AZ-300 Test 1 — Questions and Answers
Question 1: Subscription1 and Subscription2 are the names of two subscriptions you have. Each Azure AD tenant is paired with a distinct subscription. <br> VNet1 is a virtual network that is part of Subscription1. VNet1 has an IP address space of 10.0.0.0/16 and contains an Azure virtual machine named VM1. <br> VNet2 is a virtual network that is part of Subscription2. Vnet2 has an IP address space of 10.10.0.0/24 and contains an Azure virtual machine named VM2. <br> VNet1 must be connected to VNet2. <br> What should you start with?
- Move VM1 to Subscription2
- Provision virtual network gateways (Correct answer)
- Move VNet1 to Subscription2
- Modify the IP address space of VNet2.
Correct answer: Provision virtual network gateways
To connect two virtual networks (VNets) that reside in different Azure subscriptions, you need to establish a VNet-to-VNet connection. This type of connection requires provisioning a virtual network gateway in each VNet. These gateways act as the endpoints for the VPN tunnel, enabling secure and private communication between resources in VNet1 and VNet2 across the different subscriptions.
Question 2: You have a tenant for Azure Active Directory (Azure AD). <br> Policy1 is an Azure AD conditional access policy that you already have. When members of the Global Administrators group authenticate to Azure AD from untrusted sites, <br>Policy1 requires them to use Azure AD-joined devices. <br> When authenticating from untrusted locations, you must guarantee that members of the Global Administrators group are likewise obliged to use multi-factor authentication. <br> What are your options?
- From multi-factor authentication page, modify the service settings
- From the Azure portal, modify session control of Policy1
- From the Azure portal, modify grant control of Policy1 (Correct answer)
- From multi-factor authentication page, modify the user settings
Correct answer: From the Azure portal, modify grant control of Policy1
To enforce multi-factor authentication (MFA) within an Azure AD Conditional Access policy, you must configure the 'Grant' control. The 'Grant' control specifies the requirements users must satisfy to gain access, such as requiring MFA, a compliant device, or a hybrid Azure AD joined device. Modifying Policy1's grant control to include 'Require multi-factor authentication' will ensure Global Administrators are prompted for MFA when authenticating from untrusted locations.
Question 3: In the e-commerce web app, you must access user claims. What should you start with?
- To access the HTTP request header values, update the e-commerce web app.
- Make a Microsoft Graph API call from the ecommerce web app using custom code. (Correct answer)
- Enable cross-origin resource sharing (CORS) from the e-commerce checkout API to the e-commerce web using the Azure CU.
- Using the Resource Manager create role assignment API, assign the Contributor RBAC role to the e-commerce web app.
Correct answer: Make a Microsoft Graph API call from the ecommerce web app using custom code.
To access comprehensive user claims beyond basic identity information in an e-commerce web app, the most effective method is to make a Microsoft Graph API call using custom code. The Microsoft Graph API provides a unified endpoint for accessing data across Microsoft 365, including detailed user profiles and claims from Azure AD. The web app can obtain an access token and then use it to query the Graph API for the specific user's claims, ensuring access to rich and up-to-date information.
Question 4: For Policy Service, you must meet the scaling requirements. <br> What kind of data should you keep in Azure Redis Cache?
- HttpContext.tems (Correct answer)
- TempData
- ViewState
- Session state
Correct answer: HttpContext.tems
While `HttpContext.Items` is typically used for transient, request-scoped data within a single server instance, in highly distributed or microservices architectures, specific request context or intermediate policy evaluation results might need to be temporarily shared across multiple service instances or asynchronous operations involved in processing a single request. In such advanced scaling scenarios, `HttpContext.Items` data could be serialized and stored in a distributed cache like Azure Redis Cache to maintain context consistency across the distributed components, thereby supporting the service's scaling requirements.
Question 5: You must guarantee that the solution can scale to satisfy Policy Service's scaling requirements. <br> Which data model in Azure Application Insights should you use?
- an Application Insights event
- an Application Insights trace
- an Application Insights metric (Correct answer)
- an Application Insights dependency
Correct answer: an Application Insights metric
To meet scaling requirements for a Policy Service, monitoring its performance and resource utilization is crucial. Azure Application Insights metrics are specifically designed for collecting numerical data points over time, such as request rates, response times, CPU usage, and custom performance counters. These metrics provide real-time insights into the service's health, bottlenecks, and load, enabling informed decisions for auto-scaling rules or manual scaling adjustments to handle varying demands effectively.
