Real Exam Questions AZ-303 Dumps Exam Questions in here [Nov-2021]
Get Latest Nov-2021 Conduct effective penetration tests using AZ-303
NEW QUESTION 68
You have an Azure subscription that contains 100 virtual machines.
You have a set of PowerShell scripts that validate the virtual machine environment.
You need to run the scripts whenever there is an operating system update on the virtual machines. The solution must minimize implementation time and recurring costs.
Which three resources should you use to implement the scripts? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. an alert action group
- B. an alert rule
- C. an Azure Automation runbook
- D. an Azure Monitor query
- E. a virtual machine that has network access to the 100 virtual machines
Answer: A,B,C
Explanation:
Section: [none]
Explanation:
E: Step 1: Create alert
In your Automation account, select Alerts under Monitoring, and then select New alert rule.
A: Step 2: Configure action groups for your alerts
Once you have your alerts configured, you can set up an action group, which is a group of actions to use across multiple alerts. The actions can include email notifications, runbooks, webhooks, and much more.
C: Use an Azure Automation runbook to run the powershell scripts.
Note: The Azure Automation Process Automation feature supports several types of runbooks, such as the PowerShell runbook, which is a text runbook based on Windows PowerShell.scripting.
Reference:
https://docs.microsoft.com/en-us/azure/automation/update-management/configure-alerts
https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types
NEW QUESTION 69
SIMULATION
Click to expand each objective. To connect to the Azure portal, type https://portal.azure.com in the browser address bar.
When you are finished performing all the tasks, click the 'Next' button.
Note that you cannot return to the lab once you click the 'Next' button. Scoring occur in the background while you complete the rest of the exam.
Overview
The following section of the exam is a lab. In this section, you will perform a set of tasks in a live environment.
While most functionality will be available to you as it would be in a live environment, some functionality (e.g., copy and paste, ability to navigate to external websites) will not be possible by design.
Scoring is based on the outcome of performing the tasks stated in the lab. In other words, it doesn't matter how you accomplish the task, if you successfully perform it, you will earn credit for that task.
Labs are not timed separately, and this exam may have more than one lab that you must complete. You can use as much time as you would like to complete each lab. But, you should manage your time appropriately to ensure that you are able to complete the lab(s) and all other sections of the exam in the time provided.
Please note that once you submit your work by clicking the Next button within a lab, you will NOT be able to return to the lab.
To start the lab
You may start the lab by clicking the Next button.
Another administrator reports that she is unable to configure a web app named corplod10217507n3 to prevent all connections from an IP address of 11.0.0.11.
You need to modify corplod10217507n3 to successfully prevent the connections from the IP address. The solution must minimize Azure-related costs.
What should you do from the Azure portal?
Answer:
Explanation:
See explanation below.
Section: [none]
Explanation:
Step 1:
Find and select application corplod10217507n3:
1. In the Azure portal, on the left navigation panel, click Azure Active Directory.
2. In the Azure Active Directory blade, click Enterprise applications.
Step 2:
To add an IP restriction rule to your app, use the menu to open Network>IP Restrictions and click on Configure IP Restrictions
Step 3:
Click Add rule
You can click on [+] Add to add a new IP restriction rule. Once you add a rule, it will become effective immediately.
Step 4:
Add name, IP address of 11.0.0.11, select Deny, and click Add Rule
References:
https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions
NEW QUESTION 70
You have an Azure subscription.
You plan to deploy an app that has a web front end and an application tier.
You need to recommend a load balancing solution that meets the following requirements:
* Internet to web tier:
- Provides URL-based routing
- Supports connection draining
- Prevents SQL injection attacks
* Web tier to application tier:
- Provides port forwarding
- Supports HTTPS health probes
- Supports an availability set as a backend pool
Which load balancing solution should you recommend for each tier? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: An Azure Application Gateway that has a web application firewall (WAF) Azure Application Gateway offers a web application firewall (WAF) that provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks.
