AZ-305 Practice Exam 52 — 20 Questions

Question 1

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to enforce that all users accessing the company's internal application from mobile devices must be compliant with device management policies (e.g., require a PIN and encryption). The application does not support modern authentication. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Application Proxy. Microsoft Entra ID Application Proxy is the correct choice because it enables secure remote access to on-premises web applications that do not support modern authentication. By publishing the internal application through Application Proxy, you can enforce device compliance policies (e.g., requiring a PIN and encryption) via Conditional Access policies applied to the Application Proxy service, even though the application itself uses legacy authentication.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Question 2

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to automatically remove guest users who have not signed in for 60 days. Additionally, they must generate a report of all guest access for auditors. Which Microsoft Entra ID feature should they implement?

Accepted Answer

Access Reviews. Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews that automatically remove guest users who have not signed in within a specified period (e.g., 60 days) by configuring the 'Inactive users (in days)' setting. Additionally, Access Reviews generate a detailed report of all guest access decisions, which can be exported for auditors, meeting both requirements directly.

Answer

Entitlement Management

Answer

Identity Protection

Answer

Terms of Use

Question 3

A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They need to automatically block sign-ins from anonymous IP addresses (e.g., Tor) and force users from risky sign-ins to reset their password. They want to minimize administrative effort and use built-in features. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Microsoft Entra ID Identity Protection risk policies (sign-in risk and user risk).. Option A is correct because Microsoft Entra ID Identity Protection provides built-in risk policies that automatically detect and block sign-ins from anonymous IP addresses (e.g., Tor) via the sign-in risk policy, and force password reset for users flagged with high user risk via the user risk policy. These policies operate without manual intervention, minimizing administrative effort while leveraging Premium P2 capabilities.

Answer

Conditional Access policies with locations and grant controls.

Answer

Microsoft Entra ID Privileged Identity Management (PIM).

Answer

Microsoft Entra ID Access Reviews.

Question 4

A company uses Microsoft Entra ID (Microsoft Entra ID). They have many guest users with access to internal SharePoint sites and applications. They need to review guest user access every 90 days and automatically remove access if the guest does not respond to the review request. The solution must be fully automated without custom scripting. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Access Reviews. Microsoft Entra ID Access Reviews is the correct feature because it allows administrators to create recurring reviews of guest user access to groups, applications, and SharePoint sites. It can be configured to automatically remove access if the guest does not respond within a specified period (e.g., 90 days), and it supports full automation without custom scripting by leveraging built-in review schedules and auto-apply actions.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Question 5

A company uses Microsoft Entra ID and wants to allow users to sign in using their existing personal Microsoft accounts, Google, and Facebook identities. They also need custom sign-up and sign-in flows with collection of specific user attributes. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID B2C. Microsoft Entra ID B2C (Business-to-Consumer) is the correct choice because it is specifically designed to support external identity providers like personal Microsoft accounts, Google, and Facebook, and it provides a customizable policy framework (user flows) for sign-up and sign-in that can collect custom user attributes. Unlike B2B, which focuses on business partner collaboration, B2C allows you to define attribute collection during registration via built-in or custom policies.

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Conditional Access

Question 6

A company uses Microsoft Entra ID and wants to automate the lifecycle management of user accounts in their SaaS applications, such as Salesforce and ServiceNow. The solution should automatically create, update, and deactivate accounts when users join, move, or leave the organization. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Provisioning. Microsoft Entra ID Provisioning (specifically, HR-driven provisioning) automates the creation, update, and deactivation of user accounts in SaaS applications like Salesforce and ServiceNow based on changes in the organization's HR system or directory. It uses SCIM (System for Cross-domain Identity Management) protocol to synchronize identity lifecycle events, ensuring accounts are automatically created when users join, updated when they move, and deactivated when they leave.

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID Entitlement Management

Question 7

A company wants to allow remote users to access an internal web application hosted on-premises without opening inbound firewall ports. They need seamless single sign-on (SSO) using Microsoft Entra ID credentials. Which Azure service should they use?

Accepted Answer

Microsoft Entra ID Application Proxy. Microsoft Entra ID Application Proxy provides secure remote access to on-premises web applications without requiring inbound firewall ports. It works by establishing an outbound connection from the on-premises Application Proxy connector to the Entra ID service, then routing user traffic through that tunnel. It integrates with Entra ID for pre-authentication and supports seamless SSO using the user's existing Entra ID credentials via Kerberos constrained delegation (KCD) or header-based authentication.

