Examkin

Tüm alıştırma soruları

1198 soru

Tüm türler1,198Çoktan seçmeli617Çoklu seçim502Eşleştirme65Sıralama14
Soru 81Soru →

A company plans to migrate an on-premises SQL Server database to Azure. The database requires the use of SQL Server Agent to run scheduled maintenance jobs, and cross-database queries are heavily utilized. The database administration team wants to minimize administrative overhead for managing the underlying operating system. Which Azure SQL deployment option should you recommend?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance

Cevap

Azure SQL Managed Instance
Azure SQL Managed Instance is a fully managed Platform-as-a-Service (PaaS) relational database engine that provides near 100% compatibility with on-premises SQL Server. It supports instance-level capabilities such as SQL Server Agent, cross-database queries, and Common Language Runtime (CLR), while eliminating the administrative overhead of managing the underlying operating system and hardware.

Adım Adım Çözüm

1
Identify the legacy SQL Server features required by the workload.
The workload requires SQL Server Agent and cross-database queries.
These features are standard SQL Server features but are not supported by all Azure SQL deployment tiers.
2
Identify the administrative overhead requirements.
The customer wants to minimize administrative overhead for the operating system.
This rules out Infrastructure-as-a-Service (IaaS) options like SQL Server on Azure VMs, which require OS patching and management.
3
Evaluate Platform-as-a-Service (PaaS) options against the feature requirements.
Azure SQL Managed Instance supports both SQL Server Agent and cross-database queries, while Azure SQL Database (single database and elastic pools) does not support them natively.
This leaves Azure SQL Managed Instance as the only deployment option that satisfies both the legacy features and the managed OS requirements.

Anahtar Kavram

Selecting the appropriate Azure SQL deployment option based on SQL Server feature compatibility and management requirements.
Soru 82Soru →

You are designing a hybrid and multi-tenant identity solution for an organization that has an on-premises Active Directory Domain Services (AD DS) forest and a Microsoft Entra ID tenant. Match each technical requirement on the left to the correct identity technology or configuration on the right. Each technology or configuration may be used once, more than once, or not at all.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Validate hybrid user passwords in the cloud while enabling the detection of compromised credentials on the public internet.
Validate hybrid user passwords by routing requests directly to on-premises domain controllers via lightweight agents.
Enable users from an external partner organization to collaborate inside a Microsoft Teams shared channel without creating guest accounts in your tenant.
Allow guest users in your tenant to satisfy Multi-Factor Authentication (MFA) requirements using their home tenant's MFA verification.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Validate hybrid user passwords in the cloud matches Password Hash Synchronization (PHS). Validate hybrid user passwords via lightweight agents matches Pass-through Authentication (PTA). Collaborate in a Microsoft Teams shared channel without creating guest accounts matches Microsoft Entra B2B Direct Connect. Allow guest users to satisfy MFA using their home tenant's verification matches Cross-tenant access settings trust settings.
Password Hash Synchronization (PHS) is the correct choice for validating hybrid user passwords in the cloud and enabling leaked credential detection. Pass-through Authentication (PTA) is correct for validating credentials against on-premises Active Directory domain controllers using lightweight agents. Microsoft Entra B2B Direct Connect is correct for enabling external users to collaborate in Teams shared channels without creating guest accounts. Cross-tenant access settings trust settings is correct for allowing guest users to bypass local MFA prompts by trusting their home tenant's MFA validation.

Adım Adım Çözüm

1
Analyze the requirement to validate hybrid passwords in the cloud while enabling leaked credential detection.
Determine that Password Hash Synchronization (PHS) is required because it is the only sync method that replicates password hashes to Microsoft Entra ID, which is necessary for Entra ID Protection to run leaked credential checks.
PHS copies password hashes to Microsoft Entra ID, facilitating both authentication in the cloud and security analysis for leaked credentials.
2
Analyze the requirement to validate passwords directly against on-premises domain controllers using agents.
Determine that Pass-through Authentication (PTA) is required.
PTA validates credentials on-premises using local agents, ensuring that password validation occurs on-premises without replicating password hashes if desired, while avoiding full AD FS deployments.
3
Analyze the requirement to enable external collaboration inside Microsoft Teams shared channels without guest accounts.
Determine that Microsoft Entra B2B Direct Connect is required.
B2B Direct Connect establishes a direct link between organizations, enabling seamless access to shared channels without guest account clutter.
4
Analyze the requirement to trust the home tenant's MFA verification for guest users.
Identify cross-tenant access settings trust settings.
Trusting MFA settings within the cross-tenant access configuration allows external organizations' MFA validations to satisfy local host tenant conditions.

Anahtar Kavram

Selecting the correct hybrid synchronization methods and cross-tenant collaboration mechanisms based on organizational requirements.
Tahmini Süre:2m 0s
Soru 83Soru →

A financial services organization is designing an identity and access management solution for its Microsoft Entra ID tenant and hybrid Active Directory Domain Services (AD DS) environment. The design must satisfy the following requirements:
- Users must be able to authenticate to cloud services even during an on-premises WAN outage, without relying on on-premises infrastructure or authentication traffic routing.
- Privileged administrative roles must require Just-in-Time (JIT) activation, and users must be prompted for multi-factor authentication (MFA) when activating these roles.
- The configuration must guarantee that administrators can access the tenant and recover control in the event of a tenant-wide MFA service failure or Conditional Access policy misconfiguration.
- Standard employees must only access corporate applications from compliant, corporate-managed devices.

Which of the following authentication and access management strategies should you recommend?

Cevabı ve açıklamayı göster

Cevap: Configure hybrid identity using Password Hash Synchronization (PHS). Implement Privileged Identity Management (PIM) with eligible assignments for administrative roles. Define a Conditional Access policy requiring MFA and compliant devices for administrators, while excluding a dedicated emergency access account that is assigned the Global Administrator role permanently and has its credentials secured in a physical safe.