Application Gateway operates as an application delivery controller (ADC). It offers Secure Sockets Layer (SSL) termination, cookie-based session affinity, round-robin load distribution, content-based routing, ability to host multiple websites, and security enhancements.
Box 2: An internal Azure Standard Load Balancer
The internet to web tier is the public interface, while the web tier to application tier should be internal.
Note: When using load-balancing rules with Azure Load Balancer, you need to specify a health probes to allow Load Balancer to detect the backend endpoint status.
Health probes support the TCP, HTTP, HTTPS protocols.
References:
https://docs.microsoft.com/en-us/azure/application-gateway/waf-overview
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview
NEW QUESTION 71
You have an Azure App Service app.
You need to implement tracing for the app. The tracing information must include the following:
* Usage trends
* AJAX call responses
* Page load speed by browser
* Server and browser exceptions
What should you do?
- A. Configure custom logs in Azure Log Analytics.
- B. Configure IIS logging in Azure Log Analytics.
- C. Enable the Azure Application Insights site extension.
- D. Configure a connection monitor in Azure Network Watcher.
Answer: C
Explanation:
Section: [none]
Explanation:
For web pages, Application Insights JavaScript SDK automatically collects AJAX calls as dependencies.
Note: Some of the things you can track or collect are:
What are the most popular webpages in your application, at what time of day and where is that traffic coming from?
Dependency rates or response times and failure rates to find out if there's an external service that's causing performance issues on your app, maybe a user is using a portal to get through to your application and there are response time issues going through there for instance.
Exceptions for both server and browser information, as well as page views and load performance from the end users' side.
Reference:
https://azure.microsoft.com/en-us/blog/ajax-collection-in-application-insights/
https://blog.pragmaticworks.com/what-is-application-insights
NEW QUESTION 72
You need to configure the Device settings to meet the technical requirements and the user requirements.
Which two settings should you modify? To answer, select the appropriate settings in the answer area.
Answer:
Explanation:
Explanation
Box 1: Selected
Only selected users should be able to join devices
Box 2: Yes
Require Multi-Factor Auth to join devices.
From scenario:
* Ensure that only users who are part of a group named Pilot can join devices to Azure AD
* Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
NEW QUESTION 73
You create the following Azure role definition.
You need to create Role1 by using the role definition.
Which two values should you modify before you create Role1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. AssignableScopes
- B. Id
- C. IsCustom
- D. DataActions
- E. Description
Answer: A,C
Explanation:
Section: [none]
Explanation:
Part of example:
"IsCustom": true,
"AssignableScopes": [
"/subscriptions/{subscriptionId1}",
"/subscriptions/{subscriptionId2}",
"/subscriptions/{subscriptionId3}"
The following shows what a custom role looks like as displayed in JSON format. This custom role can be used for monitoring and restarting virtual machines.
{
"Name": "Virtual Machine Operator",
"Id": "88888888-8888-8888-8888-888888888888",
"IsCustom": true,
"Description": "Can monitor and restart virtual machines.",
"Actions": [
"Microsoft.Storage/*/read",
"Microsoft.Network/*/read",
"Microsoft.Compute/*/read",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Authorization/*/read",
"Microsoft.ResourceHealth/availabilityStatuses/read",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Insights/alertRules/*",
"Microsoft.Insights/diagnosticSettings/*",
"Microsoft.Support/*"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/{subscriptionId1}",
"/subscriptions/{subscriptionId2}",
"/subscriptions/{subscriptionId3}"
]
}
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles
NEW QUESTION 74
You need to ensure that you can implement Azure AD Seamless SSO for Fabrikam. The solution must meet the following requirements:
Support the planned changes.
Meet the authentication and authorization requirements.
What should you do?
- A. From the Litware.com tenant, add a custom domain named fabrikam com.
- B. Create a new Azure AD tenant named fabrikam.com
- C. From the Fabrikam forest, configure all users to have a UPN suffix ofLitware.com.
- D. From the Fabrikam forest, configure an additional UPN suffix of Litware.com.
