal pod autoscaler may schedule more pods than\ncan be provided by the existing compute resources in the node pool. If configured, this scenario would then\ntrigger the cluster autoscaler to deploy additional nodes in the node pool, but it may take a few minutes for\nthose nodes to successfully provision and allow the Kubernetes scheduler to run pods on them.\nReference:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 157, "pdfId": 159, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/159" }, "markersInGap": [], "questionText": "HOTSPOT -\nYour on-premises network contains a file server named Server1 that stores 500 GB of data.\nYou need to use Azure Data Factory to copy the data from Server1 to Azure Storage.\nYou add a new data factory.\nWhat should you do next? To answer, select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "Your on-premises network contains a file server named Server1 that stores 500 GB of data. You need to use Azure Data Factory to copy the data from Server1 to Azure Storage. You add a new data factory. What should you do next? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Install a self-hosted integration runtime.", "reference": "https://docs.microsoft.com/en-us/azure/data-factory/connector-file-system", "references": [ "https://docs.microsoft.com/en-us/azure/data-factory/connector-file-system" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 160, "pdfId": 160, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/160" }, "markersInGap": [], "questionText": "You have 100 Microsoft SQL Server Integration Services (SSIS) packages that are configured to use 10 on-\npremises SQL Server databases as their destinations.\nYou plan to migrate the 10 on-premises databases to Azure SQL Database.\nYou need to recommend a solution to create Azure-SQL Server Integration Services (SSIS) packages. The solution\nmust ensure that the packages can target the\nSQL Database instances as their destinations.\nWhat should you include in the recommendation?\nA.\nData Migration Assistant (DMA)\nB.\nAzure Data Factory\nC.\nAzure Data Catalog\nD.\nSQL Server Migration Assistant (SSMA)", "stem": "You have 100 Microsoft SQL Server Integration Services (SSIS) packages that are configured to use 10 on- premises SQL Server databases as their destinations. You plan to migrate the 10 on-premises databases to Azure SQL Database. You need to recommend a solution to create Azure-SQL Server Integration Services (SSIS) packages. The solution must ensure that the packages can target the SQL Database instances as their destinations. What should you include in the recommendation", "options": [ { "key": "A", "text": "Data Migration Assistant (DMA)" }, { "key": "B", "text": "Azure Data Factory" }, { "key": "C", "text": "Azure Data Catalog" }, { "key": "D", "text": "SQL Server Migration Assistant (SSMA)" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Migrate on-premises SSIS workloads to SSIS using ADF (Azure Data Factory).\nWhen you migrate your database workloads from SQL Server on premises to Azure database services, namely\nAzure SQL Database or Azure SQL Managed\nInstance, your ETL workloads on SQL Server Integration Services (SSIS) as one of the primary value-added\nservices will need to be migrated as well.\nAzure-SSIS Integration Runtime (IR) in Azure Data Factory (ADF) supports running SSIS packages. Once\nAzure-SSIS IR is provisioned, you can then use familiar tools, such as SQL Server Data Tools (SSDT)/SQL\nServer Management Studio (SSMS), and command-line utilities, such as dtinstall/dtutil/dtexec, to deploy and\nrun your packages in Azure.", "reference": "https://docs.microsoft.com/en-us/azure/data-factory/scenario-ssis-migration-overview", "references": [ "https://docs.microsoft.com/en-us/azure/data-factory/scenario-ssis-migration-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 159, "pdfId": 161, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/161" }, "markersInGap": [], "questionText": "You are designing an order processing system in Azure that will contain the Azure resources shown in the\nfollowing table.\nThe order processing system will have the following transaction flow:\n✑\n A customer will place an order by using App1.\n✑\n When the order is received, App1 will generate a message to check for product availability at vendor 1 and vendor\n2.\n✑\n An integration component will process the message, and then trigger either Function1 or Function2 depending\non the type of order.\n✑\n Once a vendor confirms the product availability, a status message for App1 will be generated by Function1 or\nFunction2.\n✑\n All the steps of the transaction will be logged to storage1.\nWhich type of resource should you recommend for the integration component?\nA.\nan Azure Service Bus queue\nB.\nan Azure Data Factory pipeline\nC.\nan Azure Event Grid domain\nD.\nan Azure Event Hubs capture", "stem": "You are designing an order processing system in Azure that will contain the Azure resources shown in the following table. The order processing system will have the following transaction flow: ✑ A customer will place an order by using App1. ✑ When the order is received, App1 will generate a message to check for product availability at vendor 1 and vendor 2. ✑ An integration component will process the message, and then trigger either Function1 or Function2 depending on the type of order. ✑ Once a vendor confirms the product availability, a status message for App1 will be generated by Function1 or Function2. ✑ All the steps of the transaction will be logged to storage1. Which type of resource should you recommend for the integration component", "options": [ { "key": "A", "text": "an Azure Service Bus queue" }, { "key": "B", "text": "an Azure Data Factory pipeline" }, { "key": "C", "text": "an Azure Event Grid domain" }, { "key": "D", "text": "an Azure Event Hubs capture" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "1. Option A looks correct to me: an Azure Service Bus queueADF pipeline is for data ETL/movement only\n2. Both Service Bus and Data Factory pipeline can be applied to this scenario. Don't forget that functions can\nalso integrate with the queue and process whatever is needed. In this case, I vote A since the app1 says it will\nsend a message, not that it is going to trigger a pipeline.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 158, "pdfId": 162, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/162" }, "markersInGap": [ 161, 162 ], "questionText": "You have an Azure subscription.\nYou need to recommend an Azure Kubernetes Service (AKS) solution that will use Linux nodes. The solution must\n meet the following requirements:\n✑\n Minimize the time it takes to provision compute resources during scale-out operations.\n✑\n Support autoscaling of Linux containers.\n✑\n Minimize administrative effort.\nWhich scaling option should you recommend?\nA.\nhorizontal pod autoscaler\nB.\ncluster autoscaler\nC.\nvirtual nodes\nD.\nVirtual Kubelet", "stem": "You have an Azure subscription. You need to recommend an Azure Kubernetes Service (AKS) solution that will use Linux nodes. The solution must meet the following requirements: ✑ Minimize the time it takes to provision compute resources during scale-out operations. ✑ Support autoscaling of Linux containers. ✑ Minimize administrative effort. Which scaling option should you recommend", "options": [ { "key": "A", "text": "horizontal pod autoscaler" }, { "key": "B", "text": "cluster autoscaler" }, { "key": "C", "text": "virtual nodes" }, { "key": "D", "text": "Virtual Kubelet" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "To rapidly scale application workloads in an AKS cluster, you can use virtual nodes. With virtual nodes, you\nhave quick provisioning of pods, and only pay per second for their execution time. You don't need to wait for\nKubernetes cluster autoscaler to deploy VM compute nodes to run the additional pods. Virtual nodes are only\nsupported with Linux pods and nodes.", "reference": "https://docs.microsoft.com/en-us/azure/aks/virtual-nodes", "references": [ "https://docs.microsoft.com/en-us/azure/aks/virtual-nodes" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 161, "pdfId": 163, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/163" }, "markersInGap": [], "questionText": "You have an Azure virtual machine named VM1 that runs Windows Server 2019 and contains 500 GB of data files.\nYou are designing a solution that will use Azure Data Factory to transform the data files, and then load the files to\nAzure Data Lake Storage.\nWhat should you deploy on VM1 to support the design?\nA.\nthe On-premises data gateway\nB.\nthe Azure Pipelines agent\nC.\nthe self-hosted integration runtime\nD.\nthe Azure File Sync agent", "stem": "You have an Azure virtual machine named VM1 that runs Windows Server 2019 and contains 500 GB of data files. You are designing a solution that will use Azure Data Factory to transform the data files, and then load the files to Azure Data Lake Storage. What should you deploy on VM1 to support the design", "options": [ { "key": "A", "text": "the On-premises data gateway" }, { "key": "B", "text": "the Azure Pipelines agent" }, { "key": "C", "text": "the self-hosted integration runtime" }, { "key": "D", "text": "the Azure File Sync agent" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "The integration runtime (IR) is the compute infrastructure that Azure Data Factory and Synapse pipelines use\nto provide data-integration capabilities across different network environments.\nA self-hosted integration runtime can run copy activities between a cloud data store and a data store in a\nprivate network. It also can dispatch transform activities against compute resources in an on-premises\nnetwork or an Azure virtual network. The installation of a self-hosted integration runtime needs an on-\npremises machine or a virtual machine inside a private network.", "reference": "https://docs.microsoft.com/en-us/azure/data-factory/create-self-hosted-integration-runtime", "references": [ "https://docs.microsoft.com/en-us/azure/data-factory/create-self-hosted-integration-runtime" ], "note": "Each correct selection is worth one point.\nA.\nAzure AD Privileged Identity Management (PIM)\nB.\nAzure Application Gateway\nC.\nAzure AD enterprise applications\nD.\nAzure AD Identity Protection\nE.\nConditional Access policies", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 162, "pdfId": 164, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/164" }, "markersInGap": [], "questionText": "You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain.\nYour company has a line-of-business (LOB) application that was developed internally.\nYou need to implement SAML single sign-on (SSO) and enforce multi-factor authentication (MFA) when users\nattempt to access the application from an unknown location.\nWhich two features should you include in the solution? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nAzure AD Privileged Identity Management (PIM)\nB.\nAzure Application Gateway\nC.\nAzure AD enterprise applications\nD.\nAzure AD Identity Protection\nE.\nConditional Access policies", "stem": "You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain. Your company has a line-of-business (LOB) application that was developed internally. You need to implement SAML single sign-on (SSO) and enforce multi-factor authentication (MFA) when users attempt to access the application from an unknown location. Which two features should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Azure AD Privileged Identity Management (PIM)" }, { "key": "B", "text": "Azure Application Gateway" }, { "key": "C", "text": "Azure AD enterprise applications" }, { "key": "D", "text": "Azure AD Identity Protection" }, { "key": "E", "text": "Conditional Access policies" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Correct ist Azure AD enterprise applications and Conditional Access\nEnterprise App for SSO\nConditional Access for MFA", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 163, "pdfId": 165, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/165" }, "markersInGap": [], "questionText": "You plan to automata the deployment of resources to Azure subscriptions.\nWhat is a difference between using Azure Blueprints and Azure Resource Manager (ARM) templates?\nA.\nARM templates remain connected to the deployed resources.\nB.\nOnly blueprints can contain policy definitions.\nC.\nOnly ARM templates can contain policy definitions.\nD.\nBlueprints remain connected to the deployed resources.", "stem": "You plan to automata the deployment of resources to Azure subscriptions. What is a difference between using Azure Blueprints and Azure Resource Manager (ARM) templates", "options": [ { "key": "A", "text": "ARM templates remain connected to the deployed resources." }, { "key": "B", "text": "Only blueprints can contain policy definitions." }, { "key": "C", "text": "Only ARM templates can contain policy definitions." }, { "key": "D", "text": "Blueprints remain connected to the deployed resources." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "With Azure Blueprints, the relationship between the blueprint definition (what should be deployed) and the\nblueprint assignment (what was deployed) is preserved.\nThis connection supports improved tracking and auditing of deployments.\nIncorrect:\nNot A: An ARM template is a document that doesn't exist natively in Azure - each is stored either locally or in\nsource control or in Templates (preview). The template gets used for deployments of one or more Azure\nresources, but once those resources deploy there's no active connection or relationship to the template.\nNot C: Blueprints are a declarative way to orchestrate the deployment of various resource templates and\nother artifacts such as:\nRole Assignments -\nPolicy Assignments -\nAzure Resource Manager templates (ARM templates)\nResource Groups -", "reference": "https://docs.microsoft.com/en-us/azure/governance/blueprints/overview#how-its-different-from-resource-\nmanager-templates", "references": [ "https://docs.microsoft.com/en-us/azure/governance/blueprints/overview#how-its-different-from-resource-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 164, "pdfId": 166, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/166" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure Resource Mover -\nTo move Azure VMs to another region, Microsoft now recommends using Azure Resource Mover.\nIncorrect:\nNot Azure Migrate: We are not migrating, only moving a VM between resource groups.\nBox 2: Azure Migrate -\nAzure Migrate provides a centralized hub to assess and migrate on-premises servers, infrastructure,\napplications, and data to Azure.\nAzure migrate includes Azure Migrate Server Migration: Migrate VMware VMs, Hyper-V VMs, physical servers,\nother virtualized servers, and public cloud VMs to\nAzure.\nIncorrect:\nNot Arc: Azure Migrate is adequate. No need to use Azure Arc.\nNot Data Migration Assistant: Data Migration Assistant is a stand-alone tool to assess SQL Servers.\nIt is used to assess SQL Server databases for migration to Azure SQL Database, Azure SQL Managed\nInstance, or Azure VMs running SQL Server.\nNot Lighthouse: Azure Lighthouse enables multi-tenant management with scalability, higher automation, and\nenhanced governance across resources.\nWith Azure Lighthouse, service providers can deliver managed services using comprehensive and robust\ntooling built into the Azure platform. Customers maintain control over who has access to their tenant, which\nresources they can access, and what actions can be taken.", "reference": "https://docs.microsoft.com/en-us/azure/resource-mover/overview https://docs.microsoft.com/en-\nus/azure/migrate/migrate-services-overview https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-\nazure-tutorial-migrate", "references": [ "https://docs.microsoft.com/en-us/azure/resource-mover/overview", "https://docs.microsoft.com/en-", "https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 165, "pdfId": 167, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/167" }, "markersInGap": [], "questionText": "You plan to deploy an Azure App Service web app that will have multiple instances across multiple Azure regions.\nYou need to recommend a load balancing service for the planned deployment The solution must meet the\nfollowing requirements:\n✑\n Maintain access to the app in the event of a regional outage.\n✑\n Support Azure Web Application Firewall (WAF).\n✑\n Support cookie-based affinity.\n✑\n Support URL routing.\nWhat should you include in the recommendation?\nA.\nAzure Front Door\nB.\nAzure Traffic Manager\nC.\nAzure Application Gateway\nD.\nAzure Load Balancer", "stem": "You plan to deploy an Azure App Service web app that will have multiple instances across multiple Azure regions. You need to recommend a load balancing service for the planned deployment The solution must meet the following requirements: ✑ Maintain access to the app in the event of a regional outage. ✑ Support Azure Web Application Firewall (WAF). ✑ Support cookie-based affinity. ✑ Support URL routing. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Front Door" }, { "key": "B", "text": "Azure Traffic Manager" }, { "key": "C", "text": "Azure Application Gateway" }, { "key": "D", "text": "Azure Load Balancer" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Front Door works across regions and support URL routing (HTTP(S)).", "reference": "https://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview" ], "note": "HTTP(S) load-balancing services are Layer 7 load balancers that only accept HTTP(S) traffic. They are\nintended for web applications or other HTTP(S) endpoints. They include features such as SSL offload, web\napplication firewall, path-based load balancing, and session affinity.\nIncorrect:\nApplication Gateway and Azure Load Balancer only work within one single region.\nReference:\nhttps://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 168, "pdfId": 168, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/168" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou plan to deploy multiple instances of an Azure web app across several Azure regions.\nYou need to design an access solution for the app. The solution must meet the following replication requirements:\n✑\n Support rate limiting.\n✑\n Balance requests between all instances.\n✑\n Ensure that users can access the app in the event of a regional outage.\nSolution: You use Azure Front Door to provide access to the app.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You plan to deploy multiple instances of an Azure web app across several Azure regions. You need to design an access solution for the app. The solution must meet the following replication requirements: ✑ Support rate limiting. ✑ Balance requests between all instances. ✑ Ensure that users can access the app in the event of a regional outage. Solution: You use Azure Front Door to provide access to the app. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Front Door meets the requirements. The Azure Web Application Firewall (WAF) rate limit rule for Azure\nFront Door controls the number of requests allowed from clients during a one-minute duration.", "reference": "https://www.nginx.com/blog/nginx-plus-and-azure-load-balancers-on-microsoft-azure/\nhttps://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell", "references": [ "https://www.nginx.com/blog/nginx-plus-and-azure-load-balancers-on-microsoft-azure/", "https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 167, "pdfId": 169, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/169" }, "markersInGap": [], "questionText": "You are designing a microservices architecture that will support a web application.\nThe solution must meet the following requirements:\n✑\n Deploy the solution on-premises and to Azure.\nSupport low-latency and hyper-scale operations.\n✑\n Allow independent upgrades to each microservice.\n✑\n Set policies for performing automatic repairs to the microservices.\nYou need to recommend a technology.\nWhat should you recommend?\nA.\nAzure Container Instance\nB.\nAzure Logic App\nC.\nAzure Service Fabric\nD.\nAzure virtual machine scale set", "stem": "You are designing a microservices architecture that will support a web application. The solution must meet the following requirements: ✑ Deploy the solution on-premises and to Azure. Support low-latency and hyper-scale operations. ✑ Allow independent upgrades to each microservice. ✑ Set policies for performing automatic repairs to the microservices. You need to recommend a technology. What should you recommend", "options": [ { "key": "A", "text": "Azure Container Instance" }, { "key": "B", "text": "Azure Logic App" }, { "key": "C", "text": "Azure Service Fabric" }, { "key": "D", "text": "Azure virtual machine scale set" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Service Fabric enables you to create Service Fabric clusters on premises or in other clouds.\nAzure Service Fabric is low-latency and scales up to thousands of machines.", "reference": "https://azure.microsoft.com/en-us/services/service-fabric/", "references": [ "https://azure.microsoft.com/en-us/services/service-fabric/" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 166, "pdfId": 170, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/170" }, "markersInGap": [ 169, 170 ], "questionText": "HOTSPOT -\nYou have the Azure resources shown in the following table.\n You need to design a solution that provides on-premises network connectivity to SQLDB1 through PE1.\nHow should you configure name resolution? To answer select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have the Azure resources shown in the following table. You need to design a solution that provides on-premises network connectivity to SQLDB1 through PE1. How should you configure name resolution? To answer select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Configure vm1 to forward contoso.com to the azure provided dns at 168.63.129.16\nBox 2: Forward contoso.com to VM1\nForward to the DNS server VM1.", "reference": null, "references": [], "note": "You can use the following options to configure your DNS settings for private endpoints:\n* Use the host file (only recommended for testing). You can use the host file on a virtual machine to override\nthe DNS.\n* Use a private DNS zone. You can use private DNS zones to override the DNS resolution for a private endpoint.\nA private DNS zone can be linked to your virtual network to resolve specific domains.\n* Use your DNS forwarder (optional). You can use your DNS forwarder to override the DNS resolution for a\nprivate link resource. Create a DNS forwarding rule to use a private DNS zone on your DNS server hosted in a\nvirtual network.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 169, "pdfId": 171, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/171" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nAzure Activity Log\nB.\nAzure Arc\nC.\nAzure Analysis Services\nD.\nAzure Monitor action groups", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Activity Log" }, { "key": "B", "text": "Azure Arc" }, { "key": "C", "text": "Azure Analysis Services" }, { "key": "D", "text": "Azure Monitor action groups" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't more\nthan 90 days in the past.\nThrough activity logs, you can determine:\n✑\n what operations were taken on the resources in your subscription\n✑\n who started the operation\nwhen the operation occurred\n✑\n the status of the operation\n✑\n the values of other properties that might help you research the operation", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 170, "pdfId": 172, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/172" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou need to recommend a solution to provide developers with the ability to provision Azure virtual machines. The\nsolution must meet the following requirements:\n✑\n Only allow the creation of the virtual machines in specific regions.\n✑\n Only allow the creation of specific sizes of virtual machines.\nWhat should you include in the recommendation?\nA.\nAttribute-based access control (ABAC)\nB.\nAzure Policy\nC.\nConditional Access policies\nD.\nrole-based access control (RBAC)", "stem": "You have an Azure subscription. You need to recommend a solution to provide developers with the ability to provision Azure virtual machines. The solution must meet the following requirements: ✑ Only allow the creation of the virtual machines in specific regions. ✑ Only allow the creation of specific sizes of virtual machines. What should you include in the recommendation", "options": [ { "key": "A", "text": "Attribute-based access control (ABAC)" }, { "key": "B", "text": "Azure Policy" }, { "key": "C", "text": "Conditional Access policies" }, { "key": "D", "text": "role-based access control (RBAC)" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Policies allows you to specify allowed locations, and allowed VM SKUs.", "reference": "https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage", "references": [ "https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 171, "pdfId": 173, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/173" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Notification Hubs\nB.\nAzure Data Lake\nC.\nAzure Service Bus\nD.\nAzure Blob Storage", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Notification Hubs" }, { "key": "B", "text": "Azure Data Lake" }, { "key": "C", "text": "Azure Service Bus" }, { "key": "D", "text": "Azure Blob Storage" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Asynchronous messaging options.\nThere are different types of messages and the entities that participate in a messaging infrastructure. Based\non the requirements of each message type, Microsoft recommends Azure messaging services. The options\ninclude Azure Service Bus, Event Grid, and Event Hubs.\nAzure Service Bus queues are well suited for transferring commands from producers to consumers.\nData is transferred between different applications and services using messages. A message is a container\ndecorated with metadata, and contains data. The data can be any kind of information, including structured\ndata encoded with the common formats such as the following ones: JSON, XML, Apache Avro, Plain Text.", "reference": "https://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/messaging\nhttps://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-messaging-overview", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/messaging", "https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-messaging-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 172, "pdfId": 174, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/174" }, "markersInGap": [], "questionText": "You have 100 devices that write performance data to Azure Blob Storage.