AZ-305 Practice Test 9 — 10 Questions

Question 1

Match each Azure disaster recovery feature to its description.

Question 2

Match each Azure service to its primary function.

Question 3

You are designing an identity governance solution for a multinational company. The company uses Microsoft Entra ID and has a requirement to automatically remove user access to critical SaaS applications when the user leaves the organization or changes roles. You need to ensure that the access removal is audited and can be reversed within 30 days if needed. What should you implement?

Accepted Answer

Microsoft Entra Access Reviews with automatic removal and a grace period. Microsoft Entra Access Reviews allow you to automatically remove user access to SaaS applications when a user leaves or changes roles, with a configurable grace period (up to 30 days) for reversal. This meets the audit and reversal requirements because Access Reviews provide a full audit trail of decisions and can automatically revoke access, while the grace period allows administrators to restore access within the specified timeframe.

Answer

Conditional Access policies to block access for inactive users

Answer

Azure Automation runbooks to delete user accounts upon termination

Answer

Microsoft Entra Privileged Identity Management (PIM) to require approval for access assignments

Question 4

Refer to the exhibit. You create this Azure Policy definition in a management group that contains all subscriptions. After assigning the policy, you notice that no audit events are generated when a new custom RBAC role is created. What is the most likely reason?

Accepted Answer

The 'Audit' effect with the specified details does not trigger an audit event when a custom role is created because the policy is not evaluating the correct condition.. Option C is correct because the policy uses 'Audit' effect but the details section incorrectly references all role definitions, which does not produce an audit log entry for custom role creation. The policy should use 'AuditIfNotExists' or 'Deny' effect to detect custom roles. Option A is wrong because custom policies can audit custom roles. Option B is wrong because the mode 'All' includes resource types like role definitions. Option D is wrong because custom RBAC roles are indeed a resource type that can be audited.

Answer

The policy should be assigned at the subscription level to audit custom role creation.

Answer

The policy definition is a custom policy, and custom policies cannot audit RBAC role definitions.

Answer

The policy mode is set to 'All', which does not include RBAC role definitions.

Question 5

Which TWO are benefits of using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Automate the deprovisioning of user accounts when an employee leaves the organization. Option A is correct because Microsoft Entra ID Governance includes automated lifecycle workflows that can detect when an employee leaves the organization (e.g., via HR integration) and automatically remove or disable their user accounts, ensuring timely deprovisioning and reducing security risks. This automation is a core governance capability that enforces the principle of least privilege and helps maintain a clean identity lifecycle.

Answer

Enable just-in-time privileged access to Azure resources

Answer

Provide single sign-on to all SaaS applications

Answer

Provide VPN connectivity for remote users

Question 6

Your company uses Microsoft Entra ID to manage identities for 5,000 employees. You plan to implement Microsoft Entra ID Governance to automate the user provisioning lifecycle for a third-party SaaS application. The application supports SCIM 2.0. You need to ensure that user accounts are automatically created, updated, and disabled in the application based on changes in Entra ID. What should you do?

Accepted Answer

Configure automatic provisioning in Microsoft Entra ID using the SCIM endpoint. Option D is correct because Microsoft Entra ID's automatic provisioning feature natively supports SCIM 2.0 endpoints, enabling automated creation, update, and deactivation of user accounts in third-party SaaS applications based on changes in Entra ID. This eliminates the need for custom code and provides a managed, scalable solution for the user provisioning lifecycle.

Answer

Use Microsoft Graph API to write a custom provisioning solution

Answer

Configure Microsoft Entra B2B collaboration for the application

Answer

Publish the application using Microsoft Entra Application Proxy

Question 7

Your organization has a hybrid identity infrastructure with Microsoft Entra ID and on-premises Active Directory. You plan to implement Microsoft Entra ID Protection to detect and respond to identity risks. You need to ensure that risky sign-ins from anonymous IP addresses are automatically blocked, while still allowing legitimate users to self-remediate. What should you configure?

Accepted Answer

Configure a Conditional Access policy to block sign-ins from anonymous IP addresses and enable user risk policy for self-remediation. Option C is correct because it combines a Conditional Access policy to block sign-ins from anonymous IP addresses with a user risk policy that allows legitimate users to self-remediate by performing a password change. This ensures that high-risk sign-ins are automatically blocked while users can still recover their accounts without administrative intervention.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to block access for high risk

Answer

Use the Identity Protection dashboard to manually review and block risky sign-ins

Answer

Configure a user risk policy to require password change for high risk users

Question 8

A company uses Microsoft Entra ID for identity management. They want to ensure that users accessing sensitive data from unmanaged devices are prompted for multifactor authentication (MFA) and must accept a terms-of-use. Which policy should be configured?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow granular control over access based on conditions such as device state (managed vs. unmanaged). By configuring a policy that targets unmanaged devices, you can enforce MFA and require acceptance of a terms-of-use before granting access to sensitive data. This directly meets the requirement without needing separate policies for MFA and terms-of-use.

Answer

Terms-of-use policy

Answer

Identity Protection policy

Answer

Privileged Identity Management (PIM) policy

Question 9

Your company has multiple Azure subscriptions managed by a management group. You need to enforce that all resources are deployed in the West US region only. Additionally, you must allow a specific resource group in the production subscription to be deployed in East US. What should you configure?

Accepted Answer

Assign a policy at the management group level that denies all locations except West US, and create a policy exemption for the specific resource group.. Azure Policy can be assigned at the management group level with a deny effect to restrict locations. To allow exceptions, you can create an exclusion by specifying the resource group as an exemption or by using a policy assignment at a lower scope with a different effect. The best practice is to use policy exemptions for specific RGs.

Answer

Assign a policy at the management group level that denies all locations except West US, and assign a separate policy at the subscription level that allows East US.

Answer

Assign a policy at each subscription level allowing only West US, and grant the resource group owner role to bypass.

Answer

Use Azure Blueprints to assign a policy at the management group and then edit the blueprint for the exception.

Question 10

Refer to the exhibit. You are analyzing a deployment of a Custom Script Extension on an Azure VM. The extension fails to run. What is the most likely cause?

Accepted Answer

The 'protectedSettings' property is misconfigured.. The Custom Script Extension on Azure VMs requires the `commandToExecute` parameter to be placed in the `protectedSettings` property when the script URL or command contains sensitive information (e.g., storage account keys). If `commandToExecute` is incorrectly placed in the `publicSettings` property instead, or if the `protectedSettings` JSON structure is malformed (e.g., missing the required `commandToExecute` key or using an incorrect casing), the extension will fail to run because it cannot parse the execution command. This is a common misconfiguration that causes the extension to report a failure status without executing the script.

Answer

The VM agent is not installed.

Answer

The VM has no outbound internet connectivity.

Answer

The extension type is incorrect.