AZ-305 Practice Test 12 — 15 Questions

Question 1

You are designing a monitoring solution for a critical application hosted on Azure Virtual Machines. The application experiences intermittent high CPU usage that lasts for 10 minutes. You need to be notified within 5 minutes of the start of each occurrence. The solution must minimize false alerts. What should you use?

Accepted Answer

Azure Monitor metric alert with a dynamic threshold and 5-minute frequency, alert on 2 consecutive breaches. Option C is correct because it uses a dynamic threshold that adapts to normal CPU patterns, reducing false alerts, and the 5-minute frequency with a requirement for 2 consecutive breaches ensures that the 10-minute event is detected within 5 minutes of its start (since the first breach triggers the second evaluation after 5 minutes, and if the second consecutive breach occurs, the alert fires). This matches the requirement for notification within 5 minutes while minimizing false positives.

Answer

Azure Monitor log alert querying Perf table every 1 minute

Answer

Create an Azure Monitor action group that sends email

Answer

Azure Monitor metric alert with a static threshold of 90% CPU

Question 2

Which TWO features of Microsoft Entra ID can be used to secure hybrid identities?

Accepted Answer

Seamless Single Sign-On. Seamless Single Sign-On (Seamless SSO) automatically signs users in when they are on corporate devices connected to the corporate network, eliminating password prompts. Password Hash Synchronization (PHS) synchronizes a hash of the user's on-premises AD password to Azure AD, enabling cloud authentication without additional infrastructure. Both features directly secure hybrid identities by extending on-premises credentials to the cloud.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Azure Active Directory Domain Services

Question 3

Your Azure subscription contains multiple virtual machines (VMs) that run a line-of-business application. You need to configure alerts when the CPU usage exceeds 90% for more than 5 minutes. Additionally, the alert must automatically trigger a runbook to scale out the application. Which Azure service should you use to create this alert?

Accepted Answer

Azure Monitor metric alert. Azure Monitor metric alerts can evaluate resource metrics like CPU usage at a specified frequency and trigger actions when a threshold (e.g., 90%) is breached for a given duration (e.g., 5 minutes). The alert can invoke an Automation runbook via an action group, enabling automatic scaling of the application. This is the correct service because it directly supports metric-based alerting with multi-condition evaluation and action group integration.

Answer

Azure Automation

Answer

Azure Logic Apps

Answer

Azure Autoscale

Question 4

Which THREE of the following are required to collect Windows security events into Microsoft Sentinel?

Accepted Answer

Log Analytics workspace. A Log Analytics workspace is required because Microsoft Sentinel is built on top of it; all security events collected by Sentinel are stored in the workspace's tables, and Sentinel uses the workspace as its data repository for analytics, alerting, and investigation.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 5

Refer to the exhibit. You run this Kusto query in Azure Monitor Logs. What does it return?

Accepted Answer

Computers that have not sent a heartbeat in the last 5 minutes.. The query uses the `Heartbeat` table and filters for heartbeats older than 5 minutes (`ago(5m)`). The `where` clause selects records where `TimeGenerated` is less than 5 minutes ago, meaning it finds heartbeats that were sent before that threshold. The `distinct Computer` then returns only computers whose most recent heartbeat is older than 5 minutes, i.e., computers that have not sent a heartbeat in the last 5 minutes. This is a common pattern for detecting unresponsive or offline machines.

Answer

The number of heartbeats per computer in the last hour.

Answer

Computers that sent a heartbeat in the last 5 minutes.

Answer

The average heartbeat frequency per computer.

Question 6

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that automatically blocks sign-ins from risky users and requires multi-factor authentication (MFA) when a sign-in risk is detected. Which TWO services should you use? (Choose two.)

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (B) is the service that detects sign-in risks (e.g., anonymous IP, atypical travel) and labels users or sign-ins as risky. Conditional Access policies (E) then enforce automated responses, such as blocking the sign-in or requiring MFA, based on the risk level from Entra ID Protection. Together, they provide the detection and enforcement mechanism described in the requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 7

Your company uses Azure Resource Manager templates for infrastructure deployment. You need to ensure that all deployments are validated against organizational policies before resources are provisioned. Which Azure service should you use?

Accepted Answer

Azure Policy. Option B is correct because Azure Policy can be used with a 'deny' effect to prevent non-compliant deployments. Option A is wrong because Azure Blueprints bundles artifacts but does not enforce policies. Option C is wrong because RBAC controls access but not resource compliance. Option D is wrong because Management Groups organize subscriptions but do not validate deployments.

Answer

Azure RBAC

Answer

Management Groups

Answer

Azure Blueprints

Question 8

Your organization is implementing a hybrid identity solution with Microsoft Entra ID. Users in an on-premises Active Directory domain need to access cloud applications. You need to ensure that password changes on-premises are synchronized to Entra ID within 30 seconds. Which configuration should you use?

Accepted Answer

Microsoft Entra Cloud Sync. Microsoft Entra Cloud Sync (Option C) is the correct choice because it is designed for near-real-time synchronization of identity changes, including password writes, with a target latency of under 30 seconds. It uses the lightweight Microsoft Entra Connect provisioning agent and the SCIM (System for Cross-domain Identity Management) protocol to sync changes from on-premises Active Directory to Entra ID, meeting the strict 30-second requirement for password change propagation.

