AZ-305 Practice Exam 59 — 20 Questions

Question 1

Refer to the exhibit. You are deploying a Log Analytics workspace using an ARM template with the parameters shown. Your compliance team requires that all log data be retained for at least 2 years. Which parameter value should you modify?

Accepted Answer

retentionInDays. The `retentionInDays` parameter controls how long log data is retained in a Log Analytics workspace. To meet the compliance requirement of at least 2 years (730 days), you must set this value to 730 or higher. The default retention is 30 days for free tiers and up to 730 days for paid tiers, but the parameter must be explicitly modified to enforce the 2-year retention.

Answer

workspaceName

Answer

sku

Answer

dailyQuotaGb

Question 2

Your organization is designing a governance solution for multiple Azure subscriptions. You need to enforce that all resources are created in specific Azure regions (East US and West Europe only). Additionally, any resource group must have a cost center tag. Which THREE Azure components should you use? (Choose three.)

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to define and enforce rules for resource creation, such as restricting allowed locations to East US and West Europe. By assigning a built-in or custom policy definition to a management group or subscription, you can prevent any resource from being created outside the specified regions. This directly addresses the requirement to enforce regional compliance.

Answer

Azure Blueprints

Answer

Role-Based Access Control (RBAC)

Question 3

Refer to the exhibit. You are reviewing the output of an Azure Key Vault secret listing command. The application team reports that a secret is not accessible. What is the most likely reason?

Accepted Answer

The secret has expired. The secret listing output shows an 'expires' field with a date in the past, indicating the secret has expired. Azure Key Vault enforces expiration by preventing access to secrets whose expiration date has passed, returning a 403 Forbidden error. This is the most likely reason the application cannot access the secret.

Answer

The secret is tagged as production but the application is in development

Answer

The Key Vault is in a soft-deleted state

Answer

The secret is disabled

Question 4

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Accepted Answer

Use managed identities for Azure resources instead of service principals with secrets. Managed identities for Azure resources eliminate the need to manage credentials by automatically rotating them and binding them to a resource lifecycle. This removes the risk of secret leakage or mismanagement that exists with service principal secrets, directly supporting a least-privilege identity strategy by ensuring identities are scoped and ephemeral.

Answer

Assign the Contributor role at the subscription scope to allow flexibility

Answer

Use storage account keys for access to blob data

Answer

Use a single service principal for all applications

Question 5

Your company is implementing a monitoring solution for Azure virtual machines. You need to collect performance counters and log events from the VMs and send them to a centralized Log Analytics workspace. Which agent should you install on the VMs?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent (AMA) is the current recommended agent for collecting performance counters and log events from Azure VMs and sending them to a Log Analytics workspace. It replaces the legacy Log Analytics agent (MMA) and offers centralized management via data collection rules (DCRs), improved security, and support for both Windows and Linux VMs. The AMA uses the Azure Monitor service pipeline and supports multi-homing to multiple workspaces natively.

Answer

Log Analytics agent (MMA)

Answer

Diagnostics Extension

Answer

Dependency Agent

Question 6

You are designing a governance strategy for Azure resources. You need to enforce compliance with corporate standards and ensure that resource provisioning is audited. Which TWO Azure features should you include?

Accepted Answer

Azure Policy. Azure Policy is correct because it enforces compliance by applying rules (e.g., allowed SKUs, tagging requirements) to resources during provisioning and existing resources via audit or deny effects. It ensures corporate standards are met and provides continuous compliance evaluation, which directly addresses the need to enforce standards and audit provisioning.

Answer

Azure Role-Based Access Control

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 7

Refer to the exhibit. You are deploying an ARM template that assigns a policy to audit virtual machines not using managed disks. After deployment, you need to verify that the policy assignment is working. Which Azure CLI command should you run?

Accepted Answer

az policy assignment list --subscription 12345678-1234-1234-1234-123456789abc. Option A is correct because the `az policy assignment list` command retrieves all policy assignments in the specified subscription, including the one deployed via the ARM template. This allows you to confirm that the policy assignment exists and is properly configured. To verify that the policy is actually evaluating resources and producing compliance states, you would then use `az policy state list` to see the compliance results, but the question specifically asks to verify that the assignment itself is working, which is done by listing assignments.

