AZ-305 Practice Test 11 — 15 Questions

Question 1

You are designing a monitoring solution for a critical application running on Azure Kubernetes Service (AKS). The application generates custom metrics that need to be queried in real-time for dashboards. You also need to retain logs for one year for compliance. Which combination of services should you use?

Accepted Answer

Azure Monitor Metrics and Azure Monitor Logs. Azure Monitor Metrics is the correct choice for real-time querying of custom metrics because it stores numeric time-series data with sub-minute granularity and supports near real-time alerting and dashboarding via Azure Dashboards or Grafana. Azure Monitor Logs (Log Analytics) is required for retaining logs for one year, as it offers configurable retention up to 730 days (2 years) and supports KQL queries for compliance and audit needs. Together, they provide a unified monitoring solution for AKS that meets both real-time metric querying and long-term log retention requirements.

Answer

Prometheus and Azure Monitor Logs

Answer

Azure Data Explorer and Azure Blob Storage

Answer

Application Insights and Azure Storage

Question 2

You are designing a governance strategy for an Azure environment that includes multiple subscriptions. The security team requires that all storage accounts must have HTTPS traffic only. Any non-compliant storage account must be automatically remediated. What is the most efficient solution?

Accepted Answer

Use Azure Policy with a DeployIfNotExists effect to enable HTTPS-only traffic. Option C is correct because Azure Policy with a DeployIfNotExists effect can automatically remediate non-compliant storage accounts by enabling the 'HTTPS traffic only' property. This approach ensures continuous compliance without manual intervention, meeting the security team's requirement for automatic remediation.

Answer

Create an Azure Blueprint that includes a policy initiative

Answer

Assign a custom RBAC role that denies creation of storage accounts without HTTPS

Answer

Configure Azure Monitor alerts to notify the security team

Question 3

Your Azure environment includes multiple subscriptions that are managed by different teams. You need to ensure that all resources are compliant with your company's security policies, and any non-compliant resources must be automatically remediated or reported. Which solution should you implement?

Accepted Answer

Azure Policy with remediation tasks. Azure Policy with remediation tasks is the correct solution because it allows you to define and enforce security policies across multiple subscriptions, and automatically remediate non-compliant resources using managed identities and DeployIfNotExists or Modify policy effects. This ensures continuous compliance without manual intervention, meeting the requirement for both automatic remediation and reporting.

Answer

Azure Blueprints

Answer

Azure RBAC

Answer

Microsoft Defender for Cloud

Question 4

Refer to the exhibit. You are implementing an Azure Policy to control VM SKU deployment. You assign this policy to a subscription. A developer attempts to deploy a virtual machine with SKU Standard_DS2_v2. What is the outcome?

Accepted Answer

The deployment is denied.. The Azure Policy in the exhibit uses a 'deny' effect, which explicitly blocks any deployment that does not match the allowed VM SKUs. Since Standard_DS2_v2 is not in the allowed list, the policy engine evaluates the request during deployment and rejects it before any resource is created. This results in the deployment being denied entirely, not just audited or flagged.

Answer

The deployment is audited and logged.

Answer

The deployment is allowed.

Answer

The VM is deployed but flagged as non-compliant.

Question 5

Which THREE are valid Azure RBAC role types? (Choose three.)

Accepted Answer

Service roles. Options B, C, and E are correct. Built-in roles (B), custom roles (C), and service roles (E) exist. Option A (Guest roles) is not a category. Option D (Directory roles) are for Entra ID, not Azure RBAC.

Answer

Directory roles

Answer

Guest roles

Question 6

Your company plans to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from multiple Azure resources and on-premises servers. Which data connector should you use for Windows servers on-premises?

Accepted Answer

Azure Monitor Agent. The Azure Monitor Agent (AMA) is the correct choice because it is the current, recommended data collection agent for Microsoft Sentinel, replacing the legacy Log Analytics agent. It supports collecting security logs from Windows servers on-premises via the Windows Security Events via AMA connector, which uses data collection rules (DCRs) for flexible, scalable log ingestion. AMA is optimized for Sentinel's SIEM requirements and provides better performance, security, and manageability than its predecessor.

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Answer

Azure Arc agent

Question 7

Your company has an Azure subscription that contains 100 virtual machines (VMs). You are designing a monitoring solution that must meet the following requirements: - Alert when any VM's CPU usage exceeds 90% for 15 minutes. - Alert when any VM's available memory drops below 1 GB. - Provide a centralized dashboard showing real-time performance metrics for all VMs. Which TWO Azure services should you include in the solution? (Choose two.)

Accepted Answer

Azure Monitor. Azure Monitor is the core service for collecting, analyzing, and acting on telemetry from Azure resources. It can collect CPU and memory metrics from VMs via the Azure Monitor Agent, and its alerting engine can trigger actions when CPU exceeds 90% for 15 minutes or available memory drops below 1 GB, meeting both alerting requirements.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Automation

Question 8

Your organization uses Azure Policy to enforce tagging standards. You need to ensure that any resource created without the required 'CostCenter' tag is automatically remediated by adding the tag with a default value. Which policy effect should you use?