Answer

Pass-through Authentication (PTA)

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect Sync with password hash synchronization

Question 9

Your company has multiple Azure subscriptions. You need to ensure that all security-related logs from Azure resources are centralized in a single Log Analytics workspace for analysis. Which Azure service should you use to collect and route these logs?

Accepted Answer

Azure Policy. Azure Policy is correct because it can enforce the deployment of a diagnostic setting on all Azure resources, automatically routing security-related logs (such as Activity Logs, resource logs, and audit logs) to a single Log Analytics workspace. This ensures centralized collection and analysis without manual configuration per resource, meeting the requirement for a governance-driven approach.

Answer

Azure Monitor

Answer

Microsoft Sentinel

Answer

Azure Event Hubs

Question 10

You are reviewing a custom RBAC role in Azure. The exhibit shows the role definition. A user with this role reports they cannot read diagnostic settings for a storage account in the Production resource group. What is the most likely cause?

Accepted Answer

The role does not include 'Microsoft.Storage/storageAccounts/read'. The user cannot read diagnostic settings because the custom role lacks the 'Microsoft.Storage/storageAccounts/read' permission. This permission is required to read the storage account resource itself, which is a prerequisite for accessing its diagnostic settings. Without it, the role cannot perform any read operations on the storage account, including reading diagnostic logs or metrics configuration.

Answer

Custom roles cannot be assigned to users

Answer

The role lacks the 'Microsoft.Storage/storageAccounts/listKeys/action' permission

Answer

The role is assigned at the wrong scope

Question 11

Your company has multiple Azure subscriptions. You need to create a single query that aggregates resource utilization metrics across all subscriptions and visualizes them in a dashboard. Which combination of Azure services should you use?

Accepted Answer

Azure Resource Graph and Azure Monitor Workbooks. Azure Resource Graph (ARG) can query across multiple subscriptions, resource groups, and resource types in a single query, making it ideal for aggregating utilization metrics. Azure Monitor Workbooks then provide a flexible, interactive canvas to visualize those query results in a dashboard, supporting rich visualizations and parameterized inputs.

Answer

Azure Monitor Log Analytics workspace and Azure Dashboards

Answer

Azure Policy and Azure Monitor Alerts

Answer

Microsoft Sentinel and Azure Playbooks

Question 12

Your organization uses Microsoft Sentinel for security monitoring. You need to ensure that all sign-in logs from Microsoft Entra ID are ingested into a Log Analytics workspace in real time. Which diagnostic setting should you configure?

Accepted Answer

SignInLogs. The SignInLogs diagnostic setting captures all user sign-in activities, including interactive and non-interactive sign-ins, which is required for real-time ingestion of all sign-in logs from Microsoft Entra ID into a Log Analytics workspace. This setting ensures that every authentication event is streamed to Sentinel for security monitoring without delay.

Answer

NonInteractiveUserSignInLogs

Answer

AuditLogs

Answer

ServicePrincipalSignInLogs

Question 13

Your organization plans to use Azure Policy to enforce tagging on all resources. The tags must include 'CostCenter' and 'Environment'. Resources that do not have these tags should be automatically remediated. What should you use?

Accepted Answer

A policy with 'deployIfNotExists' effect and a remediation task. The 'deployIfNotExists' effect is correct because it allows Azure Policy to evaluate resources for missing tags and then deploy a remediation task that automatically adds the required tags. This effect is specifically designed for scenarios where non-compliance can be corrected by deploying or modifying resources, such as adding tags via a policy definition that triggers a remediation task.

Answer

A policy with 'append' effect

Answer

A policy with 'audit' effect

Answer

A policy with 'deny' effect

Question 14

Your company uses Microsoft Entra ID for identity management. You need to ensure that only devices compliant with your company's security policies can access corporate resources. Which solution should you implement?

Accepted Answer

Conditional Access with device compliance policies from Microsoft Intune. Conditional Access in Microsoft Entra ID allows you to enforce access controls based on conditions, including device compliance. By integrating with Microsoft Intune, you can define device compliance policies (e.g., requiring encryption, a minimum OS version, or anti-malware status) and then configure a Conditional Access policy to block or grant access only to devices that are marked as compliant. This directly ensures that only compliant devices can access corporate resources.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Sentinel

Answer

Microsoft Defender XDR

Question 15

Your organization uses Microsoft Purview to govern data across Azure and on-premises sources. You need to ensure that sensitive data, such as credit card numbers, is automatically detected and classified in Azure Blob Storage. Which Purview feature should you configure?

Accepted Answer

Data classification scanning with built-in sensitive information types. Option C is correct because Microsoft Purview's data classification scanning can be configured to automatically detect sensitive data like credit card numbers using built-in sensitive information types (e.g., Credit Card Number). When a scan is run against Azure Blob Storage, Purview identifies and classifies the data based on these predefined patterns, enabling governance and compliance.

Answer

Microsoft Sentinel

Answer

Data catalog search

Answer

Data lineage tracking