Microsoft AZ-305

Incorrect. Azure AD administrative units are used to delegate administrative control over subsets of Azure AD objects (users, groups, devices). Azure Policy is an Azure Resource Manager governance feature and does not assign to Azure AD administrative units. This option is a common distractor mixing identity governance with resource governance.

Incorrect. An Azure AD tenant is an identity boundary, not an ARM resource scope. Azure Policy assignments are made within the Azure resource hierarchy (management groups, subscriptions, resource groups, resources). While many Azure services integrate with Azure AD, Azure Policy does not assign at the tenant level as an Azure AD construct.

Incorrect. “Compute resources” is not a valid Azure Policy assignment scope. Azure Policy can evaluate and enforce rules on compute resource types (VMs, VMSS, AKS, etc.) via policy conditions, but the assignment scope is still management group, subscription, resource group (or individual resource), not a generic compute category.

Azure Files provides managed file shares over SMB/NFS and is best for lift-and-shift file server scenarios, shared application configuration, or user home directories. It is not typically the fastest or most cost-effective option for serving large video files to internet users at scale. Internet delivery usually requires additional components and doesn’t align as well as object storage with CDN caching and tiering for cost optimization.

Azure Data Lake Storage Gen2 is essentially Blob Storage with a hierarchical namespace and POSIX-like ACLs, optimized for big data analytics (Spark/Hadoop) and data engineering. While it can store large files, its primary value is analytics and filesystem semantics rather than lowest-cost, highest-performance internet content delivery. For a video hosting app focused on fast reads and minimal cost, standard Blob Storage is the more direct fit.

Azure SQL Database is a relational database service intended for structured data and transactional workloads. Storing 50 MB to 12 GB video files in a database (as BLOBs) is inefficient and expensive, complicates scaling, and typically results in worse read performance and higher costs than object storage. The correct pattern is to store metadata in SQL (if needed) and store the actual video content in Blob Storage.

Incorrect. An Azure Automation runbook using Get-AzRoleAssignment can enumerate RBAC assignments, but you would still need to build custom logic for monthly scheduling, emailing the manager, capturing approvals, tracking non-responses, and revoking access. This increases development and maintenance effort and is less aligned with built-in identity governance and audit workflows.

Incorrect. Privileged Identity Management (PIM) focuses on just-in-time access, eligible vs. active role assignments, approval workflows for elevation, and time-bound assignments. It does not inherently provide the required monthly manager attestation with automatic removal for non-response in the same straightforward way as Access Reviews. PIM can complement governance but is not the best fit here.

Incorrect. Get-AzureADUserAppRoleAssignment targets application role assignments (app roles) rather than Azure RBAC role assignments to Azure resources. Application1 access is described as RBAC permissions to components, which are typically Azure resource role assignments. Even if applicable, a runbook would still require custom approval/attestation and revocation logic, increasing development effort.

Conditional Access policies control how users authenticate to applications via Microsoft Entra ID (e.g., require MFA, compliant device, named locations). They are not the primary mechanism to grant time-limited access to blobs via URLs, and SAS-based access may not be subject to Conditional Access at all. Conditional Access also doesn’t inherently provide a simple per-resource expiry for blob access.

Certificates are not a typical or recommended method to grant temporary access to Azure blobs. While certificates can be used for certain authentication scenarios (e.g., client certificates, service principals), they do not provide the built-in, resource-scoped, time-bound permission model that SAS offers for Blob Storage access. Managing certificate issuance/rotation also adds unnecessary complexity for this requirement.

Storage account access keys are highly privileged, long-lived secrets that grant broad access to the entire storage account. Sharing them with 10 users violates least privilege and makes it difficult to enforce “April only” access without manual rotation. If a key is leaked, an attacker could access all data until the key is regenerated, making this a poor security design choice.

Azure AD Privileged Identity Management (PIM) is wrong because it is used to manage privileged roles and provide just-in-time elevation for administrative access. It helps reduce standing privilege and supports approval workflows, notifications, and access reviews for privileged accounts. However, it does not publish on-premises applications, provide remote connectivity, or enable SSO for end users accessing an internal web app. Therefore, it does not address the core requirement in this scenario.

