AZ-305 Practice Test 47 — 15 Questions

Question 1

A company uses Microsoft Entra ID B2B to collaborate with external vendors. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from compliant devices (e.g., managed by Intune). They also want to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

B. It combines Conditional Access policies with session controls to enforce MFA, device compliance (via Intune), and a 1-hour session timeout. Conditional Access policies evaluate sign-in risk and require MFA and compliant devices, while the session control 'Sign-in frequency' can be set to 1 hour to enforce reauthentication. This meets all three requirements without relying on deprecated or separate features.

Answer

A

Answer

C

Answer

D

Question 2

You are designing a monitoring solution for an Azure function app that processes messages from Azure Service Bus. The function app is critical and must be highly available. You need to monitor for poison messages and trigger an alert when the dead-letter queue count exceeds 100. What should you use?

Accepted Answer

Azure Monitor metric alert on the dead-letter message count. Azure Monitor metric alerts can directly monitor the 'Dead-letter message count' metric for a Service Bus namespace or entity. When this count exceeds 100, the alert triggers, enabling automated response to poison messages without additional query overhead. This is the most efficient and native monitoring solution for real-time threshold-based alerts on Service Bus metrics.

Answer

Azure Service Bus Explorer

Answer

Azure Log Analytics workspace querying Service Bus logs

Answer

Azure Application Insights availability tests

Question 3

Your company uses Microsoft Entra ID. You need to implement a privileged identity management (PIM) strategy to secure administrative roles. Which TWO capabilities does PIM provide? (Choose two.)

Accepted Answer

Approval workflows for role activation. Privileged Identity Management (PIM) in Microsoft Entra ID provides time-based and approval-based role activation to secure privileged roles. Approval workflows for role activation (Option A) are a core PIM feature, allowing designated approvers to review and approve activation requests before a user gains elevated permissions. This ensures that privileged access is granted only after explicit authorization, reducing the risk of unauthorized use.

Answer

Conditional Access policies for role activation

Answer

Management of external identities

Answer

Automated user provisioning to applications

Question 4

Your Azure subscription contains multiple virtual machines (VMs) that run a line-of-business application. You need to configure alerts when the CPU usage exceeds 90% for more than 5 minutes. Additionally, the alert must automatically trigger a runbook to scale out the application. Which Azure service should you use to create this alert?

Accepted Answer

Azure Monitor metric alert. Azure Monitor metric alerts can evaluate resource metrics like CPU usage at a specified frequency and trigger actions when a threshold (e.g., 90%) is breached for a given duration (e.g., 5 minutes). The alert can invoke an Automation runbook via an action group, enabling automatic scaling of the application. This is the correct service because it directly supports metric-based alerting with multi-condition evaluation and action group integration.

Answer

Azure Automation

Answer

Azure Logic Apps

Answer

Azure Autoscale

Question 5

A company is designing a solution for storing sensitive financial records that must be retained for 7 years. The solution must meet the following requirements: - Data must be immutable during the retention period. - After the retention period, data must be automatically deleted. - The solution must minimize storage costs. Which two Azure services should the company use? (Choose two.)

Accepted Answer

Azure Blob Storage lifecycle management. Azure Blob Storage lifecycle management (B) is correct because it allows you to define rules to automatically delete blobs after a specified period, such as 7 years, minimizing storage costs by tiering or expiring data. Azure Blob Storage with immutable storage policy (D) is correct because it enforces WORM (Write Once, Read Many) immutability, preventing data modification or deletion during the retention period, which is essential for sensitive financial records.

Answer

Microsoft Purview Data Map

Answer

Azure NetApp Files with replication

Answer

Azure Files with snapshots

Question 6

Your company has multiple Azure subscriptions and needs a single pane of glass to monitor the health and performance of all resources across subscriptions. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it provides a unified, single-pane-of-glass experience for collecting, analyzing, and acting on telemetry from all Azure resources across multiple subscriptions. It aggregates metrics, logs, and alerts from various sources, enabling cross-subscription monitoring of health and performance without requiring separate tools.

Answer

Microsoft Sentinel

Answer

Azure Service Health

Answer

Azure Advisor

Question 7

Your company plans to use Microsoft Sentinel as a SIEM solution. You need to ensure that security events from all Azure subscriptions are collected in a single workspace. What should you configure?

Accepted Answer

Enable Microsoft Sentinel on a single Log Analytics workspace and configure diagnostic settings for all subscriptions to send logs to that workspace. Microsoft Sentinel requires a single Log Analytics workspace to act as the SIEM repository. By enabling Sentinel on that workspace and configuring diagnostic settings on all Azure subscriptions to stream their security logs (e.g., Activity logs, NSG flow logs, Windows Event logs) to that same workspace, you centralize all security events in one location. This ensures unified detection, investigation, and response across the entire enterprise without needing multiple Sentinel instances.

Answer

Create a Log Analytics workspace per subscription and use cross-workspace queries

Answer

Use Azure Policy to enforce Log Analytics workspace configuration across subscriptions

Answer

Deploy Microsoft Sentinel in each subscription and connect them via Azure Lighthouse

Question 8

Your organization is implementing a hybrid identity solution with Microsoft Entra ID. Users in an on-premises Active Directory domain need to access cloud applications. You need to ensure that password changes on-premises are synchronized to Entra ID within 30 seconds. Which configuration should you use?

