AZ-305 Architecture Solutions Practice Flashcards

Vocabulary practice flashcards generated from AZ-305 exam review notes.

Solution for Monthly Access Verification of Application1 (Fabrikam Developers)

In Azure Active Directory (Azure AD), create an access review of Application1.

Solution for Temporary Access to Blob Container (April Only)

Shared access signatures (SAS)

Solution for Single Sign-On (SSO) to On-Premises WebApp1 without VPN

Azure AD Application Proxy; Azure AD enterprise applications

Solution for Evaluating Membership of Group1 Repeatedly Every Three Months

Create an access review.

Azure Databricks Deployment for Folder-Level Data Engineer Permissions

Databricks SKU: Premium; Cluster configuration: Credential passthrough

User Authentication and Device Access Requirements for App1

The users can connect to App1 without being prompted for authentication: An Azure AD app registration; The users can access App1 only from company-owned computers: A Conditional Access policy

Network Traffic Analysis for VM Packet Allowance (IP flow verify)

Use Azure Network Watcher to run IP flow verify to analyze the network traffic.

Azure Monitor Logs Tables for Security-Related Events

Events from Windows event logs: Event; Events from Linux system logging: Syslog

Azure Policy Assignment Scopes

Subscriptions; resource groups; management groups

Deployment Sequence for User Sign-In with Azure AD and MFA for ASP.NET App1

1. Azure AD Application Proxy → 2. An Azure AD enterprise application → 3. A Conditional Access policy

Monthly Report Generator for New ARM Resource Deployments

Azure Activity Log (si no aparece entre las opciones: Azure Log Analytics)

Architecture Services to Capture User Creation and Role Assignment to Azure Cosmos DB

Azure Services: Azure Event Hubs, Azure Functions

Solution for External Developer Access to Logic Apps via Third-Party OAuth 2.0

Azure API Management

Monitoring Warning Events in System Logs for 300 Windows Server 2019 VMs

Resource to create in Azure: A Log Analytics workspace; Configuration to perform on the virtual machines: Install the Azure Monitor agent

Azure Services for Key Vault Management Requests (Security, Development, QA)

Security: Azure AD Privileged Identity Management; Development: Azure Managed Identity; Quality Assurance: Azure AD Privileged Identity Management

Minimum Objects Required for Deploying Application via Azure Blueprints Across Subscriptions

Management groups: 2; Blueprint definitions: 2; Blueprint assignments: 4

Azure Policy Configuration for Resource Tagging and Remediation

Azure Policy effect to use: Modify; Azure Active Directory (Azure AD) object and role-based access control (RBAC) role to use for the remediation tasks: A managed identity with the Contributor role

Azure SQL Diagnostic Settings Statements (storage1, storage2, Workspace1, Workspace2, Hub1)

No, No, Yes

PII Protection Solution for Azure SQL Database

Dynamic data masking

Storage Solution for Multi-User Encryption with Separate Customer-Managed Keys

Blobs in a general purpose v2 storage account

App Service Web App Integration with Key Vault Secrets

Key Vault integration method: Key Vault references in Application settings; Key Vault permissions for the managed identity: Secrets: Get

Managed Identity Type for Multiple VMs Accessing Key Vault, Logic Apps, and SQL DB

A user-assigned managed identity

Solution to Analyze Cosmos DB Operational Data Daily via Synapse

Azure Synapse Link for Azure Cosmos DB

Storage and Retention Rules for SQLInsights Data

The amount of time that SQLInsights data will be stored in blob storage is: 90 days; The maximum amount of time that SQLInsights data can be stored in Azure Log Analytics is: 730 days

SSO Authentication Method for Legacy App Managing Own Credentials

Password-based

Management Solution for Internet Access to Virtual Machines on VNET1

To provide access to virtual machines on VNET1, use: Azure Bastion; To enforce Azure MFA, use: A Conditional Access policy that has the Cloud apps assignment set to Microsoft Azure Management

Azure Governance Solution for Resource Identification Reporting

An Azure policy that enforces tagging rules

Solution for Assigning Contributor Role to External Fabrikam Developers

In the Azure AD tenant of Contoso, create guest accounts for the Fabrikam developers.

Solution to Enable External Users in fabrikam.com to Authenticate to App1

Configure Supported account types in the application registration and update the sign-in endpoint (si no aparece: Use Azure AD entitlement management to govern external users)

Security Configuration for 10 Web Apps Accessing 20 In-House Web APIs

Grant permissions to allow the web apps to access the web APIs by using: Azure AD; Configure a JSON Web Token (JWT) validation policy by using: Azure API Management

Authentication Solution for Reading Subscription Activity Logs with Azure Functions

System-assigned managed identities

Configuration for App1 on VM1 to Retrieve Secrets from Key Vault KV1

Configure App1 to use OAuth 2.0: Client credentials grant flows; Configure App1 to use a REST API call to retrieve an authentication token from the: Azure Instance Metadata Service (IMDS) endpoint

