2021 PremiumVCEDump Microsoft AZ-303 Dumps and Exam Test Engine
Microsoft AZ-303 DUMPS WITH REAL EXAM QUESTIONS
NEW QUESTION 106
SIMULATION
Click to expand each objective. To connect to the Azure portal, type https://portal.azure.com in the browser address bar.
When you are finished performing all the tasks, click the 'Next' button.
Note that you cannot return to the lab once you click the 'Next' button. Scoring occur in the background while you complete the rest of the exam.
Overview
The following section of the exam is a lab. In this section, you will perform a set of tasks in a live environment.
While most functionality will be available to you as it would be in a live environment, some functionality (e.g., copy and paste, ability to navigate to external websites) will not be possible by design.
Scoring is based on the outcome of performing the tasks stated in the lab. In other words, it doesn't matter how you accomplish the task, if you successfully perform it, you will earn credit for that task.
Labs are not timed separately, and this exam may have more than one lab that you must complete. You can use as much time as you would like to complete each lab. But, you should manage your time appropriately to ensure that you are able to complete the lab(s) and all other sections of the exam in the time provided.
Please note that once you submit your work by clicking the Next button within a lab, you will NOT be able to return to the lab.
To start the lab
You may start the lab by clicking the Next button.
You plan to host several secured websites on Web01.
You need to allow HTTPS over TCP port 443 to Web01 and to prevent HTTP over TCP port 80 to Web01.
What should you do from the Azure portal?
Answer:
Explanation:
See explanation below.
Section: [none]
Explanation:
You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.
A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.
Step A: Create a network security group
A1. Search for and select the resource group for the VM, choose Add, then search for and select Network security group.
A2. Select Create.
The Create network security group window opens.
A3. Create a network security group
Enter a name for your network security group.
Select or create a resource group, then select a location.
A4. Select Create to create the network security group.
Step B: Create an inbound security rule to allows HTTPS over TCP port 443 B1. Select your new network security group.
B2. Select Inbound security rules, then select Add.
B3. Add inbound rule
B4. Select Advanced.
From the drop-down menu, select HTTPS.
You can also verify by clicking Custom and selecting TCP port, and 443.
B5. Select Add to create the rule.
Repeat step B2-B5 to deny TCP port 80
B6. Select Inbound security rules, then select Add.
B7. Add inbound rule
B8. Select Advanced.
Clicking Custom and selecting TCP port, and 80.
B9. Select Deny.
Step C: Associate your network security group with a subnet
Your final step is to associate your network security group with a subnet or a specific network interface.
C1. In the Search resources, services, and docs box at the top of the portal, begin typing Web01. When the Web01 VM appears in the search results, select it.
C2. Under SETTINGS, select Networking. Select Configure the application security groups, select the Security Group you created in Step A, and then select Save, as shown in the following picture:
References:
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic
NEW QUESTION 107
Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are planning to create a virtual network that has a scale set that contains six virtual machines (VMs).
A monitoring solution on a different network will need access to the VMs inside the scale set.
You need to define public access to the VMs.
Solution: Design a scale set to automatically assign public IP addresses to all VMs.
Does the solution meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
Section: [none]
NEW QUESTION 108
You have SQL Server on an Azure virtual machine named SQL1.
You need to automate the backup of the databases on SQL1 by using Automated Backup v2 for the virtual machines. The backups must meet the following requirements:
* Meet a recovery point objective (RPO) of 15 minutes.
* Retain the backups for 30 days.
* Encrypt the backups at rest.
What should you provision as part of the backup solution?
- A. a Recovery Services vault
- B. an Azure Storage account
- C. Elastic Database jobs
- D. Azure Key Vault
Answer: B
Explanation:
Explanation
An Azure storage account is used for storing Automated Backup files in blob storage. A container is created at this location to store all backup files. The backup file naming convention includes the date, time, and database GUID.
Reference:
https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/automated-backup
NEW QUESTION 109
You have an Azure subscription that contains the storage accounts shown in the following table.
