Microsoft AZ-305 Practice Test - Questions Answers

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overviewThis allows for limited-time fine grained access control to resources. So you can generate URL,specify duration (for month of April) and disseminate URL to 10 team members. On May 1, the SAStoken is automatically invalidated, denying team members continued access.

A: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client. Application Proxy includes both the Application Proxy service which runs in the cloud, and the Application Proxy connector which runs on an on-premises server.

You can configure single sign-on to an Application Proxy application.

C: Microsoft recommends using Application Proxy with pre-authentication and Conditional Access policies for remote access from the internet. An approach to provide Conditional Access for intranet use is to modernize applications so they can directly authenticate with AAD.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-config-ssohow-to https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-deploymentplan

https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviewsoverview#learn-about-access-reviewsHave reviews recur periodically: You can set up recurring access reviews of users at set frequenciessuch as weekly, monthly, quarterly or annually, and the reviewers will be notified at the start of eachreview. Reviewers can approve or deny access with a friendly interface and with the help of smartrecommendations. An administrator creates an access review of Group C with 50 member users and 25 guest users.

Makes it a self-review. 50 licenses for each user as self-reviewers.* https://docs.microsoft.com/enus/azure/active-directory/governance/access-reviews-overview#example-license-scenariosThere are 4 requirements and every single one is only met by access reviews.

https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviewsoverview#when-should-you-use-access-reviewsDynamic User is needed if a user must be automatically granted access on base of its attributes (department, jobtitle, location, etc.) https://techcommunity.microsoft.com/t5/itops-talkblog/dynamic-groups-in-azure-ad-and-microsoft-365/ba-p/2267494Implementing Azure AD PIM is no solution and absolutely not necessary for access reviews.

https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviewsoverview#where-do-you-create-reviews

Instead use Azure Network Watcher IP Flow Verify, which allows you to detect traffic filtering issues at a VM level. Note: IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

Reference:

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics

Instead use Azure Network Watcher to run IP flow verify to analyze the network traffic.

Note: Advisor is a personalized cloud consultant that helps you follow best practices to optimize your Azure deployments. It analyzes your resource configuration and usage telemetry and then recommends solutions that can help you improve the cost effectiveness, performance, high availability, and security of your Azure resources. With Advisor, you can:

Get proactive, actionable, and personalized best practices recommendations.

Improve the performance, security, and high availability of your resources, as you identify opportunities to reduce your overall Azure spend. Get recommendations with proposed actions inline.

Reference:

https://docs.microsoft.com/en-us/azure/advisor/advisor-overview

The Network Watcher Network performance monitor is a cloud-based hybrid network monitoring solution that helps you monitor network performance between various points in your network infrastructure. It also helps you monitor network connectivity to service and application endpoints and monitor the performance of Azure ExpressRoute.

Note:

IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment. IP flow verify looks at the rules for all Network Security Groups (NSGs) applied to the network interface, such as a subnet or virtual machine NIC. Traffic flow is then verified based on the configured settings to or from that network interface. IP flow verify is useful in confirming if a rule in a Network Security Group is blocking ingress or egress traffic to or from a virtual machine.

Reference:

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

Azure Policy evaluates resources in Azure by comparing the properties of those resources to business rules. Once your business rules have been formed, the policy definition or initiative is assigned to any scope of resources that Azure supports, such as management groups, subscriptions, resource groups, or individual resources.

Reference:

https://docs.microsoft.com/en-us/azure/governance/policy/overview

Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't more than 90 days in the past. Through activity logs, you can determine: what operations were taken on the resources in your subscription who started the operation when the operation occurred the status of the operation the values of other properties that might help you research the operation

Reference:

https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs

https://docs.microsoft.com/en-us/azure/automation/change-tracking

Reference:

https://docs.microsoft.com/en-us/azure/sql-database/sql-database-managed-instanceSQL Managed Instance allows existing SQL Server customers to lift and shift their on-premisesapplications to the cloud with minimal application and database changes. At the same time, SQLManaged Instance preserves all PaaS capabilities (automatic patching and version updates,automated backups, high availability) that drastically reduce management overhead and TCO. https://docs.microsoft.com/en-us/azure/azure-sql/managed-instance/transact-sql-tsql-differencessql-server#clr https://docs.microsoft.com/en-gb/azure/azure-sql/database/transact-sql-tsql-differences-sqlserver#transact-sql-syntax-not-supported-in-azure-sql-database