Answer

az policy state list --resource-group myResourceGroup

Answer

az policy definition list --subscription 12345678-1234-1234-1234-123456789abc

Answer

az policy event list --subscription 12345678-1234-1234-1234-123456789abc

Question 8

Which TWO actions should you take to ensure that only authorized users can access sensitive data stored in Azure Blob Storage? (Choose two.)

Accepted Answer

Configure Azure RBAC roles to grant access to specific users.. Azure RBAC roles allow you to grant granular permissions to specific users or groups, ensuring that only authorized identities can access sensitive data in Blob Storage. By assigning built-in roles like 'Storage Blob Data Reader' or 'Storage Blob Data Contributor', you enforce identity-based access control at the storage account, container, or blob level. This directly addresses the requirement of restricting access to authorized users.

Answer

Configure firewall rules to allow only specific IP addresses.

Answer

Enable blob versioning.

Answer

Enable soft delete for blobs.

Question 9

Your organization uses Microsoft Azure and has a subscription with multiple resource groups. You need to ensure that only users in the Finance department can access storage accounts in the 'Finance' resource group. The solution must use role-based access control (RBAC). What should you assign?

Accepted Answer

Assign the Storage Blob Data Reader role to the Finance users at the Finance resource group scope. Option B is correct because assigning the Storage Blob Data Reader role at the Finance resource group scope grants Finance users read access to blob data within all storage accounts in that resource group, using RBAC. This meets the requirement of restricting access to only the Finance department while leveraging Azure RBAC's built-in data plane role for storage.

Answer

Assign the Contributor role to the Finance users at the management group scope

Answer

Assign the Reader role to the Finance users at the subscription scope

Answer

Assign the Storage Account Contributor role to the Finance users at each storage account scope

Question 10

Which TWO Microsoft Entra ID features should you use to protect against credential attacks?

Accepted Answer

Password Protection. Password Protection is correct because it specifically targets credential attacks by blocking weak passwords and common variations (e.g., 'Password123!') using a global banned password list and the option to add custom terms. Identity Protection is correct because it uses real-time risk detection (e.g., leaked credentials, anonymous IP addresses) to automatically block or require MFA for suspicious sign-ins, directly mitigating credential-based attacks like password spray or brute force.

Answer

Group-based licensing

Answer

Self-Service Password Reset (SSPR)

Answer

Application Proxy

Question 11

You need to monitor the sign-in activities of users in Microsoft Entra ID and detect risky sign-ins, such as those from anonymous IP addresses. Which service should you use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct service because it is specifically designed to detect and respond to risky sign-in activities, including sign-ins from anonymous IP addresses, using machine learning-based risk detection policies. It integrates directly with Microsoft Entra ID to evaluate sign-in risk in real time and can automatically block or require multi-factor authentication based on configured risk thresholds.

Answer

Microsoft Defender XDR

Answer

Azure Monitor

Answer

Microsoft Sentinel

Question 12

Refer to the exhibit. You assign this Azure Policy to a management group. A user creates a new virtual machine without any tags. What will happen?

Accepted Answer

The virtual machine is created with the 'Environment' tag automatically added.. The Azure Policy in the exhibit uses the 'DeployIfNotExists' effect, which automatically deploys a tag (e.g., 'Environment') to resources that lack it during creation or update. Since the policy is assigned at the management group level, it applies to all child subscriptions and resources, including new virtual machines. When a user creates a VM without tags, the policy evaluates the resource and adds the missing tag without denying the creation or requiring manual intervention.

Answer

The policy is not evaluated because the resource is new.

Answer

The virtual machine creation is denied.

Answer

The virtual machine is created without the tag, and a compliance alert is generated.

Question 13

You are reviewing a Conditional Access policy for a Microsoft Entra ID tenant. The exhibit shows the policy configuration. Users report that they are prompted for MFA every hour even when using approved Microsoft applications. The security team wants to reduce MFA prompts but maintain security. What should you modify?

Accepted Answer

Increase the signInFrequency value to 24 hours. The sign-in frequency control in Conditional Access determines how often a user must re-authenticate. Increasing the value from 1 hour to 24 hours directly reduces the frequency of MFA prompts while still requiring re-authentication daily, balancing security and user experience. This change applies to approved Microsoft applications as configured in the policy.

