AZ-305 Practice Test 14 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID and Azure Key Vault. You need to ensure that a custom application can securely access secrets in Key Vault without storing credentials in code. The application runs on an Azure Virtual Machine. What should you use?

Accepted Answer

Assign a system-assigned managed identity to the VM. Option C is correct because a system-assigned managed identity for Azure Virtual Machines allows the application to authenticate to Azure Key Vault without storing any credentials in code. Azure automatically manages the identity's lifecycle and tokens, enabling the VM to obtain an access token from Azure AD (now Microsoft Entra ID) to call Key Vault's REST API. This aligns with the principle of zero-trust and eliminates the need for service principals or certificates in the application.

Answer

Store the Key Vault URL and connection string in the application configuration

Answer

Create a service principal and upload a certificate to the VM

Answer

Use a shared access signature (SAS) token

Question 2

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. The query returns no results. Which is the most likely cause?

Accepted Answer

Microsoft Entra ID Protection is not enabled for the tenant. The KQL query references the 'IdentityLogonEvents' table, which is populated by Microsoft Entra ID Protection. If Entra ID Protection is not enabled, this table will contain no data, causing the query to return zero results even if the syntax, column names, and time range are correct.

Answer

The syntax is invalid because where clause should use == instead of ==

Answer

The column names are incorrect

Answer

The time range is too short

Question 3

Your company has a Microsoft Entra ID tenant with 50,000 users. You need to design a solution to ensure that users can reset their own passwords without help desk intervention, while preventing password reuse for the last 10 passwords. Which feature should you enable?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention. Additionally, SSPR can be configured with password protection policies that enforce password history, preventing reuse of the last 10 passwords. This directly meets both requirements stated in the question.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Connect

Answer

Privileged Identity Management (PIM)

Question 4

You are designing an identity solution for a multinational company that uses Microsoft Entra ID. The company has a requirement that all users must authenticate using biometrics or FIDO2 security keys. Which Entra ID feature should you configure?

Accepted Answer

Conditional Access policies. Option D is correct because Conditional Access policies in Microsoft Entra ID allow you to enforce authentication strength requirements, such as requiring biometrics or FIDO2 security keys, by targeting specific user groups or applications. This is achieved by configuring a Conditional Access policy with the 'Require multifactor authentication' control and integrating with authentication methods like Windows Hello for Business or FIDO2 security keys, ensuring that only passwordless authentication methods meeting the company's biometric or FIDO2 requirement are permitted.

Answer

Passwordless authentication

Answer

Identity Protection

Answer

Entra Verified ID

Question 5

Which TWO features are part of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. Options A and C are correct. Entitlement Management (A) and Access Reviews (C) are core governance features. Option B (Self-service password reset) is a user management feature. Option D (Privileged Identity Management) is part of Identity Protection. Option E (Conditional Access) is security policy.

Answer

Self-service password reset

Answer

Conditional Access

Answer

Privileged Identity Management

Question 6

You are designing identity governance for a company that uses Microsoft Entra ID. The company wants to grant external partners access to an internal application for 90 days. After 90 days, access must be automatically removed. Additionally, the application requires that users have multi-factor authentication (MFA) and a compliant device. You need to design a solution that meets these requirements with minimal administrative effort. What should you do?

Accepted Answer

Create an access package in Microsoft Entra entitlement management with a 90-day policy and conditional access policies for MFA and device compliance.. Option A is correct because Microsoft Entra entitlement management allows you to create an access package that automatically grants external partners access to the application for exactly 90 days, after which access is automatically removed via an expiration policy. Additionally, you can enforce multi-factor authentication (MFA) and device compliance by configuring conditional access policies that are applied to the access package, meeting all requirements with minimal administrative effort through automation.

Answer

Manually create guest user accounts, assign app, and set calendar reminder to delete after 90 days.

Answer

Create a dynamic group in Microsoft Entra ID that includes partners and assign the app; use a scheduled script to remove membership after 90 days.

Answer

Use Microsoft Entra Privileged Identity Management to grant just-in-time access for 90 days.

