Microsoft AZ-305 Exam Practice Test Instant Access

Question 1

You plan to deploy an application named App1 that will run on five Azure virtual machines. Additional virtual machines will be deployed later to run App1.

You need to recommend a solution to meet the following requirements for the virtual machines that will run App1:

Ensure that the virtual machines can authenticate to Azure Active Directory (Azure AD) to gain access to

an Azure key vault, Azure Logic Apps instances, and an Azure SQL database.

Avoid assigning new roles and permissions for Azure services when you deploy additional virtual machines.

Avoid storing secrets and certificates on the virtual machines.

Which type of identity should you include in the recommendation?

Aa service principal that is configured to use a certificate

Ba system-assigned managed identity

Ca service principal that is configured to use a client secret

Da user-assigned managed identity

Answer : D

Managed identities for Azure resources is a feature of Azure Active Directory.

User-assigned managed identity can be shared. The same user-assigned managed identity can be associated with more than one Azure resource.

Incorrect Answers:

B: System-assigned managed identity cannot be shared. It can only be associated with a single Azure resource.

https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

Question 2

You are designing an Azure solution.

The network traffic for the solution must be securely distributed by providing the following features:

HTTPS protocol

Round robin routing

SSL offloading

You need to recommend a load balancing option.

What should you recommend?

AAzure Load Balancer

BAzure Traffic Manager

CAzure Internal Load Balancer (ILB)

DAzure Application Gateway

Answer : D

If you are looking for Transport Layer Security (TLS) protocol termination ('SSL offload') or per-HTTP/HTTPS

request, application-layer processing, review Application Gateway.

Application Gateway is a layer 7 load balancer, which means it works only with web traffic (HTTP, HTTPS, WebSocket, and HTTP/2). It supports capabilities such as SSL termination, cookie-based session affinity, and round robin for load-balancing traffic. Load Balancer load-balances traffic at layer 4 (TCP or UDP).

https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq

Question 3

You need to design a highly available Azure SQL database that meets the following requirements:

* Failover between replicas of the database must occur without any data loss.

* The database must remain available in the event of a zone outage.

* Costs must be minimized.

Which deployment option should you use?

AAzure SQL Database Business Critical

BAzure SQL Database Managed Instance Business Critical

CAzure SQL Database Serverless

DAzure SQL Database Premium

Answer : D

General Purpose / Standard prevents data loss through high available storage https://docs.microsoft.com/en-us/azure/azure-sql/database/service-tier-general-purpose?view=azuresql. This architectural model relies on high availability and reliability of Azure Blob storage that transparently replicates database files and guarantees no data loss if underlying infrastructure failure happens. General Purpose / Standard support Zone Redundancy For General Purpose tier the zone-redundant configuration is Generally Available in the following regions: https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla?view=azuresql&tabs=azure-powershell Without any information regarding the usage pattern, serverless is possible. Other option is D https://docs.microsoft.com/en-us/azure/azure-sql/database/serverless-tier-overview?view=azuresql

Question 4

Your company, named Contoso, Ltd, implements several Azure logic apps that have HTTP triggers: The logic apps provide access to an on-premises web service.

Contoso establishes a partnership with another company named Fabrikam, Inc.

Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0 identity management to authenticate its users.

Developers at Fabrikam plan to use a subset of the logics apps to build applications that will integrate with the on-premises web service of Contoso.

You need to design a solution to provide the Fabrikam developers with access to the logic apps. The solution must meet the following requirements:

Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso.

The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps.

The solution must NOT require changes to the logic apps.

The solution must NOT use Azure AD guest accounts.

What should you include in the solution?

AAzure AD business-to-business (B2B)

BAzure Front Door

CAzure API Management

DAzure AD Application Proxy

Answer : C

API Management helps organizations publish APIs to external, partner, and internal developers to unlock the potential of their data and services.

You can secure API Management using the OAuth 2.0 client credentials flow.

https://docs.microsoft.com/en-us/azure/api-management/api-management-key-concepts

https://docs.microsoft.com/en-us/azure/api-management/api-management-features

https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-protect-backend-with-aad#enable-oauth-20-user-authorization-in-the-developer-console

Question 5

The developers at your company are building a containerized Python Django app.

You need to recommend platform to host the app. The solution must meet the following requirements:

Support autoscaling.

Support continuous deployment from an Azure Container Registry.

Provide built-in functionality to authenticate app users by using Azure Active Directory (Azure AD).

Which platform should you include in the recommendation?

AAzure Container instances

Ban Azure App Service instance that uses containers

CAzure Kubernetes Service (AKS)

Answer : C

To keep up with application demands in Azure Kubernetes Service (AKS), you may need to adjust the number of nodes that run your workloads. The cluster autoscaler component can watch for pods in your cluster that can't be scheduled because of resource constraints. When issues are detected, the number of nodes in a node pool is increased to meet the application demand.

Azure Container Registry is a private registry for hosting container images. It integrates well with orchestrators like Azure Container Service, including Docker Swarm, DC/OS, and the new Azure Kubernetes service.

Moreover, ACR provides capabilities such as Azure Active Directory-based authentication, webhook support, and delete operations.

https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler

https://medium.com/velotio-perspectives/continuous-deployment-with-azure-kubernetes-service-azurecontainer-

registry-jenkins-ca337940151b

Question 6

You are designing a microservices architecture that will be hosted in an Azure Kubernetes Service (AKS) cluster. Apps that will consume the microservices will be hosted on Azure virtual machines. The virtual machines and the AKS cluster will reside on the same virtual network.

You need to design a solution to expose the microservices to the consumer apps. The solution must meet the following requirements:

* Ingress access to the microservices must be restricted to a single private IP address and protected by using mutual TLS authentication.

* The number of incoming microservice calls must be rate-limited.

* Costs must be minimized.

What should you include in the solution?

AAzure API Management Premium tier with virtual network connection

BAzure Front Door with Azure Web Application Firewall (WAF)

CAzure API Management Standard tier with a service endpoint

DAzure App Gateway with Azure Web Application Firewall (WAF)

Answer : A

One option is to deploy APIM (API Management) inside the cluster VNet.

The AKS cluster and the applications that consume the microservices might reside within the same VNet, hence there is no reason to expose the cluster publicly as all API traffic will remain within the VNet. For these scenarios, you can deploy API Management into the cluster VNet. API Management Premium tier supports VNet deployment.

https://docs.microsoft.com/en-us/azure/api-management/api-management-kubernetes

Question 7

You migrate App1 to Azure. You need to ensure that the data storage for App1 meets the security and compliance requirement

What should you do?

ACreate an access policy for the blob

BModify the access level of the blob service.

CImplement Azure resource locks.

DCreate Azure RBAC assignments.

Answer : A

Scenario: Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.

As an administrator, you can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have.

https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

Microsoft AZ-305 Designing Microsoft Azure Infrastructure Solutions Exam Practice Test