Cevap

Configure hybrid identity using Password Hash Synchronization (PHS), implement Privileged Identity Management (PIM) with eligible assignments for administrative roles, and define a Conditional Access policy requiring MFA and compliant devices while excluding a dedicated emergency access account.
The correct strategy combines Password Hash Synchronization (PHS) to ensure authentication capability during on-premises outages, Privileged Identity Management (PIM) with eligible assignments to enforce Just-in-Time (JIT) activation for administrative roles, and an explicit exclusion for a dedicated emergency access account within the Conditional Access policies to prevent lockout.

Adım Adım Çözüm

1
Evaluate hybrid authentication methods against resilience requirements.
Password Hash Synchronization (PHS) is selected over Active Directory Federation Services (AD FS) and Pass-through Authentication (PTA) because it is the only method that allows authentication to continue completely in the cloud without relying on on-premises infrastructure during a WAN outage.
The scenario requires that cloud authentication continue to function during an on-premises outage without routing traffic on-premises.
2
Determine the proper configuration for administrative roles in Microsoft Entra Privileged Identity Management (PIM).
Administrative roles are configured as eligible rather than active.
Eligible assignments are required to support Just-in-Time (JIT) role activation, which ensures that permissions are not permanently assigned and are only active when requested and verified.
3
Design the Conditional Access policies for administrative accounts and assess tenant recovery capabilities.
Excluding a dedicated emergency access account from Conditional Access policies requiring MFA.
A dedicated emergency access (glass-breaker) account must be excluded from multi-factor authentication policies to guarantee tenant access in the event of an MFA service failure or policy misconfiguration.

Anahtar Kavram

Microsoft Entra ID Authentication and Conditional Access configuration for high availability, JIT governance, and emergency access.
Tahmini Süre:3m 0s
Soru 84Soru →

Zephyr Logistics is designing a hybrid identity solution to integrate its on-premises Active Directory Domain Services (AD DS) forest, internal.zephyrlogistics.com, with a Microsoft Entra ID tenant. The solution must meet the following requirements:
- Users must be able to sign in to cloud services using their on-premises credentials.
- Authentication to cloud services must continue to function even if all on-premises Active Directory domain controllers or the corporate network connection become completely unavailable.
- Users on domain-joined corporate devices inside the corporate network must experience seamless single sign-on (SSO).
- Multi-factor authentication (MFA) must be enforced for all users when accessing cloud applications, but the design must guarantee that administrators are not locked out of the tenant in the event of an MFA service disruption.
- Users must be able to change their passwords in the cloud, and these changes must be reflected on-premises immediately.

Which two actions should you include in the hybrid identity design? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Password Hash Synchronization (PHS) and enable Seamless Single Sign-On (SSO) in Microsoft Entra Connect.; Configure a Conditional Access policy requiring Multi-Factor Authentication (MFA) for all users, and exclude a dedicated emergency access account from the policy.

Cevap

Configure Password Hash Synchronization (PHS) with Seamless SSO in Microsoft Entra Connect, and configure a Conditional Access policy requiring MFA for all users while excluding a dedicated emergency access account.
To meet the business continuity and authentication requirements, Password Hash Synchronization (PHS) is required because it syncs password hashes to the cloud, enabling users to authenticate even if on-premises servers or connectivity are down. Seamless SSO satisfies the single sign-on requirement for domain-joined corporate devices on the network. To meet the security and emergency access requirements, a Conditional Access policy enforcing MFA should be created, but it must exclude a dedicated emergency access account to prevent administrative lockout during an identity or MFA service disruption.

Adım Adım Çözüm

1
Analyze authentication and business continuity requirements.
Identify that Password Hash Synchronization (PHS) must be used because it is the only hybrid sync method that allows authentication in Microsoft Entra ID when the on-premises domain controllers or network connectivity are offline.
Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS) require operational on-premises servers/agents to validate credentials, which would fail if the on-premises network or domain controllers are down.
2
Determine the required single sign-on configuration.
Choose Seamless SSO to provide single sign-on for domain-joined devices on the corporate network.
This meets the requirement of providing seamless single sign-on from corporate devices inside the corporate network without adding the complexity of AD FS.
3
Address the secure access and lockout prevention constraints.
Design a Conditional Access policy requiring MFA for all users, but explicitly exclude a dedicated emergency access account.
Excluding the emergency access account ensures that administrators can still access the tenant to resolve issues during a global MFA or federation service outage.

Anahtar Kavram

Designing a secure, resilient hybrid identity solution using Password Hash Synchronization (PHS), Seamless SSO, and Conditional Access with emergency account exclusions.
Soru 85Soru →

Solas Energy Systems is designing a governance and compliance strategy for its Azure environment. The resource hierarchy consists of a root management group named Solas-Root, with a child management group named Solas-Prod. Under Solas-Prod, there are multiple subscriptions, including 'Solas-Prod-Sub-02'. You must design an Azure Policy solution that meets the following compliance requirements:

1. All storage accounts deployed under Solas-Prod must use HTTPS only. If a storage account is deployed without HTTPS enabled, Azure Policy must automatically enable it during resource creation.
2. Virtual machines in all subscriptions under Solas-Prod must not be deployed with public IP addresses.
3. Virtual machines in a resource group named 'Legacy-App-RG' under 'Solas-Prod-Sub-02' must be allowed to have public IP addresses to support a legacy telemetry service. However, storage accounts in 'Legacy-App-RG' must still be forced to use HTTPS.
4. The solution must minimize administrative overhead for policy assignment and compliance reporting.

Which design should you recommend?

Cevabı ve açıklamayı göster

Cevap: Create a policy initiative containing a policy definition with the Modify effect for storage accounts and a policy definition with the Deny effect for virtual machine public IPs. Assign the initiative to the Solas-Prod management group. Create a policy exemption targeting the Legacy-App-RG resource group scope for the virtual machine public IP policy definition within the initiative assignment.