Question 7

You are investigating a security incident where an unauthorized user may have modified a production VM. You run the KQL query shown in the exhibit in Microsoft Sentinel, but it returns no results. The VMs are present and have been modified recently. What is the most likely reason for no results?

Accepted Answer

The ResourceId contains the VM name in lowercase, but the extract pattern is case-sensitive.. Option D is correct because the KQL query uses the `extract` function with a pattern that expects the VM name in the ResourceId to be in lowercase, but the actual ResourceId contains the VM name in uppercase. The `extract` function in KQL is case-sensitive by default, so the pattern fails to match, returning no results. Even though the VMs have been modified, the query cannot parse the ResourceId correctly, leading to zero output.

Answer

The query does not filter by a time range, so it may be returning old data.

Answer

The Caller field is not included in the output, so the query cannot identify unauthorized users.

Answer

The OperationNameValue is incorrect; the correct value is 'MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE' in uppercase.

Question 8

Your company has a large Azure environment with thousands of resources. You need to design a solution to track resource ownership and ensure that resources are cleaned up when projects end. You want to use a tag-based approach where each resource has an 'Owner' and 'Project' tag. Additionally, you need to generate a weekly report of resources that are not tagged or have been orphaned (no recent activity). What should you include in the design?

Accepted Answer

Use Azure Resource Graph queries in an Azure Logic App scheduled to run weekly, and send the report via email.. Option C is correct because Azure Resource Graph can query all resources and their tags, and Azure Logic Apps can schedule the query and send a report via email. Option A is wrong because Azure Policy can enforce tags but does not generate reports natively. Option B is wrong because Azure Monitor alerts are for real-time notifications, not scheduled reports. Option D is wrong because Azure Automation runbooks can do this but are more complex than Logic Apps.

Answer

Use Azure Policy to audit missing tags and create a custom dashboard in Azure Monitor.

Answer

Use Azure Monitor alerts with a metric alert for unmodified resources.

Answer

Use Azure Automation runbook to inventory resources and store in a SQL database, then use Power BI to report.

Question 9

You are a solutions architect for a financial services company. The company uses Microsoft Entra ID and has the following requirements:
1. All Azure administrators must use Privileged Identity Management (PIM) to activate their roles for a maximum of 4 hours.
2. Activation must require Azure Multi-Factor Authentication (MFA) and a ticket number.
3. Approvers must be notified via email when a role is activated.
4. All activation requests must be audited.
You configure PIM for Entra ID roles. Which additional configuration is needed to meet all requirements?

Accepted Answer

Set the maximum activation duration to 4 hours in the PIM settings.. Option C is correct. PIM for Entra ID roles already supports MFA, ticket numbers, email notifications, and audit logs. However, the requirement to limit activation to 4 hours requires configuring a maximum activation duration in PIM settings. Option A (Conditional Access) is not needed because PIM handles MFA separately. Option B (Azure AD audit logs) is already enabled. Option D (Azure Monitor) is not required for this scenario.

Answer

Configure a Conditional Access policy to require MFA for all admins.

Answer

Enable Azure AD audit logs in the Azure portal.

Answer

Create an Azure Monitor alert rule for role activations.

Question 10

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. You need to ensure that all Azure subscriptions are covered by a single continuous export configuration that sends security alerts to a Log Analytics workspace. What should you do?

Accepted Answer

Configure continuous export at the management group level.. Continuous export can be configured at the subscription level or management group scope. By configuring it at the management group level, all subscriptions under that management group inherit the export settings. This provides a single configuration point.

Answer

Use Azure Policy to deploy continuous export settings to all subscriptions.

Answer

Create an Azure Automation runbook to export settings to all subscriptions.

Answer

Configure continuous export in each subscription individually.

Question 11

Your company uses Azure Policy to enforce compliance. You need to ensure that all storage accounts use HTTPS only. The policy should automatically remediate non-compliant storage accounts by enabling HTTPS-only. What policy effect should you use?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it not only evaluates whether storage accounts have the 'HTTPS only' setting enabled but also automatically deploys a remediation task to enable it when non-compliance is detected. This ensures continuous compliance without manual intervention, which aligns with the requirement for automatic remediation.