Answer: A
NEW QUESTION 75
You create a virtual machine scale set named Scale1. Scale1 is configured as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Answer:
Explanation:
Explanation:
4 virtual machines
4 virtual machines
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-autoscale-portal
NEW QUESTION 76
You plan to create an Azure Storage account named storage1 that will store blobs and be accessed by Azure Databricks.
You need to ensure that you can set permissions for individual blobs by using Azure Active Directory (Azure AD) authentication.
Which Advanced setting should you enable for storage1?
- A. Large file shares
- B. NFS v3
- C. Hierarchical namespace
- D. Blob soft delete
Answer: C
Explanation:
Section: [none]
Explanation:
Question: Do I have to enable support for ACLs?
No. Access control via ACLs is enabled for a storage account as long as the Hierarchical Namespace (HNS) feature is turned ON.
Note 1: We [Microsoft] are pleased to share the general availability of Azure Active Directory (AD) based access control for Azure Storage Blobs and Queues. Enterprises can now grant specific data access permissions to users and service identities from their Azure AD tenant using Azure's Role-based access control (RBAC).
Note 2: Azure Data Lake Storage Gen2 implements an access control model that supports both Azure role- based access control (Azure RBAC) and POSIX-like access control lists (ACLs).
You can associate a security principal with an access level for files and directories. These associations are captured in an access control list (ACL). Each file and directory in your storage account has an access control list. When a security principal attempts an operation on a file or directory, An ACL check determines whether that security principal (user, group, service principal, or managed identity) has the correct permission level to perform the operation.
Incorrect Answers:
D: Blob soft delete protects your data from being accidentally or erroneously modified or deleted. When blob soft delete is enabled for a storage account, blobs, blob versions, and snapshots in that storage account may be recovered after they are deleted, within a retention period that you specify.
Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control#access-control-lists-on- files-and-directories
https://azure.microsoft.com/en-us/blog/azure-storage-support-for-azure-ad-based-access-control-now- generally-available/
NEW QUESTION 77
You have an Azure subscription that includes an Azure key vault named Vault1.
You create the Azure virtual machines shown in the following table.
You enable Azure Disk Encryption for all the virtual machines and use the -VolumeType All parameter.
You add data disks to the virtual machines as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Premium and standard, but not basic, account types support disk encryption.
Disk encryption requires managed disks.
References:
https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-overview
NEW QUESTION 78
Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1.
RG1 contains resources that were deployed by using templates.
You need to view the date and time when the resources were created in RG1.
Solution: From the RG1 blade, you click Deployments.
Does this meet the goal?
- A. No
- B. Yes
Answer: B
Explanation:
Section: [none]
Explanation:
From the RG1 blade, click Deployments. You see a history of deployment for the resource group.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first- template?tabs=azure-powershell
NEW QUESTION 79
Your network contains an on-premises Active Directory domain. The domain contains the Hyper-V failover clusters shown in the following table.
You plan to assess and migrate the virtual machines by using Azure Migrate.
What is the minimum number of Azure Migrate appliances and Microsoft Azure Recovery Services (MARS) agents required?
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/migrate/tutorial-migrate-hyper-v
NEW QUESTION 80
HOTSPOT
You have an Azure Resource Manager template named Template1 in the library as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer:
Explanation:
Section: [none]
Explanation/Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-syntax
NEW QUESTION 81
DRAG DROP
You need to use an Azure logic app to receive a notification when an administrator modifies the settings of a virtual machine in a resource group named RG1.
Which three components should you create next in the Logic Apps Designer? To answer, move the appropriate components from the list of components to the answer area and arrange them in the correct order.
Select and Place:
Answer:
Explanation:
Section: [none]
Explanation:
Step 1: an Azure Event Grid trigger
First add an Event grid trigger that monitors the resource group for your virtual machine.
Step 2: a conditional control
To run your logic app workflow only when a specific event happens, add a condition that checks for virtual machine "write" operations.
Step 3: an action
Now add an action so that you get an email when the specified condition is true.