Cevap

The correct design uses a single policy initiative to minimize administrative overhead, configuring the Modify effect for storage accounts, the Deny effect for VM public IPs, and applying a policy exemption to exclude the legacy resource group from the VM public IP policy within the initiative assignment.
The correct design uses a single policy initiative to minimize administrative overhead. The requirement to automatically remediate non-compliant storage accounts is met by the Modify effect, which modifies properties of the resource during creation. The VM public IP block is met by the Deny effect. To exclude only the VM policy for the Legacy-App-RG resource group without excluding it from the storage account policy, a policy exemption is created targeting that specific policy definition within the initiative assignment.

Adım Adım Çözüm

1
Determine the appropriate policy effect for automatically enabling HTTPS on storage accounts.
Modify effect
The Modify effect is used to add or update properties on a resource during creation or update. DeployIfNotExists is for deploying nested resources (like diagnostics), and Deny blocks the resource creation entirely.
2
Determine the appropriate policy effect for blocking public IP creation on VMs.
Deny effect
The Deny effect prevents the resource deployment if it matches the defined non-compliant criteria.
3
Select the grouping mechanism to minimize administrative overhead.
Policy Initiative
Grouping the policy definitions into a single policy initiative allows tracking compliance and managing assignments from a single container.
4
Determine the scoping/exemption mechanism that allows Legacy-App-RG to have public IPs while still enforcing storage HTTPS.
Policy Exemption for the specific definition inside the initiative assignment
Using the notScopes property on the entire initiative assignment would exclude Legacy-App-RG from all policies in the initiative. A policy exemption can target a specific policy definition within the initiative assignment, leaving the storage account policy active.

Anahtar Kavram

Azure Policy effects and scoping mechanisms (Exemptions vs. Exclusions) within Policy Initiatives
Soru 86Soru →

An enterprise is designing a diagnostic log routing solution for a workload consisting of Azure Key Vault instances and Azure SQL Database instances. The solution must satisfy the following constraints:
- Audit logs for all key operations and access attempts in Azure Key Vault must be routed to an external, third-party security information and event management (SIEM) system with sub-minute latency.
- Azure SQL Database transaction logs must be stored cost-effectively in a Write Once, Read Many (WORM) format for 5 years within the same region.
- Access control configuration must adhere to the principle of least privilege, preventing the assignment of permissions directly to individual administrator user accounts.

Which two destination resources and configurations should you include in the diagnostic settings design? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An Azure Event Hubs namespace to stream the Key Vault diagnostic logs to the external SIEM.; An Azure Storage account configured with a time-based retention policy for immutable storage (WORM) to store the SQL Database transaction logs.

Cevap

An Azure Event Hubs namespace to stream the Key Vault diagnostic logs to the external SIEM, and an Azure Storage account configured with a time-based retention policy for immutable storage (WORM) to store the SQL Database transaction logs.
To stream Key Vault diagnostic logs to a third-party SIEM with sub-minute latency, routing logs to an Azure Event Hubs namespace is the correct approach. For cost-effective archival of SQL Database transaction logs under strict WORM compliance for 5 years, configuring an Azure Storage account with a time-based retention policy for immutable storage meets both cost and compliance requirements.

Adım Adım Çözüm

1
Determine the optimal routing destination for Key Vault logs that must reach an external SIEM within a sub-minute window.
Identify that Azure Event Hubs is the designed mechanism for streaming Azure diagnostic logs directly to external systems like third-party SIEMs.
Log Analytics and Storage accounts do not support the real-time, low-latency streaming pipeline required for external SIEM integration without intermediate components.
2
Select a cost-effective storage target that complies with WORM regulatory requirements for a 5-year retention period.
Choose Azure Storage with time-based immutable policies enabled on the destination containers.
Azure Storage is significantly more cost-effective than Log Analytics for long-term cold data retention, and natively supports immutable WORM configuration.
3
Ensure that administrative assignment and automatic deployment comply with operational best practices.
Avoid direct RBAC assignments to individual user accounts, choosing group assignments instead, and ensure diagnostic configurations are deployed dynamically using DeployIfNotExists policies.
Direct user assignments violate security scale requirements, and Deny policies cannot perform automated deployments.

Anahtar Kavram

Designing diagnostic log routing architectures in Azure Monitor to meet compliance, latency, cost, and administrative separation requirements.
Soru 87Soru →

An enterprise is designing a monitoring and log routing architecture for its Azure workloads to meet various operational and compliance requirements. Match each logging scenario to the most appropriate Azure Monitor routing configuration.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Collect guest OS performance metrics and system logs from on-premises and Azure virtual machines for correlation using KQL.
Stream HTTP access logs from an Azure App Service instance to an external, third-party Security Information and Event Management (SIEM) system with minimal latency.
Store Azure SQL Database diagnostic telemetry for a mandatory 5-year compliance audit at the lowest possible storage cost.
Consolidate and search Microsoft Entra ID sign-in activity and directory audit logs across the entire directory tenant.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Match guest OS metrics to Azure Monitor Agent and DCRs; stream App Service HTTP logs to Azure Event Hubs; store SQL Database logs in Azure Storage with lifecycle management; and consolidate Microsoft Entra ID logs via tenant-level Diagnostic Settings.
Matching guest OS logs to the Azure Monitor Agent and DCRs ensures proper agent-based telemetry collection. Streaming App Service HTTP logs to an Event Hub satisfies real-time SIEM ingestion. Archiving SQL Database logs in an Azure Storage account with lifecycle policies minimizes costs for 5-year retention. Consolidating Microsoft Entra ID logs requires tenant-level diagnostic settings to span across the entire tenant directory.