\nYou plan to store and analyze the performance data in an Azure SQL database.\nYou need to recommend a solution to continually copy the performance data to the Azure SQL database.\nWhat should you include in the recommendation?\nA.\nAzure Data Factory\nB.\nData Migration Assistant (DMA)\nC.\nAzure Data Box\nD.\nAzure Database Migration Service", "stem": "You have 100 devices that write performance data to Azure Blob Storage. You plan to store and analyze the performance data in an Azure SQL database. You need to recommend a solution to continually copy the performance data to the Azure SQL database. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Data Factory" }, { "key": "B", "text": "Data Migration Assistant (DMA)" }, { "key": "C", "text": "Azure Data Box" }, { "key": "D", "text": "Azure Database Migration Service" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Data Factory - using Data Factory pipelines. Data Factory pipelines can copy data from Azure Blob\nStorage to an Azure SQL Database. The configuration pattern applies to copying from a file- based data store\nto a relational data store.\nhttps://learn.microsoft.com/en-us/azure/data-factory/tutorial-copy-data-dot-net\nYou need to recommend a storage solution for the records of a mission critical application. The solution must\nprovide a Service Level Agreement (SLA) for the latency of write operations and the throughput.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 173, "pdfId": 175, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/175" }, "markersInGap": [], "questionText": "What should you include in the recommendation?\nA.\nAzure Data Lake Storage Gen2\nB.\nAzure Blob Storage\nC.\nAzure SQL\nD.\nAzure Cosmos DB", "stem": "What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Data Lake Storage Gen2" }, { "key": "B", "text": "Azure Blob Storage" }, { "key": "C", "text": "Azure SQL" }, { "key": "D", "text": "Azure Cosmos DB" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Azure Cosmos DB is Microsoft's fast NoSQL database with open APIs for any scale. It offers turnkey global\ndistribution across any number of Azure regions by transparently scaling and replicating your data wherever\nyour users are. The service offers comprehensive 99.99% SLAs which covers the guarantees for throughput,\nconsistency, availability and latency for the Azure Cosmos DB Database Accounts scoped to a single Azure\nregion configured with any of the five\nConsistency Levels or Database Accounts spanning multiple Azure regions, configured with any of the four\nrelaxed Consistency Levels. Azure Cosmos DB allows configuring multiple Azure regions as writable\nendpoints for a Database Account. In this configuration, Azure Cosmos DB offers 99.999% SLA for both read\nand write availability.", "reference": "https://azure.microsoft.com/en-us/support/legal/sla/cosmos-db/v1_3/", "references": [ "https://azure.microsoft.com/en-us/support/legal/sla/cosmos-db/v1_3/" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 174, "pdfId": 176, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/176" }, "markersInGap": [], "questionText": "You are planning a storage solution. The solution must meet the following requirements:\n✑\n Support at least 500 requests per second.\n✑\n Support a large image, video, and audio streams.\nWhich type of Azure Storage account should you provision?\nA.\nstandard general-purpose v2\nB.\npremium block blobs\nC.\npremium page blobs\nD.\npremium file shares", "stem": "You are planning a storage solution. The solution must meet the following requirements: ✑ Support at least 500 requests per second. ✑ Support a large image, video, and audio streams. Which type of Azure Storage account should you provision", "options": [ { "key": "A", "text": "standard general-purpose v2" }, { "key": "B", "text": "premium block blobs" }, { "key": "C", "text": "premium page blobs" }, { "key": "D", "text": "premium file shares" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Use Azure Blobs if you want your application to support streaming and random access scenarios.\nIt's ideal for applications that require high transaction rates or consistent low-latency storage.\nIncorrect:\nNot A: Standard storage accounts has a default maximum request rate per storage account 20,000 requests\nper second1, but is not optimized for video and audio streams.\nNot C: Page blobs is best suited for random reads and random writes.\nNot D: FileStorage storage accounts (premium) has a maximum concurrent request rate of 100,000 IOPS.\nMaximum file size is 4 TB, but is not optimized for video and audio streams.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-introduction\nhttps://docs.microsoft.com/en-us/azure/storage/files/storage-files-scale-targets", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-introduction", "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-scale-targets" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 175, "pdfId": 177, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/177" }, "markersInGap": [], "questionText": "You need to recommend a data storage solution that meets the following requirements:\n✑\n Ensures that applications can access the data by using a REST connection\n✑\n Hosts 20 independent tables of varying sizes and usage patterns\n✑\n Automatically replicates the data to a second Azure region\n✑\n Minimizes costs\nWhat should you recommend?\nA.\nan Azure SQL Database elastic pool that uses active geo-replication\nB.\ntables in an Azure Storage account that use geo-redundant storage (GRS)\nC.\ntables in an Azure Storage account that use read-access geo-redundant storage (RA-GRS)\nD.\nan Azure SQL database that uses active geo-replication", "stem": "You need to recommend a data storage solution that meets the following requirements: ✑ Ensures that applications can access the data by using a REST connection ✑ Hosts 20 independent tables of varying sizes and usage patterns ✑ Automatically replicates the data to a second Azure region ✑ Minimizes costs What should you recommend", "options": [ { "key": "A", "text": "an Azure SQL Database elastic pool that uses active geo-replication" }, { "key": "B", "text": "tables in an Azure Storage account that use geo-redundant storage (GRS)" }, { "key": "C", "text": "tables in an Azure Storage account that use read-access geo-redundant storage (RA-GRS)" }, { "key": "D", "text": "an Azure SQL database that uses active geo-replication" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The Table service offers structured storage in the form of tables. The Table service API is a REST API for\nworking with tables and the data that they contain.\nGeo-redundant storage (GRS) has a lower cost than read-access geo-redundant storage (RA-GRS).", "reference": "https://docs.microsoft.com/en-us/rest/api/storageservices/table-service-rest-api\nhttps://docs.microsoft.com/en-us/azure/storage/common/geo-redundant-design", "references": [ "https://docs.microsoft.com/en-us/rest/api/storageservices/table-service-rest-api", "https://docs.microsoft.com/en-us/azure/storage/common/geo-redundant-design" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 176, "pdfId": 178, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/178" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure AD -\nThe Azure AD server issues tokens (access & refresh token). See step 5 below in graphic.\nOAuth 2.0 authentication with Azure Active Directory.\nThe OAuth 2.0 is the industry protocol for authorization. It allows a user to grant limited access to its\nprotected resources. Designed to work specifically with\nHypertext Transfer Protocol (HTTP), OAuth separates the role of the client from the resource owner. The\nclient requests access to the resources controlled by the resource owner and hosted by the resource server\n(here the Azure AD server). The resource server issues access tokens with the approval of the resource owner.\nThe client uses the access tokens to access the protected resources hosted by the resource server.\nBox 2: A web API -\nDelegated access is used.\nThe bearer token sent to the web API contains the user identity.\nThe web API makes authorization decisions based on the user identity.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-oauth2\nhttps://docs.microsoft.com/lb-lu/azure/architecture/multitenant-identity/web-api", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-oauth2", "https://docs.microsoft.com/lb-lu/azure/architecture/multitenant-identity/web-api" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 177, "pdfId": 179, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/179" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1. The root management group\nWhen creating a blueprint definition, you'll define where the blueprint is saved. Blueprints can be saved to a\nmanagement group or subscription that you have\nContributor access to. If the location is a management group, the blueprint is available to assign to any child\nsubscription of that management group.\nThe root management group is built into the hierarchy to have all management groups and subscriptions fold\nup to it. This root management group allows for global policies and Azure role assignments to be applied at\nthe directory level.\nBox 2.\nThe Subscriptions.\nIn the dark MS language: \"Assigning a blueprint definition to a management group means the assignment\nobject exists at the management group. The deployment of artifacts still targets a subscription.\"\nhttps://docs.microsoft.com/en-us/azure/governance/blueprints/overview#blueprint-assignment", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 178, "pdfId": 180, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/180" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: None -\nNo data disk caching for the Log files.\nBox 2: ReadOnly -\nGuidelines to optimize performance for your SQL Server on Azure Virtual Machines (VMs) include:\nSet host caching to read-only for data file disks.\nSet host caching to none for log file disks.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-\npractices-storage\nYou are designing a solution that calculates 3D geometry from height-map data.", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-" ], "note": "Each correct selection is worth one point.\nA.\nEnable parallel file systems on Azure.\nB.\nCreate a render farm that uses virtual machines.\nC.\nCreate a render farm that uses virtual machine scale sets.\nD.\nCreate a render farm that uses Azure Batch.\nE.\nEnable parallel task execution on compute nodes.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 179, "pdfId": 181, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/181" }, "markersInGap": [], "questionText": "You need to recommend a solution that meets the following requirements:\n✑\n Performs calculations in Azure.\n✑\n Ensures that each node can communicate data to every other node.\n✑\n Maximizes the number of nodes to calculate multiple scenes as fast as possible.\nMinimizes the amount of effort to implement the solution.\nWhich two actions should you include in the recommendation? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nEnable parallel file systems on Azure.\nB.\nCreate a render farm that uses virtual machines.\nC.\nCreate a render farm that uses virtual machine scale sets.\nD.\nCreate a render farm that uses Azure Batch.\nE.\nEnable parallel task execution on compute nodes.", "stem": "You need to recommend a solution that meets the following requirements: ✑ Performs calculations in Azure. ✑ Ensures that each node can communicate data to every other node. ✑ Maximizes the number of nodes to calculate multiple scenes as fast as possible. Minimizes the amount of effort to implement the solution. Which two actions should you include in the recommendation? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Enable parallel file systems on Azure." }, { "key": "B", "text": "Create a render farm that uses virtual machines." }, { "key": "C", "text": "Create a render farm that uses virtual machine scale sets." }, { "key": "D", "text": "Create a render farm that uses Azure Batch." }, { "key": "E", "text": "Enable parallel task execution on compute nodes." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Multi-instance tasks allow you to run an Azure Batch task on multiple compute nodes simultaneously. These\ntasks enable high performance computing scenarios like Message Passing Interface (MPI) applications in\nBatch.\nYou configure compute nodes for parallel task execution at the pool level.\nAzure Batch allows you to set task slots per node up to (4x) the number of node cores.", "reference": "https://docs.microsoft.com/en-us/azure/batch/batch-mpi\nhttps://docs.microsoft.com/en-us/azure/batch/batch-parallel-node-tasks#enable-parallel-task-execution", "references": [ "https://docs.microsoft.com/en-us/azure/batch/batch-mpi", "https://docs.microsoft.com/en-us/azure/batch/batch-parallel-node-tasks#enable-parallel-task-execution" ], "note": "Each correct selection is worth one point.\nA.\nSQL Server Stretch Database\nB.\nSQL Server on an Azure virtual machine\nC.\nAzure SQL Database\nD.\nAzure SQL Managed Instance", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 180, "pdfId": 182, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/182" }, "markersInGap": [], "questionText": "You have an on-premises application that consumes data from multiple databases. The application code\nreferences database tables by using a combination of the server, database, and table name.\nYou need to migrate the application data to Azure.\nTo which two services can you migrate the application data to achieve the goal? Each correct answer presents a\ncomplete solution.\nNOTE: Each correct selection is worth one point.\nA.\nSQL Server Stretch Database\nB.\nSQL Server on an Azure virtual machine\nC.\nAzure SQL Database\nD.\nAzure SQL Managed Instance", "stem": "You have an on-premises application that consumes data from multiple databases. The application code references database tables by using a combination of the server, database, and table name. You need to migrate the application data to Azure. To which two services can you migrate the application data to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "SQL Server Stretch Database" }, { "key": "B", "text": "SQL Server on an Azure virtual machine" }, { "key": "C", "text": "Azure SQL Database" }, { "key": "D", "text": "Azure SQL Managed Instance" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Cross-database queries are supported by SQL Server, for example on an Azure virtual machine, and also\nsupported by an Azure SQL Managed Instance.", "reference": "https://techcommunity.microsoft.com/t5/azure-database-support-blog/cross-database-queries-between-\nazure-sql-database-and-managed/ba- p/2706670", "references": [ "https://techcommunity.microsoft.com/t5/azure-database-support-blog/cross-database-queries-between-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 181, "pdfId": 183, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/183" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Azure SQL Managed instances & Auto Failover Group\nsupports User Initiated Backups and minimizes administrative effort for business continuity.\nhttps://docs.microsoft.com/en-us/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview?\nview=azuresql\n- Auto failover groups\nhttps://docs.microsoft.com/en-us/azure/architecture/framework/services/data/azure-sql-managed-\ninstance/reliability", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 182, "pdfId": 184, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/184" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n✑\n Failover between replicas of the database must occur without any data loss.\n✑\n The database must remain available in the event of a zone outage.\n✑\n Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Managed Instance Business Critical\nB.\nAzure SQL Managed Instance General Purpose\nC.\nAzure SQL Database Business Critical\nD.\nAzure SQL Database Serverless", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: ✑ Failover between replicas of the database must occur without any data loss. ✑ The database must remain available in the event of a zone outage. ✑ Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Managed Instance Business Critical" }, { "key": "B", "text": "Azure SQL Managed Instance General Purpose" }, { "key": "C", "text": "Azure SQL Database Business Critical" }, { "key": "D", "text": "Azure SQL Database Serverless" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Azure SQL Database Serverless meets the requirements and is less expensive than Azure SQL Database\nBusiness Critical.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla" ], "note": "General Purpose service tier zone redundant availability.\nZone-redundant configuration for the general purpose service tier is offered for both serverless and\nprovisioned compute.\nThis configuration utilizes Azure Availability Zones ‰to replicate databases across multiple physical\nlocations within an Azure region.‰By selecting zone-redundancy, you can make your‰new and existing\nserverless and provisioned general‰purpose single databases and elastic pools resilient to a much larger set\nof failures, including catastrophic datacenter outages, without any changes of the application logic.\nIncorrect:\nNot A, not B: Zone-redundant configuration is not available in SQL Managed Instance.\nNot C: Azure SQL Database Business Critical is more expensive than Azure SQL Database Serverless.\nNote: Premium and Business Critical service tiers use the Premium availability model, which integrates\ncompute resources (sqlservr.exe process) and storage\n(locally attached SSD) on a single node. High availability is achieved by replicating both compute and storage\nto additional nodes creating a three to four-node cluster.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 185, "pdfId": 185, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/185" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYour company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App\nService instances will be deployed at the same time as the Azure SQL databases.\nThe company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The\nresources for the App Service instances must reside in the same region.\nYou need to recommend a solution to meet the regulatory requirement.\nSolution: You recommend creating resource groups based on locations and implementing resource locks on the\nresource groups.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases. The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region. You need to recommend a solution to meet the regulatory requirement. Solution: You recommend creating resource groups based on locations and implementing resource locks on the resource groups. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead; you should recommend using an Azure Policy initiative to enforce the location", "reference": "https://docs.microsoft.com/en-us/azure/governance/policy/overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/governance/policy/overview" ], "note": "Azure Resource Policy Definitions can be used which can be applied to a specific Resource Group with\nthe App Service instances.\nIn Azure Policy, we offer several built-in policies that are available by default. For example:\n* Allowed Locations (Deny): Restricts the available locations for new resources. Its effect is used to enforce\nyour geo-compliance requirements.\nReference:\nhttps://docs.microsoft.com/en-us/azure/governance/policy/overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 186, "pdfId": 186, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/186" }, "markersInGap": [ 189, 190 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYour company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App\nService instances will be deployed at the same time as the Azure SQL databases.\nThe company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The\nresources for the App Service instances must reside in the same region.\nYou need to recommend a solution to meet the regulatory requirement.\nSolution: You recommend using the Regulatory compliance dashboard in Microsoft Defender for Cloud.\n Does this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases. The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region. You need to recommend a solution to meet the regulatory requirement. Solution: You recommend using the Regulatory compliance dashboard in Microsoft Defender for Cloud. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead; you should recommend using an Azure Policy initiative to enforce the location", "reference": "https://docs.microsoft.com/en-us/azure/governance/policy/overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/governance/policy/overview" ], "note": "Azure Resource Policy Definitions can be used which can be applied to a specific Resource Group with\nthe App Service instances.\nIn Azure Policy, we offer several built-in policies that are available by default. For example:\n* Allowed Locations (Deny): Restricts the available locations for new resources. Its effect is used to enforce\nyour geo-compliance requirements.\nReference:\nhttps://docs.microsoft.com/en-us/azure/governance/policy/overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 187, "pdfId": 187, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/187" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYour company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App\nService instances will be deployed at the same time as the Azure SQL databases.\nThe company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The\nresources for the App Service instances must reside in the same region.\nYou need to recommend a solution to meet the regulatory requirement.\nSolution: You recommend using an Azure Policy initiative to enforce the location.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases. The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region. You need to recommend a solution to meet the regulatory requirement. Solution: You recommend using an Azure Policy initiative to enforce the location. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Resource Policy Definitions can be used which can be applied to a specific Resource Group with the\nApp Service instances.\nIn Azure Policy, we offer several built-in policies that are available by default. For example:\n* Allowed Locations (Deny): Restricts the available locations for new resources. Its effect is used to enforce\nyour geo-compliance requirements.", "reference": "https://docs.microsoft.com/en-us/azure/governance/policy/overview", "references": [ "https://docs.microsoft.com/en-us/azure/governance/policy/overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 183, "pdfId": 188, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/188" }, "markersInGap": [ 186, 187 ], "questionText": "You have an Azure web app that uses an Azure key vault named KeyVault1 in the West US Azure region.\n You are designing a disaster recovery plan for KeyVault1.\nYou plan to back up the keys in KeyVault1.\nYou need to identify to where you can restore the backup.\nWhat should you identify?\nA.\nany region worldwide\nB.\nthe same region only\nC.\nKeyVault1 only\nD.\nthe same geography only", "stem": "You have an Azure web app that uses an Azure key vault named KeyVault1 in the West US Azure region. You are designing a disaster recovery plan for KeyVault1. You plan to back up the keys in KeyVault1. You need to identify to where you can restore the backup. What should you identify", "options": [ { "key": "A", "text": "any region worldwide" }, { "key": "B", "text": "the same region only" }, { "key": "C", "text": "KeyVault1 only" }, { "key": "D", "text": "the same geography only" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Using the backup and restore commands has two limitations:\n* You can't back up a key vault in one geography and restore it into another geography.\n* The backup command backs up all versions of each secret.\nIncorrect:\nNot A: Azure Key Vault does not allow you to move a key vault from one region to another. You can, however,\ncreate a key vault in the new region, manually copy each individual key, secret, or certificate from your\nexisting key vault to the new key vault, and then remove the original key vault.", "reference": "https://docs.microsoft.com/en-us/azure/key-vault/general/move-region", "references": [ "https://docs.microsoft.com/en-us/azure/key-vault/general/move-region" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 184, "pdfId": 189, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/189" }, "markersInGap": [], "questionText": "You have an on-premises line-of-business (LOB) application that uses a Microsoft SQL Server instance as the\nbackend.\nYou plan to migrate the on-premises SQL Server instance to Azure virtual machines.\nYou need to recommend a highly available SQL Server deployment that meets the following requirements:\n✑\n Minimizes costs\nMinimizes failover time if a single server fails\nWhat should you include in the recommendation?\nA.\nan Always On availability group that has premium storage disks and a virtual network name (VNN)\nB.\nan Always On Failover Cluster Instance that has a virtual network name (VNN) and a standard file share\nC.\nan Always On availability group that has premium storage disks and a distributed network name (DNN)\nD.\nan Always On Failover Cluster Instance that has a virtual network name (VNN) and a premium file share", "stem": "You have an on-premises line-of-business (LOB) application that uses a Microsoft SQL Server instance as the backend. You plan to migrate the on-premises SQL Server instance to Azure virtual machines. You need to recommend a highly available SQL Server deployment that meets the following requirements: ✑ Minimizes costs Minimizes failover time if a single server fails What should you include in the recommendation", "options": [ { "key": "A", "text": "an Always On availability group that has premium storage disks and a virtual network name (VNN)" }, { "key": "B", "text": "an Always On Failover Cluster Instance that has a virtual network name (VNN) and a standard file share" }, { "key": "C", "text": "an Always On availability group that has premium storage disks and a distributed network name (DNN)" }, { "key": "D", "text": "an Always On Failover Cluster Instance that has a virtual network name (VNN) and a premium file share" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Always On availability groups on Azure Virtual Machines are similar to Always On availability groups on-\npremises, and rely on the underlying Windows Server\nFailover Cluster.