Conditional Access policies are wrong as a primary answer because they only control the conditions under which users can access applications, such as requiring MFA, compliant devices, or trusted locations. They do not provide the mechanism to expose an on-premises web application to remote users who lack VPN access. While Conditional Access can be layered on top of Application Proxy for additional security, it is not one of the required features to make the application reachable and provide SSO. The scenario asks for the core solution components, which are Application Proxy and the enterprise application configuration.

Azure Arc is wrong because it is intended for hybrid and multicloud resource management, such as managing servers, Kubernetes clusters, and data services from Azure. It extends Azure governance, policy, and management capabilities to non-Azure environments. It does not provide remote user access to on-premises web applications and has no role in Integrated Windows authentication SSO for this scenario. As a result, it is unrelated to the stated requirement.

Azure Application Gateway is wrong because it is primarily a Layer 7 load balancer for HTTP/HTTPS traffic with features such as SSL termination, path-based routing, and Web Application Firewall integration. Although it can publish web applications, it is not the Azure AD identity-based reverse proxy service designed for remote access to internal apps without VPN. It also does not natively provide the same Azure AD preauthentication and KCD-based SSO pattern used by Azure AD Application Proxy for Integrated Windows authentication apps. Compared to Application Proxy, it lacks the direct identity integration needed for this exact scenario.

Azure AD (Entra ID) Identity Protection is designed for detecting and remediating identity risks (risky sign-ins, risky users) using risk policies and reports. It does not provide a periodic, user-driven membership attestation workflow for groups, nor does it automatically remove users from a group based on self-reported need or non-response. Therefore it cannot meet the stated governance and recertification requirements.

Changing Group1 to Dynamic User membership automates membership based on a rule evaluating user attributes (for example, department, jobTitle, userType). This does not satisfy the requirement that every member must explicitly report whether they still need to be in the group, and it does not implement a quarterly review/attestation process. Dynamic groups are great for attribute-driven access, not for periodic access recertification.

Privileged Identity Management (PIM) focuses on managing privileged access (Azure AD roles, Azure resource roles, and privileged groups) through eligible assignments, just-in-time activation, approval workflows, and access reviews for privileged assignments. While PIM can involve reviews, the question is specifically about evaluating standard assigned group membership with self-attestation and automatic removal of non-responders. Access Reviews is the direct and expected solution.

Azure Advisor focuses on best-practice recommendations across cost, security, reliability, operational excellence, and performance. It does not provide an authoritative audit trail of ARM deployments or a complete list of new deployments. Advisor may highlight configuration issues resulting from deployments, but it is not designed for compliance-style deployment reporting.

Azure Analysis Services is a PaaS analytics service for hosting tabular semantic models (similar to SSAS Tabular) used by BI tools like Power BI. It does not ingest or track Azure subscription Activity Log events by itself. You could theoretically model data after exporting logs elsewhere, but it is not the correct native service to generate deployment reports.

Azure Monitor action groups define notification and automation endpoints (email, SMS, webhook, Logic Apps, etc.) used by alert rules. They do not collect, store, or enumerate ARM deployment events. Action groups could be used after you create an alert on Activity Log/Log Analytics, but they are not the data source for a monthly deployment report.

An Azure Logic Apps integration account is used for enterprise integration scenarios (B2B/EDI agreements, schemas, maps, certificates) and supports Logic Apps workflows. It does not provide a direct, purpose-built mechanism to bulk copy an on-premises Windows file server’s files into Azure Blob Storage. While Logic Apps can orchestrate some transfers, the integration account itself is not a complete file-copy solution for this scenario.

The Azure Analysis Services On-premises data gateway is intended to provide secure connectivity for semantic models and reporting tools (e.g., Power BI) to access on-premises data sources. It is not a data movement service for copying file shares into Azure Blob Storage. It enables query connectivity rather than bulk file ingestion, so it does not meet the requirement to store a copy of the files in store1.