Adım Adım Çözüm

1
Identify the source of the logs (guest OS level vs platform level vs tenant level) and the target destination requirements (interactive queries vs low-cost archiving vs real-time external ingestion).
Categorize the four requirements: VM guest OS needs agent collection; SIEM requires real-time streaming; compliance audit needs low-cost long-term retention; Entra ID needs tenant-scope collection.
Correctly classifying log scopes ensures you choose the appropriate diagnostic setting level and target endpoint.
2
Match VM guest collection to its specific tool.
The Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) is the designated mechanism for VM guest OS logs and metrics targeting a Log Analytics workspace.
Diagnostic settings only collect host-level metrics for virtual machines, whereas guest-level logs require the agent.
3
Match real-time external SIEM integration to the appropriate streaming component.
Azure Event Hubs acts as the real-time event pipeline for routing logs to third-party SIEM tools.
Log Analytics and Storage accounts are not designed for direct real-time push streaming to external non-Azure SIEM systems.
4
Match long-term compliance storage to the most cost-effective option.
Azure Storage accounts with lifecycle management policies provide the lowest cost for long-term retention (e.g., 5 years) compared to Log Analytics workspaces.
Log Analytics has higher ingestion and retention costs, making Storage accounts the preferred choice for compliance archiving.
5
Match tenant-level logs to their appropriate diagnostic scope.
Microsoft Entra ID logs are tenant-level resources and require tenant-level diagnostic settings to be sent to a Log Analytics workspace.
Subscription-level diagnostic settings do not capture tenant-wide directory audit or sign-in logs.

Anahtar Kavram

Selecting appropriate Azure log routing mechanisms based on log scope (guest, platform, tenant) and operational targets (KQL analysis, low-cost archive, real-time SIEM streaming).
Tahmini Süre:3m 0s
Soru 88Soru →

A company is deploying a new retail application in Azure that requires a relational database backend. The database design must satisfy the following requirements:
- Cost-effectively manage resource allocation for 20 databases that experience short, unpredictable spikes in usage.
- Ensure that database backups remain available even if a single datacenter within the primary region suffers a complete outage.

Which two options should you include in the design? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure SQL Database Elastic Pools; Zone-redundant storage (ZRS) for backup storage redundancy

Cevap

Azure SQL Database Elastic Pools and Zone-redundant storage (ZRS) for backup storage redundancy.
Azure SQL Database Elastic Pools are the optimal choice to manage resource allocation and cost for multiple databases with unpredictable workloads. Zone-redundant storage (ZRS) provides the required resiliency against a single datacenter outage by replicating backup data across different availability zones within the region.

Adım Adım Çözüm

1
Analyze the database resource sharing requirement.
Since there are 20 databases with unpredictable usage spikes, Azure SQL Database Elastic Pools is the most cost-effective choice to share compute resources.
Elastic Pools allow databases to share a pool of resources, preventing the need to over-provision each individual database.
2
Analyze the backup redundancy requirement.
To protect backups against a single datacenter failure within the region, Zone-redundant storage (ZRS) must be chosen.
Locally redundant storage (LRS) stores all copies within a single datacenter, which fails the requirement to survive a datacenter outage.

Anahtar Kavram

Azure SQL Database Elastic Pools and Backup Redundancy Options
Soru 89Soru →

Zephyr Global Services has an on-premises Active Directory Domain Services (AD DS) domain. You are designing a hybrid identity solution to sync on-premises user accounts to a single Microsoft Entra ID tenant. The solution must meet the following requirements:
- Users must be able to sign in to cloud services using their on-premises passwords.
- Users must be able to reset their passwords in the cloud, and the new passwords must immediately apply to their on-premises accounts.
- Users must be able to authenticate to cloud services even if the network connection between the on-premises datacenter and Azure is temporarily unavailable.

Which two features should you include in the hybrid identity design? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Password Hash Synchronization (PHS); Self-service password reset (SSPR) with password writeback

Cevap

To meet the requirements, the hybrid identity design must include Password Hash Synchronization (PHS) and Self-service password reset (SSPR) with password writeback.
Password Hash Synchronization (PHS) is correct because it allows Microsoft Entra ID to perform authentication locally in the cloud, removing any dependency on the on-premises network link during sign-in. Self-service password reset (SSPR) with password writeback is correct because it allows password changes initiated in Microsoft Entra ID to be securely written back to the on-premises AD DS database immediately.

Adım Adım Çözüm

1
Analyze the authentication and business continuity requirements.
Since users must authenticate to cloud services even during a network outage between the on-premises datacenter and Azure, cloud-based authentication is required. Password Hash Synchronization (PHS) copies password hashes to Microsoft Entra ID, allowing authentication to occur completely in the cloud without requiring connectivity to the on-premises domain controllers.
Ensures authentication continues to function during a network outage, unlike Pass-through Authentication (PTA) or Active Directory Federation Services (AD FS) which rely on active on-premises connectivity.
2
Analyze the password management and self-service requirements.
To allow users to change passwords in Microsoft Entra ID and sync them back to the on-premises Active Directory Domain Services (AD DS) immediately, Self-service password reset (SSPR) with password writeback must be enabled.
Enables two-way password synchronization from cloud to on-premises.

Anahtar Kavram

Designing hybrid identity sync methods and password writeback capabilities to meet high availability and self-service requirements.
Soru 90Soru →

Zephyr Aerospace has an on-premises Active Directory Domain Services (AD DS) forest named corp.zephyraero.com. The company is designing a hybrid identity solution using Microsoft Entra Connect to integrate with a new Microsoft Entra ID tenant.

You need to select the identity synchronization and authentication design that meets the following requirements:
- Users must use their existing on-premises credentials to sign in to cloud resources.
- Users must be able to reset their passwords using the Microsoft Entra self-service password reset (SSPR) portal, and the updated passwords must immediately update on-premises AD DS.
- Users must be able to authenticate to cloud services even during an extended on-premises network outage.

Which identity solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback enabled

Cevap

Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback enabled
The correct option is the one proposing Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback enabled. PHS copies password hashes to Microsoft Entra ID, allowing authentication to continue in the cloud even if the on-premises network is offline. Enabling Password Writeback allows SSPR events to sync back to the on-premises Active Directory.