Accepted Answer

modify. Option C is correct because the 'modify' effect can add tags to resources during creation or on existing resources via remediation. Option A is wrong because 'deny' blocks creation. Option B is wrong because 'audit' only logs non-compliance. Option D is wrong because 'append' adds the tag at creation but does not support remediation for existing resources.

Answer

append

Answer

deny

Answer

audit

Question 9

Your organization uses Microsoft Purview for data governance. You need to classify sensitive data in Azure SQL Database and automatically apply sensitivity labels. What should you configure?

Accepted Answer

Microsoft Purview Data Map with scanning and labeling. Microsoft Purview Data Map with scanning and labeling is the correct solution because it integrates with Azure SQL Database to automatically scan for sensitive data types (e.g., credit card numbers, social security numbers) and apply sensitivity labels defined in Microsoft Purview Information Protection. This native integration uses the Purview scanning infrastructure to classify data at rest and propagate labels directly to the SQL database, meeting the requirement for automated classification and labeling.

Answer

Azure Information Protection scanner

Answer

Microsoft Sentinel with a workbook

Answer

Azure Policy with built-in SQL classification policy

Question 10

Your organization uses Microsoft Entra ID. You need to allow external users to sign in using their own identity providers (e.g., Google, Facebook) to access a custom application. What should you configure?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) is the correct solution because it is specifically designed to allow external users to authenticate using their own social identity providers (e.g., Google, Facebook) via OAuth 2.0 and OpenID Connect protocols. This configuration enables a custom application to accept sign-ins from these external identities without requiring them to have a Microsoft Entra ID account, using a dedicated external tenant or identity experience.

Answer

Microsoft Entra Connect

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra ID (tenant)

Question 11

You are designing a governance strategy for a multi-subscription Azure environment. Your compliance team requires that any resource group created in the production subscription must have a specific naming convention: it must start with 'prod-' and be followed by a three-letter department code and a two-digit number. Any resource group not following this convention should be automatically prevented from creation. Which Azure policy definition should you use?

Accepted Answer

Use a policy with 'pattern' constraint on the 'name' field.. Option D is correct because Azure Policy's 'pattern' constraint uses regular expressions to enforce complex naming conventions. The requirement for resource groups to start with 'prod-', followed by a three-letter department code and a two-digit number, is a pattern that can be precisely defined with a regex like '^prod-[a-z]{3}\d{2}$'. The 'pattern' constraint is the only option that supports regex-based validation, making it suitable for this multi-part naming rule.

Answer

Use a policy with 'like' constraint on the 'name' field.

Answer

Use a policy with 'match' constraint on the 'name' field.

Answer

Use a policy with 'contains' constraint on the 'name' field.

Question 12

You are designing a monitoring solution for a critical application running on Azure virtual machines. The application must maintain an SLA of 99.99% uptime. You need to be notified within five minutes if any VM becomes unavailable. What should you configure?

Accepted Answer

Azure Monitor VM Insights with availability metric alerts. Option D is correct because VM Insights with availability metric alerts monitors the heartbeat of Azure VMs and triggers an alert within five minutes if a VM becomes unavailable. This directly supports the 99.99% SLA requirement by enabling rapid notification of downtime, using the 'VM Availability Metric (Preview)' which tracks the VM's running state via the Azure Resource Health provider.

Answer

Log Analytics workspaces

Answer

Azure Advisor recommendations

Answer

Azure Service Health alerts

Question 13

You are designing a governance strategy for Azure resources. The company has multiple departments, each requiring separate cost tracking and policy enforcement. You need to organize resources to align with the departments while minimizing management overhead. What should you use?

Accepted Answer

Management groups. Management groups are the correct choice because they allow you to organize Azure subscriptions into a hierarchy that aligns with your organizational structure, enabling you to apply Azure Policy and cost management controls at scale across multiple departments. By placing each department's subscriptions into separate management groups, you can enforce department-specific policies and track costs without managing each subscription individually, minimizing administrative overhead.

Answer

Azure Blueprints

Answer

Resource tags

Answer

Resource groups

Question 14

Your organization uses Azure Monitor to collect metrics from Azure resources. You need to create a custom metric alert that triggers when the average CPU usage of a specific virtual machine exceeds 80% for 10 minutes. Which TWO components are required? (Choose two.)

Accepted Answer

Metric alert rule. Option A is correct because an action group defines who gets notified. Option C is correct because a metric alert rule defines the condition. Option B is wrong because a Log Analytics workspace is not needed for metrics. Option D is wrong because a diagnostic setting is for sending logs, not for metrics alerts. Option E is wrong because a runbook is not required; you can use action groups to trigger automation.

Answer

Automation runbook

Answer

Log Analytics workspace

Answer

Diagnostic setting

Question 15

Which TWO features of Microsoft Entra ID help protect against credential compromise? (Choose two.)

Accepted Answer

Microsoft Entra Password Protection. Options A and D are correct. Password protection bans weak passwords and smart lockout prevents brute force attacks. Option B is wrong because Conditional Access controls access after authentication. Option C is wrong because Identity Protection detects risky sign-ins but does not directly protect against credential compromise. Option E is wrong because access reviews are for governance.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra access reviews