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Connect

Question 8

A company uses Microsoft Entra ID. They need to monitor sign-in logs for anomalous activity (e.g., sign-ins from unfamiliar locations) and automatically take action such as requiring MFA or blocking sign-in. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Identity Protection. Identity Protection is the correct feature because it is specifically designed to detect anomalous sign-in activities, such as sign-ins from unfamiliar locations or anonymous IP addresses, and can automatically trigger risk-based remediation actions like requiring MFA or blocking sign-ins. It leverages machine learning models and real-time risk detections to assess sign-in risks and apply policies accordingly, directly meeting the requirement for monitoring and automated response.

Answer

Conditional Access

Answer

Access Reviews

Answer

Privileged Identity Management

Question 9

A company uses Microsoft Entra ID. They want to allow users to sign in to partner applications using their Microsoft Entra ID credentials. The partner applications support SAML 2.0 and OpenID Connect. They also need to customize the appearance of the sign-in pages. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Enterprise Application with SAML-based SSO. Microsoft Entra ID Enterprise Application with SAML-based SSO is the correct feature because it allows you to register partner applications that support SAML 2.0 or OpenID Connect, enabling federated single sign-on using existing Microsoft Entra ID credentials. Additionally, you can customize the branding (logo, sign-in page text, etc.) for each enterprise application, meeting the requirement to customize the appearance of sign-in pages.

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID Conditional Access

Question 10

A company wants to configure policies that detect risky sign-ins (e.g., from anonymous IPs or unfamiliar locations) and automatically require multi-factor authentication (MFA) when such risk is detected. Which Microsoft Entra ID feature should they use to create these policies?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct feature because it allows administrators to create policies that evaluate sign-in risk signals (such as anonymous IP addresses or unfamiliar locations) and enforce access controls like requiring multi-factor authentication (MFA). Conditional Access policies can integrate with Identity Protection risk detections, but the policy itself is defined and managed within the Conditional Access blade, making it the direct tool for this requirement.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Audit Logs

Question 11

A company uses Microsoft Entra ID. They want to grant a user temporary access to the Global Administrator role for a specific task. The access must require approval from a manager and automatically expire after 4 hours. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing users to activate roles like Global Administrator for a limited time. It supports approval workflows (manager approval) and configurable activation duration (e.g., 4 hours), making it the correct choice for temporary, approved, time-bound role elevation.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Access Reviews

Question 12

A multinational company uses Microsoft Entra ID. The company has regional IT teams that need to manage users and groups within their respective regions. Each region has a distinct set of users in specific organizational units. The company wants to assign the User Administrator role to regional IT staff, but limit their scope to only the users in their region. Which Microsoft Entra ID feature should they use?

Accepted Answer

Administrative Units. Administrative Units in Microsoft Entra ID allow you to delegate administrative roles, such as User Administrator, to a specific subset of users and groups defined by organizational boundaries (e.g., region). By creating an Administrative Unit for each region and adding the regional users and groups to it, you can assign the User Administrator role scoped to that unit, ensuring regional IT staff can only manage their own region's identities.

Answer

Dynamic Groups

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection

Question 13

A company uses Microsoft Entra ID. They want to block all access to corporate applications from devices that are not managed by their organization. They require that only devices enrolled in Microsoft Intune and compliant with company policies can access company resources. Which Microsoft Entra ID feature should they use?

Accepted Answer

Conditional Access policy requiring device compliance. Option A is correct because Conditional Access policies in Microsoft Entra ID can enforce device compliance as a condition for granting access. By configuring a policy that requires devices to be marked as compliant in Microsoft Intune, only devices enrolled and meeting company policies can access corporate applications, effectively blocking unmanaged devices.

Answer

Identity Protection with user risk policy

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Join process

Question 14

A company uses Microsoft Entra ID Premium P2. They need to automatically detect users with high-risk sign-ins (e.g., from anonymous IP addresses or leaked credentials) and require them to reset their password. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Identity Protection. Identity Protection is the correct feature because it is specifically designed to detect and remediate risky sign-ins, including those from anonymous IP addresses or leaked credentials. It uses machine learning to assign a risk level to each sign-in and user, and can automatically enforce password resets when high-risk events are detected, aligning with the requirement for automated detection and remediation.