You enable Azure Advanced Threat Protection (ATP) for all the storage accounts.
You need to identify which storage accounts will generate Azure ATP alerts.
Which two storage accounts should you identify? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. storagecontoso1
- B. storaaecontoso5
Advanced threat protection for Azure Storage is currently available only for Blob Storage. https://docs.microsoft.com/en-us/azure/storage/common/storage-advanced-threat-protection?tabs=azure-portal - C. storagecontoso4
- D. storagecontoso2
- E. storagecontoso3
Answer: A,D
NEW QUESTION 110
You have an Azure subscription that contains the Azure SQL servers shown in the following table.
The subscription contains the elastic pool shown in the following table.
The subscription contains the Azure SQL databases shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
References:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-elastic-pool
NEW QUESTION 111
You create the following Azure role definition.
You need to create Role1 by using the role definition.
Which two values should you modify before you create Role1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. DataActions
- B. IsCustom
- C. Id
- D. AssignableScopes
- E. Description
Answer: B,D
Explanation:
Part of example:
"IsCustom": true,
"AssignableScopes": [
"/subscriptions/{subscriptionId1}",
"/subscriptions/{subscriptionId2}",
"/subscriptions/{subscriptionId3}"
The following shows what a custom role looks like as displayed in JSON format. This custom role can be used for monitoring and restarting virtual machines.
{
"Name": "Virtual Machine Operator",
"Id": "88888888-8888-8888-8888-888888888888",
"IsCustom": true,
"Description": "Can monitor and restart virtual machines.",
"Actions": [
"Microsoft.Storage/*/read",
"Microsoft.Network/*/read",
"Microsoft.Compute/*/read",
"Microsoft.Compute/virtualMachines/start/action",
"Microsoft.Compute/virtualMachines/restart/action",
"Microsoft.Authorization/*/read",
"Microsoft.ResourceHealth/availabilityStatuses/read",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Insights/alertRules/*",
"Microsoft.Insights/diagnosticSettings/*",
"Microsoft.Support/*"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/{subscriptionId1}",
"/subscriptions/{subscriptionId2}",
"/subscriptions/{subscriptionId3}"
]
}
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles Implement Management and Security Solutions Testlet 2 Case study This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and maintains.
Existing Environment
Currently, Contoso uses multiple types of severs for business operations, including the following:
* File servers
* Domain controllers
* Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
You have a public-facing application named App1. App1 is comprised of the following three tiers:
* A SQL database
* A web front end
* A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
* Move all the tiers of App1 to Azure.
* Move the existing product blueprint files to Azure Blob storage.
* Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.
Technical Requirements
Contoso must meet the following technical requirements:
* Move all the virtual machines for App1 to Azure.
* Minimize the number of open ports between the App1 tiers.
* Ensure that all the virtual machines for App1 are protected by backups.
* Copy the blueprint files to Azure over the Internet.
* Ensure that the blueprint files are stored in the archive storage tier.
* Prevent user passwords or hashes of passwords from being stored in Azure.
* Use unmanaged standard storage for the hard disks of the virtual machines.
* Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
* Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
* Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
* Designate a new user named Admin1 as the service admin for the Azure subscription.
* Admin1 must receive email alerts regarding service outages.
* Ensure that a new user named User3 can create network objects for the Azure subscription.
NEW QUESTION 112
You need to identify the storage requirements for Contoso.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Box 1: Yes
Contoso is moving the existing product blueprint files to Azure Blob storage.
Use unmanaged standard storage for the hard disks of the virtual machines. We use Page Blobs for these.
Box 2: No
Box 3: No
NEW QUESTION 113
You need to configure Azure AD Seamless SSO for Fabrikam. The solution must meet the authentication and authorization requirements.
What should you install first?
- A. Azure AD Connect in staging mode on SERVER1
- B. the Azure AD Connect provisioning agent on DC1
- C. the Azure AD Connect provisioning agent on SERVER1
- D. an Azure AD Connect primary server on SERVER1
Answer: C
Explanation:
The Litware and Fabrikam datacenters are not connected.