Adım Adım Çözüm

1
Analyze the business continuity requirement: 'authenticate to cloud services even during an extended on-premises network outage'.
Identify that authentication must be handled directly by the cloud provider (Microsoft Entra ID) without relying on live on-premises connectivity.
This rules out Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS), which require active on-premises communication for authentication.
2
Analyze the self-service requirement: 'reset their passwords using the Microsoft Entra SSPR portal, and the updated passwords must immediately update on-premises AD DS'.
Identify that Password Writeback must be enabled in Microsoft Entra Connect.
Without Password Writeback, cloud-initiated password resets cannot be synchronized back to the on-premises Active Directory.
3
Combine the requirements to select the matching architecture.
Select Password Hash Synchronization (PHS) with Password Writeback enabled.
This combination ensures authentication availability during on-premises outages and supports writing password changes back to the on-premises environment.

Anahtar Kavram

Selecting the appropriate hybrid identity sync and authentication method based on business continuity and password writeback requirements.
Soru 91Soru →

A logistics company runs application workloads in Azure across two regions: East US 2 and UK South. The compliance department mandates that all log data generated by resources in UK South must reside in the United Kingdom due to data sovereignty laws. The operations team needs to query these logs to monitor health, but engineers must only be allowed to view logs for the specific Azure resources they have permission to manage. You need to design a monitoring and log routing architecture that meets these requirements while minimizing administrative overhead for access control. Which solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy a Log Analytics workspace in each region, and configure the workspaces to use resource-context access.

Cevap

Deploy a Log Analytics workspace in each region, and configure the workspaces to use resource-context access.
The configuration utilizing a Log Analytics workspace in each region combined with resource-context access meets all requirements. Regional workspaces keep UK South log data within the United Kingdom, adhering to data sovereignty regulations. Resource-context access (which uses the 'use resource permissions' setting) allows users to query logs of resources they manage without requiring workspace-level permissions, minimizing RBAC administrative overhead.

Adım Adım Çözüm

1
Evaluate data residency requirements to determine workspace placement.
Determine that two regional Log Analytics workspaces are required (one in East US 2 and one in UK South).
Log data generated by UK South resources must stay in the United Kingdom to comply with data sovereignty regulations.
2
Select the appropriate access control mode for the workspaces to meet the security and administrative requirements.
Select resource-context access (using resource permissions) for both workspaces.
Resource-context access allows engineers to view logs for resources they are authorized to manage without needing permissions on the workspace itself, minimizing the need to manage workspace-level RBAC.
3
Validate the solution against alternative governance options.
Reject direct user-level RBAC assignments and restrictive Deny policies.
Direct user role assignments scale poorly, and Deny policies block resource provisioning instead of remediating them automatically.

Anahtar Kavram

Designing regional Log Analytics architectures and access modes to satisfy data residency, access isolation, and administrative efficiency.
Tahmini Süre:1m 30s
Soru 92Soru →

A financial enterprise manages its Azure resources across multiple production subscriptions using a root management group named Finance-Root. The compliance team mandates that all Azure storage accounts must enforce secure transfer (HTTPS traffic only). If a developer attempts to deploy a storage account with secure transfer disabled, the deployment must succeed, but Azure Policy must automatically enable secure transfer during resource creation. You need to design a governance solution that enforces this requirement with the least administrative effort. Which Azure Policy design should you recommend?

Cevabı ve açıklamayı göster

Cevap: An Azure Policy definition with the Modify effect assigned at the management group level.

Cevap

An Azure Policy definition with the Modify effect assigned at the management group level.
The Modify effect allows Azure Policy to add or update properties of a resource during creation or update, enabling automatic remediation without blocking the deployment. Assigning it at the management group level applies the policy hierarchy-wide, minimizing administrative overhead.

Adım Adım Çözüm

1
Analyze compliance requirements and the target action.
The requirement is to automatically change a property (enable secure transfer) during resource deployment without blocking it.
Determines the appropriate Azure Policy effect.
2
Compare the applicable Azure Policy effects (Deny, DeployIfNotExists, and Modify).
The Modify effect is suited for changing resource properties during creation, whereas Deny blocks creation, and DeployIfNotExists deploys secondary resources.
Identifies that Modify is the correct effect for in-flight property changes.
3
Determine the optimal scope for the policy assignment.
Assigning the policy at the management group level automatically applies it to all underlying subscriptions, minimizing governance overhead.
Aligns the design with Azure governance best practices.

Anahtar Kavram

Using the Modify policy effect to alter resource properties during creation and assigning policies at the management group level to scale governance.
Soru 93Soru →

Krypton Global Systems is designing a hybrid identity and multi-tenant access solution. The company has an on-premises Active Directory Domain Services (AD DS) forest named corp.kryptonglobal.com containing 28,500 user accounts. The company has a primary Microsoft Entra ID tenant named kryptonglobal.onmicrosoft.com and has recently acquired a subsidiary company that uses a separate tenant named kryptonsub.onmicrosoft.com.

You must design a solution that satisfies the following requirements:
- On-premises security policies, specifically logon hours restrictions, must be evaluated in real-time when users log in. The solution must minimize the on-premises infrastructure footprint and avoid deploying federation servers.
- Users must be able to perform self-service password resets (SSPR) that are immediately updated in the on-premises AD DS.
- In the event of a total WAN outage at the on-premises datacenters, administrators must have a pre-configured mechanism to quickly transition authentication to the cloud to maintain user access.
- Users in the subsidiary tenant must be allowed to access resources in the primary tenant without registering for Multi-Factor Authentication (MFA) in the primary tenant.
- All administrative access to the primary tenant must require MFA, but the design must guarantee that administrators can access the tenant even if the primary authentication or MFA service suffers a global outage.

Which of the following designs should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy Microsoft Entra Connect with Pass-through Authentication (PTA) as the primary authentication method and enable Password Hash Synchronization (PHS) as a standby backup. Enable Password Writeback. In the primary tenant, configure cross-tenant access settings to trust MFA from the subsidiary tenant. Create a Conditional Access policy requiring MFA for all directory administrators, while excluding a dedicated cloud-only emergency access account.