An Azure Batch account is used to run large-scale parallel and high-performance computing workloads by scheduling jobs across pools of compute nodes. It is not a data transfer or migration service. While Batch jobs can process data once it is in Azure, Batch does not provide a straightforward, managed mechanism to copy an on-premises file server’s data into Azure Blob Storage as a complete solution.

A Recovery Services vault with Windows Server Backup is primarily a backup/restore approach. It can protect VM1’s data, but during a Toronto outage users won’t have immediate access; you must restore to alternate infrastructure first. This increases RTO and does not inherently improve user access speed across branch offices. It addresses data protection, not fast, continuous file access.

Azure blob containers with Azure File Sync is not a valid pairing for this use case. Azure File Sync requires an Azure file share (Azure Files) as the cloud endpoint, not Blob storage. While Blob is excellent for object storage and archival, it doesn’t provide SMB share semantics needed for typical Windows file server shared folders without additional services/gateways.

A Recovery Services vault with Azure Backup protects VM1 and can restore data to Azure or another server, but it is still a restore-based DR method. Users cannot access the shared files quickly during an outage unless you have already provisioned and synchronized an alternate file server. This option improves durability but typically results in higher RTO compared to a synchronized, cloud-backed file share solution.

Incorrect. Azure Site Recovery is primarily for disaster recovery of workloads like Azure VMs and some on-premises servers by replicating them to another region. It is not the standard mechanism to meet Azure SQL Database backup retention requirements. ASR addresses business continuity (failover) rather than long-term database backup retention and archival.

Incorrect. Automatic Azure SQL Database backups are enabled by default and support point-in-time restore within the short-term retention window. While you can adjust STR within supported limits, it is generally intended for operational recovery (days/weeks), not multi-month or multi-year retention. Long-term compliance retention is handled by LTR, not STR alone.

Incorrect. Geo-replication (or failover groups) provides a readable secondary and supports fast failover for regional resiliency. It is a high availability/disaster recovery feature, not a backup retention feature. Replicas can propagate logical corruption and do not provide the historical, long-term backup chain required for retention and compliance scenarios.

Yes is incorrect because although Azure Traffic Analytics can surface allowed and denied flow trends from NSG flow logs, it is not the intended tool for directly troubleshooting whether packets to a VM are being allowed or denied in a precise, per-flow manner. It focuses on traffic patterns, analytics, and visualization across networks rather than deterministic packet verification for a specific connectivity issue. In this scenario, the goal is to identify packet allow/deny behavior affecting virtual machines, which is better addressed by Network Watcher IP flow verify or by reviewing NSG flow logs directly. As a result, saying the proposed solution meets the goal would overstate what Traffic Analytics is designed to do.

Yes is incorrect because Azure Advisor does not capture or analyze network packet flows or provide allow/deny decisions for VM traffic. Advisor focuses on best-practice recommendations (cost optimization, security posture, reliability, performance), not operational traffic diagnostics. It may suggest improvements, but it cannot tell you whether specific packets were allowed or denied.

This option is incorrect because the proposed solution does meet the stated goal. IP flow verify is one of the core Azure Network Watcher diagnostics for checking whether traffic is permitted or blocked based on effective NSG rules. Although it does not perform full packet inspection or trace every hop across ExpressRoute, the question only asks to identify whether packets are being allowed or denied to the virtual machines. For that purpose, IP flow verify is the appropriate and sufficient tool.

Azure SQL Database active geo-replication provides readable secondary replicas in other regions for DR and read scaling, but it does not support multi-master writes. Only the primary database accepts writes; secondaries are read-only. This can meet low-latency reads if users read from a nearby secondary, but it fails the multi-master write requirement.

Azure SQL Database Hyperscale is a tier optimized for very large databases and rapid scale, with architecture that separates compute and storage and can use read replicas. However, it still follows a single-writer model and does not provide multi-master writes across regions. It can help with read performance and scale, but it doesn’t meet the multi-master requirement.

Azure Database for PostgreSQL supports standard SQL and can provide read replicas for scaling reads, but the managed service does not natively provide multi-master, multi-region writes as a built-in feature. Typical HA/DR patterns are single primary with replicas. Achieving multi-master would require complex custom replication/conflict handling, which is not the intended managed solution.