Azure AD Connect Cloud Sync provides support for synchronizing to an Azure AD tenant from a multi-forest disconnected Active Directory forest environment.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/cloud-sync/what-is-cloud-sync
NEW QUESTION 114
You have an Azure Resource Manager template for a virtual machine named Template1. Template1 has the following parameters section.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: Yes
The Resource group is not specified.
Box 2: No
The default value for the operating system is Windows 2016 Datacenter.
Box 3: Yes
Location is no default value.
References:
https://docs.microsoft.com/bs-latn-ba/azure/virtual-machines/windows/ps-template
NEW QUESTION 115
You set the multi-factor authentication status for a user named [email protected] to Enabled.
Adman 1 accesses the Azure portal by using a web browser.
Which additional security verifications can Admin 1 use when accessing the Azure portal?
- A. a phone call, a text, message that contains a verification code, and a notification on a verification code sent from the Microsoft Authenticator app
- B. a phone call, an email message that contains a verification code, and a te*t message that contains an app password
- C. on app password, a text message that contacts a verification code, and a verification code sent from the Microsoft Authenticator app.
- D. an app password, a text message that contains a verification code, and a notification sent from the Microsoft Authenticator app
Answer: A
NEW QUESTION 116
A company plans to use third-party application software to perform complex data analysis processes. The software will use up to 500 identical virtual machines (VMs) based on an Azure Marketplace VM image.
You need to design the infrastructure for the third-party application server. The solution must meet the following requirements:
* The number of VMs that are running at any given point in time must change when the user workload changes.
* When a new version of the application is available in Azure Marketplace it must be deployed without causing application downtime.
* Use VM scale sets.
* Minimize the need for ongoing maintenance.
Which two technologies should you recommend? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. single placement group
- B. autoscale
- C. single storage account
- D. managed disks
Answer: B,D
Explanation:
Explanation
Introduction to Azure managed disks
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/managed-disks-overview "Using managed disks, you can create up to 50,000 VM disks of a type in a subscription per region, allowing you to create thousands of VMs in a single subscription. This feature also further increases the scalability of virtual machine scale sets by allowing you to create up to 1,000 VMs in a virtual machine scale set using a Marketplace image."
NEW QUESTION 117
You have an Azure subscription.
You plan to deploy an app that has a web front end and an application tier.
You need to recommend a load balancing solution that meets the following requirements:
Internet to web tier:
- Provides URL-based routing
- Supports connection draining
- Prevents SQL injection attacks
Web tier to application tier:
- Provides port forwarding
- Supports HTTPS health probes
- Supports an availability set as a backend pool
Which load balancing solution should you recommend for each tier? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: An Azure Application Gateway that has a web application firewall (WAF) Azure Application Gateway offers a web application firewall (WAF) that provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities. SQL injection and cross-site scripting are among the most common attacks.
Application Gateway operates as an application delivery controller (ADC). It offers Secure Sockets Layer (SSL) termination, cookie-based session affinity, round-robin load distribution, content-based routing, ability to host multiple websites, and security enhancements.
Box 2: An internal Azure Standard Load Balancer
The internet to web tier is the public interface, while the web tier to application tier should be internal.
Note: When using load-balancing rules with Azure Load Balancer, you need to specify a health probes to allow Load Balancer to detect the backend endpoint status.
Health probes support the TCP, HTTP, HTTPS protocols.
References:
https://docs.microsoft.com/en-us/azure/application-gateway/waf-overview
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview
NEW QUESTION 118
You have a resource group named RG1 that contains the following:
* A virtual network that contains two subnets named Subnet 1 and AzureFirewallSubnet
* An Azure Storage account named contososa1
* An Azure firewall deployed to AzureFirewallSubnet
You need to ensure that contososa1 is accessible from Subnet 1 over the Azure backbone network. What should you do?
- A. Modify the Firewall and virtual networks settings for contososa1.
- B. implement a virtual network service endpoint.
- C. Remove the Azure firewall-
- D. Create a stored access policy for contososa1.