References:
https://docs.microsoft.com/en-us/azure/event-grid/monitor-virtual-machine-changes-event-grid-logic-app
NEW QUESTION 82
You manage a solution in Azure that consists of a single application which runs on a virtual machine (VM).
Traffic to the application has increased dramatically.
The application must not experience any downtime and scaling must be dynamically defined.
You need to define an auto-scale strategy to ensure that the VM can handle the workload.
Which three options should you recommend? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
- A. Deploy application automatic horizontal scaling.
- B. Create a VM availability set.
- C. Deploy application automatic vertical scaling.
- D. Deploy a custom auto-scale implementation.
https://stackoverflow.com/questions/38112816/difference-in-azure-availability-sets-and-scale-sets - E. Create a VM scale set.
Answer: A,D,E
NEW QUESTION 83
Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
A user named Admin1 attempts to create an access review from the Azure Active Directory admin center and discovers that the Access reviews settings are unavailable. Admin1 discovers that all the other Identity Governance settings are available.
Admin1 is assigned the User administrator, Compliance administrator, and Security administrator roles.
You need to ensure that Admin1 can create access reviews in contoso.com.
Solution: You assign the Service administrator role to Admin1.
Does this meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
Section: [none]
Explanation:
Instead use Azure AD Privileged Identity Management.
Note: PIM essentially helps you manage the who, what, when, where, and why for resources that you care about. Key features of PIM include:
* Conduct access reviews to ensure users still need roles
References:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
NEW QUESTION 84
You have an Azure subscription that contains three virtual networks named VNet1, VNet2, and VNet3. VNet2 contains a virtual appliance named VM2 that operates as a router.
You are configuring the virtual networks in a hub and spoke topology that uses VNet2 as the hub network.
You plan to configure peering between VNet1 and VNet2 and between VNet2 and VNet3.
You need to provide connectivity between VNet1 and VNet3 through VNet2.
Which two configurations should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. On the peering connections, allow forwarded traffic
- B. Create route tables and assign the table to subnets
- C. On the peering connections, use remote gateways
- D. Create a route filter
- E. On the peering connections, allow gateway transit
Answer: C,E
Explanation:
Allow gateway transit: Check this box if you have a virtual network gateway attached to this virtual network and want to allow traffic from the peered virtual network to flow through the gateway.
The peered virtual network must have the Use remote gateways checkbox checked when setting up the peering from the other virtual network to this virtual network.
Note: VNet2 is the hub network.
References:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#requirements-and- constraints
NEW QUESTION 85
You create a virtual machine scale set named Scale1. Scale1 is configured as shown in the following exhibit.
The subscription contains the Azure SQL databases shown in the following table.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Box 1:
The Autoscale scale out rule increases the number of VMs by 2 if the CPU threshold is 80% or higher. The initial instance count is 4 and rises to 6 when the 2 extra instances of VMs are added.
Box 2:
The Autoscale scale in rule decreases the number of VMs by 4 if the CPU threshold is 30% or lower. The initial instance count is 4 and thus cannot be reduced to 0 as the minimum instances is set to 2. Instances are only added when the CPU threshold reaches 80%.
References:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-overview
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-best-practices
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-common-scale-patterns
NEW QUESTION 86
You create the Azure resources shown in the following table.
You attempt to add a role assignment to a resource group as shown in the following exhibit.
What should you do to ensure that you can assign VM2 the Reader role for the resource group?
- A. Configure just in time (JIT) VM access on VM2.
- B. Modify the Reader role at the subscription level.
- C. Assign a managed identity to VM2.
- D. Configure Access control (IAM) on VM2.
Answer: C
NEW QUESTION 87
You have an Azure subscription.
You create a custom role in Azure by using the following Azure Resource Manager template.
You assign the role to a user named User1.
Which action can User1 perform?
- A. Delete virtual machines.
- B. Create support requests.
- C. Create resource groups.
- D. Create virtual machines.
Answer: B
Explanation:
Section: [none]
Explanation:
The "Microsoft.Support/*" operation will allow the user to create support tickets.
References:
https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell
NEW QUESTION 88
You create and save an Azure Resource Manager template named Template1 that includes the following four sections.
