AZ-305 Practice Test 10 — 10 Questions

Question 1

Your organization uses Azure Monitor to monitor a fleet of 500 VMs running Windows Server. You need to collect security event logs (Event ID 4625 for failed logons) from all VMs and send them to a Log Analytics workspace. The solution must support centralized configuration and be scalable. You also want to filter out high-volume noise events to reduce costs. What should you do?

Accepted Answer

Deploy the Azure Monitor agent via Azure Policy and create a data collection rule to collect Event ID 4625.. Option D is correct because the Azure Monitor agent (AMA) is the current recommended agent for collecting security events from VMs, and using Azure Policy to deploy it ensures centralized, scalable configuration across 500 VMs. A data collection rule (DCR) can be configured to collect only Event ID 4625, filtering out high-volume noise events at the source, which reduces costs by minimizing data ingestion into the Log Analytics workspace.

Answer

Enable VM Insights on all VMs and use the Performance view to detect failed logons.

Answer

Stream events to Azure Event Hubs and use a function to filter and send to Log Analytics.

Answer

Install the Log Analytics agent on each VM and configure Windows Event log collection in the workspace.

Question 2

Your company plans to use Microsoft Sentinel as a SIEM solution. You need to ensure that security events from all Azure subscriptions are collected in a single workspace. What should you configure?

Accepted Answer

Enable Microsoft Sentinel on a single Log Analytics workspace and configure diagnostic settings for all subscriptions to send logs to that workspace. Option D is correct because Microsoft Sentinel requires a single Log Analytics workspace to act as the SIEM repository. By enabling Sentinel on that workspace and configuring diagnostic settings on all Azure subscriptions to stream their security logs (e.g., Activity logs, NSG flow logs, Windows Event logs) to that same workspace, you centralize all security events in one location. This ensures unified detection, investigation, and response across the entire enterprise without needing multiple Sentinel instances.

Answer

Create a Log Analytics workspace per subscription and use cross-workspace queries

Answer

Use Azure Policy to enforce Log Analytics workspace configuration across subscriptions

Answer

Deploy Microsoft Sentinel in each subscription and connect them via Azure Lighthouse

Question 3

You have an Azure subscription that contains 100 virtual machines. You need to monitor the virtual machines for security vulnerabilities and receive recommendations. What should you use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides unified security management and advanced threat protection across hybrid cloud workloads. It continuously assesses your virtual machines for security vulnerabilities, misconfigurations, and missing updates, then delivers actionable recommendations and a secure score to prioritize remediation. This directly matches the requirement to monitor VMs for vulnerabilities and receive recommendations.

Answer

Azure Monitor

Answer

Microsoft Sentinel

Answer

Microsoft Defender XDR

Question 4

Which THREE conditions should be met to implement a successful Azure landing zone for a new enterprise subscription? (Choose three.)

Accepted Answer

A management group hierarchy that separates environments.. A management group hierarchy that separates environments (e.g., production, non-production, and management) is a core design principle of an Azure landing zone. It enables policy inheritance, role-based access control (RBAC) isolation, and cost tracking across different workloads, aligning with the Cloud Adoption Framework's governance best practices.

Answer

A dedicated Azure Active Directory tenant.

Answer

Microsoft Sentinel enabled for security monitoring.

Question 5

Refer to the exhibit. You run the KQL query in Azure Monitor Log Analytics. Which user accounts should you investigate first?

Accepted Answer

Users with more than 5 medium-risk sign-ins in the last day.. Option D is correct because the KQL query filters for sign-ins where RiskLevelDuringSignIn equals 'medium' and then summarizes by UserPrincipalName, counting occurrences. Users with more than 5 medium-risk sign-ins in the last day indicate a pattern of suspicious activity that warrants immediate investigation, as medium-risk sign-ins often correspond to atypical travel, anonymous IPs, or unfamiliar properties, but the query specifically targets the count threshold as the trigger for escalation.

Answer

Users with the highest number of sign-in attempts.

Answer

Users who had sign-ins from anonymous IP addresses.

Answer

Users who have unfamiliar features in their sign-ins.

Question 6

Your organization has multiple Azure subscriptions. You need to create a central view of policy compliance across all subscriptions. What should you use?

Accepted Answer

Azure Policy compliance dashboard. Option B is correct because Azure Policy compliance dashboard shows compliance across subscriptions. Option A is wrong because Azure Monitor is for telemetry. Option C is wrong because Azure Resource Graph is for querying resources. Option D is wrong because Azure Blueprints is for deploying environments.

Answer

Azure Monitor

Answer

Azure Resource Graph

Answer

Azure Blueprints

Question 7

Your organization uses Microsoft Entra ID and requires that all external users accessing resources must be approved by a designated reviewer. You need to automate the review process for external identities. What should you implement?

Accepted Answer

Microsoft Entra access reviews. Microsoft Entra access reviews allow you to automate the periodic review of external identities, ensuring that only approved users retain access. This feature directly supports the requirement for a designated reviewer to approve or deny external users, with automated reminders and results. It is the correct choice because it is purpose-built for governance of external identities in Entra ID.

Answer

Microsoft Purview

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Question 8

Your company has an Azure subscription with 100 virtual machines. You need to monitor the performance of these VMs and be alerted when the average CPU usage across a set of VMs exceeds 80% for 10 minutes. The set of VMs is defined by a tag (Environment=Production). Which Azure Monitor solution should you implement?

Accepted Answer

Create a metric alert rule with a dynamic threshold and scope it to a resource group containing Production VMs.. Option B is correct because a single metric alert rule with a static threshold can be scoped to a resource group and filtered by a tag (e.g., Environment=Production) using a dynamic threshold or static threshold, allowing you to monitor the average CPU usage across all VMs in that group without creating individual rules. This approach efficiently meets the requirement to alert when the average CPU usage across the set of VMs exceeds 80% for 10 minutes, as it aggregates metrics across the tagged VMs.

Answer

Use Azure Monitor VM Insights to visualize performance and set alerts per VM.

Answer

Create a metric alert rule with a static threshold of 80% for each Production VM individually.

Answer

Use a Log Analytics query to calculate average CPU and set a log alert.

Question 9

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to collect logs from on-premises firewalls and send them to Sentinel. Which TWO connectors can you use? (Choose two.)

Accepted Answer

Syslog. Syslog is a standard protocol for sending log messages from network devices, including firewalls, to a central collector. Common Event Format (CEF) is a syslog-based format that normalizes logs from different security products, making them easier to parse and analyze in Sentinel. Both connectors allow on-premises firewalls to forward their logs to a Log Analytics agent or AMA, which then sends them to Sentinel.

Answer

DNS

Answer

Azure Activity Log

Answer

Windows Security Events via AMA

Question 10

Your organization uses Microsoft Entra ID. You need to enforce multifactor authentication (MFA) for all guest users accessing a specific SharePoint Online site. What is the most efficient way to achieve this?

Accepted Answer

Create a Conditional Access policy targeting guest users and the SharePoint Online app.. Option B is correct because Conditional Access policies in Microsoft Entra ID allow you to enforce MFA specifically for guest users when they access the SharePoint Online app. This is the most efficient approach as it targets the exact user group (guests) and the specific application (SharePoint Online) without requiring per-user configuration or additional licensing overhead.

Answer

Use SharePoint site permissions to require MFA.

Answer

Enable MFA per-user for each guest account.

Answer

Configure Microsoft Entra Entitlement Management to require MFA.