Answer

Deny

Answer

AuditIfNotExists

Answer

Append

Question 12

Your company has multiple Azure subscriptions managed by different teams. You need to design a governance solution that ensures: 1) All subscriptions must have a consistent set of policies (e.g., allowed locations, allowed VM SKUs). 2) Compliance reports must be generated daily for each subscription. 3) Non-compliant resources must be automatically remediated where possible (e.g., add tags). 4) The solution must use a single management group hierarchy. What should you include in the design?

Accepted Answer

Create a management group hierarchy, assign Azure Policy at the root management group level with both 'audit' and 'deployIfNotExists' effects, and use a daily Logic App to query compliance via Azure Resource Graph and send reports.. Option A is correct because assigning Azure Policy at the root management group level ensures consistent policy enforcement across all subscriptions in the hierarchy. The 'deployIfNotExists' effect enables automatic remediation (e.g., adding missing tags), while a daily Logic App querying Azure Resource Graph can generate compliance reports without manual intervention. This design satisfies all requirements with a single management group hierarchy.

Answer

Create a management group hierarchy and use Azure Blueprints to assign policies and role assignments per subscription.

Answer

Use Azure DevOps to deploy a pipeline that runs PowerShell scripts to enforce policies and generate reports.

Answer

Create a custom Azure Policy initiative with all required policies and assign it to each subscription individually.

Question 13

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to ensure that an alert is generated when an Azure VM is created with an open inbound SSH port (22) from the internet. The solution should use existing Azure resources and minimize administrative overhead. What should you use?

Accepted Answer

Create a Microsoft Sentinel analytics rule using the Azure Activity data connector.. Option A is correct because Microsoft Sentinel's Azure Activity data connector ingests resource logs from Azure's control plane (Azure Resource Manager). By creating an analytics rule that detects a 'Microsoft.Compute/virtualMachines/write' operation with a network security group rule allowing inbound SSH (port 22) from 'Internet' (any IP), you can generate an alert without deploying additional agents or infrastructure. This minimizes administrative overhead by using existing Sentinel resources and the built-in Activity log connector.

Answer

Create an Azure Policy with audit effect and configure a Sentinel data connector for Azure Policy.

Answer

Create an Azure Monitor metric alert on the 'Network In' metric.

Answer

Enable Microsoft Defender for Cloud and configure a continuous export to Sentinel.

Question 14

Your company plans to deploy a new application to Azure. The application will be used by external partners. You need to design an identity solution that allows partners to authenticate using their own corporate credentials while ensuring that the application can enforce conditional access policies based on partner device compliance. What should you include in the design?

Accepted Answer

Configure Microsoft Entra B2B collaboration and enable conditional access policies for guest users.. Option D is correct because Microsoft Entra B2B collaboration allows you to invite external partners as guest users who can authenticate with their own corporate credentials. You can then enforce conditional access policies, including device compliance checks, on these guest users by targeting the policy to the 'Guest' user type or specific external users.

Answer

Federate your Microsoft Entra tenant with each partner's on-premises Active Directory.

Answer

Create guest user accounts in your Microsoft Entra tenant and assign them application roles.

Answer

Configure Microsoft Entra B2C and federate with partner identity providers.

Question 15

Your company uses Microsoft Entra ID for identity management. You need to design a monitoring solution for sign-in logs to detect suspicious activity. Which TWO Azure services should you include in the design?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (Option B) is correct because it provides Cloud Access Security Broker (CASB) capabilities that analyze sign-in logs for anomalous behavior, such as impossible travel, suspicious IP addresses, and credential theft. It integrates with Microsoft Entra ID to detect and respond to risky sign-in events in real time, making it a core component for monitoring suspicious activity.

Answer

Azure Monitor

Answer

Microsoft Purview

Answer

Log Analytics workspace