AZ-305試験無料問題集「Microsoft Designing Microsoft Azure Infrastructure Solutions 認定」

Explanation:
Important point here is that both apps are deployed to the same machines. So Managed identitied will violate the principle of least privelege. As a user/system managed identity will have to be assigned both read and write permission to user's calendar.
App registeration will provide ability to use the service principal per app to set the correct permission required for the app.
Use delegated permissions to access user's data as admin allowed/forces users to delegate the permission to the app.

Explanation:
Box 1: Key Vault references in Application settings
Source Application Settings from Key Vault.
Key Vault references can be used as values for Application Settings, allowing you to keep secrets in Key Vault instead of the site config. Application Settings are securely encrypted at rest, but if you need secret management capabilities, they should go into Key Vault.
To use a Key Vault reference for an app setting, set the reference as the value of the setting.
Your app can reference the secret through its key as normal. No code changes are required.
Box 2: Secrets: Get
In order to read secrets from Key Vault, you need to have a vault created and give your app permission to access it.
1. Create a key vault by following the Key Vault quickstart.
2. Create a managed identity for your application.
3. Key Vault references will use the app's system assigned identity by default, but you can specify a user-assigned identity.
4. Create an access policy in Key Vault for the application identity you created earlier. Enable the "Get" secret permission on this policy.
References:
https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references

解説: (GoShiken メンバーにのみ表示されます)

Explanation:
Box 1: Azure AD Privileged Identity Management
Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management:
- Provide just-in-time privileged access to Azure AD and Azure resources
- Assign time-bound access to resources using start and end dates
- Require approval to activate privileged roles
- Enforce multi-factor authentication to activate any role
- Use justification to understand why users activate
- Get notifications when privileged roles are activated
- Conduct access reviews to ensure users still need roles
- Download audit history for internal or external audit
- Prevents removal of the last active Global Administrator role assignment Box 2: Azure Managed Identity Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication. Applications may use the managed identity to obtain Azure AD tokens. With Azure Key Vault, developers can use managed identities to access resources. Key Vault stores credentials in a secure manner and gives access to storage accounts.
Box 3: Azure AD Privileged Identity Management
Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management:
- Provide just-in-time privileged access to Azure AD and Azure resources
- Assign time-bound access to resources using start and end dates
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

解説: (GoShiken メンバーにのみ表示されます)

Explanation:
Box 1: 1
Cross-tenant support in Azure Virtual Network Manager
Cross-tenant supports allow organizations to use a central Network Manager instance for managing virtual networks across different tenants and subscriptions.
Box 2: Azure Policy
Minimize administrative effort when assigning the network group membership.
After you deploy the Virtual Network Manager instance, you create a network group, which serves as a logical container of networking resources to apply configurations at scale. You can manually select individual virtual networks to be added to your network group, known as static membership. Or you can use *Azure Policy* to define conditions that govern your group membership dynamically, or dynamic membership.
Reference:
https://learn.microsoft.com/en-us/azure/virtual-network-manager/concept-cross-tenant
https://learn.microsoft.com/en-us/azure/virtual-network-manager/overview

Explanation:
You need to use Azure Event Hubs and Azure Functions in your solution. Azure Event Hubs can receive data for up to millions of events per second and pass them in real-time to your event consumer. In this design, you will use Azure Functions as your event consumer, which will handle the processing and write the data to a Cosmos DB database. Both Event Hubs and Functions automatically scale as the data volume changes.
You should not include Azure Event Grid in your solution. Event Grid is not designed for this type of application. It manages events, but it is not a data pipeline that delivers the event data.
You should not include Azure Service Bus. Service Bus is used for asynchronous message delivery, such as traditional transaction-processing applications. Service Bus does not stream data to a consumer, but instead, it delivers data when polled.
You should not include Azure Logic App in your solution. Logic Apps are designed to help you to schedule, automate, and orchestrate tasks, business processes, and workflows. Therefore, it is not suited to this type of data pipeline requirement.
You should not include Azure Notification Hub. Notification Hub is not used for data streaming or real-time data processing. Notification Hub is a push engine designed to let you send notifications out to any platform and it is not used for application data storage and delivery.