AZ-305 Practice Test 50 — 15 Questions

Question 1

A company uses Microsoft Entra ID. They want to allow external business partners to request access to a specific internal application. The access must be time-limited and require approval from a manager within the partner's organization. Additionally, access should automatically expire after the defined period. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management enables organizations to manage access requests for internal and external users through access packages. It supports time-limited access with automatic expiration and allows delegation of approval to a manager within the partner's organization via connected organizations. This directly meets the requirement for external partner self-service access with time-bound, approved access.

Answer

Microsoft Entra ID B2B Collaboration

Answer

Microsoft Entra ID Identity Governance

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 2

A company uses Microsoft Entra ID (Microsoft Entra ID) for identity management. They want to automatically detect sign-in risks such as sign-ins from unfamiliar locations, anonymous IP addresses, or leaked credentials. Based on the risk level, they want to apply different controls: for low-risk sign-ins, show a message but allow access; for medium-risk sign-ins, require multi-factor authentication (MFA); for high-risk sign-ins, block the sign-in. They also need to receive a weekly summary report of risk events. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Conditional Access policies with sign-in risk conditions. Option B is correct because Microsoft Entra ID Conditional Access policies can integrate sign-in risk conditions from Identity Protection to enforce granular controls based on risk levels. This allows you to configure actions such as showing a message for low risk, requiring MFA for medium risk, and blocking access for high risk, while Identity Protection provides the weekly summary report of risk events.

Answer

Microsoft Entra ID Identity Protection policies

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 3

A company has Microsoft Entra ID Premium P2 licenses and wants to ensure that privileged roles (e.g., Global Administrator) are only activated when needed and with approval. They also need to regularly review who has access to these roles. Which combination of features should they use?

Accepted Answer

Privileged Identity Management (PIM) and Microsoft Entra ID Access Reviews. Privileged Identity Management (PIM) provides just-in-time (JIT) activation of privileged roles with approval workflows, meeting the requirement for activation only when needed and with approval. Microsoft Entra ID Access Reviews then enable recurring certification of role assignments, ensuring that access is regularly reviewed and stale or inappropriate assignments are removed. Together, they form the correct combination for managing and governing privileged roles.

Answer

Identity Protection and Conditional Access

Answer

Entitlement Management and Conditional Access

Answer

Microsoft Entra ID Access Reviews and Identity Protection

Question 4

A company uses Microsoft Entra ID (Microsoft Entra ID). External partners need temporary access to an internal application. The process must be self-service: partners request access, the request goes through an approval workflow managed by a manager from the partner's organization, and access automatically expires after 30 days. The company also wants to send reminder emails 7 days before expiration. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Identity Governance - Entitlement Management. Option B is correct because Microsoft Entra ID Identity Governance - Entitlement Management is specifically designed to manage access for external users through self-service access packages. It supports approval workflows with external managers, automatic time-bound access (e.g., 30-day expiration), and lifecycle notifications like reminder emails 7 days before expiry. This aligns perfectly with the requirement for partner-managed, temporary, self-service access.

Answer

Microsoft Entra ID Identity Governance - Access Reviews

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Question 5

A company uses Microsoft Entra ID (Microsoft Entra ID). They have a SaaS application that supports SCIM (System for Cross-domain Identity Management). The company wants to automatically create, update, and deactivate user accounts in the SaaS application whenever changes occur in Microsoft Entra ID. They do not want to use custom scripts. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Provisioning (Automatic User Provisioning). Microsoft Entra ID Provisioning (Automatic User Provisioning) is the correct feature because it natively supports the SCIM (System for Cross-domain Identity Management) protocol to automate the creation, update, and deactivation of user accounts in SaaS applications. This eliminates the need for custom scripts by synchronizing identity changes from Microsoft Entra ID to the target application in near real-time.

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID B2B Collaboration

Question 6

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to grant temporary administrative roles to users for specific tasks. The process must require approval from a designated approver, and the access must automatically expire after a defined period. The company also needs audit logs of all role assignments and activations. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access, requiring approval from designated approvers and automatically expiring role assignments after a defined duration. PIM also generates detailed audit logs for all role activations and assignments, meeting the compliance and monitoring requirements.

Answer

Microsoft Entra ID Entitlement Management

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Conditional Access

Question 7

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to grant specific IT administrators just-in-time (JIT) access to Azure virtual machines for troubleshooting. The access must be time-bound, require approval from a senior manager, and be automatically revoked after the granted time period. The company also needs an audit log of all access requests and assignments. Which Azure service or feature should they use?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources. Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources provides just-in-time (JIT) access with time-bound activation, approval workflows, and automatic revocation. It also includes full audit logging of all requests and assignments, meeting all the specified requirements for granting temporary access to Azure VMs.