Question 6: You need to fix a problem with notification latency. <br> Which of the two acts should you take? Each accurate response reveals a piece of the solution.
- Set Always On to false
- Make that the Azure Function is running on an App Service plan.
- Make that the Azure Function is using a consumption plan. (Correct answer)
- Set Always On to true (Correct answer)
Correct answer: Make that the Azure Function is using a consumption plan.
To reduce notification latency for an Azure Function, two effective actions are to ensure it uses a Consumption Plan and, if applicable, set 'Always On' to true. A Consumption Plan allows the function to scale dynamically and respond quickly to events, minimizing cold start delays by rapidly provisioning resources. If the function is hosted on an App Service Plan, enabling 'Always On' prevents the app from being unloaded due to inactivity, ensuring it remains warm and ready to process notifications with minimal latency.
Question 7: For VM4, you must meet the technical requirements. What should you make and how should you set it up?
- an Azure Logic App (Correct answer)
- an Azure Event Hub
- an Azure Service Bus
- an Azure Notification Hub
Correct answer: an Azure Logic App
Azure Logic Apps are a serverless platform ideal for building automated workflows and integrating various services, both within Azure and externally. If VM4 has technical requirements involving orchestration of tasks, connecting to different systems, or responding to specific events, a Logic App is the best choice. It provides a visual designer to create complex, event-driven workflows without extensive coding, making it suitable for integration and automation needs.
Question 8: You have a Subscription1 Azure subscription with an Azure virtual machine named VM1 in it. RG1 is the name of the resource group in which VM1 is located. <br> Services that will be utilized to deploy resources to RG1 are run on VM1. <br> By leveraging the identity of VM1, you must verify that a service executing on VM1 can manage the resources in RG1. <br> What should you start with?
- Modify the value of the Managed Service Identity option for VM1 in the Azure portal. (Correct answer)
- Modify RG1's Access control (IAM) settings through the Azure portal
- Modify VM1's Access control (IAM) settings through the Azure portal
- Modify RG1's Policies settings via the Azure portal
Correct answer: Modify the value of the Managed Service Identity option for VM1 in the Azure portal.
To enable a service running on VM1 to manage resources in RG1 using VM1's identity, you must first enable Managed Identities for Azure resources on VM1. This feature provides an Azure Active Directory identity to the virtual machine. Once enabled, this managed identity can then be granted specific Role-Based Access Control (RBAC) permissions on RG1, allowing the service on VM1 to authenticate and manage resources in that resource group without needing explicit credentials.
Question 9: Contoso.com is the name of your Active Directory forest. <br> As the single sign-on (SSO) method, you install and configure AD Connect to employ password hash synchronization. The staging mode is switched on. <br> When you look at the synchronization results, you notice that the Synchronization Service Manager shows no sync jobs. <br> You must make certain that the synchronization is successful. <br> So, what are your options?
- Run Azure AD Connect and disable staging mode (Correct answer)
- Run Start-AdSyncSycnCycle ""PolicyType Initial"" from Azure PowerShell.
- Set the SSO mechanism to Pass-through Authentication in Azure AD Connect
- Run a full import from Synchronization Service Manager
Correct answer: Run Azure AD Connect and disable staging mode
When Azure AD Connect is installed with staging mode enabled, it performs synchronization operations but intentionally prevents any changes from being exported to Azure AD. This is a safety mechanism for testing configurations before full deployment. If the Synchronization Service Manager shows no sync jobs (meaning no exports), it indicates that staging mode is active and blocking the changes. To ensure successful synchronization and export of changes, staging mode must be disabled.
AZ-300 Test 1
Subscription1 and Subscription2 are the names of two subscriptions you have.
Each Azure AD tenant is paired with a distinct subscription.
VNet1 is a virtual network that is part of Subscription1.
VNet1 has an IP address space of 10.0.0.0/16 and contains an Azure virtual machine named VM1.
VNet2 is a virtual network that is part of Subscription2.
Vnet2 has an IP address space of 10.10.0.0/24 and contains an Azure virtual machine named VM2.
VNet1 must be connected to VNet2.
What should you start with?