Answer

Enable 'persistentBrowser' session control

Answer

Change cloudAppSecurityType to 'blockDownloads'

Answer

Remove the 'approvedApplication' grant control

Question 14

A company uses Azure Policy to enforce tagging on resources. The security team reports that some resources are missing the required 'CostCenter' tag. You need to ensure that any resource created without the required tag is automatically remediated by adding the tag with a default value. What should you configure in Azure Policy?

Accepted Answer

DeployIfNotExists effect. The DeployIfNotExists effect is correct because it automatically remediates non-compliant resources by deploying a tag with a default value when the required 'CostCenter' tag is missing. This effect triggers a deployment task that adds the tag, ensuring continuous compliance without manual intervention.

Answer

AuditIfNotExists effect

Answer

Append effect

Answer

Deny effect

Question 15

Your company uses Microsoft Entra ID and has a custom application that requires users to have specific roles assigned. You need to ensure that role assignments are reviewed quarterly and automatically remove assignments that are not approved. Which feature should you use?

Accepted Answer

Microsoft Entra ID Governance access reviews. Microsoft Entra ID Governance access reviews enable you to create recurring reviews of role assignments, with automatic removal of assignments that reviewers do not approve. This directly meets the requirement for quarterly reviews and automatic removal of unapproved assignments, making it the correct choice.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 16

Refer to the exhibit. You assign this Azure Policy to a resource group. A user attempts to create a new Azure SQL Server without specifying an administrator login. What will happen?

Accepted Answer

The SQL Server creation is denied.. The Azure Policy assigned to the resource group includes a condition that checks if the 'administratorLogin' property is missing or null when creating a SQL Server. Since the user does not specify an administrator login, the condition evaluates to true, triggering the 'deny' effect. This prevents the creation of the SQL Server entirely, as Azure Policy enforces compliance before the resource is provisioned.

Answer

The SQL Server is created with a default administrator login.

Answer

The policy is ignored because the condition is not met.

Answer

The SQL Server is created but a compliance alert is generated.

Question 17

Your company uses Microsoft Intune for device management. You need to ensure that only devices that are compliant with security policies can access corporate resources. The solution must also support legacy authentication protocols. What should you implement?

Accepted Answer

Conditional Access policies with 'Require device to be marked as compliant'. Option C is correct because the requirement is to enforce compliance-based access control for devices managed by Microsoft Intune, while also supporting legacy authentication protocols. Conditional Access policies with 'Require device to be marked as compliant' evaluate the device's compliance status reported by Intune and can block or allow access based on that status. This works with legacy authentication protocols (e.g., POP3, IMAP, SMTP) when combined with a compliance policy that does not require modern authentication, though legacy protocols are inherently less secure and should be used cautiously.

Answer

Microsoft Defender for Endpoint

Answer

Device-based Conditional Access with 'Require hybrid Azure AD joined device'

Answer

Microsoft Entra application proxy

Question 18

Which THREE components are required to implement a complete monitoring solution with Azure Monitor? (Choose three.)

Accepted Answer

Alert rules to notify on conditions. Alert rules (C) are a core component of a complete monitoring solution because they define conditions that trigger notifications or automated actions when monitored metrics or log data cross thresholds. Without alert rules, collected data remains passive and cannot proactively inform administrators of issues, making the solution incomplete.

Answer

Application Insights for every application

Answer

Azure Policy assignments

Question 19

Your organization uses Microsoft Sentinel for security monitoring. You need to create a rule that triggers an incident when a user from a specific IP address performs more than 10 failed sign-ins within an hour. Which rule type should you use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a custom KQL query that counts failed sign-in events from a specific IP address over a 1-hour window and triggers an incident when the count exceeds 10. This rule type is designed for user-defined detection logic based on log data, such as SigninLogs, and supports aggregation and threshold-based alerting.

Answer

Microsoft Security rule

Answer

Anomaly detection rule

Answer

Fusion rule

Question 20

Your company is migrating on-premises applications to Azure. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without duplicating accounts. Which identity solution should you recommend?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct solution because it synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to sign in with their existing credentials via password hash synchronization, pass-through authentication, or federation. This avoids duplicating accounts by maintaining a single identity source of truth, with optional seamless single sign-on (SSO) for a transparent experience.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra External ID

Answer

Microsoft Entra Domain Services

AZ-305 Practice Exam 59 — 20 Questions

Exhibit

AZ-305 Practice Exam 59 — 20 Questions

Exhibit