Authentication and Authorization Strategy for App1 and App2 Accessing Calendar

Authentication: Application registration in Azure AD; Authorization: Delegated permissions

Evaluation of RBAC Assignments across Management Groups and Subscriptions

Yes, No, Yes

Resource Grouping Tool for Subscription Compliance Reports

Azure Policy and tags

Administrative Unit Roles for User Management (User1 and User2)

User1: User Administrator for MarketingAU; User2: Helpdesk Administrator for MarketingAU

Solution for Storing and Accessing API Key for Email Service on Ubuntu VMs

Storage: Secret; Access: A managed service identity (MSI)

Modifying App Registrations for Token Role Claims (App1 and App2)

App1: App roles; App2: API permissions

Minimum Azure Monitor Workspaces for Network Insights, App Insights, Sentinel, and VM Insights

1

Fabrikam B2B Identity Requirements (Tenants and Conditional Access Policies)

Minimum number of Azure AD tenants: 1; Minimum number of conditional access policies to create: 1

Access Management Solution for Frequent Project Team Transitions

Azure AD Identity Governance

Azure Policy Configuration for TDE Remediation via ARM Template

Set available effects to: DeployIfNotExists; Include in the definition: The role-based access control (RBAC) roles required to perform the remediation task

Monitoring Solution for Container Instances App Component Synthetic Transactions

Application Insights

Cost Optimization for High Volume Log Analytics Ingestion (Workspace1)

Resource: Workspace1; Modification: Change to a commitment pricing tier.

Microsoft Cost Management Tool for Per-Project Cost Tracking Across Subscriptions

Budgets; resource tags

Azure Policy Compliance Scans and Alerts Solutions

To trigger the compliance scans, use: The Azure Command-Line Interface (CLI); To generate the non-compliance alerts, configure diagnostic settings for the: Azure activity logs

Access Authorization Strategy for Storage Accounts (Blobs and SMB File Shares)

For the blobs: A user delegation shared access signature (SAS) only; For the file shares: Azure AD credentials

JSON Log Forwarding and Transformation in Log Analytics

To forward the logs: An Azure Monitor data collection endpoint; To transform the logs and store the data: A KQL query

Cross-Subscription Windows Event Logging and DCR Support

To collect the event logs: Azure Lighthouse; To support the DCRs: The Azure Monitor agent

Azure Hosting Solution for Legacy SQL Server 2014 Instances with CLR

Azure SQL Managed Instance

Azure Services for Copying On-Premises File Server Data to Blob Storage

An Azure Import/Export job; Azure Data Factory

Messaging System Replacement for Processing Shipping Requests Across Multiple Apps

One Azure Service Bus topic

Storage Solution for High Throughput, Immutability, and Low Latency

Storage account type: BlockBlobStorage; Storage service: Blob

Storage Account Recommendation for Lifecycle Management and File Shares

App1: storage1 and storage3 only; App2: storage1 and storage4 only

Storage Option for Video Files (50 MB to 12 GB) with Certificate Authentication

Azure Blob Storage

Database Platform Recommendation for 20 SQL Databases with Dynamic Scaling

An elastic pool that contains 20 Azure SQL databases

Database Migration Architecture for Up to 75 TB OLTP Database

Service: Azure SQL Database; Service tier: Hyperscale

Real-Time Visualization Storage for High-Volume IoT Hub Device Streams

Azure Cosmos DB for NoSQL (SQL API); Azure Time Series Insights

Database Solution for Multi-Master Writes and Low Read Latency

Azure Cosmos DB for NoSQL (SQL API)

SQL Server Auditing Storage Capability Statements

Yes, No, No

Migration Tools for SQL Server 2012 DB and SQL Server 2014 Table to Azure

From the SQL Server 2012 database: Data Migration Assistant; From the table in the SQL Server 2014 database: Azure Cosmos DB Data Migration Tool

Automated Monthly Web Access Logs Upload to Azure SQL Database

Azure Data Factory

Low-Cost Storage Options for 5 TB On-Premises File Transfer (Rare Access)

Create an Azure Blob Storage account that is configured for the Cool default access tier. Create a blob container, copy the files to the blob container, and set each file to the Archive access tier.; Create a general-purpose v2 storage account that is configured for the Hot default access tier. Create a blob container, copy the files to the blob container, and set each file to the Archive access tier.

