AZ-303 Microsoft Azure Architect Technologies Questions and Answers

Active Directory Federation Services is a feature and web service in the Windows Server Operating System that allowssharing of identity information outside a company’s network.

Scenario: Technical Requirements include:

Prevent user passwords or hashes of passwords from being stored in Azure.

References:https://www.s herweb.com/blog/active-directory-federation-services/

A Recovery Services vault is a logical container that stores the backup data for each protected resource, such as Azure VMs. When the backup job for a protected resource runs, it creates arecovery point inside the Recovery Services vault.

Scenario:

There are three application tiers, each with five virtual machines.

Move all the virtual machines for App1 to Azure.

Ensure that all the virtual machines for App1 are protected bybackups.

References: https://docs.microsoft.com/en-us/azure/backup/quick-backup-vm-portal

Area 1: Start date..End Date

Theaccess review must be enforced until otherwise configured. We set End: Never

The access review must be completed within two weeks. We set Duration (in days) to 14

Area 2: Upon completion settings

A lack of response must not cause changes in theoperational environment. We set 'If reviewers don't respond: No change (which leave user's access unchanged)

Text Description automatically generated

Table Description automatically generated

Box 1: resources

Scenario: You must be able to configure deny permissions for RG1 and for the resources in Resource Group RG1.

Box 2: New-AzManagementGroupDeployment

Scenario: Litware has Azure ResourceManager (ARM) templates that deploy Azure Policy definitions and assignments to a management group.

The New-AzManagementGroupDeployment cmdlet adds a deployment at a management group.

To add a deployment at a management group, specify the management group, location and a template. The location tells Azure Resource Manager where to store the deployment data. The template is a JSON string that contains individual resources to be deployed. The template includes parameter placeholders for required resources and configurable property values, such as names and sizes.

Graphical user interface, text, application Description automatically generated

Graphical user interface, text, application Description automatically generated

Box 1: Selected

Only selected users should be able to join devices

Box 2: Yes

RequireMulti-Factor Auth to join devices.

From scenario:

• Ensure that only users who are part of a group named Pilot can join devices to Azure AD
• Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.

As App1 is public-facing we need an incoming security rule, related to the access ofthe web servers.

Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers: a SQL database, a web front end, and a processing middle tier.

Each tier is comprised of five virtual machines. Users access theweb front end by using HTTPS only.

Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage data on Windows, macOS, and Linux. You can use it to upload and download data from Azure blob storage.

Scenario:

Planned Changes include: move the existing product blueprint files to Azure Blob storage.

Technical Requirements include: Copy the blueprint files to Azure over the Internet.

References: https://docs.microsoft.com/en-us/azure/machine-learning/te am-data-science-process/move-data-to-azure-blob-using-azure-storage-explorer

Scenario: WebApp1 running on the AKS cluster must be able to retrieve secrets from KV1.

KV1 is an Azure Key Vault

Managed Identities are assigned to Azure resources which needs access to Azure Key Vault. This is the recommended approach as Azure automatically rotates the identity and app/service doesn’t have to manage the secret.

Azure Active Directory (Azure AD) pod-managed identities use Kubernetes primitives to associate managed identities for Azure resources and identities in Azure AD with pods.

The Litware and Fabrikam datacenters are not connected.

Azure AD Connect Cloud Sync provides support for synchronizing to an Azure AD tenant from a multi-forest disconnected Active Directory forest environment.