Answer: B
Explanation:
Virtual Network (VNet) service endpoints extend your virtual network private address space and the identity of your VNet to the Azure services, over a direct connection. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Traffic from your VNet to the Azure service always remains on the Microsoft Azure backbone network. References: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview
NEW QUESTION 119
You have an Azure subscription that contains the Azure SQL servers shown in the following table.
The subscription contains the elastic pool shown in the following table.
The subscription contains the Azure SQL databases shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Note: You cannot add databases from different servers into the same pool Box 1: Yes Pool2 contains DB2 but DB1 and DB2 are on Sql1. DB1 can thus be added to Pool2.
Box 2: Yes
Pool3 is empty.
Box 3: Yes
Pool1 contains DB1 but DB3 and DB1 are on Sql1. DB3 can thus be added to Pool1.
References:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-elastic-pool
NEW QUESTION 120
You have a resource group named RG5. The access controls for RG5 are configured as shown in the following exhibit.
Which users can deploy virtual networks to RG5?
- A. only User1
- B. only User1 and User2
- C. User1, User2, and prvi
- D. only prvi and User1
Answer: D
Explanation:
User1, the Network Contributor, can create and manage networks, but not access to them.
Prvi, the Owner, can create and manage resources of all types.
References:
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
NEW QUESTION 121
You create a new Azure subscription. You create a resource group named RG1. In RG1. you create the resources shown in the following table.
You need to configure an encrypted tunnel between your on-premises network and VNET1.
Which two additional resources should you create in Azure? Each correct answer presents part of the solution.
- A. a VNet-to-VNet connection
- B. a local network gateway
- C. a point-to-site configuration
- D. a VPN gateway
- E. a site-to-site connection
Answer: B,D
Explanation:
A Site-to-Site VPN gateway connection is used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This type of connection requires a VPN device, a local network gateway, located on-premises that has an externally facing public IP address assigned to it.
Finally, create a Site-to-Site VPN connection between your virtual network gateway and your on-premises VPN device.
References:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal
NEW QUESTION 122
You have an Azure subscription that contains the resource groups shown in the following table.
The subscription contains the storage accounts shown in the following table.
You create a Recovery Services vault named Vault1 in RG1 in the West US location.
You need to identify which storage accounts can be used to archive the diagnostics logs of Vault1.
Which storage accounts should you identify?
- A. Storage1 or Storage2 only
- B. Storage1 only
- C. Storage2 only
- D. Storage1 or Storage3 only
- E. Storage3 only
Answer: A
Explanation:
Section: [none]
Explanation:
The storage needs to be in the same region as the RSV.
NEW QUESTION 123
You have the Azure virtual networks shown in the following table.
All the virtual networks are peered.
You have the virtual machines shown in the following table.
You deploy an Azure Bastion named Bastion1 to VNET1.
To which virtual machines can you connect by using Bastion1?
- A. VM1 and VM2 only
- B. VM1 only
- C. VM2 and VM3 only
- D. VM1, VM2, and VM3
Answer: B
Explanation:
Section: [none]
Explanation:
Connect to a VM through Azure Bastion.
When you click on Connect in an Azure VM, you have an additional option called Bastion. In order to get this option, the Azure VM must belong to the same virtual network as the Azure Bastion.
Reference:
https://www.starwindsoftware.com/blog/overview-of-microsoft-azure-bastion
NEW QUESTION 124
......
Who should take the AZ-303: Microsoft Azure Architect Technologies Exam
The AZ-303 Exam certification is an internationally-recognized certification which help to have validation for Azure Solution Architects who participate in all phases of advising stakeholders and translate business requirements into secure, scalable, and reliable solutions. Candidates should be proficient in IT operations, including networking, virtualization, identity, security, business continuity, disaster recovery, data platform, budgeting, and governance.
2021 New PremiumVCEDump AZ-303 PDF Recently Updated Questions: https://www.premiumvcedump.com/Microsoft/valid-AZ-303-premium-vce-exam-dumps.html