AZ-305 Practice Exam — AZ-305: Azure Solutions Architect Expert

The scenario requires a low-effort solution to periodically validate access to Application1 for Fabrikam developers, send monthly notifications to the developer manager for review, and automatically revoke permissions that are not verified. This use case aligns directly with the built-in Azure AD access reviews capability, which eliminates the need for custom development and meets all stated requirements out of the box. Access reviews for enterprise applications support recurring schedules, configurable reviewer assignments, automated email notifications, and auto-application of review outcomes including revocation of unapproved access, which exactly matches the stated requirements. Option Analysis: A. Correct. Azure AD access reviews of an enterprise application like Application1 can be configured to run on a monthly recurring schedule, assign the developer manager as the designated reviewer, send automated monthly email alerts with the list of access permissions to review, and set auto-apply of results to revoke any permissions that the manager does not verify. This solution requires no custom development, so it meets the minimal development effort requirement. B. Incorrect. Creating an Azure Automation runbook using Get-AzRoleAssignment would require significant custom development to build logic for sending emails to the manager, tracking review responses, and revoking unapproved permissions, which violates the minimal development effort requirement. Additionally, Get-AzRoleAssignment returns Azure resource RBAC assignments, not application-specific role assignments for Application1, so it does not address the requirement to review Application1 access correctly. C. Incorrect. Azure AD Privileged Identity Management (PIM) is used to manage, control, and monitor access to privileged roles and resources, but creating a custom role assignment only defines a set of permissions, it does not perform recurring access reviews, send review notifications, or automatically revoke unapproved access. This option does not meet any of the stated requirements beyond role assignment definition. D. Incorrect. While Get-AzureADUserAppRoleAssignment retrieves user application role assignments for Application1, but building an Azure Automation runbook around this cmdlet requires extensive custom development to implement review notification, response tracking, and automated revocation logic, which fails the minimal development effort requirement compared to the built-in access reviews feature. Key Concepts: 1. Azure AD Access Reviews: A governance feature in Azure Active Directory that enables organizations to regularly validate user access rights to resources including enterprise applications, group memberships, Azure roles, and Azure AD roles. It supports recurring schedules, designated reviewers, automated notifications, and auto-application of review outcomes to enforce least privilege access without custom code. 2. Minimal Development Effort Design Principle: A core design requirement for AZ-305 solutions, which prioritizes using native, fully managed Azure services over custom code to reduce development overhead, reduce maintenance costs, and reduce risk of custom implementation errors. 3. Enterprise Application Access Governance: The process of auditing, reviewing, and managing user access to custom and gallery enterprise applications registered in Azure AD, which includes periodic access validation as a key component of compliance and least privilege best practices. References: What are access reviews in Azure Active Directory? https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview Manage application access using access reviews

The scenario requires providing time-bound access to a specific blob container for 10 finance users only during the month of April, while adhering to least privilege security principles. The recommended solution of shared access signatures (SAS) directly addresses this requirement by allowing granular configuration of access scope (the target blob container), allowed permissions (e.g. read, list as needed for the finance users), and explicit start and expiry dates that can be set to align exactly with the month of April. This approach avoids permanent access grants, requires no ongoing management of additional identity policies for this specific temporary access requirement, and aligns with AZ-305 storage security design best practices for temporary, granular resource access. Option Analysis: A. Correct. Shared access signatures (SAS) support explicit configuration of validity periods, so you can set the SAS start date to the first day of April and expiry date to the last day of April to enforce access only during that month. You can also restrict the SAS scope to the specific blob container and grant only the minimum permissions the finance users require, meeting both the time-bound and granular access requirements of the scenario. B. Incorrect. Conditional Access policies enforce rules for Azure AD authentication events, but they do not provide native, granular time-bound access restricted to a single calendar month for a specific blob container without extensive additional configuration. They apply to broader service access rather than targeted, temporary storage resource access, making them a poor fit for this requirement. C. Incorrect. Certificates are used for authentication of identities such as service principals, but they do not natively support time-bound access scoped to a specific blob container for individual end users. Managing individual certificates for 10 users would be overly complex, and enforcing the April-only access restriction would require additional custom logic not included out of the box. D. Incorrect. Access keys provide full, permanent administrative access to the entire storage account, which violates the least privilege principle as it gives users far more access than required to just the target blob container. Access keys do not have native expiry functionality, so you would need to manually rotate keys after April, which introduces risk of disruption and does not natively enforce the time-bound access requirement. Key Concepts: 1. Shared Access Signature (SAS) Use Cases: SAS is a core Azure Storage security feature that enables delegated, granular access to storage resources with configurable permissions, scope, and validity periods. It is the recommended solution for temporary access requirements that do not require permanent identity-based access grants. 2. Least Privilege Security Principle: A core design requirement for AZ-305 solutions, this principle mandates granting only the minimum level of access required for a task, for the shortest necessary duration. SAS aligns with this principle by avoiding overprivileged access options like storage account access keys. 3. Azure Storage Access Control Hierarchy: AZ-305 candidates must understand the appropriate use cases for different storage access controls, including access keys, SAS, Azure AD RBAC for storage, and Conditional Access, to select the right control for specific business and security requirements. References: Grant limited access to Azure Storage resources using shared access signatures (SAS), https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview Azure Well-Architected Framework Storage security controls