Azure Hosting for SQL Databases Needing Server-Side Cross-Database Transactions

Two databases on the same Azure SQL managed instance

Highly Available Azure SQL Database Deployment Option for Zone Outages

Azure SQL Database Premium (DTU) o Azure SQL Database Business Critical (vCore), según cuál aparezca

Storage Configuration for 5-Year Immutability and Low Data Access Charges

Storage account type: General purpose v2 with Hot access tier for blobs; Configuration to prevent modifications and deletions: Container access policy

Data Stores for Ingested JSON Event Data and 50 TB Relational Data Warehouse

Data store for the ingested data: Azure Data Lake Storage Gen2; Data store for the data warehouse: Azure SQL Database Hyperscale

TDE Protector Configuration for Azure SQL Managed Instance

RSA 3072

Azure Synapse Pools for Data Lake Ingestion and Delta Lake Implementation

Ingest data from Data Lake Storage into hash-distributed tables: A dedicated SQL pool; Implement, query, and update data in Delta Lake: A serverless Apache Spark pool

Storage Service Supporting Hadoop Distributed File System (HDFS)

Azure Data Lake Storage Gen2

Storage Solutions for Digital Images and Customer Accounts

Image storage: Azure Blob storage; Customer accounts: Azure Cosmos DB

Compute Tier for Azure Database for MySQL Flexible Server High Availability

General Purpose

Azure Cosmos DB API Recommendation for Relational Sales Data and Geo-Replication

PostgreSQL

Storage and Data Format Requirements for Event Hubs Capture Cold Path Processing

Storage type: Azure Data Lake Storage Gen2; Data format: Avro

Security Configurations for Employee Phone Numbers and Social Security Numbers

Phone numbers: Dynamic data masking; Social security numbers: Always Encrypted

Storage Solution Supporting Immutable Storage, ACLs, and Disabled Anonymous Access

Azure Data Lake Storage

Storage and Interactive Analytics Solution for Petabyte Text Data

For storage and interactive analytics: Azure Data Explorer; Query language: KQL

Azure SQL Product and Tier for Autoscaling Compute and Per-Second Billing

Azure SQL product: A single Azure SQL database; Service tier: General Purpose

Blob Configuration for Point-in-Time Restore

Blob type: Block; Enable: The change feed

Solution for Uploading, Transforming, and Sharing Data Between Contoso and Fabrikam

Upload and transform the data: Azure Synapse pipelines; Provide restricted access: Azure Data Share

Data Warehouse and Serving Layer Solutions for SQL Server Integration Pipeline

To implement the data warehouse: An Azure Synapse Analytics dedicated SQL pool; To implement the serving layer: Azure Analysis Services

Relational Database Solution Supporting Automatic Read-Only Request Load Balancing

Service: A single Azure SQL database; Service tier: Hyperscale

Blob Versioning Solution for Hourly Uploaded Daily Log Files

Blob versioning

ETL Tool for Consolidating 12 On-Premises Databases into Data Lake Storage

Azure Data Factory

Disaster Recovery Solution for Batch SQL Server VM (RTO 15 min, RPO 24 h)

Azure Site Recovery

Backup Retention and RPO Limits for Policy1

Virtual machines that are backed up by using the policy can be recovered for up to a maximum of: 36 months; The minimum recovery point objective (RPO) for virtual machines that are backed up by using the policy is: 1 day

Resilient Storage Tier and Redundancy for Transaction-Intensive File Shares

Storage tier: Premium; Redundancy: Zone-redundant storage (ZRS)

Storage Configuration for Two Apps with High Throughput vs Low Cost Requirements

BlockBlobStorage with Premium performance and Zone-redundant storage (ZRS) replication; General purpose v2 with Standard performance, Cool access tier, and Read-access geo-redundant storage (RA-GRS) replication

Storage Solution for Critical Data with 1-Year Non-Modification and Zone Resiliency

Storage Account type: Premium block blobs; Redundancy: Zone-redundant storage (ZRS)

Service for Multi-Region AKS Availability and Centralized SSL Offloading

Azure Front Door

Storage Configuration for West Europe On-Premises Server Migration

Storage Account type: Standard general-purpose v2; Redundancy: Zone-redundant storage (ZRS)

Key Vault Failover Region and Unavailable Request Type During Regional Outage

To where will KV1 fail over?: A server in the paired region; During the failover, which request type will be unavailable?: Delete

BCDR Solutions for Sales, Finance, and Reporting Virtual Machines

Sales: Azure Site Recovery only; Finance: Azure Site Recovery and Azure Backup; Reporting: Azure Backup only

Hosting Solution for Migration of On-Premises SQL1 with Active Geo-Replication

Azure service or service tier: Azure SQL Database; Replication mechanism: Active geo-replication

SQL Server Migration Solution using Always On Availability Group

Prepare for the migration by: Creating an Always On availability group on VM1; Perform the migration by using: A distributed availability group

Azure SQL Database Configuration for PII Column Encryption and Serverless Compute

Service tier and compute tier: General Purpose service tier and Serverless compute tier; Encryption method: Always Encrypted

Business Continuity Solution for Azure Database for MySQL Flexible Server

Implement Geo-redundant backup.

Load Balancer Solution for Distributing Traffic Across Network Virtual Appliances

Gateway Load Balancer

Backup Protection Solutions Against Ransomware Attacks (Sub1 and Sub2)

Sub1: A Recovery Services vault; Sub2: A Resource Guard

Configuration for On-Premises Windows Server Daily Backups to Recovery Services Vault

On the servers: The Microsoft Azure Recovery Services (MARS) agent; For the storage: Locally-redundant storage (LRS)