Cevap

Deploy Microsoft Entra Connect with Pass-through Authentication (PTA) as the primary authentication method and enable Password Hash Synchronization (PHS) as a standby backup. Enable Password Writeback. In the primary tenant, configure cross-tenant access settings to trust MFA from the subsidiary tenant. Create a Conditional Access policy requiring MFA for all directory administrators, while excluding a dedicated cloud-only emergency access account.
The correct design recommends Pass-through Authentication (PTA) as the primary authentication method because it evaluates on-premises security policies (like logon hours) in real-time and has a low infrastructure footprint since it only requires lightweight agents on-premises rather than full AD FS federation servers. Enabling Password Hash Synchronization (PHS) alongside PTA serves as a standby backup authentication mechanism that can be quickly activated if on-premises connectivity fails. Enabling Password Writeback is required to allow self-service password resets (SSPR) to update the on-premises Active Directory. Configuring cross-tenant access settings to trust MFA from the subsidiary tenant allows external users to collaborate seamlessly without double MFA prompts. Finally, creating a Conditional Access policy that requires MFA for administrators while excluding a cloud-only emergency access account secures the tenant while preventing administrative lockout.

Adım Adım Çözüm

1
Select the primary hybrid authentication method based on on-premises security policy constraints.
Pass-through Authentication (PTA) is selected because it evaluates local AD DS policies (such as logon hours) in real-time by routing requests directly to on-premises domain controllers, while avoiding the high infrastructure overhead of Active Directory Federation Services (AD FS).
This satisfies the real-time policy evaluation and low-footprint requirements.
2
Select the backup mechanism for business continuity during a total WAN outage.
Password Hash Synchronization (PHS) is enabled as a standby backup method.
If on-premises connectivity is lost, the PTA agents will be unreachable. Having password hashes already synchronized allows administrators to quickly switch the tenant sign-in method to PHS to restore authentication.
3
Configure multi-tenant collaboration settings to trust external claims.
In the primary tenant, cross-tenant access settings are configured to trust Multi-Factor Authentication (MFA) from the subsidiary tenant.
This allows subsidiary users to access primary tenant resources using their existing credentials and satisfies the requirement to avoid duplicate MFA registration.
4
Design administrative security policy and exclude emergency access accounts.
A Conditional Access policy is configured to require MFA for all administrators, explicitly excluding a dedicated cloud-only emergency access (break-glass) account.
This ensures compliance with administrative MFA requirements while preventing a total lockout if MFA services or primary authentication methods fail.

Anahtar Kavram

Designing hybrid identity and multi-tenant solutions that balance real-time on-premises policy enforcement, high availability through failover sync options, cross-tenant trust settings, and emergency access recovery.
Tahmini Süre:3m 0s
Soru 94Soru →

An enterprise manages its resources using a multi-level Azure management group hierarchy under a single Microsoft Entra tenant:

* Root Management Group
* Corporate (Management Group)
* Production (Management Group)
* Subscription-A
* Subscription-B
* Non-Production (Management Group)
* Subscription-C

You are designing a security and governance solution for a group of database administrators (DBAs). The solution must meet the following requirements:
1. The DBAs must be able to create, modify, and delete Azure SQL databases and SQL elastic pools across all subscriptions under the Production management group.
2. The DBAs must be able to view Azure SQL Server configurations but must not be able to create or delete SQL Servers, nor modify database firewall rules or virtual network rules.
3. The solution must minimize administrative overhead and enforce the principles of least privilege and scalable identity governance.

Which design should you recommend?

Cevabı ve açıklamayı göster

Cevap: Create a Microsoft Entra ID security group named DBA-Production-Group. Define a custom Azure RBAC role with Actions set to ["Microsoft.Sql/servers/read", "Microsoft.Sql/servers/databases/*", "Microsoft.Sql/servers/elasticPools/*"] and NotActions set to []. Assign the custom role to the DBA-Production-Group at the scope of the Production management group.

Cevap

Create a Microsoft Entra ID security group named DBA-Production-Group. Define a custom Azure RBAC role with Actions set to ["Microsoft.Sql/servers/read", "Microsoft.Sql/servers/databases/*", "Microsoft.Sql/servers/elasticPools/*"] and NotActions set to []. Assign the custom role to the DBA-Production-Group at the scope of the Production management group.
The correct approach creates an Entra ID security group to adhere to scalable identity governance. It defines a custom RBAC role that explicitly lists the required actions (reading SQL Server configurations, and full access on databases and elastic pools). Because the custom role does not include write or delete operations on servers, or access to firewall/network sub-resources, those capabilities are restricted by default. Assigning this custom role at the Production management group scope ensures that permissions inherit automatically to all underlying subscriptions, minimizing administration.

Adım Adım Çözüm

1
Analyze the scope and governance requirements.
Identify that the DBAs require access to all subscriptions under the Production management group (Subscription-A and Subscription-B). Defining the assignment at the Production management group scope ensures inheritance, minimizing administrative overhead.
Azure RBAC assignments inherit down the resource hierarchy from management groups to subscriptions and resource groups.
2
Determine the identity structure.
Create a Microsoft Entra ID security group (DBA-Production-Group) and assign roles to the group rather than individual users.
Assigning RBAC roles to groups instead of individual accounts is a critical best practice for scalable identity governance.
3
Define the custom role permissions.
Define Actions as ["Microsoft.Sql/servers/read", "Microsoft.Sql/servers/databases/*", "Microsoft.Sql/servers/elasticPools/*"] and NotActions as [].
By explicitly granting only the necessary permissions, the role implicitly denies unauthorized actions (such as server creation, deletion, or firewall modification) without relying on broad wildcards or complex NotActions.

Anahtar Kavram

Azure RBAC Custom Roles and Scope Inheritance
Soru 95Soru →

An organization is designing a governance strategy for an Azure environment consisting of a root management group and several production subscriptions. You need to implement Azure Policy definitions to enforce compliance for the following requirements:
- All newly deployed Azure storage accounts must have shared key access disabled. If a deployment template attempts to create a storage account with shared key access enabled, the deployment must be blocked.
- All virtual machines must be automatically configured with backup protection. If a virtual machine is deployed without a backup configuration, the policy must deploy the required resources and configure the backup.