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/availability-group-overview", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/availability-group-overview" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 190, "pdfId": 190, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/190" }, "markersInGap": [], "questionText": "You have an Azure Active Directory (Azure AD) tenant.\nYou plan to deploy Azure Cosmos DB databases that will use the SQL API.\nYou need to recommend a solution to provide specific Azure AD user accounts with read access to the Cosmos DB\ndatabases.\nWhat should you include in the recommendation?\nA.\nshared access signatures (SAS) and Conditional Access policies\nB.\ncertificates and Azure Key Vault\nC.\nmaster keys and Azure Information Protection policies\nD.\na resource token and an Access control (IAM) role assignment", "stem": "You have an Azure Active Directory (Azure AD) tenant. You plan to deploy Azure Cosmos DB databases that will use the SQL API. You need to recommend a solution to provide specific Azure AD user accounts with read access to the Cosmos DB databases. What should you include in the recommendation", "options": [ { "key": "A", "text": "shared access signatures (SAS) and Conditional Access policies" }, { "key": "B", "text": "certificates and Azure Key Vault" }, { "key": "C", "text": "master keys and Azure Information Protection policies" }, { "key": "D", "text": "a resource token and an Access control (IAM) role assignment" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "The Access control (IAM) pane in the Azure portal is used to configure role-based access control on Azure\nCosmos resources. The roles are applied to users, groups, service principals, and managed identities in Active\nDirectory. You can use built-in roles or custom roles for individuals and groups. The following screenshot\nshows Active Directory integration (RBAC) using access control (IAM) in the Azure portal:", "reference": "https://docs.microsoft.com/en-us/azure/cosmos-db/role-based-access-control https://docs.microsoft.com/en-\nus/azure/cosmos-db/how-to-setup-rbac", "references": [ "https://docs.microsoft.com/en-us/azure/cosmos-db/role-based-access-control", "https://docs.microsoft.com/en-" ], "note": "To use the Azure Cosmos DB RBAC in your application, you have to update the way you initialize the\nAzure Cosmos DB SDK. Instead of passing your account's primary key, you have to pass an instance of a\nTokenCredential class. This instance provides the Azure Cosmos DB SDK with the context required to fetch an\nAzure AD (AAD) token on behalf of the identity you wish to use.\nReference:\nhttps://docs.microsoft.com/en-us/azure/cosmos-db/role-based-access-control https://docs.microsoft.com/en-\nus/azure/cosmos-db/how-to-setup-rbac", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 189, "pdfId": 191, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/191" }, "markersInGap": [], "questionText": "You plan to deploy an application named App1 that will run in containers on Azure Kubernetes Service (AKS)\nclusters. The AKS clusters will be distributed across four Azure regions.\nYou need to recommend a storage solution to ensure that updated container images are replicated automatically\nto all the Azure regions hosting the AKS clusters.\nWhich storage solution should you recommend?\nA.\ngeo-redundant storage (GRS) accounts\nB.\nPremium SKU Azure Container Registry\nC.\nAzure Content Delivery Network (CDN)\nD.\nAzure Cache for Redis", "stem": "You plan to deploy an application named App1 that will run in containers on Azure Kubernetes Service (AKS) clusters. The AKS clusters will be distributed across four Azure regions. You need to recommend a storage solution to ensure that updated container images are replicated automatically to all the Azure regions hosting the AKS clusters. Which storage solution should you recommend", "options": [ { "key": "A", "text": "geo-redundant storage (GRS) accounts" }, { "key": "B", "text": "Premium SKU Azure Container Registry" }, { "key": "C", "text": "Azure Content Delivery Network (CDN)" }, { "key": "D", "text": "Azure Cache for Redis" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Enable geo-replication for container images.\nBest practice: Store your container images in Azure Container Registry and geo-replicate the registry to each\nAKS region.\nTo deploy and run your applications in AKS, you need a way to store and pull the container images. Container\nRegistry integrates with AKS, so it can securely store your container images or Helm charts. Container\nRegistry supports multimaster geo-replication to automatically replicate your images to Azure regions around\nthe world.\nGeo-replication is a feature of Premium SKU container registries.", "reference": "https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-multi-region", "references": [ "https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-multi-region" ], "note": "When you use Container Registry geo-replication to pull images from the same region, the results are:\nFaster: You pull images from high-speed, low-latency network connections within the same Azure region.\nMore reliable: If a region is unavailable, your AKS cluster pulls the images from an available container\nregistry.\nCheaper: There's no network egress charge between datacenters.\nReference:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 188, "pdfId": 192, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/192" }, "markersInGap": [ 191, 192 ], "questionText": "You plan to move a web app named App1 from an on-premises datacenter to Azure.\nApp1 depends on a custom COM component that is installed on the host server.\nYou need to recommend a solution to host App1 in Azure. The solution must meet the following requirements:\n✑\n App1 must be available to users if an Azure datacenter becomes unavailable.\n✑\n Costs must be minimized.\n What should you include in the recommendation?\nA.\nIn two Azure regions, deploy a load balancer and a web app.\nB.\nIn two Azure regions, deploy a load balancer and a virtual machine scale set.\nC.\nDeploy a load balancer and a virtual machine scale set across two availability zones.\nD.\nIn two Azure regions, deploy an Azure Traffic Manager profile and a web app.", "stem": "You plan to move a web app named App1 from an on-premises datacenter to Azure. App1 depends on a custom COM component that is installed on the host server. You need to recommend a solution to host App1 in Azure. The solution must meet the following requirements: ✑ App1 must be available to users if an Azure datacenter becomes unavailable. ✑ Costs must be minimized. What should you include in the recommendation", "options": [ { "key": "A", "text": "In two Azure regions, deploy a load balancer and a web app." }, { "key": "B", "text": "In two Azure regions, deploy a load balancer and a virtual machine scale set." }, { "key": "C", "text": "Deploy a load balancer and a virtual machine scale set across two availability zones." }, { "key": "D", "text": "In two Azure regions, deploy an Azure Traffic Manager profile and a web app." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Need to use a virtual machine as Azure App service does not allow COM components.\nNeed two availability zones to protect against an Azure datacenter failure.\nIncorrect:\nNot A, Not D: Cannot use a web app.\nAzure App Service does not allow the registration of COM components on the platform. If your app makes use\nof any COM components, these need to be rewritten in managed code and deployed with the site or\napplication.", "reference": "https://docs.microsoft.com/en-us/dotnet/azure/migration/app-service#com-and-com-components", "references": [ "https://docs.microsoft.com/en-us/dotnet/azure/migration/app-service#com-and-com-components" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 193, "pdfId": 193, "exam": "AZ-305", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/193" }, "markersInGap": [], "questionText": "You have an on-premises application named App1 that uses an Oracle database.\nYou plan to use Azure Databricks to transform and load data from App1 to an Azure Synapse Analytics instance.\nYou need to ensure that the App1 data is available to Databricks.\nWhich two Azure services should you include in the solution? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nAzure Data Box Gateway\nB.\nAzure Import/Export service\nC.\nAzure Data Lake Storage\nD.\nAzure Data Box Edge\nE.\nAzure Data Factory", "stem": "You have an on-premises application named App1 that uses an Oracle database. You plan to use Azure Databricks to transform and load data from App1 to an Azure Synapse Analytics instance. You need to ensure that the App1 data is available to Databricks. Which two Azure services should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Azure Data Box Gateway" }, { "key": "B", "text": "Azure Import/Export service" }, { "key": "C", "text": "Azure Data Lake Storage" }, { "key": "D", "text": "Azure Data Box Edge" }, { "key": "E", "text": "Azure Data Factory" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "ADF moves data from on-prem Oracle to Data Lake storage, which makes data ready for DataBrick\nhttps://docs.microsoft.com/en-us/azure/data-factory/load-azure-data-lake-storage-gen2\nDataBricks \"ETL\" data to Synapse:\nhttps://docs.microsoft.com/en-us/azure/databricks/scenarios/databricks-extract-load-sql-data-warehouse", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 192, "pdfId": 194, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/194" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: vCore -\nYou can only apply the Azure Hybrid licensing model when you choose a vCore-based purchasing model and\nthe provisioned compute tier for your Azure SQL\nDatabase. Azure Hybrid Benefit isn't available for service tiers under the DTU-based purchasing model or for\nthe serverless compute tier.\nBox 2: An Azure SQL Database elastic pool\nAzure SQL Database elastic pools are a simple, cost-effective solution for managing and scaling multiple\ndatabases that have varying and unpredictable usage demands. The databases in an elastic pool are on a\nsingle server and share a set number of resources at a set price. Elastic pools in SQL Database enable\nsoftware as a service (SaaS) developers to optimize the price performance for a group of databases within a\nprescribed budget while delivering performance elasticity for each database.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/azure-hybrid-benefit https://docs.microsoft.com/ko-\nkr/azure/azure-sql/database/elastic-pool-overview", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/azure-hybrid-benefit", "https://docs.microsoft.com/ko-" ], "note": "Each correct selection is worth one point.\nA.\nAzure Data Box Gateway\nB.\nAzure Import/Export service\nC.\nAzure Data Lake Storage\nD.\nAzure Data Box Edge\nE.\nAzure Data Factory", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 191, "pdfId": 195, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/195" }, "markersInGap": [ 194, 195 ], "questionText": "You need to recommend an Azure Storage solution that meets the following requirements:\n✑\n The storage must support 1 PB of data.\n✑\n The data must be stored in blob storage.\n✑\n The storage must support three levels of subfolders.\n✑\n The storage must support access control lists (ACLs).\n What should you include in the recommendation?\nA.\na premium storage account that is configured for block blobs\nB.\na general purpose v2 storage account that has hierarchical namespace enabled\nC.\na premium storage account that is configured for page blobs\nD.\na premium storage account that is configured for file shares and supports large file shares", "stem": "You need to recommend an Azure Storage solution that meets the following requirements: ✑ The storage must support 1 PB of data. ✑ The data must be stored in blob storage. ✑ The storage must support three levels of subfolders. ✑ The storage must support access control lists (ACLs). What should you include in the recommendation", "options": [ { "key": "A", "text": "a premium storage account that is configured for block blobs" }, { "key": "B", "text": "a general purpose v2 storage account that has hierarchical namespace enabled" }, { "key": "C", "text": "a premium storage account that is configured for page blobs" }, { "key": "D", "text": "a premium storage account that is configured for file shares and supports large file shares" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Default limits for Azure general-purpose v2 (GPv2), general-purpose v1 (GPv1), and Blob storage accounts\ninclude:\n* Default maximum storage account capacity: 5 PiB\nBlob storage supports Azure Data Lake Storage Gen2, Microsoft's enterprise big data analytics solution for\nthe cloud. Azure Data Lake Storage Gen2 offers a hierarchical file system as well as the advantages of Blob\nstorage.\nBlob storage supports Azure Data Lake Storage Gen2, Microsoft's enterprise big data analytics solution for\nthe cloud. Azure Data Lake Storage Gen2 offers a hierarchical file system as well as the advantages of Blob\nstorage\nIncorrect:\nNot D: In a Premium FileStorage account, storage size is limited to 100 TB.", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-\nlimits#storage-limits", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction", "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 194, "pdfId": 196, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/196" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: User subscription and low-priority virtual machines\nThe first job type will consist of short-running tasks for a development environment.\nAmong the many ways to purchase and consume Azure resources are Azure low priority VMs and Spot VMs.\nThese virtual machines are compute instances allocated from spare capacity, offered at a highly discounted\nrate compared to on demand VMs. This means they can be a great option for cost savings \" for the right\nworkloads\nBox 2: Batch service and dedicate virtual machines\nThe second job type will consist of long-running Message Passing Interface (MPI) applications for a\nproduction environment that requires timely job completion.\nAzure Batch Service is a cloud based job scheduling and compute management platform that enables running\nlarge-scale parallel and high performance computing applications efficiently in the cloud. Azure Batch\nService provides job scheduling and in automatically scaling and managing virtual machines running those\njobs.", "reference": "https://www.parkmycloud.com/blog/azure-low-priority-vms\nhttps://azure.microsoft.com/en-us/pricing/details/batch/", "references": [ "https://www.parkmycloud.com/blog/azure-low-priority-vms", "https://azure.microsoft.com/en-us/pricing/details/batch/" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 195, "pdfId": 197, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/197" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Notification Hubs\nB.\nAzure Service Fabric\nC.\nAzure Queue Storage\nD.\nAzure Data Lake", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Notification Hubs" }, { "key": "B", "text": "Azure Service Fabric" }, { "key": "C", "text": "Azure Queue Storage" }, { "key": "D", "text": "Azure Data Lake" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Queue Storage delivers asynchronous messaging between application components, whether they are running\nin the cloud, on the desktop, on an on-premises server, or on a mobile device.\nThe maximum message size supported by Azure Storage Queues is 64KB while Azure Service Bus Queues\nsupport messages up to 256KB. This becomes an important factor especially when the message format is\npadded (such as XML).", "reference": "https://docs.microsoft.com/en-us/azure/storage/queues/storage-dotnet-how-to-use-queues\nhttps://blog.kloud.com.au/2016/03/01/cloud-cushioning-using-azure-queues/", "references": [ "https://docs.microsoft.com/en-us/azure/storage/queues/storage-dotnet-how-to-use-queues", "https://blog.kloud.com.au/2016/03/01/cloud-cushioning-using-azure-queues/" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 196, "pdfId": 198, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/198" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Notification Hubs\nB.\nAzure Service Fabric\nC.\nAzure Queue Storage\nD.\nAzure Application Gateway", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Notification Hubs" }, { "key": "B", "text": "Azure Service Fabric" }, { "key": "C", "text": "Azure Queue Storage" }, { "key": "D", "text": "Azure Application Gateway" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Queue storage is often used to create a backlog of work to process asynchronously.\nA queue message must be in a format compatible with an XML request using UTF-8 encoding.", "reference": "https://docs.microsoft.com/en-us/azure/storage/queues/storage-tutorial-queues", "references": [ "https://docs.microsoft.com/en-us/azure/storage/queues/storage-tutorial-queues" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 197, "pdfId": 199, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/199" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n• Failover between replicas of the database must occur without any data loss.\n• The database must remain available in the event of a zone outage.\n• Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Hyperscale\nB.\nAzure SQL Database Premium\nC.\nAzure SQL Database Basic\nD.\nAzure SQL Database Standard", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: • Failover between replicas of the database must occur without any data loss. • The database must remain available in the event of a zone outage. • Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Hyperscale" }, { "key": "B", "text": "Azure SQL Database Premium" }, { "key": "C", "text": "Azure SQL Database Basic" }, { "key": "D", "text": "Azure SQL Database Standard" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Premium be the answer.\nWhenever zone-redundancy (availability within the same region) is required you can only choose:\n-General Purpose\n-Premium\n-Business Critical\nhttps://learn.microsoft.com/en-GB/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-\npowershell", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 198, "pdfId": 200, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/200" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Service Bus\nB.\nAzure Data Lake\nC.\nAzure Traffic Manager\nD.\nAzure Blob Storage", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Service Bus" }, { "key": "B", "text": "Azure Data Lake" }, { "key": "C", "text": "Azure Traffic Manager" }, { "key": "D", "text": "Azure Blob Storage" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Service Bus or Azure Queue Storage", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 199, "pdfId": 201, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/201" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n• Failover between replicas of the database must occur without any data loss.\n• The database must remain available in the event of a zone outage.\n• Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Basic\nB.\nAzure SQL Managed Instance General Purpose\nC.\nAzure SQL Database Business Critical\nD.\nAzure SQL Managed Instance Business Critical", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: • Failover between replicas of the database must occur without any data loss. • The database must remain available in the event of a zone outage. • Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Basic" }, { "key": "B", "text": "Azure SQL Managed Instance General Purpose" }, { "key": "C", "text": "Azure SQL Database Business Critical" }, { "key": "D", "text": "Azure SQL Managed Instance Business Critical" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Managed Instance General Purpose zone redundant feature is not available world wide yet therefore I don't\nthink is a \"safe\" answer.\nTherefore, it come down to C and D. Azure SQL Database Business Critical should be cheaper than Managed. I\nmean, managed is called managed for a reason even if you don't know the actual available specs. Upon\ngoogling, you will learn that Azure SQL Database Business Critical provide lower specs aka cheaper options\nthan Managed.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 200, "pdfId": 202, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/202" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou need to deploy an Azure Kubernetes Service (AKS) solution that will use Windows Server 2019 nodes. The\nsolution must meet the following requirements:\n• Minimize the time it takes to provision compute resources during scale-out operations.\n• Support autoscaling of Windows Server containers.\nWhich scaling option should you recommend?\nA.\nhorizontal pod autoscaler\nB.\nVirtual nodes\nC.\nKubernetes version 1.20.2 or newer\nD.\ncluster autoscaler", "stem": "You have an Azure subscription. You need to deploy an Azure Kubernetes Service (AKS) solution that will use Windows Server 2019 nodes. The solution must meet the following requirements: • Minimize the time it takes to provision compute resources during scale-out operations. • Support autoscaling of Windows Server containers. Which scaling option should you recommend", "options": [ { "key": "A", "text": "horizontal pod autoscaler" }, { "key": "B", "text": "Virtual nodes" }, { "key": "C", "text": "Kubernetes version 1.20.2 or newer" }, { "key": "D", "text": "cluster autoscaler" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "cluster autoscaler - For Windows\nvirtual nodes - For Linux", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 201, "pdfId": 203, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/203" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Service Fabric\nB.\nAzure Data Lake\nC.\nAzure Service Bus\nD.\nAzure Application Gateway", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Service Fabric" }, { "key": "B", "text": "Azure Data Lake" }, { "key": "C", "text": "Azure Service Bus" }, { "key": "D", "text": "Azure Application Gateway" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Service Bus\nYour company has offices in North America and Europe.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 202, "pdfId": 204, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/204" }, "markersInGap": [], "questionText": "You plan to migrate to Azure.\nYou need to recommend a networking solution for the new Azure infrastructure. The solution must meet the\nfollowing requirements:\n• The Point-to-Site (P2S) VPN connections of mobile users must connect automatically to the closest Azure region.\n• The offices in each region must connect to their local Azure region by using an ExpressRoute circuit.\n• Transitive routing between virtual networks and on-premises networks must be supported.\n• The network traffic between virtual networks must be filtered by using FQDNs.\nWhat should you include in the recommendation?\nA.\nAzure Virtual WAN with a secured virtual hub\nB.\nvirtual network peering and application security groups\nC.\nvirtual network gateways and network security groups (NSGs)\nD.\nAzure Route Server and Azure Network Function Manager", "stem": "You plan to migrate to Azure. You need to recommend a networking solution for the new Azure infrastructure. The solution must meet the following requirements: • The Point-to-Site (P2S) VPN connections of mobile users must connect automatically to the closest Azure region. • The offices in each region must connect to their local Azure region by using an ExpressRoute circuit. • Transitive routing between virtual networks and on-premises networks must be supported. • The network traffic between virtual networks must be filtered by using FQDNs. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Virtual WAN with a secured virtual hub" }, { "key": "B", "text": "virtual network peering and application security groups" }, { "key": "C", "text": "virtual network gateways and network security groups (NSGs)" }, { "key": "D", "text": "Azure Route Server and Azure Network Function Manager" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The Virtual WAN meets the first 3 requirements, and the secured virtual hub has the Azure Firewall Manager,", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 203, "pdfId": 205, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/205" }, "markersInGap": [], "questionText": "which can do the FQDN filtering. https://learn.microsoft.com/en-us/azure/firewall-manager/secured-virtual-\nhub https://learn.microsoft.com/en-us/azure/firewall/fqdn-filtering-network-rules\nYou need to design a highly available Azure SQL database that meets the following requirements:\n• Failover between replicas of the database must occur without any data loss.\n• The database must remain available in the event of a zone outage.\n• Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Business Critical\nB.\nAzure SQL Managed Instance Business Critical\nC.\nAzure SQL Database Standard\nD.\nAzure SQL Managed Instance General Purpose", "stem": "which can do the FQDN filtering. https://learn.microsoft.com/en-us/azure/firewall-manager/secured-virtual- hub https://learn.microsoft.com/en-us/azure/firewall/fqdn-filtering-network-rules You need to design a highly available Azure SQL database that meets the following requirements: • Failover between replicas of the database must occur without any data loss. • The database must remain available in the event of a zone outage. • Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Business Critical" }, { "key": "B", "text": "Azure SQL Managed Instance Business Critical" }, { "key": "C", "text": "Azure SQL Database Standard" }, { "key": "D", "text": "Azure SQL Managed Instance General Purpose" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "for these questions where zone-redundancy is required, there are only these options:\n-General Purpose\n-Premium\n-Business Critical", "reference": "https://learn.microsoft.com/en-GB/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-\npowershell", "references": [ "https://learn.microsoft.com/en-GB/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 204, "pdfId": 206, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/206" }, "markersInGap": [], "questionText": "You are designing a point of sale (POS) solution that will be deployed across multiple locations and will use an\nAzure Databricks workspace in the Standard tier. The solution will include multiple apps deployed to the on-\npremises network of each location.\nYou need to configure the authentication method that will be used by the app to access the workspace. The\nsolution must minimize the administrative effort associated with staff turnover and credential management.\nWhat should you configure?\nA.\na managed identity\nB.\na service principal\nC.