The scenario requires two core capabilities: VPN-free remote access to an on-premises web app that uses Integrated Windows Authentication (IWA), and single sign-on (SSO) for remote users authenticated via Azure AD. The combination of Azure AD Application Proxy and Azure AD enterprise applications delivers both capabilities. Azure AD Application Proxy acts as the secure remote access layer, eliminating the need for VPN by routing authenticated user traffic from the internet to the on-premises app via a lightweight connector deployed in the on-premises environment. Registering WebApp1 as an Azure AD enterprise application enables configuration of SSO settings, including Kerberos Constrained Delegation (KCD) that allows the App Proxy connector to impersonate users to complete IWA authentication against the on-premises Active Directory, delivering seamless SSO for remote users. Option Analysis: A. Correct. Azure AD Application Proxy is a purpose-built Azure AD feature for providing secure, VPN-free remote access to on-premises web applications. It natively integrates with Azure AD identity capabilities, including support for SSO for IWA-enabled on-premises apps, directly addressing the remote access requirement in the scenario. B. Incorrect. Azure AD Privileged Identity Management (PIM) is used to manage, monitor, and restrict access to privileged administrative roles across Azure and Microsoft 365 services. It has no functionality for publishing on-premises applications or enabling end-user SSO for web apps, so it is irrelevant to this use case. C. Incorrect. Conditional Access policies enforce post-authentication access controls such as multi-factor authentication or device compliance requirements for existing app integrations. They are not a required core component to enable basic remote access or SSO for the on-premises app, so they are not part of the minimum required solution. D. Incorrect. Azure Arc is a hybrid management service that enables unified governance of on-premises, multi-cloud, and edge resources from the Azure control plane. It does not provide web application publishing or SSO integration capabilities, so it is not applicable here. E. Correct. Azure AD enterprise applications are the identity representation of applications in Azure AD. Registering WebApp1 as an enterprise application is required to configure SSO settings, manage user access to the app, and integrate the app with Azure AD Application Proxy. For IWA-enabled apps, the enterprise app configuration supports setup of Kerberos Constrained Delegation to enable seamless SSO for remote users. F. Incorrect. Azure Application Gateway is a layer 7 web traffic load balancer and web application firewall for managing traffic to web workloads. It does not natively support SSO integration for on-premises IWA-enabled apps with Azure AD, nor is it required to provide VPN-free remote access when using Azure AD Application Proxy, so it is not part of the solution. Key Concepts: 1. Azure AD Application Proxy: A core hybrid identity feature of Azure AD that enables secure remote access to on-premises web applications without VPN. It uses an on-premises connector to broker traffic between external users and the on-premises app, and integrates with Azure AD for authentication and SSO. 2. Azure AD Enterprise Applications: Application objects in Azure AD that enable centralized identity and access management for cloud and on-premises applications. They support configuration of SSO methods, user access assignments, and integration with other Azure AD features including Application Proxy and Conditional Access. 3. Kerberos Constrained Delegation for IWA SSO: For on-premises apps using Integrated Windows Authentication, Azure AD Application Proxy uses KCD configured via the associated enterprise application to impersonate authenticated users and complete Kerberos authentication against the on-premises Active Directory, delivering seamless SSO without a VPN connection. References: Remote access to on-premises applications through Azure Active Directory Application Proxy, https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy Add an on-premises application for remote access through Application Proxy in Azure Active Directory, https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-application

The scenario requires recurring, automated group membership evaluation with self-attestation, and automatic removal of users who confirm they no longer need membership or fail to respond. Azure AD access reviews are purpose-built for this governance requirement. You can configure a scheduled access review for Group1 set to recur every 3 months, assign each group member as a reviewer for their own membership, enable the auto-apply results setting, and configure the default outcome for non-responders and users who indicate they do not need access to be removal from Group1. This configuration directly meets every stated requirement in the question. Option Analysis: A. Implement Azure AD Identity Protection. Incorrect. Azure AD Identity Protection is used to detect and remediate identity-based risks such as risky sign-ins, compromised user accounts, and enforce risk-based conditional access policies. It does not support scheduled group membership reviews, self-attestation of membership need, or automated removal based on review responses, so it fails to meet all core requirements. B. Change the Membership type of Group1 to Dynamic User. Incorrect. Dynamic user group membership automatically adds or removes members based on predefined user attribute rules such as department or job title. There is no capability to request user self-attestation of membership need, no recurring review cycle, and no handling of non-response to access confirmation requests, so this does not address the requirements. C. Create an access review. Correct. Azure AD access reviews support scheduled recurring reviews including every 3 month intervals, allow assignment of members as self-reviewers, support auto-application of review outcomes including automatic removal of users who deny needing access or do not respond to the review request. This option satisfies all four requirements specified in the scenario. D. Implement Azure AD Privileged Identity Management (PIM). Incorrect. Azure AD PIM is designed to manage, monitor, and audit privileged access to Azure AD roles, Azure resource roles, and other high-privilege assignments, including just-in-time access activation. While PIM supports access reviews for privileged role assignments, it is not intended for general security group membership reviews for non-privileged groups as described in the scenario, and does not provide the required self-attestation and automated removal functionality for standard group membership. Key Concepts: 1. Azure AD Access Reviews: A core Azure AD governance feature that enables organizations to conduct regular, auditable reviews of user access to groups, applications, and role assignments, with support for custom scheduling, multiple reviewer types, and automated outcome application. 2. Access Governance: The set of processes and tools used to enforce least privilege access, ensure compliance with internal policies and regulatory requirements, and reduce risk from unnecessary or stale access to organizational resources, which includes recurring access reviews as a core component. 3. Auto-apply Review Outcomes: A configurable setting for Azure AD access reviews that automatically executes review decisions after the review period ends, removing users who are denied access or do not respond to the review without manual administrator intervention. References: Access reviews in Azure Active Directory, https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview Create an access review of groups and applications in Azure AD, https://learn.microsoft.com/en-us/azure/active-directory/governance/create-access-review

" target="_blank" rel="nofollow noopener">https://www.examtopics.com/assets/media/exam-media/04224/0002700001.jpg">