Which two policy effects should you recommend to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The Deny effect to block the deployment of storage accounts with shared key access enabled; The DeployIfNotExists effect to configure backup protection for virtual machines

Cevap

Recommend the Deny effect to block the deployment of storage accounts with shared key access enabled, and recommend the DeployIfNotExists effect to configure backup protection for virtual machines.
To block resource creation that fails to comply with the disabled shared key setting, the Deny effect must be used. To automatically deploy backup configurations (which represent related/secondary resources) when a virtual machine is created, the DeployIfNotExists effect is required since it triggers a template deployment to remediate non-compliance.

Adım Adım Çözüm

1
Determine the policy effect needed to block resource deployments that do not match the configuration rules.
The Deny effect is selected for the storage account shared key configuration.
The Deny effect prevents the deployment of resources that violate policy rules.
2
Determine the policy effect needed to deploy nested/related resources automatically for non-compliant resources.
The DeployIfNotExists effect is selected for the virtual machine backup configuration.
The DeployIfNotExists effect allows deploying additional resources (such as backup resources or extensions) when they do not exist.

Anahtar Kavram

Azure Policy effects mapping to blocking and automatic remediation scenarios
Tahmini Süre:1m 30s
Soru 96Soru →

Nebula Diagnostics is designing an Azure governance solution. The compliance team mandates that all newly created Azure Virtual Machines must have the Azure Monitor Agent installed. The virtual machine deployment must not be blocked if the agent is missing at the time of creation; instead, the agent must be deployed and configured automatically post-deployment.

Which Azure Policy effect should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: DeployIfNotExists

Cevap

DeployIfNotExists
The DeployIfNotExists effect is the correct choice because it evaluates compliance after a resource is created or updated, and then deploys a template (such as the Azure Monitor Agent extension) if the resource is found to be non-compliant. This ensures that the virtual machine deployment is not blocked and compliance is achieved automatically.

Adım Adım Çözüm

1
Analyze the compliance requirement.
The requirement states that the Azure Monitor Agent must be installed and configured automatically for all new virtual machines.
This establishes that automated remediation is required rather than simple logging or manual intervention.
2
Analyze the deployment flow constraint.
The virtual machine creation must not be blocked, which rules out preventative effects.
Preventing resource creation directly is handled by the Deny effect, which cannot be used here because the virtual machine deployment must be allowed to succeed first.
3
Select the policy effect that deploys resources dynamically.
Identify DeployIfNotExists as the correct effect for template-based resource deployment (such as VM extensions) that triggers after a resource is successfully created or updated.
DeployIfNotExists allows the VM to be deployed first, then evaluates compliance and deploys the Azure Monitor Agent extension if it is missing, matching all requirements.

Anahtar Kavram

Azure Policy Effects for Automated Remediation
Soru 97Soru →

Arrange the levels of the Azure resource hierarchy in order from the highest scope (broadest access) to the lowest scope (most granular access).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of the Azure resource hierarchy from highest to lowest scope is: Management Groups, Subscriptions, Resource Groups, and Resources.
The correct order from broadest to most granular scope is Management Groups, Subscriptions, Resource Groups, and Resources. This structure governs scope inheritance, where permissions and policies assigned at higher scopes are inherited by lower scopes.

Adım Adım Çözüm

1
Identify the broadest administrative boundary used for managing multiple subscriptions.
Management Groups represent the highest level.
Management groups allow you to organize subscriptions and apply governance controls at scale.
2
Identify the billing and management boundary beneath Management Groups.
Subscriptions sit below Management Groups.
Subscriptions group resources together and are associated with a single billing account.
3
Determine the logical container within a subscription.
Resource Groups are positioned beneath Subscriptions.
Resource groups organize resources that share the same lifecycle and deployment cycle.
4
Identify the individual instances of Azure services.
Resources sit at the lowest level of the hierarchy.
Resources are the final deployable units (like VMs or storage accounts) inheriting all access and policies from parent scopes.

Anahtar Kavram

Azure Resource Hierarchy and Scope Inheritance
Tahmini Süre:45s
Soru 98Soru →

An enterprise is designing a comprehensive monitoring and log routing architecture for various workloads across Azure subscriptions. You need to match the administrative and operational requirements with the most appropriate Azure Monitor destination or feature to minimize costs and administrative overhead.

Match the requirements on the left to their corresponding destinations or features on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Retain application diagnostic logs for seven years to meet regulatory compliance while minimizing storage costs.
Collect, correlate, and run complex Kusto Query Language (KQL) queries on resource telemetry across multiple subscriptions.
Stream Azure resource logs in near-real-time to an external third-party Security Information and Event Management (SIEM) system.
Monitor IP traffic patterns, identify traffic hotspots, and analyze security group rule hits for virtual networks.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct matches are: (1) Retaining logs for seven years to minimize costs matches Azure Storage account; (2) Running KQL queries and correlating telemetry matches Azure Monitor Log Analytics workspace; (3) Streaming logs to an external SIEM matches Azure Event Hubs; (4) Monitoring IP traffic patterns and NSG rules matches Azure Network Watcher Traffic Analytics.
Each requirement maps to a specific destination in Azure Monitor: Azure Storage accounts provide low-cost long-term archiving; Log Analytics workspaces enable centralized KQL querying; Azure Event Hubs provides near-real-time integration with external SIEMs; and Traffic Analytics processes NSG flow logs to analyze network traffic patterns.