Answer

Azure Bastion

Answer

Just-in-Time VM access (Microsoft Defender for Cloud)

Answer

Microsoft Entra ID Application Proxy

Question 8

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically review and remove guest accounts that have not signed in for 90 days. They also need to generate reports for auditors. Which Microsoft Entra ID feature should they use?

Accepted Answer

Access Reviews. Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews of guest users' access. By configuring a review with a 'days since last sign-in' condition (e.g., 90 days), Entra ID automatically flags and can remove guest accounts that have not authenticated within that period. The review process also generates detailed audit logs and reports suitable for auditor compliance, directly meeting the stated requirements.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Conditional Access

Question 9

A company uses Microsoft Entra ID. They need to grant external partners access to an internal application for a limited time (30 days). The access must be approved by a manager from the partner's organization. After the period ends, access should automatically be removed. The company also wants to send email reminders 7 days before expiration. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management is the correct feature because it provides automated access lifecycle management for external users, including time-limited access packages, approval workflows (including external manager approval), and automatic expiration with email notifications. This directly matches the requirement for 30-day access with partner manager approval and 7-day reminder emails.

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Question 10

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to require multi-factor authentication (MFA) for all users accessing the Azure portal, but do not want MFA to be required for other applications like Office 365. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Conditional Access. Conditional Access in Microsoft Entra ID allows granular control over authentication requirements based on conditions such as application, user, location, or device state. By creating a Conditional Access policy targeting the Azure Portal application and requiring MFA, the company can enforce MFA specifically for Azure Portal access without affecting other applications like Office 365, which can be excluded from the policy.

Answer

Microsoft Entra ID Security defaults

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 11

A company uses Microsoft Entra ID. They want to enforce that all users must use multi-factor authentication (MFA) when accessing sensitive applications from outside the corporate network, but allow access without MFA when coming from the corporate office IP range. Which Microsoft Entra ID feature should they use to create this policy?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow administrators to define access controls based on conditions such as user location, device state, and application sensitivity. By creating a policy that requires MFA for all users accessing sensitive applications from outside the corporate network, and excluding the trusted corporate office IP range from the MFA requirement, the company can enforce the desired behavior. This is the correct feature because it directly supports location-based access controls and granular policy conditions.

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID roles

Question 12

A company uses Microsoft Entra ID. They want to require users to use multi-factor authentication when accessing the Azure portal from any device. They do not want to require MFA for other applications. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access policy targeting Azure Portal. Conditional Access policies allow granular control over authentication requirements based on conditions such as application, user, location, or device state. By creating a policy that targets the 'Microsoft Azure Management' cloud app and requires multi-factor authentication, you can enforce MFA specifically for the Azure portal without affecting other applications. This provides the precise control requested, unlike broader or legacy methods.

Answer

Per-user MFA (legacy)

Answer

Security defaults

Answer

Identity Protection

Question 13

A company uses Microsoft Entra ID and wants to enforce that all users must use multi-factor authentication (MFA) when accessing sensitive applications. However, they want to exclude users when connecting from the corporate office IP range and only allow access from devices that are compliant with Intune policies. Which Microsoft Entra ID feature should they use to create this policy?

Accepted Answer

Microsoft Entra ID Conditional Access. C is correct because Microsoft Entra ID Conditional Access is the feature specifically designed to enforce granular access policies based on conditions such as user, location, device compliance, and application sensitivity. By configuring a Conditional Access policy, you can require MFA for sensitive applications, exclude the corporate office IP range, and restrict access to Intune-compliant devices, all within a single policy.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Identity Governance

Question 14

A company wants to collect metrics and logs from all Azure resources in their subscription, including custom metrics from their applications, and create dashboards and alerts. Which Azure service should they use as the primary monitoring platform?

Accepted Answer

Azure Monitor. Azure Monitor is the correct primary monitoring platform because it serves as the single, unified ingestion and analysis service for all metrics and logs across Azure resources, including custom metrics from applications via the Application Insights SDK or the custom metrics API. It provides a consolidated workspace for creating dashboards, setting alerts, and querying data, making it the foundational service for observability in Azure.

Answer

Azure Log Analytics

Answer

Azure Application Insights

Answer

Azure Service Health

Question 15

A company wants workload deployments to access Azure resources without storing client secrets in CI/CD variables. The pipeline runs from GitHub Actions. Which identity design should be used?

Accepted Answer

Workload identity federation with Microsoft Entra ID. Workload identity federation with Microsoft Entra ID allows GitHub Actions to exchange an OpenID Connect (OIDC) token for an Azure access token, eliminating the need to store client secrets in CI/CD variables. This design uses short-lived tokens and federated identity credentials, aligning with the principle of zero-trust and secretless authentication.

Answer

A shared user account with MFA disabled

Answer

A storage account access key

Answer

A long-lived app registration client secret