Free Microsoft Azure Solutions Architect Expert Questions and Answers — Questions and Answers
Question 1: You have an on-premises Active Directory domain that is synchronized with an Azure Active Directory (Azure AD) tenant. <br> WebApp1 is an internal web application that is hosted on your premises. WebApp1 makes use of Windows Integrated authentication. <br> Some users access the on-premises network via remote access but do not have VPN access. You must grant single sign-on (SSO) access to WebApp1 to the remote users. <br> <br> What two features need to be incorporated into the solution? Each right response offers a piece of the answer.
- Azure Arc
- Azure AD Application Proxy (Correct answer)
- Conditional Access policies (Correct answer)
- Azure AD Privileged Identity Management (PIM)
Correct answer: Azure AD Application Proxy
Azure AD Application Proxy enables secure remote access to on-premises web applications without a VPN, publishing them as SaaS apps in Azure AD and supporting Windows Integrated authentication. Conditional Access policies can then be applied to these published applications to enforce security requirements like MFA or device compliance for remote users. Together, these features provide secure single sign-on access for remote users to on-premises applications.
Question 2: You have a security group called Group1 in your Azure Active Directory (Azure AD) tenant contoso.com. In Group1, assigned membership is configured. 50 people make up Group1, including 20 visitors. <br> You must offer a suggestion for how to assess Group1's membership. The answer must adhere to the following criteria: <br> ‥ Every three months, the examination must be automatically redone. <br> ‥ Each participant must be able to indicate whether they should belong in Group 1. <br> ‥ Users who claim that Group1 is not something they should be in must be automatically removed from Group1. <br> ‥ Users who fail to indicate whether they belong in Group 1 must be automatically removed from Group 1. <br> <br> What should the recommendation contain?
- Create an access review. (Correct answer)
- Implement Azure AD Privileged Identity Management (PIM).
- Implement Azure AD Identity Protection.
- Change the Membership type of Group1 to Dynamic User.
Correct answer: Create an access review.
Azure AD Access Reviews are designed precisely for this scenario. They allow you to review group memberships periodically (e.g., every three months), enable members to self-attest whether they still need access, and automatically remove users who either deny needing access or fail to respond within the review period. This automates the process of ensuring group memberships are current and appropriate, meeting all specified requirements.
Question 3: You are creating a sizable Azure environment with numerous subscriptions. <br> As a component of a governance solution, you intend to employ Azure Policy. <br> Which three scopes are available for Azure Policy definitions assignment? Each accurate response offers an entire resolution.
- subscriptions (Correct answer)
- resource groups (Correct answer)
- management groups (Correct answer)
- compute resources
Correct answer: subscriptions
Azure Policy definitions can be assigned at various levels within the Azure resource hierarchy to enforce governance rules. The three primary scopes available for assignment are management groups (for broad organizational policies), subscriptions (for policies specific to a billing or administrative boundary), and resource groups (for granular control over resources within a specific group). This hierarchical structure allows for flexible and targeted policy application.
Question 4: You have a bespoke application called Application1 in your Azure subscription. Application1 was created by Fabrikam, a third-party company. <br> Ltd. Role-based access control (RBAC) permissions were given to Fabrikam developers for the Application1 components. All users are granted access to the E5 plan for Microsoft 365. <br> <br> You must provide a remedy to determine whether the Fabrikam developers still need access to Application1. The answer must adhere to the following criteria: <br> <br> ‥ Every month, send an email to the manager of the developers listing the access permissions for Application1. <br> ‥ Automatically revoke access authorization if the manager doesn't check it. <br> ‥ Reduce development work. <br> <br> What ought to you suggest?
- Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.
- In Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources.
- Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.
- In Azure Active Directory (Azure AD), create an access review of Application1. (Correct answer)
Correct answer: In Azure Active Directory (Azure AD), create an access review of Application1.
Azure AD access reviews are a built-in feature designed to manage access to resources like applications efficiently. They allow for scheduled reviews of user access, automatically sending email notifications to managers and revoking access if not approved. This solution directly addresses all the requirements—monthly email, automatic revocation, and minimal development work—by leveraging an existing Azure AD capability.
Question 5: To host a stateless web application under an Azure subscription, you must deploy resources. The answer must adhere to the following criteria: <br> <br> ‥ Make the entire.NET framework available. <br> ‥ Offer redundancy in case an Azure region goes down. <br> ‥ Permit administrators to install application dependencies on the operating system. <br> <br> Solution: You put up an autoscaling Azure virtual machine scale set. <br> Is the objective being met?
- Yes
- No (Correct answer)
- Maybe
Correct answer: No
The proposed solution, an autoscaling Azure Virtual Machine Scale Set (VMSS), does not fully meet the objective in the most appropriate way for a stateless web application. While VMSS allows for the full .NET framework, regional redundancy, and OS-level dependency installation, for a stateless application, best practice often involves packaging dependencies within an immutable image (e.g., a container) rather than relying on manual OS-level installations. This approach ensures consistency and simplifies scaling, which is typically desired for stateless services.
Question 6: You have a storage account in your Azure subscription. <br> Duplicate files can occasionally be written to the storage account by an application. <br> You have a PowerShell script that locates duplicate files in the storage account and removes them. The script is currently executed manually upon operations manager approval. <br> You must suggest a serverless solution that carries out the following tasks: <br> <br> ‥ Checks for duplicate files every hour by executing the script once. <br> ‥ Notifies the operations manager through email and asks for permission to delete the duplicate files. <br> ‥ Handles the Operations Manager's email answer, processing it to determine whether the deletion was authorized. <br> ‥ If the deletion was authorized, runs the script. <br> <br> What should the recommendation contain?
- Azure Functions and Azure Batch
- Azure Logic Apps and Azure Event Grid
- Azure Logic Apps and Azure Functions (Correct answer)
- Azure Pipelines and Azure Service Fabric
Correct answer: Azure Logic Apps and Azure Functions
This scenario requires workflow orchestration, scheduled execution, conditional logic for approval, and script execution. Azure Logic Apps are ideal for orchestrating complex workflows, handling scheduling, integrating with email for approvals, and managing conditional branching based on responses. Azure Functions are perfect for executing the PowerShell script in a serverless manner, as they can be triggered by Logic Apps and provide a cost-effective way to run code on demand.
Question 7: You are creating a program that will run on Azure. <br> The program will store video files with sizes varying from 50 MB to 12 GB. Users will be able to access the application online and it will employ certificate-based authentication. <br> You must suggest a location for the video files to be stored. The solution must minimize storage costs while offering the quickest read speed. <br> <br> What should you suggest?
- Azure Blob Storage (Correct answer)
- Azure SQL Database
- Azure Files
- Azure Data Lake Storage Gen2
Correct answer: Azure Blob Storage
Azure Blob Storage is the optimal choice for storing large, unstructured data like video files, offering high scalability and cost-effectiveness. It is designed for quick read speeds, especially when using appropriate access tiers and potentially a Content Delivery Network (CDN). Its ability to handle a wide range of file sizes (50 MB to 12 GB) while minimizing costs makes it superior to database solutions or file shares for this specific use case.
Free Microsoft Azure Solutions Architect Expert Questions and Answers
You have an on-premises Active Directory domain that is synchronized with an Azure Active Directory (Azure AD) tenant.
WebApp1 is an internal web application that is hosted on your premises.
WebApp1 makes use of Windows Integrated authentication.
Some users access the on-premises network via remote access but do not have VPN access.
You must grant single sign-on (SSO) access to WebApp1 to the remote users.
What two features need to be incorporated into the solution? Each right response offers a piece of the answer.