\na personal access token", "stem": "You are designing a point of sale (POS) solution that will be deployed across multiple locations and will use an Azure Databricks workspace in the Standard tier. The solution will include multiple apps deployed to the on- premises network of each location. You need to configure the authentication method that will be used by the app to access the workspace. The solution must minimize the administrative effort associated with staff turnover and credential management. What should you configure", "options": [ { "key": "A", "text": "a managed identity" }, { "key": "B", "text": "a service principal" }, { "key": "C", "text": "a personal access token" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "MID can be used only between Azure resources, here we have on-prem application communicating to Azure\nresources, then you need a service principal", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 205, "pdfId": 207, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/207" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. Owner\n2. Owner\nhttps://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-\nassociated-directory#before-you-begin\nBefore you can associate or add your subscription, do the following steps:\n- Sign in using an account that: Has an Owner role assignment for the subscription.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 206, "pdfId": 208, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/208" }, "markersInGap": [], "questionText": "Your company has the divisions shown in the following table.\nSub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user\nauthentication. Users from contoso.com can authenticate to App1.\nYou need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.\nWhat should you recommend?\nA.\nConfigure a Conditional Access policy.\nB.\nUse Azure AD entitlement management to govern external users.\nC.\nConfigure the Azure AD provisioning service.\nD.\nConfigure Azure AD Identity Protection.", "stem": "Your company has the divisions shown in the following table. Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1. You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1. What should you recommend", "options": [ { "key": "A", "text": "Configure a Conditional Access policy." }, { "key": "B", "text": "Use Azure AD entitlement management to govern external users." }, { "key": "C", "text": "Configure the Azure AD provisioning service." }, { "key": "D", "text": "Configure Azure AD Identity Protection." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Use Azure AD entitlement management to govern external users.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 207, "pdfId": 209, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/209" }, "markersInGap": [], "questionText": "You have a multi-tier app named App1 and an Azure SQL database named SQL1. The backend service of App1\nwrites data to SQL1. Users use the App1 client to read the data from SQL1.\nDuring periods of high utilization, the users experience delays retrieving the data.\nYou need to minimize how long it takes for data requests.\nWhat should you include in the solution?\nA.\nAzure Cache for Redis\nB.\nAzure Content Delivery Network (CDN)\nC.\nAzure Data Factory\nD.\nAzure Synapse Analytics", "stem": "You have a multi-tier app named App1 and an Azure SQL database named SQL1. The backend service of App1 writes data to SQL1. Users use the App1 client to read the data from SQL1. During periods of high utilization, the users experience delays retrieving the data. You need to minimize how long it takes for data requests. What should you include in the solution", "options": [ { "key": "A", "text": "Azure Cache for Redis" }, { "key": "B", "text": "Azure Content Delivery Network (CDN)" }, { "key": "C", "text": "Azure Data Factory" }, { "key": "D", "text": "Azure Synapse Analytics" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Caching: Implementing a caching mechanism, such as Redis, can help to reduce the number of requests made\nto the Azure SQL database. This can improve the performance of data retrieval for users.\nYou have an Azure subscription that contains the resources shown in the following table.\nYou create peering between VNet1 and VNet2 and between VNet1 and VNet3.\nThe virtual machines host an HTTPS-based client/server application and are accessible only via the private IP\naddress of each virtual machine.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 208, "pdfId": 210, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/210" }, "markersInGap": [], "questionText": "You need to implement a load balancing solution for VM2 and VM3. The solution must ensure that if VM2 fails,\nrequests will be routed automatically to VM3, and if VM3 fails, requests will be routed automatically to VM2.\nWhat should you include in the solution?\nA.\nAzure Firewall Premium\nB.\nAzure Application Gateway v2\nC.\na cross-region load balancer\nD.\nAzure Front Door Premium", "stem": "You need to implement a load balancing solution for VM2 and VM3. The solution must ensure that if VM2 fails, requests will be routed automatically to VM3, and if VM3 fails, requests will be routed automatically to VM2. What should you include in the solution", "options": [ { "key": "A", "text": "Azure Firewall Premium" }, { "key": "B", "text": "Azure Application Gateway v2" }, { "key": "C", "text": "a cross-region load balancer" }, { "key": "D", "text": "Azure Front Door Premium" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Azure Front Door Premium.\nAzure Front Door Premium now supports Private Link, which enables private connectivity from a virtual\nnetwork to a service running in Azure. This feature can be used to connect to services across regions\nprivately, so this should work for your use case where VM2 is in East US and VM3 is in West US. Here is how it\ncould work:\nAzure Front Door Premium could be set up with Private Link to create a private endpoint in a regional network.\nThis network can route traffic to VM2 and VM3 through the private link over the Microsoft backbone network,\nwithout exposure to the public internet. When one VM fails, Azure Front Door can automatically route the\ntraffic to the other VM, maintaining the availability of your application.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 210, "pdfId": 211, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/211" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "You are developing an app that will use Azure Functions to process Azure Event H", "keys": [ "You are developing an app that will use Azure Functions to process Azure Event H" ] }, "explanation": "Only Dedicated and Premium have the matching timeout so we need to choose between A and D. Then as\nusual they let us guess what is hidden in the \"Supports estimates of request processing runtimes\". If it is\n\"Predictive scaling and costs are required\" then the correct answer is D as per https://learn.microsoft.com/en-\nus/azure/azure-functions/functions-scale#overview-of-plans", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 282, "pdfId": 212, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/212" }, "markersInGap": [], "questionText": "You have a multi-tier app named App1 and an Azure SQL database named SQL1. The backend service of App1\nwrites data to SQL1. Users use the App1 client to read the data from SQL1.\nDuring periods of high utilization, the users experience delays retrieving the data.You need to minimize how long it takes for data requests.What should you include in the solution?\nA.\nAzure Cache for Redis\nB.\nAzure Content Delivery Network (CDN)\nC.\nAzure Data Factory\nD.\nAzure Synapse Analytics\nAnswer:\nA\nExplanation:\nCaching: Implementing a caching mechanism, such as Redis, can help to reduce the number of requests made\nto the Azure SQL database. This can improve the performance of data retrieval for users.", "stem": "You have a multi-tier app named App1 and an Azure SQL database named SQL1. The backend service of App1 writes data to SQL1. Users use the App1 client to read the data from SQL1. During periods of high utilization, the users experience delays retrieving the data.You need to minimize how long it takes for data requests.What should you include in the solution", "options": [ { "key": "A", "text": "Azure Cache for Redis" }, { "key": "B", "text": "Azure Content Delivery Network (CDN)" }, { "key": "C", "text": "Azure Data Factory" }, { "key": "D", "text": "Azure Synapse Analytics" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Caching: Implementing a caching mechanism, such as Redis, can help to reduce the number of requests made\nto the Azure SQL database. This can improve the performance of data retrieval for users.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false, "recoveredFromMarkerSplit": true } }, { "seq": 209, "pdfId": 213, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/213" }, "markersInGap": [ 213 ], "questionText": "You are designing an app that will include two components. The components will communicate by sending\nmessages via a queue.\nYou need to recommend a solution to process the messages by using a First in, First out (FIFO) pattern.\nWhat should you include in the recommendation?\nA.\nstorage queues with a custom metadata setting\nB.\nAzure Service Bus queues with partitioning enabled\nC.\nAzure Service Bus queues with sessions enabled\nD.\nstorage queues with a stored access policy", "stem": "You are designing an app that will include two components. The components will communicate by sending messages via a queue. You need to recommend a solution to process the messages by using a First in, First out (FIFO) pattern. What should you include in the recommendation", "options": [ { "key": "A", "text": "storage queues with a custom metadata setting" }, { "key": "B", "text": "Azure Service Bus queues with partitioning enabled" }, { "key": "C", "text": "Azure Service Bus queues with sessions enabled" }, { "key": "D", "text": "storage queues with a stored access policy" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Sessions: Enabling sessions on an Azure Service Bus queue allows for grouping of related messages together.\nThis can be useful if you need to ensure that messages related to a specific session or conversation are\nprocessed in order. With sessions, you can also allow multiple consumers to process messages from the same\nsession in parallel, which can improve the overall throughput of the queue. This is useful if you expect to have\na large number of conversations and need to scale out the processing of those messages.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 283, "pdfId": 214, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/214" }, "markersInGap": [], "questionText": "s.\nHOTSPOT\n-\nYou need to deploy an instance of SQL Server on Azure Virtual Machines. The solution must meet the following\nrequirements:\n• Support 15,000 disk IOPS.\n• Support SR-IOV.\n• Minimize costs.\nWhat should you include in the solution? To answer, select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nAnswer:", "stem": "s. You need to deploy an instance of SQL Server on Azure Virtual Machines. The solution must meet the following requirements: • Support 15,000 disk IOPS. • Support SR-IOV. • Minimize costs. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": null, "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": true, "missingOptions": false, "recoveredFromMarkerSplit": true } }, { "seq": 212, "pdfId": 215, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/215" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Notification Hubs\nB.\nAzure Application Gateway\nC.\nAzure Queue Storage\nD.\nAzure Traffic Manager", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Notification Hubs" }, { "key": "B", "text": "Azure Application Gateway" }, { "key": "C", "text": "Azure Queue Storage" }, { "key": "D", "text": "Azure Traffic Manager" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C is the answer.\nhttps://learn.microsoft.com/en-us/azure/storage/queues/storage-queues-introduction\nAzure Queue Storage is a service for storing large numbers of messages. You access messages from\nanywhere in the world via authenticated calls using HTTP or HTTPS. A queue message can be up to 64 KB in\nsize. A queue may contain millions of messages, up to the total capacity limit of a storage account. Queues are\ncommonly used to create a backlog of work to process asynchronously.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 211, "pdfId": 216, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/216" }, "markersInGap": [ 215, 216 ], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\n A.\n Azure Notification Hubs\nB.\n Azure Application Gateway\nC.\n Azure Service Bus\nD.\n Azure Traffic Manager", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Notification Hubs" }, { "key": "B", "text": "Azure Application Gateway" }, { "key": "C", "text": "Azure Service Bus" }, { "key": "D", "text": "Azure Traffic Manager" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C is the answer.\nhttps://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-messaging-overviewAzure\nService Bus is a fully managed enterprise message broker with message queues and publish-subscribe topics\n(in a namespace). Service Bus is used to decouple applications and services from each other, providing the\nfollowing benefits:- Load-balancing work across competing workers- Safely routing and transferring data and\ncontrol across service and application boundaries- Coordinating transactional work that requires a high-\ndegree of reliability", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 214, "pdfId": 217, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/217" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Hyperscale\nB.\nAzure SQL Database Premium\nC.\nAzure SQL Database Standard\nD.\nAzure SQL Managed Instance General Purpose", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: •Failover between replicas of the database must occur without any data loss. •The database must remain available in the event of a zone outage. •Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Hyperscale" }, { "key": "B", "text": "Azure SQL Database Premium" }, { "key": "C", "text": "Azure SQL Database Standard" }, { "key": "D", "text": "Azure SQL Managed Instance General Purpose" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "In Premium, Business Critical, and Hyperscale service tiers, SQL Database supports the use of read-only\nreplicas to offload read-only query workloads, using the ApplicationIntent=ReadOnly parameter in the\nconnection string.The question to ask for costs must be minimized.So the answer is Premium", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 213, "pdfId": 218, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/218" }, "markersInGap": [ 217, 218 ], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n• Failover between replicas of the database must occur without any data loss.\n• The database must remain available in the event of a zone outage.\n • Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Basic\nB.\nAzure SQL Database Business Critical\nC.\nAzure SQL Database Standard\nD.\nAzure SQL Managed Instance General Purpose", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: • Failover between replicas of the database must occur without any data loss. • The database must remain available in the event of a zone outage. • Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Basic" }, { "key": "B", "text": "Azure SQL Database Business Critical" }, { "key": "C", "text": "Azure SQL Database Standard" }, { "key": "D", "text": "Azure SQL Managed Instance General Purpose" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure SQL Database Business Critical", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 215, "pdfId": 219, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/219" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "You have an Azure Functions microservice app named App1 that is hosted in the Co", "keys": [ "You have an Azure Functions microservice app named App1 that is hosted in the Co" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/aks/concepts-scale#horizontal-pod-autoscaler\nKubernetes uses the horizontal pod autoscaler (HPA) to monitor the resource demand and automatically scale\nthe number of replicas. By default, the horizontal pod autoscaler checks the Metrics API every 15 seconds for\nany required changes in replica count, but the Metrics API retrieves data from the Kubelet every 60 seconds.\nEffectively, the HPA is updated every 60 seconds. When changes are required, the number of replicas is\nincreased or decreased accordingly. Horizontal pod autoscaler works with AKS clusters that have deployed\nthe Metrics Server for Kubernetes 1.8+.\nhttps://learn.microsoft.com/en-us/azure/aks/keda-about\nKubernetes Event-driven Autoscaling (KEDA) is a single-purpose and lightweight component that strives to\nmake application autoscaling simple and is a CNCF Incubation project.\nIt applies event-driven autoscaling to scale your application to meet demand in a sustainable and cost-\nefficient manner with scale-to-zero.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 216, "pdfId": 220, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/220" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Application Gateway\nB.\nAzure Queue Storage\nC.\nAzure Data Lake\nD.\nAzure Traffic Manager", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Application Gateway" }, { "key": "B", "text": "Azure Queue Storage" }, { "key": "C", "text": "Azure Data Lake" }, { "key": "D", "text": "Azure Traffic Manager" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Queue Storage", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 217, "pdfId": 221, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/221" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Managed Instance General Purpose\nB.\nAzure SQL Database Hyperscale\nC.\nAzure SQL Database Premium\nD.\nAzure SQL Managed Instance Business Critical", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: •Failover between replicas of the database must occur without any data loss. •The database must remain available in the event of a zone outage. •Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Managed Instance General Purpose" }, { "key": "B", "text": "Azure SQL Database Hyperscale" }, { "key": "C", "text": "Azure SQL Database Premium" }, { "key": "D", "text": "Azure SQL Managed Instance Business Critical" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure SQL Database Premium\nYou need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 218, "pdfId": 222, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/222" }, "markersInGap": [], "questionText": "Which deployment option should you use?\nA.\nAzure SQL Database Hyperscale\nB.\nAzure SQL Database Premium\nC.\nAzure SQL Database Basic\nD.\nAzure SQL Database Serverless", "stem": "Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Hyperscale" }, { "key": "B", "text": "Azure SQL Database Premium" }, { "key": "C", "text": "Azure SQL Database Basic" }, { "key": "D", "text": "Azure SQL Database Serverless" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "There are *16* variations of this question. Each of them offering different possible answers.\nThe answer priority is as follows. If it exists then choose it. If it doesn't, proceeded to the next priority.\nSometimes both appear in the same question, so make sure to select the higher priority.\n1. Azure SQL Database Premium\n2. Azure SQL Database Serverless\n3. Azure SQL Database Business Critical", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 219, "pdfId": 223, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/223" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Notification Hubs\nB.\nAzure Service Bus\nC.\nAzure Blob Storage\nD.\nAzure Service Fabric", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Notification Hubs" }, { "key": "B", "text": "Azure Service Bus" }, { "key": "C", "text": "Azure Blob Storage" }, { "key": "D", "text": "Azure Service Fabric" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Service Bus\nYou are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 220, "pdfId": 224, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/224" }, "markersInGap": [], "questionText": "You need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Service Fabric\nB.\nAzure Traffic Manager\nC.\nAzure Queue Storage\nD.\nAzure Notification Hubs", "stem": "You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Service Fabric" }, { "key": "B", "text": "Azure Traffic Manager" }, { "key": "C", "text": "Azure Queue Storage" }, { "key": "D", "text": "Azure Notification Hubs" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "To enable asynchronous communication between cloud services using XML messages, you should use a\nmessaging system. Out of the options provided:A. Azure Service Fabric: It's a distributed systems platform for\ndeploying and managing microservices and containers. While it can be used to build resilient applications, it's\nnot a messaging system per se.B. Azure Traffic Manager: It's a DNS-based traffic load balancer. It doesn't\ndeal with asynchronous messaging.C. Azure Queue Storage: This service allows you to decouple cloud\ncomponents and ensure asynchronous message delivery. Messages can be placed into a queue, where\nanother service can pick them up and process them, which is exactly what's described in the scenario. The\nmessages can be in XML format or any other format that suits your needs.D. Azure Notification Hubs: This is\nfor sending push notifications to mobile devices. It's not designed for inter-service communication.Therefore,\nthe correct Answer is:C. Azure Queue Storage.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 221, "pdfId": 225, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/225" }, "markersInGap": [], "questionText": "You have an on-premises Microsoft SQL Server 2008 instance that hosts a 50-GB database.\nYou need to migrate the database to an Azure SQL managed instance. The solution must minimize downtime.\nWhat should you use?\nA.\nAzure Migrate\nB.\nAzure Data Studio\nC.\nWANdisco LiveData Platform for Azure\nD.\nSQL Server Management Studio (SSMS)", "stem": "You have an on-premises Microsoft SQL Server 2008 instance that hosts a 50-GB database. You need to migrate the database to an Azure SQL managed instance. The solution must minimize downtime. What should you use", "options": [ { "key": "A", "text": "Azure Migrate" }, { "key": "B", "text": "Azure Data Studio" }, { "key": "C", "text": "WANdisco LiveData Platform for Azure" }, { "key": "D", "text": "SQL Server Management Studio (SSMS)" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Data StudioIs a lightweight multi-platform database tool for managing SQL Server instances and\ndatabases. While it can be used for migrations, it is not specifically designed for this purpose and does not\nprovide the same level of automation and ease of use as Azure Migrate.\nWith Azure Migrate, you can discover, assess, and migrate your on-premises applications, infrastructure, and\ndata to Azure. Azure Migrate uses Azure Site Recovery to migrate on-premises SQL Server instances to Azure\nSQL Managed Instance. It provides a single integrated experience for assessment, migration, and monitoring.\nYou need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 222, "pdfId": 226, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/226" }, "markersInGap": [], "questionText": "Which deployment option should you use?\nA.\nAzure SQL Managed Instance Business Critical\nB.\nAzure SQL Managed Instance General Purpose\nC.\nAzure SQL Database Standard\nD.\nAzure SQL Database Premium", "stem": "Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Managed Instance Business Critical" }, { "key": "B", "text": "Azure SQL Managed Instance General Purpose" }, { "key": "C", "text": "Azure SQL Database Standard" }, { "key": "D", "text": "Azure SQL Database Premium" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Azure SQL Database Premium", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 223, "pdfId": 227, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/227" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Business Critical\nB.\nAzure SQL Database Basic\nC.\nAzure SQL Managed Instance General Purpose\nD.\nAzure SQL Database Hyperscale", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: •Failover between replicas of the database must occur without any data loss. •The database must remain available in the event of a zone outage. •Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Business Critical" }, { "key": "B", "text": "Azure SQL Database Basic" }, { "key": "C", "text": "Azure SQL Managed Instance General Purpose" }, { "key": "D", "text": "Azure SQL Database Hyperscale" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure SQL Database Business Critical", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 225, "pdfId": 228, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/228" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Application Gateway\nB.\nAzure Data Lake\nC.\nAzure Queue Storage\nD.\nAzure Blob Storage", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Application Gateway" }, { "key": "B", "text": "Azure Data Lake" }, { "key": "C", "text": "Azure Queue Storage" }, { "key": "D", "text": "Azure Blob Storage" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Queue Storage", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 226, "pdfId": 229, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/229" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Blob Storage\nB.\nAzure Data Lake\nC.\nAzure Queue Storage\nD.\nAzure Service Fabric", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Blob Storage" }, { "key": "B", "text": "Azure Data Lake" }, { "key": "C", "text": "Azure Queue Storage" }, { "key": "D", "text": "Azure Service Fabric" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Queue Storage is a correct answer.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 224, "pdfId": 230, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/230" }, "markersInGap": [ 228, 229, 230 ], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\n A.\nAzure Service Fabric\nB.\nAzure Queue Storage\nC.\nAzure Traffic Manager\nD.\nAzure Application Gateway", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Service Fabric" }, { "key": "B", "text": "Azure Queue Storage" }, { "key": "C", "text": "Azure Traffic Manager" }, { "key": "D", "text": "Azure Application Gateway" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Queue Storage", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 227, "pdfId": 231, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/231" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Serverless\nB.\nAzure SQL Managed Instance General Purpose\nC.\nAzure SQL Database Basic\nD.