Adım Adım Çözüm

1
Analyze the log retention and cost requirement.
Identify that seven-year retention requires cold storage to minimize costs. Azure Storage accounts with lifecycle management are the most cost-effective choice for long-term archiving.
Log Analytics workspaces charge significant fees for data retention beyond the default period, whereas Azure Storage Archive tier is highly cost-effective.
2
Analyze the correlation and query requirement.
Identify that running Kusto Query Language (KQL) queries across subscriptions requires a centralized repository.
Azure Monitor Log Analytics workspace provides the KQL engine and native cross-workspace or cross-subscription querying capabilities.
3
Analyze the integration requirement for external SIEM.
Identify the mechanism for streaming logs in near-real-time to third-party endpoints.
Azure Event Hubs serves as the event ingestor and message bus used to route diagnostic logs to external systems like Splunk or QRadar.
4
Analyze the network security and flow logging requirement.
Identify the tool that visualizes and analyzes NSG flow logs.
Azure Network Watcher Traffic Analytics uses NSG flow logs to provide dashboard visualizations of traffic patterns and security rule behaviors.

Anahtar Kavram

Matching Azure log sources and regulatory requirements to the correct Azure Monitor diagnostic destinations.
Tahmini Süre:2m 0s
Soru 99Soru →

Vanguard Retail Group has an on-premises Active Directory Domain Services (AD DS) forest named corp.vanguardretail.com that contains 14,200 users. You are designing a hybrid identity and governance solution to integrate the on-premises environment with a new Microsoft Entra ID tenant.

The solution must meet the following requirements:
- Users must be able to sign in to cloud services using their on-premises passwords, even if the connection between the on-premises network and Azure is temporarily lost.
- Users must have the ability to reset their passwords in the cloud, with the new passwords synchronizing back to the on-premises AD DS.
- All user accounts must be subject to Conditional Access policies that require Multi-Factor Authentication (MFA), but the design must prevent administrative lockout during an MFA service disruption.
- Privileged administrative roles must not be permanently assigned to users, and access permissions for Azure subscriptions must be managed to minimize administrative overhead.

Which design solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabled. Create two emergency access accounts that are excluded from all Conditional Access MFA policies. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments. Assign Azure RBAC roles to Microsoft Entra ID security groups.

Cevap

Deploy Microsoft Entra Connect with Password Hash Synchronization (PHS) and password writeback enabled. Create two emergency access accounts that are excluded from all Conditional Access MFA policies. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments. Assign Azure RBAC roles to Microsoft Entra ID security groups.
The correct solution involves deploying Password Hash Synchronization (PHS) because it enables users to sign in to cloud services using their on-premises passwords even if the on-premises network or connection is lost. It also enables leaked credential detection. Password writeback on Microsoft Entra Connect enables self-service password reset (SSPR) changes to sync back to the on-premises Active Directory. Excluding emergency access accounts from Conditional Access MFA policies prevents lockout during MFA provider outages. Using Privileged Identity Management (PIM) with eligible assignments prevents standing administrative privileges, and assigning RBAC roles to security groups rather than individual users reduces management overhead.

Adım Adım Çözüm

1
Determine the hybrid sync method.
Choose Password Hash Synchronization (PHS) with password writeback enabled.
This satisfies the requirement to authenticate using on-premises passwords even during a network disconnect, and enables password writeback for self-service password reset (SSPR).
2
Configure administrative lockout prevention.
Create two emergency access accounts and exclude them from Conditional Access MFA policies.
This ensures that administrators can access the tenant to troubleshoot if the MFA service experiences an outage.
3
Address privileged access governance.
Configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for administrative roles.
This enforces just-in-time (JIT) access and prevents permanent standing privileges.
4
Design resource access management.
Assign Azure RBAC roles to Microsoft Entra ID security groups.
This minimizes administrative overhead compared to assigning roles to individual user accounts.

Anahtar Kavram

Designing hybrid identity and access governance solutions using Microsoft Entra ID, Microsoft Entra Connect, and PIM.
Tahmini Süre:3m 0s
Soru 100Soru →

Novasphere Solutions has an on-premises Active Directory Domain Services (AD DS) forest named novasphere.local with 3,200 user accounts. You are designing a hybrid identity solution to integrate the on-premises directory with a new Microsoft Entra ID tenant. The solution must meet the following requirements:
- Users must be able to sign in to Azure resources using their on-premises credentials.
- In the event of an on-premises datacenter or internet connectivity outage, users must still be able to authenticate to cloud services.
- Users must have the ability to reset their own passwords in the cloud, and these changes must immediately reflect in the on-premises directory.
- The administrative overhead of the identity infrastructure must be minimized.

Which hybrid identity synchronization and configuration strategy should you recommend?

Cevabı ve açıklamayı göster

Cevap: Password Hash Synchronization (PHS) with Microsoft Entra Connect and password writeback enabled

Cevap

Password Hash Synchronization (PHS) with Microsoft Entra Connect and password writeback enabled
The correct strategy is to use Password Hash Synchronization (PHS) with password writeback enabled. PHS copies password hashes to Microsoft Entra ID, allowing authentication to occur completely in the cloud. This fulfills the business continuity requirement during an on-premises outage and minimizes administrative overhead. Enabling password writeback allows users to reset their passwords in the cloud and syncs those changes back to on-premises AD DS.

Adım Adım Çözüm

1
Analyze the business continuity requirement
Since users must authenticate to cloud services even during an on-premises outage, the authentication must not depend on on-premises infrastructure. This rules out Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS), pointing to Password Hash Synchronization (PHS).
PHS allows authentication requests to be handled entirely by Microsoft Entra ID in the cloud.
2
Analyze the self-service password reset (SSPR) requirement
Users must reset their passwords in the cloud and have the change reflected on-premises. This requires password writeback.
Password writeback is a feature of Microsoft Entra Connect that copies cloud-initiated password changes back to on-premises AD DS.
3
Evaluate the administrative overhead constraint
PHS has the lowest administrative overhead compared to PTA and AD FS, as it does not require hosting and maintaining additional authentication agents or complex federation infrastructure.
Minimizing administrative overhead is achieved by choosing the simplest model that meets all technical requirements.

Anahtar Kavram

Selecting the appropriate hybrid identity synchronization method and configuring password writeback to satisfy business continuity, administrative overhead, and self-service password reset constraints.
ÖncekiSayfa 5 / 60Sonraki
Tüm alıştırma soruları — Microsoft Azure Solutions Architect (AZ-305) | Examkin