Answer

Privileged Identity Management

Answer

Conditional Access

Answer

Access Reviews

Question 15

A company uses Microsoft Entra ID and wants to automate the process of granting access to internal applications and Microsoft 365 groups. Employees request access through a portal, and managers must approve the requests. The access should be automatically removed after a defined period, and managers must perform quarterly access reviews to confirm continued need. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management is the correct feature because it provides automated access request workflows, time-bound access assignments (via access packages), and periodic access reviews. This directly matches the requirements for a portal-based request process with manager approval, automatic expiration, and quarterly reviews.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Self-Service Group Management

Question 16

A company has Azure virtual networks (VNets) in three different Azure regions (West US, East US, and West Europe). They also have an on-premises data center connected to the East US region via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. The solution must support transitive routing between all sites and provide centralized management of connectivity and routing policies. Which Azure service should they use?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is correct because it provides a hub-and-spoke architecture with built-in transitive routing between all VNets and on-premises sites. It supports automatic connectivity through Virtual Hub routers, which use BGP to propagate routes across all spokes and branches, meeting the requirement for centralized management of connectivity and routing policies.

Answer

VNet peering

Answer

VPN Gateway

Answer

ExpressRoute Direct

Question 17

A company has multiple Azure virtual networks (VNets) in different regions. They want to connect all VNets to each other securely over the Microsoft backbone network, and also connect to their on-premises data center via ExpressRoute. What is the simplest Azure solution to enable connectivity between all VNets and on-premises?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is the simplest solution because it provides a hub-and-spoke architecture that automatically connects all VNets and on-premises sites over the Microsoft backbone network. It natively integrates ExpressRoute and VPN gateways into a single managed service, eliminating the need to manually configure multiple peering or gateway connections.

Answer

VNet peering

Answer

ExpressRoute

Answer

VPN Gateway

Question 18

A company has an on-premises data center and wants to connect it to Azure to extend their network. They require a dedicated, private, high-bandwidth connection that is not routed over the public internet. They also want a lower-cost backup connection for redundancy in case the primary connection fails. Which combination of connectivity options should they implement?

Accepted Answer

ExpressRoute as the primary connection and a Site-to-Site VPN as the backup connection.. ExpressRoute provides a dedicated, private, high-bandwidth connection that bypasses the public internet, meeting the primary requirement. A Site-to-Site VPN over the internet serves as a cost-effective backup path for redundancy, as it uses encrypted tunnels over the public internet without the recurring costs of a second ExpressRoute circuit.

Answer

Two ExpressRoute circuits from different service providers, both active.

Answer

Site-to-Site VPN as the primary connection and Point-to-Site VPN as the backup.

Answer

Azure VPN Gateway with active-passive mode and a second VPN Gateway for failover.

Question 19

A company deploys a web application on Azure VMs in an availability set. They need to expose the application to the internet with SSL termination and health probes. Additionally, they need to protect against DDoS attacks and common web vulnerabilities. Which Azure service should they use?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF) and DDoS Protection. Azure Application Gateway with WAF and DDoS Protection is the correct choice because it provides Layer 7 load balancing with SSL termination at the gateway, health probes for backend VMs, and the WAF feature protects against common web vulnerabilities (e.g., OWASP Top 10). DDoS Protection (Azure DDoS Network Protection) can be enabled on the virtual network hosting the Application Gateway to mitigate volumetric attacks. This combination directly meets all stated requirements: internet exposure, SSL offload, health monitoring, and dual-layer security.

Answer

Azure Front Door with WAF and DDoS Protection

Answer

Azure Traffic Manager and Azure Load Balancer

Answer

Azure CDN with WAF

Question 20

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center. They need to implement a hub-and-spoke topology where the hub VNet hosts shared services like firewalls and DNS. All traffic between spokes, and between spokes and on-premises, must be routed through the hub for inspection. Additionally, spoke VNets must not be able to directly communicate with each other. Which Azure networking solution should they implement to meet these requirements with minimal administrative overhead?

Accepted Answer

Azure Virtual WAN with routing policies. Azure Virtual WAN with routing policies is the correct choice because it provides a managed hub-and-spoke topology that automatically routes all traffic between spokes and on-premises through the hub for inspection, without requiring manual user-defined routes (UDRs) or complex peering configurations. It enforces spoke isolation by default and integrates with network virtual appliances (NVAs) for traffic inspection, minimizing administrative overhead through centralized routing policies.

Answer

VNet peering with user-defined routes (UDRs) and network virtual appliances (NVAs)

Answer

Azure VPN Gateway with route-based VPN

Answer

Azure ExpressRoute with private peering