\nAzure SQL Database Business Critical", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: •Failover between replicas of the database must occur without any data loss. •The database must remain available in the event of a zone outage. •Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Serverless" }, { "key": "B", "text": "Azure SQL Managed Instance General Purpose" }, { "key": "C", "text": "Azure SQL Database Basic" }, { "key": "D", "text": "Azure SQL Database Business Critical" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Azure SQL Database Business Critical\nFailover Without Data Loss: The Business Critical tier uses synchronous replication, ensuring that failover\nbetween replicas occurs without any data loss.\nZone Outage Resilience: It supports zone redundancy, ensuring that the database remains available even in\nthe event of a zone outage.\nCost Efficiency: While providing high availability and resilience, it is generally more cost-effective compared\nto other options that offer similar levels of availability and data integrity.\nThis option balances high availability, data integrity, and cost efficiency, making it the most suitable choice for\nyour requirements.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 228, "pdfId": 232, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/232" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Standard\nB.\nAzure SQL Managed Instance General Purpose\nC.\nAzure SQL Database Serverless\nD.\nAzure SQL Database Premium", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: •Failover between replicas of the database must occur without any data loss. •The database must remain available in the event of a zone outage. •Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Standard" }, { "key": "B", "text": "Azure SQL Managed Instance General Purpose" }, { "key": "C", "text": "Azure SQL Database Serverless" }, { "key": "D", "text": "Azure SQL Database Premium" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Azure SQL Database Premium", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 229, "pdfId": 233, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/233" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Notification Hubs\nB.\nAzure Queue Storage\nC.\nAzure Blob Storage\nD.\nAzure Application Gateway", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Notification Hubs" }, { "key": "B", "text": "Azure Queue Storage" }, { "key": "C", "text": "Azure Blob Storage" }, { "key": "D", "text": "Azure Application Gateway" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Queue Storage", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 232, "pdfId": 234, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/234" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Service Bus\nB.\nAzure Data Lake\nC.\nAzure Traffic Manager\nD.\nAzure Notification Hubs", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Service Bus" }, { "key": "B", "text": "Azure Data Lake" }, { "key": "C", "text": "Azure Traffic Manager" }, { "key": "D", "text": "Azure Notification Hubs" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Service Bus\nYou are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 231, "pdfId": 235, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/235" }, "markersInGap": [], "questionText": "You have an on-premises Microsoft SQL server named SQL1 that hosts 50 databases.\nYou plan to migrate SQL1 to Azure SQL Managed Instance.\nYou need to perform an offline migration of SQL1. The solution must minimize administrative effort.\nWhat should you include in the solution?\nA.\nAzure Migrate\nB.\nAzure Database Migration Service\nC.\nSQL Server Migration Assistant (SSMA)\nD.\nData Migration Assistant (DMA)", "stem": "You have an on-premises Microsoft SQL server named SQL1 that hosts 50 databases. You plan to migrate SQL1 to Azure SQL Managed Instance. You need to perform an offline migration of SQL1. The solution must minimize administrative effort. What should you include in the solution", "options": [ { "key": "A", "text": "Azure Migrate" }, { "key": "B", "text": "Azure Database Migration Service" }, { "key": "C", "text": "SQL Server Migration Assistant (SSMA)" }, { "key": "D", "text": "Data Migration Assistant (DMA)" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Azure Database Migration Service Azure Database Migration Service is a tool that helps you simplify, guide,\nand automate your database migration to Azure. Specifically for SQL Server to Azure SQL Managed Instance\nmigrations, it provides an option for offline (one-time) migrations which is suitable for your scenario. The Data\nMigration Assistant (DMA) tool can be used beforehand to assess your SQL Server databases for any feature\nparity and compatibility issues that could impact the database functionality in Azure SQL Managed Instance.\nAzure Migrate is a service that helps you assess and migrate applications, infrastructure, and data, but it\ndoesn't specifically cater to SQL Server migrations. SQL Server Migration Assistant (SSMA) is more suited for\nmigrations to Azure SQL Database and does not support Azure SQL Managed Instance.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 230, "pdfId": 236, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/236" }, "markersInGap": [ 235, 236 ], "questionText": "HOTSPOT\n-\nYou are developing a multi-tier app named App1 that will be hosted on Azure virtual machines. The peak utilization\nperiods for App1 will be from 8 AM to 9 AM and 4 PM to 5 PM on weekdays.\nYou need to deploy the infrastructure for App1. The solution must meet the following requirements:\n•Support virtual machines deployed to four availability zones across two Azure regions.\n•Minimize costs by accumulating CPU credits during periods of low utilization.\nWhat is the minimum number of virtual networks you should deploy, and which virtual machine size should you\nuse? To answer, select the appropriate options in the answer area.", "stem": "You are developing a multi-tier app named App1 that will be hosted on Azure virtual machines. The peak utilization periods for App1 will be from 8 AM to 9 AM and 4 PM to 5 PM on weekdays. You need to deploy the infrastructure for App1. The solution must meet the following requirements: •Support virtual machines deployed to four availability zones across two Azure regions. •Minimize costs by accumulating CPU credits during periods of low utilization. What is the minimum number of virtual networks you should deploy, and which virtual machine size should you use? To answer, select the appropriate options in the answer area.", "options": [], "answer": { "raw": "You are developing a sales application that will contain several Azure cloud ser", "keys": [ "You are developing a sales application that will contain several Azure cloud ser" ] }, "explanation": "Azure Service Bus", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 233, "pdfId": 237, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/237" }, "markersInGap": [], "questionText": "You need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Service Bus\nB.\nAzure Data Lake\nC.\nAzure Application Gateway\nD.\nAzure Notification Hubs", "stem": "You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Service Bus" }, { "key": "B", "text": "Azure Data Lake" }, { "key": "C", "text": "Azure Application Gateway" }, { "key": "D", "text": "Azure Notification Hubs" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Service Bus", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 234, "pdfId": 238, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/238" }, "markersInGap": [], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Business Critical\nB.\nAzure SQL Database Hyperscale\nC.\nAzure SQL Managed Instance Business Critical\nD.\nAzure SQL Database Standard", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: •Failover between replicas of the database must occur without any data loss. •The database must remain available in the event of a zone outage. •Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Business Critical" }, { "key": "B", "text": "Azure SQL Database Hyperscale" }, { "key": "C", "text": "Azure SQL Managed Instance Business Critical" }, { "key": "D", "text": "Azure SQL Database Standard" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Azure SQL Database Business Critical.\nThe Business Critical tier of Azure SQL Database is designed to provide high availability with zone\nredundancy, ensuring failover between replicas without data loss. It also remains available during zone\noutages, making it suitable for mission-critical applications. While it may not be the cheapest option, it\nbalances cost and performance effectively for scenarios requiring high availability and data integrity", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 235, "pdfId": 239, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/239" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Protection against Open Web Application Security Project (OWASP) vulnerabilities: OWASP is a well-known\nproject that identifies and categorizes common web application security risks (e.g., SQL injection, cross-site\nscripting). This function refers to the ability to protect web applications against these types of vulnerabilities.\nValidation of Azure B2C JSON Web Tokens (JWTs): Azure B2C (Business-to-Consumer) is an identity\nmanagement service. JWTs are commonly used for authentication and authorization. This function refers to\nthe ability to verify the authenticity and integrity of JWTs issued by Azure B2C.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 237, "pdfId": 240, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/240" }, "markersInGap": [], "questionText": "You need to enforce the location of the App Service instances, and not of resource groups.\nYour on-premises datacenter contains a server that runs Linux and hosts a Java app named App1. App1 has the\nfollowing characteristics:\n•App1 is an interactive app that users access by using HTTPS connections.\n•The number of connections to App1 changes significantly throughout the day.\n•App1 runs multiple concurrent instances.\n•App1 requires major changes to run in a container.\nYou plan to migrate App1 to Azure.\nYou need to recommend a compute solution for App1. The solution must meet the following requirements:\n•The solution must run multiple instances of App1.\n•The number of instances must be managed automatically depending on the load.\n•Administrative effort must be minimized.\nWhat should you include in the recommendation?\nA.\nAzure Batch\nB.\nAzure App Service\nC.\nAzure Kubernetes Service (AKS)\nD.\nAzure Virtual Machine Scale Sets", "stem": "You need to enforce the location of the App Service instances, and not of resource groups. Your on-premises datacenter contains a server that runs Linux and hosts a Java app named App1. App1 has the following characteristics: •App1 is an interactive app that users access by using HTTPS connections. •The number of connections to App1 changes significantly throughout the day. •App1 runs multiple concurrent instances. •App1 requires major changes to run in a container. You plan to migrate App1 to Azure. You need to recommend a compute solution for App1. The solution must meet the following requirements: •The solution must run multiple instances of App1. •The number of instances must be managed automatically depending on the load. •Administrative effort must be minimized. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Batch" }, { "key": "B", "text": "Azure App Service" }, { "key": "C", "text": "Azure Kubernetes Service (AKS)" }, { "key": "D", "text": "Azure Virtual Machine Scale Sets" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Absolutely Azure App Service.\"requires major changes to run in a container\" so Azure Kubernetes Service\ndiscarded. No need for Azure Batch. Azure Virtual Machine Scale Sets is bigger a burden and setup.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 238, "pdfId": 241, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/241" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1 subnet .\nA Private DNS zone.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 239, "pdfId": 242, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/242" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "You have an Azure subscription that contains an Azure Kubernetes Service (AKS) i", "keys": [ "You have an Azure subscription that contains an Azure Kubernetes Service (AKS) i" ] }, "explanation": "Deploy an ingress controller to AKS1.", "reference": "https://learn.microsoft.com/en-us/azure/api-management/api-management-kubernetes", "references": [ "https://learn.microsoft.com/en-us/azure/api-management/api-management-kubernetes" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 236, "pdfId": 243, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/243" }, "markersInGap": [ 243 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\n Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App\nService instances will be deployed at the same time as the Azure SQL databases.\nThe company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The\nresources for the App Service instances must reside in the same region.\nYou need to recommend a solution to meet the regulatory requirement.\nSolution: You recommend using an Azure Policy initiative to enforce the location of resource groups.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases. The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region. You need to recommend a solution to meet the regulatory requirement. Solution: You recommend using an Azure Policy initiative to enforce the location of resource groups. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "\"You recommend using an Azure Policy initiative to enforce the location of resource groups\".", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 240, "pdfId": 244, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/244" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "You have an Azure subscription that contains an Azure Cosmos DB for NoSQL accoun", "keys": [ "You have an Azure subscription that contains an Azure Cosmos DB for NoSQL accoun" ] }, "explanation": "B. Serverless SQL pool Reasoning:Serverless SQL pool in Azure Synapse Analytics is designed to handle on-\ndemand queries against large datasets, which is suitable for the NRT processing requirement stated.Minimal\nData Movement: Using serverless SQL pool allows querying data in place without the need to move data into\nthe pool, which aligns with the need to minimize data movement. It can directly query the Cosmos DB\nanalytical store.Integration with Cosmos DB Analytical Store: Serverless SQL pool has built-in integration with\nAzure Cosmos DB's analytical store, allowing efficient and performant processing of the data.Apache Spark\ncould also process the data, but it would involve more data movement compared to serverless SQL. Dedicated\nSQL pool requires pre-provisioned resources and wouldn't be as cost-effective for NRT scenarios. Data\nExplorer is not a compute pool within Azure Synapse Analytics.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 241, "pdfId": 245, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/245" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Sub1: An Azure Migrate project\nCluster1: An Azure Migrate appliance\nAssuming that the agentless migration is the optimal way to reduce admin effort. You need a Migrate Project\nin Azure, and a Migrate Appliance (VM) in the on-prem host to discover and assess the rest of the VMs.", "reference": "https://learn.microsoft.com/en-us/azure/migrate/server-migrate-overview#compare-deployment-steps", "references": [ "https://learn.microsoft.com/en-us/azure/migrate/server-migrate-overview#compare-deployment-steps" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 242, "pdfId": 246, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/246" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Sql Server on Azure Virtual Machines.\nAzure Database Migration Service.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 244, "pdfId": 247, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/247" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nAzure Log Analytics\nB.\nAzure Arc\nC.\nAzure Monitor metrics\nD.\nAzure Monitor action groups", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Log Analytics" }, { "key": "B", "text": "Azure Arc" }, { "key": "C", "text": "Azure Monitor metrics" }, { "key": "D", "text": "Azure Monitor action groups" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Correct answer is A:Azure Log Analytics.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 245, "pdfId": 248, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/248" }, "markersInGap": [], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\nWhat should you include in the recommendation?\nA.\nAzure Log Analytics\nB.\nAzure Arc\nC.\nAzure Analysis Services\nD.\nAzure Monitor action groups", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Log Analytics" }, { "key": "B", "text": "Azure Arc" }, { "key": "C", "text": "Azure Analysis Services" }, { "key": "D", "text": "Azure Monitor action groups" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Log Analytics.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 284, "pdfId": 250, "exam": "AZ-305", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/250" }, "markersInGap": [], "questionText": "You need to recommend a solution that will process the data stored in Contained in near-real-time (NRT) and\noutput the results to a data warehouse in Workspace1 by using a runtime engine in the workspace. The solution\nmust minimize data movement.\nWhich pool in Workspace1 should you use?\nA.\nApache Spark\nB.\nserverless SQL\nC.\ndedicated SQL\nD.\nData Explorer\nAnswer:\nB\nExplanation:\nB. Serverless SQL pool Reasoning:Serverless SQL pool in Azure Synapse Analytics is designed to handle on-\ndemand queries against large datasets, which is suitable for the NRT processing requirement stated.Minimal\nData Movement: Using serverless SQL pool allows querying data in place without the need to move data into\nthe pool, which aligns with the need to minimize data movement. It can directly query the Cosmos DB\nanalytical store.Integration with Cosmos DB Analytical Store: Serverless SQL pool has built-in integration with\nAzure Cosmos DB's analytical store, allowing efficient and performant processing of the data.Apache Spark\ncould also process the data, but it would involve more data movement compared to serverless SQL. Dedicated\nSQL pool requires pre-provisioned resources and wouldn't be as cost-effective for NRT scenarios. Data\nExplorer is not a compute pool within Azure Synapse Analytics.\nDRAG DROP\n-\nYou have an on-premises datacenter named Site1. Site1 contains a VMware vSphere cluster named Cluster1 that\nhosts 100 virtual machines. Cluster1 is managed by using VMware vCenter.\nYou have an Azure subscription named Sub1.\nYou plan to migrate the virtual machines from Cluster1 to Sub1.\nYou need to identify which resources are required to run the virtual machines in Azure. The solution must minimize\nadministrative effort.\nWhat should you configure? To answer, drag the appropriate resources to the correct targets. Each resource may\nbe used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view\ncontent.\nNOTE: Each correct selection is worth one point.\nAnswer:\nExplanation:\nSub1: An Azure Migrate project\nCluster1: An Azure Migrate appliance\nAssuming that the agentless migration is the optimal way to reduce admin effort. You need a Migrate Project\nin Azure, and a Migrate Appliance (VM) in the on-prem host to discover and assess the rest of the VMs.\nReference:\nhttps://learn.microsoft.com/en-us/azure/migrate/server-migrate-overview#compare-deployment-steps\nHOTSPOT\n-\nYour on-premises datacenter contains a server named Server1 that runs Microsoft SQL Server 2022. Server1\ncontains a 30-TB database named DB1 that stores customer data. Server1 runs a custom application named App1\nthat verifies the compliance of records in DB1. App1 must run on the same server as DB1", "stem": "You need to recommend a solution that will process the data stored in Contained in near-real-time (NRT) and output the results to a data warehouse in Workspace1 by using a runtime engine in the workspace. The solution must minimize data movement. Which pool in Workspace1 should you use", "options": [ { "key": "A", "text": "Apache Spark" }, { "key": "B", "text": "serverless SQL" }, { "key": "C", "text": "dedicated SQL" }, { "key": "D", "text": "Data Explorer" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Serverless SQL pool Reasoning:Serverless SQL pool in Azure Synapse Analytics is designed to handle on-\ndemand queries against large datasets, which is suitable for the NRT processing requirement stated.Minimal\nData Movement: Using serverless SQL pool allows querying data in place without the need to move data into\nthe pool, which aligns with the need to minimize data movement. It can directly query the Cosmos DB\nanalytical store.Integration with Cosmos DB Analytical Store: Serverless SQL pool has built-in integration with\nAzure Cosmos DB's analytical store, allowing efficient and performant processing of the data.Apache Spark\ncould also process the data, but it would involve more data movement compared to serverless SQL. Dedicated\nSQL pool requires pre-provisioned resources and wouldn't be as cost-effective for NRT scenarios. Data\nExplorer is not a compute pool within Azure Synapse Analytics.", "reference": "https://learn.microsoft.com/en-us/azure/migrate/server-migrate-overview#compare-deployment-steps", "references": [ "https://learn.microsoft.com/en-us/azure/migrate/server-migrate-overview#compare-deployment-steps" ], "note": "Each correct selection is worth one point.\nAnswer:\nExplanation:\nSub1: An Azure Migrate project\nCluster1: An Azure Migrate appliance\nAssuming that the agentless migration is the optimal way to reduce admin effort. You need a Migrate Project\nin Azure, and a Migrate Appliance (VM) in the on-prem host to discover and assess the rest of the VMs.\nReference:\nhttps://learn.microsoft.com/en-us/azure/migrate/server-migrate-overview#compare-deployment-steps", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false, "recoveredFromMarkerSplit": true } }, { "seq": 285, "pdfId": 251, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/251" }, "markersInGap": [], "questionText": "1.\nYou have an Azure subscription.\nYou need to migrate DB1 to Azure. The solution must minimize administrative effort.\nTo which service should you migrate DB1, and what should you use to perform the migration? To answer, select the\nappropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nAnswer:\nExplanation:\nSql Server on Azure Virtual Machines.\nAzure Database Migration Service", "stem": "1. You have an Azure subscription. You need to migrate DB1 to Azure. The solution must minimize administrative effort. To which service should you migrate DB1, and what should you use to perform the migration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Sql Server on Azure Virtual Machines.\nAzure Database Migration Service", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false, "recoveredFromMarkerSplit": true } }, { "seq": 243, "pdfId": 252, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/252" }, "markersInGap": [ 252 ], "questionText": "You need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Managed Instance Business Critical\n B.\nAzure SQL Database Business Critical\nC.\nAzure SQL Database Basic\nD.\nAzure SQL Database Standard", "stem": "You need to design a highly available Azure SQL database that meets the following requirements: •Failover between replicas of the database must occur without any data loss. •The database must remain available in the event of a zone outage. •Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Managed Instance Business Critical" }, { "key": "B", "text": "Azure SQL Database Business Critical" }, { "key": "C", "text": "Azure SQL Database Basic" }, { "key": "D", "text": "Azure SQL Database Standard" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure SQL Database Business Critical.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 247, "pdfId": 253, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/253" }, "markersInGap": [], "questionText": "which track all ARM resource deployments.\n- You can query deployment events using Kusto Query Language (KQL) in Azure Monitor Logs.\n- You can schedule reports to run monthly and export the results.\n- This solution provides detailed insights into resource deployments and allows for custom filtering.\nWhy Not the Other Options?\n- B. Azure Analysis Services\n→\n Used for business intelligence and data modeling, not for logging Azure\ndeployments.\n- C. Azure Monitor metrics\n→\n Tracks performance metrics (CPU, memory, etc.), but does not log ARM\ndeployments.\n- D. Azure Monitor action groups\n→\n Used for alerting and notifications, not for generating reports.\nYou need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.\nWhich deployment option should you use?\nA.\nAzure SQL Database Business Critical\nB.\nAzure SQL Database Premium\nC.\nAzure SQL Database Basic\nD.\nAzure SQL Database Hyperscale", "stem": "which track all ARM resource deployments. - You can query deployment events using Kusto Query Language (KQL) in Azure Monitor Logs. - You can schedule reports to run monthly and export the results. - This solution provides detailed insights into resource deployments and allows for custom filtering. Why Not the Other Options? - B. Azure Analysis Services → Used for business intelligence and data modeling, not for logging Azure deployments. - C. Azure Monitor metrics → Tracks performance metrics (CPU, memory, etc.), but does not log ARM deployments. - D. Azure Monitor action groups → Used for alerting and notifications, not for generating reports. You need to design a highly available Azure SQL database that meets the following requirements: •Failover between replicas of the database must occur without any data loss. •The database must remain available in the event of a zone outage. •Costs must be minimized. Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Business Critical" }, { "key": "B", "text": "Azure SQL Database Premium" }, { "key": "C", "text": "Azure SQL Database Basic" }, { "key": "D", "text": "Azure SQL Database Hyperscale" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure SQL Database Premium.\nYou need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 248, "pdfId": 254, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/254" }, "markersInGap": [], "questionText": "What should you include in the recommendation?\nA.\nApplication Insights\nB.\nAzure Analysis Services\nC.\nAzure Advisor\nD.