Microsoft AZ-303 Microsoft Azure Architect Technologies Exam Practice Test

Change the Service administrator for an Azure subscription

• Sign in to Account Center as the Account administrator.
• Select a subscription.
• On the right side, select Edit subscription details.

Scenario: Designate a new user named Admin1 as theservice administrator of the Azure subscription.

References:

Box 1: Selected

Only selected users should be able to join devices

Box 2: Yes

RequireMulti-Factor Auth to join devices.

From scenario:

• Ensure that only users who are part of a group named Pilot can join devices to Azure AD
• Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.

Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage data on Windows, macOS, and Linux. You can use it to upload and download data from Azure blob storage.

Scenario:

Planned Changes include: move the existing product blueprint files to Azure Blob storage.

Technical Requirements include: Copy the blueprint files to Azure over the Internet.

References: am-data-science-process/move-data-to-azure-blob-using-azure-storage-explorer

A Recovery Services vault is a logical container that stores the backup data for each protected resource, such as Azure VMs. When the backup job for a protected resource runs, it creates arecovery point inside the Recovery Services vault.

Scenario:

There are three application tiers, each with five virtual machines.

Move all the virtual machines for App1 to Azure.

Ensure that all the virtual machines for App1 are protected bybackups.

References:

Active Directory Federation Services is a feature and web service in the Windows Server Operating System that allowssharing of identity information outside a company’s network.

Scenario: Technical Requirements include:

Prevent user passwords or hashes of passwords from being stored in Azure.

References:h herweb.com/blog/active-directory-federation-services/

Box 1: Yes

Contoso is moving the existing product blueprint files to Azure Blob storage.

Use unmanaged standard storage for the hard disks of the virtual machines. We use Page Blobs for these.

Box 2: No

Box 3: No

Box 1: 3

One virtual network for every tier

Box 2: 1

Only one subnet for each tier, to minimize the number of open ports.

Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers:

• A SQLdatabase
• A web front end
• A processing middle tier

Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

Technical requirements:

• Move all the virtual machines for App1 to Azure.
• Minimize the number of open ports between the App1 tiers.

As App1 is public-facing we need an incoming security rule, related to the access ofthe web servers.

Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers: a SQL database, a web front end, and a processing middle tier.

Each tier is comprised of five virtual machines. Users access theweb front end by using HTTPS only.

Scenario: WebApp1 running on the AKS cluster must be able to retrieve secrets from KV1.

KV1 is an Azure Key Vault

Managed Identities are assigned to Azure resources which needs access to Azure Key Vault. This is the recommended approach as Azure automatically rotates the identity and app/service doesn’t have to manage the secret.

Azure Active Directory (Azure AD) pod-managed identities use Kubernetes primitives to associate managed identities for Azure resources and identities in Azure AD with pods.

Text Description automatically generated

Publishing a .NET Core WebJob to App Service from Visual Studio uses the same tooling as publishing an

ASP.NET Core app.

References:

https://docs.microsoft.com/en-us/azure/app-service/webjobs-dotnet-deploy-vs

ure/azure-monitor/learn/quick-collect-azurevm

Syslog is an event logging protocol that is common to Linux. Applications will send messages that may be stored on the local machine or delivered to a Syslog collector. When the Log Analytics agent for Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then sends the message to Azure Monitor where a corresponding record is created.

kubectl apply –f appl.yaml applies a configuration change to a resource from a file or stdin.

References:

bectl/overview/

ks

We should use a Conditional Access policy.

Note: There are two ways to secure user sign-in events by requiring multi-factor authentication in Azure AD. The first, and preferred, option is to set up a Conditional Access policy that requires multi-factor authentication under certain conditions. The second option is to enable each user for Azure Multi-Factor Authentication. When users are enabled individually, they perform multi-factor authentication each time they sign in (with some exceptions, such as when they sign in from trusted IP addresses or when the remembered devices feature is turned on).

Enabling Azure Multi-Factor Authentication using Conditional Access policies is the recommended approach. Changing user states is no longer recommended unless your licenses don't include Conditional Access as it requires users to perform MFA every time they sign in.

Application security groups enable you to configure network security as a natural extension of an application's structure, allowing you to group virtual machines and define network security policies based on those groups.

You can filter network traffic inbound to and outbound from a virtual network subnet with a network security group.

In staging mode, the server is active for import and synchronization, but it does not run any exports. A server in staging mode is not running password sync or password writeback, even if you selected these features during installation. When you disable staging mode, the server starts exporting, enables password sync, and enables password writeback.

Multi-region writes protects against any regional outage.

The databases in an elastic pool are on a single Azure SQL Database server and share a set number of resources at a set price.

Box 1: Yes

You have assigned the role, so you can remove it.

Box 2: Yes

Contributor role: Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC.

Box 3: No