Accepted Answer

Microsoft Entra Cloud Sync. Microsoft Entra Cloud Sync (Option C) is the correct choice because it is designed for near-real-time synchronization of identity changes, including password writes, with a target latency of under 30 seconds. It uses the lightweight Microsoft Entra Connect provisioning agent and the SCIM (System for Cross-domain Identity Management) protocol to sync changes from on-premises Active Directory to Entra ID, meeting the strict 30-second requirement for password change propagation.

Answer

Pass-through Authentication (PTA)

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect Sync with password hash synchronization

Question 9

Which THREE Azure services or features should you use to design a comprehensive monitoring solution for a hybrid infrastructure spanning on-premises and Azure?

Accepted Answer

Azure Monitor. Azure Monitor is the central platform for collecting, analyzing, and acting on telemetry from both Azure and on-premises resources. It provides a unified monitoring experience by aggregating metrics and logs, enabling alerting, dashboards, and integration with other services like Log Analytics. For a hybrid infrastructure, Azure Monitor serves as the core data ingestion and analysis hub, making it essential for a comprehensive monitoring solution.

Answer

Network Watcher

Answer

Azure Traffic Manager

Question 10

Which THREE of the following are required to collect Windows security events into Microsoft Sentinel?

Accepted Answer

Log Analytics workspace. A Log Analytics workspace is required because Microsoft Sentinel is built on top of it; all security events collected by Sentinel are stored in the workspace's tables, and Sentinel uses the workspace as its data repository for analytics, alerting, and investigation.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 11

Your company plans to use Microsoft Sentinel for security information and event management (SIEM). You need to ingest security logs from multiple Azure resources and on-premises servers. Which data connector should you use for Windows servers on-premises?

Accepted Answer

Azure Monitor Agent. The Azure Monitor Agent (AMA) is the correct choice because it is the current, recommended data collection agent for Microsoft Sentinel, replacing the legacy Log Analytics agent. It supports collecting security logs from Windows servers on-premises via the Windows Security Events via AMA connector, which uses data collection rules (DCRs) for flexible, scalable log ingestion. AMA is optimized for Sentinel's SIEM requirements and provides better performance, security, and manageability than its predecessor.

Answer

Log Analytics agent

Answer

Microsoft Defender for Cloud agent

Answer

Azure Arc agent

Question 12

Which THREE components are required to monitor and audit Azure resource changes using Azure Monitor?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is required because it serves as the central repository where Azure Monitor collects and stores log data from various sources, including diagnostic settings and activity logs. Without a workspace, there is no destination for the logs to be ingested, queried, or analyzed, making it an essential component for monitoring and auditing resource changes.

Answer

An Application Insights resource

Answer

Azure Policy with audit effect

Question 13

Your organization has a complex Azure environment with multiple subscriptions. You need to design a governance strategy that ensures: 1) All resources must have specific tags (CostCenter, Environment, Owner). 2) Any resource without required tags must be reported to the compliance team weekly. 3) Virtual machines must not be deployed in certain regions due to data sovereignty. 4) The solution must be automated and use native Azure services. You already have an Azure Log Analytics workspace and a central automation account. What should you include in the design?

Accepted Answer

Use Azure Policy with 'audit' effect for missing tags and region restriction; use Azure Logic Apps triggered by a schedule to query Azure Resource Graph and email the compliance report.. It uses Azure Policy with 'audit' effect to detect missing tags and region violations without blocking deployment, which satisfies the reporting requirement. Azure Logic Apps, triggered on a schedule, queries Azure Resource Graph to identify non-compliant resources and sends an email report to the compliance team weekly, fulfilling the automation and native service criteria without manual intervention.

Answer

Use Azure Resource Graph queries to find untagged resources and export to CSV manually each week.

Answer

Use Azure Blueprints to define tags and region restrictions; use Azure Monitor alerts to report non-compliance.

Answer

Use Azure Policy with 'deny' effect for missing tags and an Azure Automation runbook to add tags weekly.

Question 14

A company needs to store large amounts of unstructured data such as images and videos for a content management system. The data must be accessible via HTTPS and support tiered storage for cost optimization. Which Azure service should they use?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is the correct choice because it is designed for storing large amounts of unstructured data (such as images and videos) and provides HTTPS access. It also offers tiered storage (hot, cool, cold, and archive tiers) to optimize costs based on data access patterns, making it ideal for a content management system.

Answer

Azure Cosmos DB

Answer

Azure Data Lake Storage

Answer

Azure Files

Question 15

Your company is designing a data lake solution for IoT telemetry data. The data is ingested continuously and must be stored cost-effectively while allowing occasional interactive queries. The data has a lifespan of 90 days for hot access and 3 years for archived access. Which Azure storage tiering strategy minimizes costs?

Accepted Answer

Use Azure Blob Storage with lifecycle management: Hot for 90 days, then Cool, then Archive after 3 years. Azure Blob Storage lifecycle management can automatically transition data from Hot to Cool to Archive tiers based on age, minimizing costs for IoT telemetry that needs 90 days of hot access and 3 years of archival. The Hot tier provides low-latency access for interactive queries, Cool offers lower storage cost for infrequent access, and Archive provides the lowest cost for long-term retention. This tiering strategy aligns with the data's lifespan and access patterns, reducing overall storage expenses compared to keeping all data in a single tier.

Answer

Use Azure Blob Storage with only Hot tier for 90 days, then delete

Answer

Use Azure Blob Storage with Cool tier for all data

Answer

Use Azure Files with lifecycle management to Archive after 90 days