Microsoft

AZ-305 Free Practice Questions — Page 4

Question 32

HOTSPOT - You have an Azure subscription. The subscription contains 100 virtual machines that run Windows Server 2022 and have the Azure Monitor Agent installed. You need to recommend a solution that meets the following requirements: • Forwards JSON-formatted logs from the virtual machines to a Log Analytics workspace • Transforms the logs and stores the data in a table in the Log Analytics workspace What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-305 question 32
Show Answer
Correct Answer: To forward the logs: An Azure Monitor data collection endpoint To transform the logs and store the data: A KQL query
Explanation:
Azure Monitor Agent uses Data Collection Rules with a Data Collection Endpoint to ingest logs. Ingestion-time transformations are defined in the DCR using Kusto Query Language (KQL), which can transform JSON data before it is stored in Log Analytics. XPath is for filtering Windows Event Logs, not general JSON transformations.

Question 33

HOTSPOT - You have an Azure subscription. You plan to deploy five storage accounts that will store block blobs and five storage accounts that will host file shares. The file shares will be accessed by using the SMB protocol. You need to recommend an access authorization solution for the storage accounts. The solution must meet the following requirements: • Maximize security. • Prevent the use of shared keys. • Whenever possible, support time-limited access. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-305 question 33
Show Answer
Correct Answer: For the blobs: A user delegation shared access signature (SAS) only For the file shares: Azure AD credentials
Explanation:
User delegation SAS for blobs uses Microsoft Entra ID instead of shared keys, maximizing security while supporting time-limited access. It cannot use stored access policies. For Azure Files over SMB, use Azure AD (Microsoft Entra) credentials to avoid shared keys; user delegation SAS is not supported for SMB file share access.

Question 34

HOTSPOT - You have an Azure subscription that contains multiple storage accounts. You assign Azure Policy definitions to the storage accounts. You need to recommend a solution to meet the following requirements: • Trigger on-demand Azure Policy compliance scans. • Raise Azure Monitor non-compliance alerts by querying logs collected by Log Analytics. What should you recommend for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-305 question 34
Show Answer
Correct Answer: The Azure Command-Line Interface (CLI) Azure activity logs
Explanation:
On-demand Azure Policy compliance scans are triggered with Azure CLI (for example, az policy state trigger-scan). To create Azure Monitor alerts from Log Analytics queries about policy non-compliance, configure diagnostic settings for the Azure Activity Log so policy events are sent to Log Analytics.

Question 35

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases. The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region. You need to recommend a solution to meet the regulatory requirement. Solution: You recommend using an Azure Policy initiative to enforce the location of resource groups. Does this meet the goal?

A. Yes
B. No
Show Answer
Correct Answer: B
Explanation:
No. Enforcing the location of resource groups does not enforce the deployment location of resources within those resource groups. Azure resources, including App Service and Azure SQL, can be deployed in different regions than the resource group's metadata location. To meet the requirement, the policy must enforce allowed locations for the resources (or the specific resource types), not merely the resource group location.

Question 36

You have an Azure subscription. The subscription contains a tiered app named App1 that is distributed across multiple containers hosted in Azure Container Instances. You need to deploy an Azure Monitor monitoring solution for App. The solution must meet the following requirements: • Support using synthetic transaction monitoring to monitor traffic between the App1 components. • Minimize development effort. What should you include in the solution?

A. Network insights
B. Application Insights
C. Container insights
D. Log Analytics Workspace insights
Show Answer
Correct Answer: B
Explanation:
Application Insights is the Azure Monitor feature that provides application performance monitoring and supports synthetic transaction/availability monitoring with minimal application changes. Container Insights focuses on container infrastructure, Network Insights on networking, and Log Analytics Workspace is the data platform rather than the synthetic monitoring capability.