\nAzure Log Analytics", "stem": "What should you include in the recommendation", "options": [ { "key": "A", "text": "Application Insights" }, { "key": "B", "text": "Azure Analysis Services" }, { "key": "C", "text": "Azure Advisor" }, { "key": "D", "text": "Azure Log Analytics" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Azure Log Analytics\n- Azure Log Analytics collects and analyzes logs from various Azure services, including Azure Activity Logs,", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 246, "pdfId": 255, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/255" }, "markersInGap": [ 253, 254, 255 ], "questionText": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM)\nresource deployments in your Azure subscription.\n What should you include in the recommendation?\nA.\nAzure Log Analytics\nB.\nAzure Analysis Services\nC.\nAzure Monitor metrics\nD.\nAzure Monitor action groups", "stem": "You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Log Analytics" }, { "key": "B", "text": "Azure Analysis Services" }, { "key": "C", "text": "Azure Monitor metrics" }, { "key": "D", "text": "Azure Monitor action groups" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Azure Log Analytics.\n- Azure Log Analytics collects and analyzes logs from various Azure services, including Azure Activity Logs,", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 253, "pdfId": 256, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/256" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure AD Identity Protection\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid\nAzure AD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-\nconfigure-mfa-policy https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-\nazure-mfa", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-", "https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-" ], "note": "Policy configuration -\n1. Navigate to the Azure portal.\n2. Browse to Azure Active Directory > Security > Identity Protection > MFA registration policy.\n3. Under Assignments\n4. Users - Choose All users or Select individuals and groups if limiting your rollout.\n5. Optionally you can choose to exclude users from the policy.\n6. Enforce Policy - On", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 250, "pdfId": 257, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/257" }, "markersInGap": [], "questionText": "Which deployment option should you use?\nA.\nAzure SQL Database Standard\nB.\nAzure SQL Managed Instance Business Critical\nC.\nAzure SQL Database Serverless\nD.\nAzure SQL Database Premium", "stem": "Which deployment option should you use", "options": [ { "key": "A", "text": "Azure SQL Database Standard" }, { "key": "B", "text": "Azure SQL Managed Instance Business Critical" }, { "key": "C", "text": "Azure SQL Database Serverless" }, { "key": "D", "text": "Azure SQL Database Premium" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Azure SQL Database Premium.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 249, "pdfId": 258, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/258" }, "markersInGap": [ 257, 258 ], "questionText": "which track all ARM resource deployments.\n- You can query deployment events using Kusto Query Language (KQL) in Azure Monitor Logs.\n- You can schedule reports to run monthly and export the results.\n- This solution provides detailed insights into resource deployments and allows for custom filtering.\nWhy Not the Other Options?\n- A. Application Insights\n→\n Primarily used for monitoring application performance, not tracking ARM\ndeployments.\n- B. Azure Analysis Services\n→\n Used for business intelligence and data modeling, not for logging Azure\ndeployments.\n- C. Azure Advisor\n→\n Provides recommendations for best practices but does not generate deployment reports.\nHOTSPOT\n-\nYou have an Azure subscription that contains the resources shown in the following table.\n VNet1, VNet2, and VNet3 each has multiple virtual machines connected. The virtual machines use the Azure DNS\nservice for name resolution.\nYou need to recommend an Azure Monitor log routing solution that meets the following requirements:\n•Ensures that the logs collected from the virtual machines and sent to Workspace1 are routed over the Microsoft\nbackbone network\n•Minimizes administrative effort\nWhat should you include in the recommendation? To answer, select the appropriate options in the answer area.", "stem": "which track all ARM resource deployments. - You can query deployment events using Kusto Query Language (KQL) in Azure Monitor Logs. - You can schedule reports to run monthly and export the results. - This solution provides detailed insights into resource deployments and allows for custom filtering. Why Not the Other Options? - A. Application Insights → Primarily used for monitoring application performance, not tracking ARM deployments. - B. Azure Analysis Services → Used for business intelligence and data modeling, not for logging Azure deployments. - C. Azure Advisor → Provides recommendations for best practices but does not generate deployment reports. You have an Azure subscription that contains the resources shown in the following table. VNet1, VNet2, and VNet3 each has multiple virtual machines connected. The virtual machines use the Azure DNS service for name resolution. You need to recommend an Azure Monitor log routing solution that meets the following requirements: •Ensures that the logs collected from the virtual machines and sent to Workspace1 are routed over the Microsoft backbone network •Minimizes administrative effort What should you include in the recommendation? To answer, select the appropriate options in the answer area.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "You need to design a highly available Azure SQL database that meets the following requirements:\n•Failover between replicas of the database must occur without any data loss.\n•The database must remain available in the event of a zone outage.\n•Costs must be minimized.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 252, "pdfId": 259, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/259" }, "markersInGap": [], "questionText": "You are developing a sales application that will contain several Azure cloud services and handle different\ncomponents of a transaction. Different cloud services will process customer orders, billing, payment, inventory,\nand shipping.\nYou need to recommend a solution to enable the cloud services to asynchronously communicate transaction\ninformation by using XML messages.\nWhat should you include in the recommendation?\nA.\nAzure Service Fabric\nB.\nAzure Notification Hubs\nC.\nAzure Service Bus\nD.\nAzure Traffic Manager", "stem": "You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping. You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure Service Fabric" }, { "key": "B", "text": "Azure Notification Hubs" }, { "key": "C", "text": "Azure Service Bus" }, { "key": "D", "text": "Azure Traffic Manager" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Azure Service Bus.\nAzure Service Bus is designed for asynchronous messaging and supports communication between cloud\nservices using XML messages. It provides reliable messaging capabilities, including queues and topics, to\nensure smooth and efficient communication even when services are not actively running.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 251, "pdfId": 260, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/260" }, "markersInGap": [ 259, 260 ], "questionText": "HOTSPOT\n-\nYou have 100 Azure Storage accounts.\nAccess to the accounts is restricted by using Azure role-based access control (Azure RBAC) assignments.\nYou need to recommend a solution that uses role assignment conditions based on the tags assigned to individual\nresources within the storage accounts.\nWhat should you include in the recommendation? To answer, select the appropriate options in the answer area.", "stem": "You have 100 Azure Storage accounts. Access to the accounts is restricted by using Azure role-based access control (Azure RBAC) assignments. You need to recommend a solution that uses role assignment conditions based on the tags assigned to individual resources within the storage accounts. What should you include in the recommendation? To answer, select the appropriate options in the answer area.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Attribute-based access Control(ABAC)\nBlobs.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 254, "pdfId": 261, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/261" }, "markersInGap": [], "questionText": "After you migrate App1 to Azure, you need to enforce the data modification requirements to meet the security and\ncompliance requirements.\nWhat should you do?\nA.\nCreate an access policy for the blob service.\nB.\nImplement Azure resource locks.\nC.\nCreate Azure RBAC assignments.\nD.\nModify the access level of the blob service.", "stem": "After you migrate App1 to Azure, you need to enforce the data modification requirements to meet the security and compliance requirements. What should you do", "options": [ { "key": "A", "text": "Create an access policy for the blob service." }, { "key": "B", "text": "Implement Azure resource locks." }, { "key": "C", "text": "Create Azure RBAC assignments." }, { "key": "D", "text": "Modify the access level of the blob service." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Scenario: Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the\nmodification of new and existing data is prevented for a period of three years.\nAs an administrator, you can lock a subscription, resource group, or resource to prevent other users in your\norganization from accidentally deleting or modifying critical resources. The lock overrides any permissions\nthe user might have.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 255, "pdfId": 262, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/262" }, "markersInGap": [], "questionText": "You need to recommend a solution for the App1 maintenance task. The solution must minimize costs.\nWhat should you include in the recommendation?\nA.\nan Azure logic app\nB.\nan Azure function\nC.\nan Azure virtual machine\nD.\nan App Service WebJob", "stem": "You need to recommend a solution for the App1 maintenance task. The solution must minimize costs. What should you include in the recommendation", "options": [ { "key": "A", "text": "an Azure logic app" }, { "key": "B", "text": "an Azure function" }, { "key": "C", "text": "an Azure virtual machine" }, { "key": "D", "text": "an App Service WebJob" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. an Azure function.\nAzure Functions are a cost-effective solution for running small pieces of code or tasks on demand. They\nfollow a serverless architecture, meaning you only pay for the execution time and resources consumed, which\nhelps minimize costs. This makes them an ideal choice for maintenance tasks like App1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 256, "pdfId": 263, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/263" }, "markersInGap": [], "questionText": "You need to recommend a solution that meets the application development requirements.\nWhat should you include in the recommendation?\nA.\nthe Azure App Configuration service\nB.\nan Azure Container Registry instance\nC.\ndeployment slots\nD.\nContinuous Integration/Continuous Deployment (CI/CD) sources", "stem": "You need to recommend a solution that meets the application development requirements. What should you include in the recommendation", "options": [ { "key": "A", "text": "the Azure App Configuration service" }, { "key": "B", "text": "an Azure Container Registry instance" }, { "key": "C", "text": "deployment slots" }, { "key": "D", "text": "Continuous Integration/Continuous Deployment (CI/CD) sources" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "When you deploy your web app, web app on Linux, mobile back end, or API app to Azure App Service, you can\nuse a separate deployment slot instead of the default production slot when you're running in the Standard,\nPremium, or Isolated App Service plan tier. Deployment slots are live apps with their own host names.\nApp content and configurations elements can be swapped between two deployment slots, including the\nproduction slot.\nDeploying your application to a non-production slot has the following benefits:\n* You can validate app changes in a staging deployment slot before swapping it with the production slot.\n* Deploying an app to a slot first and swapping it into production makes sure that all instances of the slot are\nwarmed up before being swapped into production.\nThis eliminates downtime when you deploy your app.\n* After a swap, the slot with previously staged app now has the previous production app. If the changes\nswapped into the production slot aren't as you expect, you can perform the same swap immediately to get\nyour \"last known good site\" back.", "reference": "https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots", "references": [ "https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots" ], "note": "Application Development Requirements\nApplication developers will constantly develop new versions of App1 and App2. The development process\nmust meet the following requirements:\n¢ A staging instance of a new application version must be deployed to the application host before the new\nversion is used in production.\n¢ After testing the new version, the staging version of the application will replace the production version.\n¢ The switch to the new application version from staging to production must occur without any downtime of\nthe application.\nReference:\nhttps://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 259, "pdfId": 264, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/264" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Yes: Migrate to SQL Managed Instance needs storage account https://docs.microsoft.com/en-\nus/azure/dms/tutorial-sql-server-managed-instance-online#configure-migration-settings\nNo: use Azure Web app where the app can be upgraded from a single point and can scale in /out with its own\nstorage https://docs.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-get-started?\ntoc=/azure/app-service/toc.json\nNo: Storage account is not mandatory, you can use Log Analytics workspace instead. Storage account can be\nused as a cheap option when you want to \"archive\" Stream metrics and resource logs\nhttps://docs.microsoft.com/en-us/azure/azure-sql/database/monitor-tune-overview#azure-storage", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 258, "pdfId": 265, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/265" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: A system-assigned managed identity.\nNo one knows the credentials of managed identities.\nManaged Identities exist in two formats:\n* System assigned: in this scenario, the identity is linked to a single Azure Resource, eg a Virtual Machine, a\nLogic App, a Storage Account, Web App, Function,¦ so almost anything. Next, they also live with the Azure\nResource, which means they get deleted when the Azure Resource gets deleted.\n* User Assigned Managed Identity (incorrect for this question), which means that you first have to create it as\na stand-alone Azure resource by itself, after which it can be linked to multiple Azure Resources.\nBox 2: A Role Assignment.\nWhen using the Access Policy permission model, if a user has Contributor permissions to a key vault\nmanagement plane, the user can grant themselves access to the data plane by setting a Key Vault access\npolicy. You should tightly control who has Contributor role access to your key vaults with the Access Policy\npermission model to ensure that only authorized persons can access and manage your key vaults, keys,\nsecrets, and certificates. It is recommended to use the new Role Based Access Control (RBAC) permission\nmodel to avoid this issue. With the RBAC permission model, permission management is limited to 'Owner' and\n'User Access Administrator' roles, which allows separation of duties between roles for security operations and\ngeneral administrative operations.", "reference": "https://learn.microsoft.com/en-us/azure/key-vault/general/security-features?WT.mc_id=Portal-\nMicrosoft_Azure_KeyVault#access-model-overview", "references": [ "https://learn.microsoft.com/en-us/azure/key-vault/general/security-features?WT.mc_id=Portal-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 257, "pdfId": 266, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/266" }, "markersInGap": [ 265, 266 ], "questionText": "You need to recommend an App Service architecture that meets the requirements for App1. The solution must\nminimize costs.\nWhat should you recommend?\nA.\none App Service Environment (ASE) per availability zone\nB.\none App Service Environment (ASE) per region\nC.\none App Service plan per region\nD.\none App Service plan per availability zone", "stem": "You need to recommend an App Service architecture that meets the requirements for App1. The solution must minimize costs. What should you recommend", "options": [ { "key": "A", "text": "one App Service Environment (ASE) per availability zone" }, { "key": "B", "text": "one App Service Environment (ASE) per region" }, { "key": "C", "text": "one App Service plan per region" }, { "key": "D", "text": "one App Service plan per availability zone" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. one App Service plan per region.\nUsing one App Service plan per region minimizes costs while ensuring scalability and availability for App1. This\napproach allows you to share resources across multiple apps within the same region, reducing the need for\nadditional infrastructure and optimizing expenses.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 260, "pdfId": 267, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/267" }, "markersInGap": [], "questionText": "What should you include in the identity management strategy to support the planned changes?\nA.\nDeploy domain controllers for corp.fabrikam.com to virtual networks in Azure.\nB.\nMove all the domain controllers from corp.fabrikam.com to virtual networks in Azure.\nC.\nDeploy a new Azure AD tenant for the authentication of new R&D projects.\nD.\nDeploy domain controllers for the rd.fabrikam.com forest to virtual networks in Azure.", "stem": "What should you include in the identity management strategy to support the planned changes", "options": [ { "key": "A", "text": "Deploy domain controllers for corp.fabrikam.com to virtual networks in Azure." }, { "key": "B", "text": "Move all the domain controllers from corp.fabrikam.com to virtual networks in Azure." }, { "key": "C", "text": "Deploy a new Azure AD tenant for the authentication of new R&D projects." }, { "key": "D", "text": "Deploy domain controllers for the rd.fabrikam.com forest to virtual networks in Azure." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not be\naffected by a link failure between Azure and the on- premises network. (This requires domain controllers in\nAzure).\nUsers on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link fails.\n(This requires domain controllers on-premises).\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).\nThe litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that\ngrants the DataActions read permission to the blobs and files in Azure Storage.\nOn-Premises Environment -\nThe on-premises network of Litware contains the resources shown in the following table.\nNetwork Environment -\nLitware has ExpressRoute connectivity to Azure.\nPlanned Changes and Requirements\nPlanned Changes -\nLitware plans to implement the following changes:\nMigrate DB1 and DB2 to Azure.\nMigrate App1 to Azure virtual machines.\nMigrate the external storage used by App1 to Azure Storage.\nDeploy the Azure virtual machines that will host App1 to Azure dedicated hosts.\nAuthentication and Authorization Requirements\nLitware identifies the following authentication and authorization requirements:\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid Azure\nAD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).\nThe Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for\nall the virtual networks in all the Azure subscriptions.\nTo access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the\napp.\nRBAC roles must be applied to management groups.\nResiliency Requirements -\nLitware identifies the following resiliency requirements:\nOnce migrated to Azure, DB1 and DB2 must meet the following requirements:\n- Maintain availability if two availability zones in the local Azure region fail.\n- Fail over automatically.\n- Minimize I/O latency.\nApp1 must meet the following requirements:\n- Be hosted in an Azure region that supports availability zones.\n- Be hosted on Azure virtual machines that support automatic scaling.\n- Maintain availability if two availability zones in the local Azure region fail.\nSecurity and Compliance Requirements\nLitware identifies the following security and compliance requirements:\nOnce App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of\nnew and existing data is prevented for a period of three years.\nOn-premises users and services must be able to access the Azure Storage account that will host the data in App1.\nAccess to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.\nApp1 must NOT share physical hardware with other workloads.\nBusiness Requirements -\nLitware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\n\nQuestion", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 261, "pdfId": 268, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/268" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 3 -\nNeed three host groups to meet the third scenario requirement below.\nScenario: App1 must meet the following requirements:\nBe hosted in an Azure region that supports availability zones.\nBe hosted on Azure virtual machines that support automatic scaling.\nMaintain availability if two availability zones in the local Azure region fail.\nBox 2: 3 -\nThe availability setting of your host group should match your scale set.\n* The host group and the scale set must be using the same availability zone.\n* The fault domain count for the host group level should match the fault domain count for your scale set.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/dedicated-hosts\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).\nThe litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that\ngrants the DataActions read permission to the blobs and files in Azure Storage.\nOn-Premises Environment -\nThe on-premises network of Litware contains the resources shown in the following table.\nNetwork Environment -\nLitware has ExpressRoute connectivity to Azure.\nPlanned Changes and Requirements\nPlanned Changes -\nLitware plans to implement the following changes:\nMigrate DB1 and DB2 to Azure.\nMigrate App1 to Azure virtual machines.\nMigrate the external storage used by App1 to Azure Storage.\nDeploy the Azure virtual machines that will host App1 to Azure dedicated hosts.\nAuthentication and Authorization Requirements\nLitware identifies the following authentication and authorization requirements:\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid Azure\nAD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).\nThe Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for\nall the virtual networks in all the Azure subscriptions.\nTo access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the\napp.\nRBAC roles must be applied to management groups.\nResiliency Requirements -\nLitware identifies the following resiliency requirements:\nOnce migrated to Azure, DB1 and DB2 must meet the following requirements:\n- Maintain availability if two availability zones in the local Azure region fail.\n- Fail over automatically.\n- Minimize I/O latency.\nApp1 must meet the following requirements:\n- Be hosted in an Azure region that supports availability zones.\n- Be hosted on Azure virtual machines that support automatic scaling.\n- Maintain availability if two availability zones in the local Azure region fail.\nSecurity and Compliance Requirements\nLitware identifies the following security and compliance requirements:\nOnce App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of\nnew and existing data is prevented for a period of three years.\nOn-premises users and services must be able to access the Azure Storage account that will host the data in App1.\nAccess to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.\nApp1 must NOT share physical hardware with other workloads.\nBusiness Requirements -\nLitware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\n\nQuestion", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/dedicated-hosts" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 262, "pdfId": 269, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/269" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1:\nStandard general-purpose v2.\nStandard general-purpose v2 supports Blob Storage.\nAzure Storage provides data protection for Blob Storage and Azure Data Lake Storage Gen2.\nScenario:\nLitware identifies the following security and compliance requirements:\n✑\n Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the\nmodification of new and existing data is prevented for a period of three years.\n✑\n On-premises users and services must be able to access the Azure Storage account that will host the data in\nApp1.\n✑\n Access to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE)\nenabled.\n✑\n App1 must NOT share physical hardware with other workloads.\nBox 2:\nHierarchical namespace .\nScenario: Plan: Migrate App1 to Azure virtual machines.\nAzure Data Lake Storage Gen2 implements an access control model that supports both Azure role-based\naccess control (Azure RBAC) and POSIX-like access control lists (ACLs).\nData Lake Storage Gen2 and the Network File System (NFS) 3.0 protocol both require a storage account with\na hierarchical namespace enabled.", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/data-protection-overview\nhttps://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).\nThe litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that\ngrants the DataActions read permission to the blobs and files in Azure Storage.\nOn-Premises Environment -\nThe on-premises network of Litware contains the resources shown in the following table.\nNetwork Environment -\nLitware has ExpressRoute connectivity to Azure.\nPlanned Changes and Requirements\nPlanned Changes -\nLitware plans to implement the following changes:\nMigrate DB1 and DB2 to Azure.\nMigrate App1 to Azure virtual machines.\nMigrate the external storage used by App1 to Azure Storage.\nDeploy the Azure virtual machines that will host App1 to Azure dedicated hosts.