You deploy template1.
For each of the following statement, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION 89
You have an Azure SQL database named DB1.
You plan to create the following four tables in DB1 by using the following code.
Table1.
Table2.
Table3.
Table4.
You need to identify which table must be created last.
What should you identify?
- A. Table4
- B. Table3
- C. Table2
- D. Table1
Answer: C
Explanation:
Section: [none]
Explanation:
Table1 references Table4. Therefore Table4 must be created before Table1.
Table2 references Table1 and Table3. Therefore Table1 and Table3 must be created before Table2.
Note: FOREIGN KEY REFERENCES is a constraint that provides referential integrity for the data in the column or columns. FOREIGN KEY constraints require that each value in the column exists in the corresponding referenced column or columns in the referenced table. FOREIGN KEY constraints can reference only columns that are PRIMARY KEY or UNIQUE constraints in the referenced table or columns referenced in a UNIQUE INDEX on the referenced table.
Incorrect Answers:
A: Table1 is referenced by Table2 and should be crated before Table2.
C: Table3 is referenced by Table2 and should be crated before Table2.
D: Table4 is referenced by Table1 and should be crated before Table1.
Reference:
https://docs.microsoft.com/en-us/sql/t-sql/statements/create-table-transact-sql?view=sql-server-ver15
NEW QUESTION 90
You have two Azure SQL Database managed instances in different Azure regions.
You plan to configure the managed instances in an instance failover group.
What should you configure before you can add the managed instances to the instance failover group?
- A. an Azure Application Gateway that has managed instance endpoints in a backend pool
- B. Azure Private Link that has endpoints on two virtual networks
- C. an internal Azure Load Balancer instance that has managed instance endpoints in a backend pool
- D. a Site-to-Site VPN between the virtual networks that contain the instances
Answer: D
Explanation:
Explanation
For two managed instances to participate in a failover group, there must be either ExpressRoute or a gateway configured between the virtual networks of the two managed instances to allow network communication.
You create the two VPN gateways and connect them.
* Create the gateway for the virtual network of your primary managed instance using the Azure portal.
* Create the gateway for the virtual network of your secondary managed instance using the Azure portal.
* Create a bidirectional connection between the two gateways of the two virtual networks.
Reference:
https://docs.microsoft.com/en-us/azure/azure-sql/managed-instance/failover-group-add-instance-tutorial?tabs=az
NEW QUESTION 91
You plan to use the Azure Import/Export service to copy files to a storage account.
Which two files should you create before you prepare the drives for the import job? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. a driveset CSV file
- B. a JSON configuration file
- C. a PowerShell PS1 file
- D. an XML manifest file
- E. a dataset CSV file
Answer: A,E
Explanation:
Section: [none]
Explanation:
A: Modify the dataset.csv file in the root folder where the tool resides. Depending on whether you want to import a file or folder or both, add entries in the dataset.csv file C: Modify the driveset.csv file in the root folder where the tool resides.
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-data-to-files
NEW QUESTION 92
HOTSPOT
You have Azure Storage accounts as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer:
Explanation:
Section: [none]
Explanation:
Note: The three different storage account options are: General-purpose v2 (GPv2) accounts, General-purpose v1 (GPv1) accounts, and Blob storage accounts.
* General-purpose v2 (GPv2) accounts are storage accounts that support all of the latest features for blobs, files, queues, and tables.
* Blob storage accounts support all the same block blob features as GPv2, but are limited to supporting only block blobs.
* General-purpose v1 (GPv1) accounts provide access to all Azure Storage services, but may not have the latest features or the lowest per gigabyte pricing.
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-account-options
NEW QUESTION 93
......
Authentic Best resources for AZ-303 Online Practice Exam: https://www.dumpexams.com/AZ-303-real-answers.html
Get the superior quality AZ-303 Dumps with explanations waiting just for you, get it now: https://drive.google.com/open?id=1TbkN2A8Q4ncXU2dBYWPMgzHDTZYK1Yu1