Question 37

DRAG DROP - You plan to deploy an infrastructure solution that will contain the following configurations: • External users will access the infrastructure by using Azure Front Door. • External user access to the backend APIs hosted in Azure Kubernetes Service (AKS) will be controlled by using Azure API Management. • External users will be authenticated by an Azure AD B2C tenant that uses OpenID Connect-based federation with a third-party identity provider. Which function does each service provide? To answer, drag the appropriate functions to the correct services. Each function may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Illustration for AZ-305 question 37
Show Answer
Correct Answer: Front Door → Protection against Open Web Application Security Project (OWASP) vulnerabilities API Management → Validation of Azure B2C JSON Web Tokens (JWTs)
Explanation:
Azure Front Door with Web Application Firewall (WAF) protects against OWASP web vulnerabilities. Azure API Management can validate Azure AD B2C-issued JWTs using the validate-jwt policy. Although APIM also supports IP filtering, the per-API IP filtering function is not required by the described solution.

Question 38

You have an Azure subscription that contains the resources shown in the following table. You need to recommend a load balancing solution that will distribute incoming traffic for VMSS1 across NVA1 and NVA2. The solution must minimize administrative effort. What should you include in the recommendation?

A. Gateway Load Balancer
B. Azure Front Door
C. Azure Application Gateway
D. Azure Traffic Manager
Show Answer
Correct Answer: A
Explanation:
Azure Gateway Load Balancer is specifically designed to transparently distribute traffic across Network Virtual Appliances (NVAs) such as firewalls and inspection devices with minimal configuration and administrative effort. Azure Front Door, Application Gateway, and Traffic Manager serve different load-balancing and routing scenarios and are not intended for NVA service chaining.

Question 39

You have 12 Azure subscriptions and three projects. Each project uses resources across multiple subscriptions. You need to use Microsoft Cost Management to monitor costs on a per project basis. The solution must minimize administrative effort. Which two components should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. budgets
B. resource tags
C. custom role-based access control (RBAC) roles
D. management groups
E. Azure boards
Show Answer
Correct Answer: A, B
Explanation:
Use resource tags to associate resources with one of the three projects across multiple subscriptions. Microsoft Cost Management can group and analyze costs by tag, enabling per-project cost tracking regardless of subscription. Use budgets scoped to the tagged costs (or appropriate scope) to monitor spending and receive alerts. Management groups organize subscriptions, but because each project spans multiple subscriptions and subscriptions can also contain resources from multiple projects, management groups alone do not provide per-project cost tracking.

Question 40

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table: Log files from App1 are registered to App1Logs. An average of 120 GB of log data is ingested per day. You configure an Azure Monitor alert that will be triggered if the App1 logs contain error messages. You need to minimize the Log Analytics costs associated with App1. The solution must meet the following requirements: • Ensure that all the log files from App1 are ingested to App1Logs. • Minimize the impact on the Azure Monitor alert. Which resource should you modify, and which modification should you perform? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-305 question 40 Illustration for AZ-305 question 40
Show Answer
Correct Answer: Resource: Workspace1 Modification: Change to a commitment pricing tier
Explanation:
The workspace is currently pay-as-you-go and ingests about 120 GB/day. A commitment pricing tier reduces ingestion cost at this sustained volume while continuing to ingest all logs. Switching the table to Basic Logs would negatively affect alert capabilities, and a daily cap could stop ingestion, violating the requirement.

Question 41

HOTSPOT - You have an Azure subscription that contains 50 Azure SQL databases. You create an Azure Resource Manager (ARM) template named Template1 that enables Transparent Data Encryption (TDE). You need to create an Azure Policy definition named Policy1 that will use Template1 to enable TDE for any noncompliant Azure SQL databases. How should you configure Policy1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-305 question 41
Show Answer
Correct Answer: DeployIfNotExists The role-based access control (RBAC) roles required to perform the remediation task
Explanation:
Use the DeployIfNotExists effect to deploy the ARM template for noncompliant SQL databases. In the policy definition, DeployIfNotExists requires the roleDefinitionIds (RBAC roles) needed for remediation; the managed identity is configured at policy assignment, not in the definition.

$19

Get all 271 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.