\nAuthentication and Authorization Requirements\nLitware identifies the following authentication and authorization requirements:\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid Azure\nAD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).\nThe Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for\nall the virtual networks in all the Azure subscriptions.\nTo access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the\napp.\nRBAC roles must be applied to management groups.\nResiliency Requirements -\nLitware identifies the following resiliency requirements:\nOnce migrated to Azure, DB1 and DB2 must meet the following requirements:\n- Maintain availability if two availability zones in the local Azure region fail.\n- Fail over automatically.\n- Minimize I/O latency.\nApp1 must meet the following requirements:\n- Be hosted in an Azure region that supports availability zones.\n- Be hosted on Azure virtual machines that support automatic scaling.\n- Maintain availability if two availability zones in the local Azure region fail.\nSecurity and Compliance Requirements\nLitware identifies the following security and compliance requirements:\nOnce App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of\nnew and existing data is prevented for a period of three years.\nOn-premises users and services must be able to access the Azure Storage account that will host the data in App1.\nAccess to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.\nApp1 must NOT share physical hardware with other workloads.\nBusiness Requirements -\nLitware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\n\nQuestion\n You plan to migrate App1 to Azure.", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/data-protection-overview", "https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 263, "pdfId": 270, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/270" }, "markersInGap": [], "questionText": "You need to recommend a network connectivity solution for the Azure Storage account that will host the App1\ndata. The solution must meet the security and compliance requirements.\nWhat should you include in the recommendation?\nA.\nMicrosoft peering for an ExpressRoute circuit\nB.\nAzure public peering for an ExpressRoute circuit\nC.\na service endpoint that has a service endpoint policy\nD.\na private endpoint", "stem": "You need to recommend a network connectivity solution for the Azure Storage account that will host the App1 data. The solution must meet the security and compliance requirements. What should you include in the recommendation", "options": [ { "key": "A", "text": "Microsoft peering for an ExpressRoute circuit" }, { "key": "B", "text": "Azure public peering for an ExpressRoute circuit" }, { "key": "C", "text": "a service endpoint that has a service endpoint policy" }, { "key": "D", "text": "a private endpoint" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Private Endpoint securely connect to storage accounts from on-premises networks that connect to the VNet\nusing VPN or ExpressRoutes with private-peering.\nPrivate Endpoint also secure your storage account by configuring the storage firewall to block all connections\non the public endpoint for the storage service.\nIncorrect Answers:\nA: Microsoft peering provides access to Azure public services via public endpoints with public IP addresses,", "reference": "https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuit-peerings\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).\nThe litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that\ngrants the DataActions read permission to the blobs and files in Azure Storage.\nOn-Premises Environment -\nThe on-premises network of Litware contains the resources shown in the following table.\nNetwork Environment -\nLitware has ExpressRoute connectivity to Azure.\nPlanned Changes and Requirements\nPlanned Changes -\nLitware plans to implement the following changes:\nMigrate DB1 and DB2 to Azure.\nMigrate App1 to Azure virtual machines.\nMigrate the external storage used by App1 to Azure Storage.\nDeploy the Azure virtual machines that will host App1 to Azure dedicated hosts.\nAuthentication and Authorization Requirements\nLitware identifies the following authentication and authorization requirements:\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid Azure\nAD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).\nThe Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for\nall the virtual networks in all the Azure subscriptions.\nTo access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the\napp.\nRBAC roles must be applied to management groups.\nResiliency Requirements -\nLitware identifies the following resiliency requirements:\nOnce migrated to Azure, DB1 and DB2 must meet the following requirements:\n- Maintain availability if two availability zones in the local Azure region fail.\n- Fail over automatically.\n- Minimize I/O latency.\nApp1 must meet the following requirements:\n- Be hosted in an Azure region that supports availability zones.\n- Be hosted on Azure virtual machines that support automatic scaling.\n- Maintain availability if two availability zones in the local Azure region fail.\nSecurity and Compliance Requirements\nLitware identifies the following security and compliance requirements:\nOnce App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of\nnew and existing data is prevented for a period of three years.\nOn-premises users and services must be able to access the Azure Storage account that will host the data in App1.\nAccess to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.\nApp1 must NOT share physical hardware with other workloads.\nBusiness Requirements -\nLitware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\n\nQuestion\n You need to implement the Azure RBAC role assignments for the Network Contributor role. The\nsolution must meet the authentication and authorization requirements.", "references": [ "https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuit-peerings" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 264, "pdfId": 271, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/271" }, "markersInGap": [], "questionText": "What is the minimum number of assignments that you must use?\nA.\n1\nB.\n2\nC.\n5\nD.\n10\nE.\n15", "stem": "What is the minimum number of assignments that you must use", "options": [ { "key": "D", "text": "10" }, { "key": "E", "text": "15" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Scenario: The Network Contributor built-in RBAC role must be used to grant permissions to the network\nadministrators for all the virtual networks in all the Azure subscriptions.\nRBAC roles must be applied at the highest level possible.\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).\nThe litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that\ngrants the DataActions read permission to the blobs and files in Azure Storage.\nOn-Premises Environment -\nThe on-premises network of Litware contains the resources shown in the following table.\nNetwork Environment -\nLitware has ExpressRoute connectivity to Azure.\nPlanned Changes and Requirements\nPlanned Changes -\nLitware plans to implement the following changes:\nMigrate DB1 and DB2 to Azure.\nMigrate App1 to Azure virtual machines.\nMigrate the external storage used by App1 to Azure Storage.\nDeploy the Azure virtual machines that will host App1 to Azure dedicated hosts.\nAuthentication and Authorization Requirements\nLitware identifies the following authentication and authorization requirements:\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid Azure\nAD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).\nThe Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for\nall the virtual networks in all the Azure subscriptions.\nTo access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the\napp.\nRBAC roles must be applied to management groups.\nResiliency Requirements -\nLitware identifies the following resiliency requirements:\nOnce migrated to Azure, DB1 and DB2 must meet the following requirements:\n- Maintain availability if two availability zones in the local Azure region fail.\n- Fail over automatically.\n- Minimize I/O latency.\nApp1 must meet the following requirements:\n- Be hosted in an Azure region that supports availability zones.\n- Be hosted on Azure virtual machines that support automatic scaling.\n- Maintain availability if two availability zones in the local Azure region fail.\nSecurity and Compliance Requirements\nLitware identifies the following security and compliance requirements:\nOnce App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of\nnew and existing data is prevented for a period of three years.\nOn-premises users and services must be able to access the Azure Storage account that will host the data in App1.\nAccess to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.\nApp1 must NOT share physical hardware with other workloads.\nBusiness Requirements -\nLitware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\n\nQuestion", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 265, "pdfId": 272, "exam": "AZ-305", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/272" }, "markersInGap": [], "questionText": "You need to configure an Azure policy to ensure that the Azure SQL databases have Transparent Data Encryption\n(TDE) enabled. The solution must meet the security and compliance requirements.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.\nSelect and Place:", "stem": "You need to configure an Azure policy to ensure that the Azure SQL databases have Transparent Data Encryption (TDE) enabled. The solution must meet the security and compliance requirements. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Step 1: Create an Azure policy definition that uses the deployIfNotExists\nThe first step is to define the roles that deployIfNotExists and modify needs in the policy definition to\nsuccessfully deploy the content of your included template.\nStep 2: Create an Azure policy assignment\nWhen creating an assignment using the portal, Azure Policy both generates the managed identity and grants\nit the roles defined in roleDefinitionIds.\nStep 3: Invoke a remediation task.\nResources that are non-compliant to a deployIfNotExists or modify policy can be put into a compliant state\nthrough Remediation. Remediation is accomplished by instructing Azure Policy to run the deployIfNotExists\neffect or the modify operations of the assigned policy on your existing resources and subscriptions, whether\nthat assignment is to a management group, a subscription, a resource group, or an individual resource.\nDuring evaluation, the policy assignment with deployIfNotExists or modify effects determines if there are\nnon-compliant resources or subscriptions. When non- compliant resources or subscriptions are found, the\ndetails are provided on the Remediation page.", "reference": "https://docs.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources", "references": [ "https://docs.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 266, "pdfId": 273, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/273" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 1 -\nOne single Azure AD tenant is needed as only the Corp tenant is migrated.\nBox 2: 1 -\nBox 3: 2 -\nOne conditional access policy for Multi-Factor Authentication (MFA) will be used for administative access, and\na second conditional access policy in order to prevent external access.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-\nlocation https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-\naccess-policy-admin-mfa", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-", "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 268, "pdfId": 274, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/274" }, "markersInGap": [], "questionText": "You need to recommend a solution to meet the database retention requirements.\nWhat should you recommend?\nA.\nConfigure a long-term retention policy for the database.\nB.\nConfigure Azure Site Recovery.\nC.\nUse automatic Azure SQL Database backups.\nD.\nConfigure geo-replication of the database.", "stem": "You need to recommend a solution to meet the database retention requirements. What should you recommend", "options": [ { "key": "A", "text": "Configure a long-term retention policy for the database." }, { "key": "B", "text": "Configure Azure Site Recovery." }, { "key": "C", "text": "Use automatic Azure SQL Database backups." }, { "key": "D", "text": "Configure geo-replication of the database." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Scenario: Database backups must be retained for a minimum of seven years to meet compliance\nrequirements.\nMany applications have regulatory, compliance, or other business purposes that require you to retain\ndatabase backups beyond the 7-35 days provided by Azure\nSQL Database and Azure SQL Managed Instance automatic backups. By using the long-term retention (LTR)\nfeature, you can store specified SQL Database and\nSQL Managed Instance full backups in Azure Blob storage with configured redundancy for up to 10 years. LTR\nbackups can then be restored as a new database.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/database/long-term-retention-overview", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/database/long-term-retention-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 269, "pdfId": 275, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/275" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Requirements: Identity Requirements", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 267, "pdfId": 276, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/276" }, "markersInGap": [ 276 ], "questionText": "You need to recommend a notification solution for the IT Support distribution group.\nWhat should you include in the recommendation?\n A.\na SendGrid account with advanced reporting\nB.\nan action group\nC.\nAzure Network Watcher\nD.\nAzure AD Connect Health", "stem": "You need to recommend a notification solution for the IT Support distribution group. What should you include in the recommendation", "options": [ { "key": "A", "text": "a SendGrid account with advanced reporting" }, { "key": "B", "text": "an action group" }, { "key": "C", "text": "Azure Network Watcher" }, { "key": "D", "text": "Azure AD Connect Health" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "An email distribution group named IT Support must be notified of any issues relating to the directory\nsynchronization services.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-operations", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-operations" ], "note": "You can configure the Azure AD Connect Health service to send email notifications when alerts indicate\nthat your identity infrastructure is not healthy. his occurs when an alert is generated, and when it is resolved.\nReference:\nhttps://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-operations", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 270, "pdfId": 277, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/277" }, "markersInGap": [], "questionText": "What should you recommend to meet the monitoring requirements for App2?\nA.\nVM insights\nB.\nAzure Application Insights\nC.\nMicrosoft Sentinel\nD.\nContainer insights", "stem": "What should you recommend to meet the monitoring requirements for App2", "options": [ { "key": "A", "text": "VM insights" }, { "key": "B", "text": "Azure Application Insights" }, { "key": "C", "text": "Microsoft Sentinel" }, { "key": "D", "text": "Container insights" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Scenario: You need to monitor App2 to analyze how long it takes to perform different transactions within the\napplication. The solution must not require changes to the application code.\nUnified cross-component transaction diagnostics.\nThe unified diagnostics experience automatically correlates server-side telemetry from across all your\nApplication Insights monitored components into a single view. It doesn't matter if you have multiple resources.\nApplication Insights detects the underlying relationship and allows you to easily diagnose the application\ncomponent, dependency, or exception that caused a transaction slowdown or failure.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/app/transaction-diagnostics", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/app/transaction-diagnostics" ], "note": "Components are independently deployable parts of your distributed/microservices application.\nDevelopers and operations teams have code-level visibility or access to telemetry generated by these\napplication components.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/app/transaction-diagnostics", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 271, "pdfId": 278, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/278" }, "markersInGap": [], "questionText": "You need to recommend a data storage strategy for WebApp1.\nWhat should you include in the recommendation?\nA.\nan Azure virtual machine that runs SQL Server\nB.\na fixed-size DTU Azure SQL database\nC.\nan Azure SQL Database elastic pool\nD.\na vCore-based Azure SQL database", "stem": "You need to recommend a data storage strategy for WebApp1. What should you include in the recommendation", "options": [ { "key": "A", "text": "an Azure virtual machine that runs SQL Server" }, { "key": "B", "text": "a fixed-size DTU Azure SQL database" }, { "key": "C", "text": "an Azure SQL Database elastic pool" }, { "key": "D", "text": "a vCore-based Azure SQL database" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "The use of WebApp1 is unpredictable. At peak times, users often report delays. At other times, many\nresources for WebApp1 are underutilized.\nDatabase metrics for the production instance of WebApp1 must be available for analysis so that database\nadministrators can optimize the performance settings.", "reference": "https://docs.microsoft.com/en-us/azure/azure-sql/database/service-tiers-sql-database-vcore", "references": [ "https://docs.microsoft.com/en-us/azure/azure-sql/database/service-tiers-sql-database-vcore" ], "note": "A virtual core (vCore) represents a logical CPU and offers you the option to choose between generations\nof hardware and the physical characteristics of the hardware (for example, the number of cores, the memory,\nand the storage size). The vCore-based purchasing model gives you flexibility, control, transparency of\nindividual resource consumption, and a straightforward way to translate on-premises workload requirements\nto the cloud. This model optimizes price, and allows you to choose compute, memory, and storage resources\nbased on your workload needs.\nIncorrect:\nNot C: Azure SQL Database elastic pools are a simple, cost-effective solution for managing and scaling\nmultiple databases, not for a single database.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-sql/database/service-tiers-sql-database-vcore", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 274, "pdfId": 279, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/279" }, "markersInGap": [], "questionText": "You need to implement the Azure RBAC role assignments for the Network Contributor role. The solution must meet\nthe authentication and authorization requirements.\nWhat is the minimum number of assignments that you must use?\nA.\n1\nB.\n2\nC.\n5\nD.\n10\nE.\n15", "stem": "You need to implement the Azure RBAC role assignments for the Network Contributor role. The solution must meet the authentication and authorization requirements. What is the minimum number of assignments that you must use", "options": [ { "key": "D", "text": "10" }, { "key": "E", "text": "15" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "There are 2 tenants (10 + 5 subscriptions), so I think we need to do it on both (at tenant root group level).", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 273, "pdfId": 280, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/280" }, "markersInGap": [], "questionText": "You need to recommend a network connectivity solution for the Azure Storage account that will host the App1\ndata. The solution must meet the security and compliance requirements.\nWhat should you include in the recommendation?\nA.\nMicrosoft peering for an ExpressRoute circuit\nB.\nAzure public peering for an ExpressRoute circuit\nC.\na service endpoint that has a service endpoint policy\nD.\na private endpoint", "stem": "You need to recommend a network connectivity solution for the Azure Storage account that will host the App1 data. The solution must meet the security and compliance requirements. What should you include in the recommendation", "options": [ { "key": "A", "text": "Microsoft peering for an ExpressRoute circuit" }, { "key": "B", "text": "Azure public peering for an ExpressRoute circuit" }, { "key": "C", "text": "a service endpoint that has a service endpoint policy" }, { "key": "D", "text": "a private endpoint" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Private Endpoint securely connect to storage accounts from on-premises networks that connect to the VNet\nusing VPN or ExpressRoutes with private-peering.\nPrivate Endpoint also secure your storage account by configuring the storage firewall to block all connections\non the public endpoint for the storage service.\nIncorrect Answers:\nA: Microsoft peering provides access to Azure public services via public endpoints with public IP addresses,", "reference": "https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuit-peerings", "references": [ "https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuit-peerings" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 272, "pdfId": 281, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/281" }, "markersInGap": [ 280, 281 ], "questionText": "HOTSPOT -\nYou plan to migrate DB1 and DB2 to Azure.\nYou need to ensure that the Azure database and the service tier meet the resiliency and business requirements.\nWhat should you configure? To answer, select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You plan to migrate DB1 and DB2 to Azure. You need to ensure that the Azure database and the service tier meet the resiliency and business requirements. What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: An Azure SQL Database elastic pool\nScenario:\n* Resiliency Requirements. Once migrated to Azure, DB1 and DB2 must meet the following requirements:\nMaintain availability if two availability zones in the local Azure region fail.\nFail over automatically.\nMinimize I/O latency.\n* Litware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\nBox 2: Business Critical\nYou plan to migrate App1 to Azure.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 275, "pdfId": 282, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/282" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Azure Files -\nScenario: App2 has the following file storage requirements:\n✑\n Save files to an Azure Storage account.\n✑\n Replicate files to an on-premises location.\n✑\n Ensure that on-premises clients can read the files over the LAN by using the SMB protocol.\nBox 2: Azure File Sync -\nUse Azure File Sync to centralize your organization's file shares in Azure Files, while keeping the flexibility,\nperformance, and compatibility of an on-premises file server. Azure File Sync transforms Windows Server into\na quick cache of your Azure file share. You can use any protocol that's available on Windows Server to access\nyour data locally, including SMB, NFS, and FTPS. You can have as many caches as you need across the world.", "reference": "https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide", "references": [ "https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 276, "pdfId": 283, "exam": "AZ-305", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/283" }, "markersInGap": [], "questionText": "You need to recommend a solution that meets the data requirements for App1.\nWhat should you recommend deploying to each availability zone that contains an instance of App1?\nA.\nan Azure Cosmos DB that uses multi-region writes\nB.\nan Azure Data Lake store that uses geo-zone-redundant storage (GZRS)\nC.\nan Azure Storage account that uses geo-zone-redundant storage (GZRS)", "stem": "You need to recommend a solution that meets the data requirements for App1. What should you recommend deploying to each availability zone that contains an instance of App1", "options": [ { "key": "A", "text": "an Azure Cosmos DB that uses multi-region writes" }, { "key": "B", "text": "an Azure Data Lake store that uses geo-zone-redundant storage (GZRS)" }, { "key": "C", "text": "an Azure Storage account that uses geo-zone-redundant storage (GZRS)" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Scenario: App1 has the following data requirements:\n✑\n Each instance will write data to a data store in the same availability zone as the instance.\n✑\n Data written by any App1 instance must be visible to all App1 instances.\nAzure Cosmos DB: Each partition across all the regions is replicated. Each region contains all the data\npartitions of an Azure Cosmos container and can serve reads as well as serve writes when multi-region writes\nis enabled.\nIncorrect Answers:\nB, D: GZRS protects against failures. Geo-redundant storage (with GRS or GZRS) replicates your data to\nanother physical location in the secondary region to protect against regional outages. However, that data is\navailable to be read only if the customer or Microsoft initiates a failover from the primary to secondary region.\nC: Active geo-replication is designed as a business continuity solution that lets you perform quick disaster\nrecovery of individual databases in case of a regional disaster or a large scale outage. Once geo-replication is\nset up, you can initiate a geo-failover to a geo-secondary in a different Azure region. The geo-failover is\ninitiated programmatically by the application or manually by the user.", "reference": "https://docs.microsoft.com/en-us/azure/cosmos-db/high-availability", "references": [ "https://docs.microsoft.com/en-us/azure/cosmos-db/high-availability" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 277, "pdfId": 284, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/284" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1:\n 1 -\nApp1 will only be accessible from the internet. App1 has the following connection requirements:\n¢ Connections to App1 must be active-active load balanced between instances.\n¢ All connections to App1 from North America must be directed to the East US region. All other connections\nmust be directed to the West Europe region.\nApp1 will have six instances: three in the East US Azure region and three in the West Europe Azure region.", "reference": "https://docs.microsoft.com/en-us/azure/architecture/high-availability/reference-architecture-traffic-\nmanager-application-gateway\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).\nThe litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that\ngrants the DataActions read permission to the blobs and files in Azure Storage.\nOn-Premises Environment -\nThe on-premises network of Litware contains the resources shown in the following table.\nNetwork Environment -\nLitware has ExpressRoute connectivity to Azure.\nPlanned Changes and Requirements\nPlanned Changes -\nLitware plans to implement the following changes:\nMigrate DB1 and DB2 to Azure.\nMigrate App1 to Azure virtual machines.\nMigrate the external storage used by App1 to Azure Storage.\nDeploy the Azure virtual machines that will host App1 to Azure dedicated hosts.\nAuthentication and Authorization Requirements\nLitware identifies the following authentication and authorization requirements:\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid Azure\nAD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).\nThe Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for\nall the virtual networks in all the Azure subscriptions.\nTo access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the\napp.\nRBAC roles must be applied to management groups.\nResiliency Requirements -\nLitware identifies the following resiliency requirements:\nOnce migrated to Azure, DB1 and DB2 must meet the following requirements:\n- Maintain availability if two availability zones in the local Azure region fail.\n- Fail over automatically.\n- Minimize I/O latency.\nApp1 must meet the following requirements:\n- Be hosted in an Azure region that supports availability zones.\n- Be hosted on Azure virtual machines that support automatic scaling.\n- Maintain availability if two availability zones in the local Azure region fail.\nSecurity and Compliance Requirements\nLitware identifies the following security and compliance requirements:\nOnce App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of\nnew and existing data is prevented for a period of three years.\nOn-premises users and services must be able to access the Azure Storage account that will host the data in App1.\nAccess to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.\nApp1 must NOT share physical hardware with other workloads.\nBusiness Requirements -\nLitware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\n\nQuestion", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/high-availability/reference-architecture-traffic-" ], "note": "Azure Traffic Manager is a DNS-based traffic load balancer. This service allows you to distribute traffic\nto your public facing applications across the global\nAzure regions.\nBox 2:\n 2 -\nFor production workloads, run at least two gateway instances.\nA single Application Gateway deployment can run multiple instances of the gateway.\nUse one Application Gateway in East US Region, and one in the West Europe region.\nReference:\nhttps://docs.microsoft.com/en-us/azure/architecture/high-availability/reference-architecture-traffic-\nmanager-application-gateway\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 278, "pdfId": 285, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/285" }, "markersInGap": [], "questionText": "How should the migrated databases DB1 and DB2 be implemented in Azure?\nHot Area:", "stem": "How should the migrated databases DB1 and DB2 be implemented in Azure? Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: An Azure SOL Database elastic pool.\nMulti DB so not Azure SQL and as per below not SQL MI either.\nBox 2: Business critical -\nSQL Managed Instance is available in two service tiers:\nGeneral purpose: Designed for applications with typical performance and I/O latency requirements.\nBusiness critical: Designed for applications with low I/O latency requirements and minimal impact of\nunderlying maintenance operations on the workload.", "reference": "https://learn.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-\npowershell\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nFabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main office in\nLondon and three branch offices in Amsterdam,\nBerlin, and Rome.\nExisting Environment: Active Directory Environment\nThe network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com. There are no\ntrust relationships between the forests.\nCorp.fabrikam.com is a production forest that contains identities used for internal user and computer\nauthentication.\nRd.fabrikam.com is used by the research and development (R&D) department only. The R&D department is\nrestricted to using on-premises resources only.\nExisting Environment: Network Infrastructure", "references": [ "https://learn.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 279, "pdfId": 286, "exam": "AZ-305", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/286" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes -\nAny new deployments to Azure must be redundant in case an Azure region fails.\nTraffic Manager is resilient to failure, including the failure of an entire Azure region.\nBox 2: Yes\nSure traffic manager doesn't offer auto-scaling but Azure web app does offer Auto-scaling.\nBox 3: No -\nAutomatic failover using Azure Traffic Manager: when you have complex architectures and multiple sets of\nresources capable of performing the same function, you can configure Azure Traffic Manager (based on DNS)\nto check the health of your resources and route the traffic from the non-healthy resource to the healthy\nresource.", "reference": "https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-get-started\n\nThank you\nThank you for being so interested in the premium exam material.\nI'm glad to hear that you found it informative and helpful.", "references": [ "https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-get-started" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 286, "pdfId": 287, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/287" }, "markersInGap": [], "questionText": "requirements for App1.\nWhat is the minimum numbers of instances required for each service? To answer, select the appropriate options in\nthe answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:\nAnswer:\nExplanation:\nBox 1:\n 1 -\nApp1 will only be accessible from the internet. App1 has the following connection requirements:\n¢ Connections to App1 must be active-active load balanced between instances.\n¢ All connections to App1 from North America must be directed to the East US region. All other connections\nmust be directed to the West Europe region.\nApp1 will have six instances: three in the East US Azure region and three in the West Europe Azure region.\nNote: Azure Traffic Manager is a DNS-based traffic load balancer. This service allows you to distribute traffic\nto your public facing applications across the global\nAzure regions.\nBox 2:\n 2 -\nFor production workloads, run at least two gateway instances.\nA single Application Gateway deployment can run multiple instances of the gateway.\nUse one Application Gateway in East US Region, and one in the West Europe region.\nReference:\nhttps://docs.microsoft.com/en-us/azure/architecture/high-availability/reference-architecture-traffic-\nmanager-application-gateway\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).\nThe litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that\ngrants the DataActions read permission to the blobs and files in Azure Storage.\nOn-Premises Environment -\nThe on-premises network of Litware contains the resources shown in the following table.\nNetwork Environment -\nLitware has ExpressRoute connectivity to Azure.\nPlanned Changes and Requirements\nPlanned Changes -\nLitware plans to implement the following changes:\nMigrate DB1 and DB2 to Azure.\nMigrate App1 to Azure virtual machines.\nMigrate the external storage used by App1 to Azure Storage.\nDeploy the Azure virtual machines that will host App1 to Azure dedicated hosts.\nAuthentication and Authorization Requirements\nLitware identifies the following authentication and authorization requirements:\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid Azure\nAD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).\nThe Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for\nall the virtual networks in all the Azure subscriptions.\nTo access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the\napp.\nRBAC roles must be applied to management groups.\nResiliency Requirements -\nLitware identifies the following resiliency requirements:\nOnce migrated to Azure, DB1 and DB2 must meet the following requirements:\n- Maintain availability if two availability zones in the local Azure region fail.\n- Fail over automatically.\n- Minimize I/O latency.\nApp1 must meet the following requirements:\n- Be hosted in an Azure region that supports availability zones.\n- Be hosted on Azure virtual machines that support automatic scaling.\n- Maintain availability if two availability zones in the local Azure region fail.\nSecurity and Compliance Requirements\nLitware identifies the following security and compliance requirements:\nOnce App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of\nnew and existing data is prevented for a period of three years.\nOn-premises users and services must be able to access the Azure Storage account that will host the data in App1.\nAccess to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.\nApp1 must NOT share physical hardware with other workloads.\nBusiness Requirements -\nLitware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\n\nQuestion\n HOTSPOT -\nHow should the migrated databases DB1 and DB2 be implemented in Azure?\nHot Area:\nAnswer:\n\nExplanation:\nBox 1: An Azure SOL Database elastic pool.\nMulti DB so not Azure SQL and as per below not SQL MI either.\nBox 2: Business critical -\nSQL Managed Instance is available in two service tiers:\nGeneral purpose: Designed for applications with typical performance and I/O latency requirements.\nBusiness critical: Designed for applications with low I/O latency requirements and minimal impact of\nunderlying maintenance operations on the workload.\nReference:\nhttps://learn.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-\npowershell\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nFabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main office in\nLondon and three branch offices in Amsterdam,\nBerlin, and Rome.\nExisting Environment: Active Directory Environment\nThe network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com. There are no\ntrust relationships between the forests.\nCorp.fabrikam.com is a production forest that contains identities used for internal user and computer\nauthentication.\nRd.fabrikam.com is used by the research and development (R&D) department only. The R&D department is\nrestricted to using on-premises resources only.\nExisting Environment: Network Infrastructure\nEach office contains at least one domain controller from the corp.fabrikam.com domain. The main office contains\nall the domain controllers for the rd.fabrikam.com forest.\nAll the offices have a high-speed connection to the internet.\nAn existing application named WebApp1 is hosted in the data center of the London office. WebApp1 is used by\ncustomers to place and track orders. WebApp1 has a web tier that uses Microsoft Internet Information Services\n(IIS) and a database tier that runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to\nvirtual machines that run on Hyper-V.\nThe IT department currently uses a separate Hyper-V environment to test updates to WebApp1.\nFabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software\nAssurance.", "stem": "requirements for App1. What is the minimum numbers of instances required for each service? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1:\n 1 -\nApp1 will only be accessible from the internet. App1 has the following connection requirements:\n¢ Connections to App1 must be active-active load balanced between instances.\n¢ All connections to App1 from North America must be directed to the East US region. All other connections\nmust be directed to the West Europe region.\nApp1 will have six instances: three in the East US Azure region and three in the West Europe Azure region.", "reference": "https://docs.microsoft.com/en-us/azure/architecture/high-availability/reference-architecture-traffic-\nmanager-application-gateway\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).\nThe litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that\ngrants the DataActions read permission to the blobs and files in Azure Storage.\nOn-Premises Environment -\nThe on-premises network of Litware contains the resources shown in the following table.\nNetwork Environment -\nLitware has ExpressRoute connectivity to Azure.\nPlanned Changes and Requirements\nPlanned Changes -\nLitware plans to implement the following changes:\nMigrate DB1 and DB2 to Azure.\nMigrate App1 to Azure virtual machines.\nMigrate the external storage used by App1 to Azure Storage.\nDeploy the Azure virtual machines that will host App1 to Azure dedicated hosts.\nAuthentication and Authorization Requirements\nLitware identifies the following authentication and authorization requirements:\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid Azure\nAD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).\nThe Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for\nall the virtual networks in all the Azure subscriptions.\nTo access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the\napp.\nRBAC roles must be applied to management groups.\nResiliency Requirements -\nLitware identifies the following resiliency requirements:\nOnce migrated to Azure, DB1 and DB2 must meet the following requirements:\n- Maintain availability if two availability zones in the local Azure region fail.\n- Fail over automatically.\n- Minimize I/O latency.\nApp1 must meet the following requirements:\n- Be hosted in an Azure region that supports availability zones.\n- Be hosted on Azure virtual machines that support automatic scaling.\n- Maintain availability if two availability zones in the local Azure region fail.\nSecurity and Compliance Requirements\nLitware identifies the following security and compliance requirements:\nOnce App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of\nnew and existing data is prevented for a period of three years.\nOn-premises users and services must be able to access the Azure Storage account that will host the data in App1.\nAccess to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.\nApp1 must NOT share physical hardware with other workloads.\nBusiness Requirements -\nLitware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\n\nQuestion", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/high-availability/reference-architecture-traffic-" ], "note": "Azure Traffic Manager is a DNS-based traffic load balancer. This service allows you to distribute traffic\nto your public facing applications across the global\nAzure regions.\nBox 2:\n 2 -\nFor production workloads, run at least two gateway instances.\nA single Application Gateway deployment can run multiple instances of the gateway.\nUse one Application Gateway in East US Region, and one in the West Europe region.\nReference:\nhttps://docs.microsoft.com/en-us/azure/architecture/high-availability/reference-architecture-traffic-\nmanager-application-gateway\nIntroductory Info\n Case Study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nLitware, Inc. is a medium-sized finance company that has a main office in Boston.\nExisting Environment -\nIdentity Environment -\nThe network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory\n(Azure AD) tenant named litware.com. All users have Azure Active Directory Premium P2 licenses.\nLitware has a second Azure AD tenant named dev.litware.com that is used as a development environment.\nThe litware.com tenant has a Conditional Access policy named Capolicy1. Capolicy1 requires that when users\nmanage the Azure subscription for a production environment by using the Azure portal, they must connect from a\nhybrid Azure AD-joined device.\nAzure Environment -\nLitware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are\nlinked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).\nThe litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that\ngrants the DataActions read permission to the blobs and files in Azure Storage.\nOn-Premises Environment -\nThe on-premises network of Litware contains the resources shown in the following table.\nNetwork Environment -\nLitware has ExpressRoute connectivity to Azure.\nPlanned Changes and Requirements\nPlanned Changes -\nLitware plans to implement the following changes:\nMigrate DB1 and DB2 to Azure.\nMigrate App1 to Azure virtual machines.\nMigrate the external storage used by App1 to Azure Storage.\nDeploy the Azure virtual machines that will host App1 to Azure dedicated hosts.\nAuthentication and Authorization Requirements\nLitware identifies the following authentication and authorization requirements:\nOnly users that manage the production environment by using the Azure portal must connect from a hybrid Azure\nAD-joined device and authenticate by using\nAzure Multi-Factor Authentication (MFA).\nThe Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for\nall the virtual networks in all the Azure subscriptions.\nTo access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the\napp.\nRBAC roles must be applied to management groups.\nResiliency Requirements -\nLitware identifies the following resiliency requirements:\nOnce migrated to Azure, DB1 and DB2 must meet the following requirements:\n- Maintain availability if two availability zones in the local Azure region fail.\n- Fail over automatically.\n- Minimize I/O latency.\nApp1 must meet the following requirements:\n- Be hosted in an Azure region that supports availability zones.\n- Be hosted on Azure virtual machines that support automatic scaling.\n- Maintain availability if two availability zones in the local Azure region fail.\nSecurity and Compliance Requirements\nLitware identifies the following security and compliance requirements:\nOnce App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of\nnew and existing data is prevented for a period of three years.\nOn-premises users and services must be able to access the Azure Storage account that will host the data in App1.\nAccess to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.\nAll Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled.\nApp1 must NOT share physical hardware with other workloads.\nBusiness Requirements -\nLitware identifies the following business requirements:\nMinimize administrative effort.\nMinimize costs.\n\nQuestion", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false, "recoveredFromMarkerSplit": true } }, { "seq": 287, "pdfId": 288, "exam": "AZ-305", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-305/288" }, "markersInGap": [], "questionText": ".\nExisting Environment: Problem Statements\nThe use of WebApp1 is unpredictable. At peak times, users often report delays. At other times, many resources for\nWebApp1 are underutilized.\nRequirements: Planned Changes -\nFabrikam plans to move most of its production workloads to Azure during the next few years, including virtual\nmachines that rely on Active Directory for authentication.\nAs one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming\nMicrosoft 365 deployment.\nAll R&D operations will remain on-premises.\nFabrikam plans to migrate the production and test instances of WebApp1 to Azure.\nRequirements: Technical Requirements\nFabrikam identifies the following technical requirements:\nWebsite content must be easily updated from a single point.\nUser input must be minimized when provisioning new web app instances.\nWhenever possible, existing on-premises licenses must be used to reduce cost.\nUsers must always authenticate by using their corp.fabrikam.com UPN identity.\nAny new deployments to Azure must be redundant in case an Azure region fails.\nWhenever possible, solutions must be deployed to Azure by using the Standard pricing tier of Azure App Service.\nAn email distribution group named IT Support must be notified of any issues relating to the directory\nsynchronization services.\nIn the event that a link fails between Azure and the on-premises network, ensure that the virtual machines hosted\nin Azure can authenticate to Active Directory.\nDirectory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not be affected\nby a link failure between Azure and the on- premises network.\nRequirements: Database Requirements\nFabrikam identifies the following database requirements:\nDatabase metrics for the production instance of WebApp1 must be available for analysis so that database\nadministrators can optimize the performance settings.\nTo avoid disrupting customer access, database downtime must be minimized when databases are migrated.\nDatabase backups must be retained for a minimum of seven years to meet compliance requirements.\nRequirements: Security Requirements\nFabrikam identifies the following security requirements:\nCompany information including policies, templates, and data must be inaccessible to anyone outside the company.\nUsers on the on-premises network must be able to authenticate to corp.fabrikam.com if an internet link fails.\nAdministrators must be able authenticate to the Azure portal by using their corp.fabrikam.com credentials.\nAll administrative access to the Azure portal must be secured by using multi-factor authentication (MFA).\nThe testing of WebApp1 updates must not be visible to anyone outside the company.\nQuestion\n HOTSPOT -\nYou design a solution for the web tier of WebApp1 as shown in the exhibit.\nFor each of the following statements, select Yes if the statement is true. Otherwise, select No.\nNOTE: Each correct selection is worth one point.\nHot Area:\nAnswer:\nExplanation:\nBox 1: Yes -\nAny new deployments to Azure must be redundant in case an Azure region fails.\nTraffic Manager is resilient to failure, including the failure of an entire Azure region.\nBox 2: Yes\nSure traffic manager doesn't offer auto-scaling but Azure web app does offer Auto-scaling.\nBox 3: No -\nAutomatic failover using Azure Traffic Manager: when you have complex architectures and multiple sets of\nresources capable of performing the same function, you can configure Azure Traffic Manager (based on DNS)\nto check the health of your resources and route the traffic from the non-healthy resource to the healthy\nresource.\nReference:\nhttps://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-get-started\n\nThank you\nThank you for being so interested in the premium exam material.\nI'm glad to hear that you found it informative and helpful.\n\nIf you have any feedback or thoughts on the bumps, I would love to hear them.\nYour insights can help me improve our writing and better understand our readers.\nBest of Luck\nYou have worked hard to get to this point, and you are well-prepared for the exam\nKeep your head up, stay positive, and go show that exam what you're made of!\n\nTotal:\n288 Questions\nLink:\nhttps://.com/papers/microsoft/az-305\n\n Feedback\nMore Papers", "stem": ". Existing Environment: Problem Statements The use of WebApp1 is unpredictable. At peak times, users often report delays. At other times, many resources for WebApp1 are underutilized. Requirements: Planned Changes - Fabrikam plans to move most of its production workloads to Azure during the next few years, including virtual machines that rely on Active Directory for authentication. As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming Microsoft 365 deployment. All R&D operations will remain on-premises. Fabrikam plans to migrate the production and test instances of WebApp1 to Azure. Requirements: Technical Requirements Fabrikam identifies the following technical requirements: Website content must be easily updated from a single point. User input must be minimized when provisioning new web app instances. Whenever possible, existing on-premises licenses must be used to reduce cost. Users must always authenticate by using their corp.fabrikam.com UPN identity. Any new deployments to Azure must be redundant in case an Azure region fails. Whenever possible, solutions must be deployed to Azure by using the Standard pricing tier of Azure App Service. An email distribution group named IT Support must be notified of any issues relating to the directory synchronization services. In the event that a link fails between Azure and the on-premises network, ensure that the virtual machines hosted in Azure can authenticate to Active Directory. Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not be affected by a link failure between Azure and the on- premises network. Requirements: Database Requirements Fabrikam identifies the following database requirements: Database metrics for the production instance of WebApp1 must be available for analysis so that database administrators can optimize the performance settings. To avoid disrupting customer access, database downtime must be minimized when databases are migrated. Database backups must be retained for a minimum of seven years to meet compliance requirements. Requirements: Security Requirements Fabrikam identifies the following security requirements: Company information including policies, templates, and data must be inaccessible to anyone outside the company. Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an internet link fails. Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com credentials. All administrative access to the Azure portal must be secured by using multi-factor authentication (MFA). The testing of WebApp1 updates must not be visible to anyone outside the company. Question HOTSPOT - You design a solution for the web tier of WebApp1 as shown in the exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes -\nAny new deployments to Azure must be redundant in case an Azure region fails.\nTraffic Manager is resilient to failure, including the failure of an entire Azure region.\nBox 2: Yes\nSure traffic manager doesn't offer auto-scaling but Azure web app does offer Auto-scaling.\nBox 3: No -\nAutomatic failover using Azure Traffic Manager: when you have complex architectures and multiple sets of\nresources capable of performing the same function, you can configure Azure Traffic Manager (based on DNS)\nto check the health of your resources and route the traffic from the non-healthy resource to the healthy\nresource.", "reference": "https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-get-started\n\nThank you\nThank you for being so interested in the premium exam material.\nI'm glad to hear that you found it informative and helpful.", "references": [ "https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-get-started" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false, "recoveredFromMarkerSplit": true } } ]