AZ-305 Design identity, governance, and monitoring solutions — 20 Questions

Question 1

A company needs to monitor sign-in logs from multiple Microsoft Entra ID tenants and analyze user sign-in patterns across those tenants. Which Azure solution should they use?

Accepted Answer

Azure Sentinel with Microsoft Entra ID connectors. Azure Sentinel (now Microsoft Sentinel) is the correct choice because it is a cloud-native SIEM that can ingest sign-in logs from multiple Microsoft Entra ID tenants via its connectors and provide centralized monitoring, analytics, and correlation across those tenants. While it is possible to configure diagnostic settings to a single Log Analytics workspace for multi-tenant log collection, Sentinel adds pre-built security analytics, workbooks, and incident management that make it the more comprehensive solution for analyzing user sign-in patterns across tenants.

Answer

Azure Log Analytics workspace with Microsoft Entra ID diagnostic settings

Answer

Microsoft Entra ID Reports and Monitoring

Answer

Azure Monitor Workbooks

Question 2

A company has multiple Azure subscriptions and wants to enforce that all administrators must use multi-factor authentication (MFA) when accessing the Azure portal. They also want to monitor and report on any policy changes that affect this enforcement. Which combination of Azure services should they use?

Accepted Answer

Microsoft Entra ID Conditional Access policy to require MFA for Azure management and Azure Monitor with Log Analytics for monitoring.. Microsoft Entra ID Conditional Access policies can enforce MFA specifically for Azure management (including the Azure portal). To monitor and report on policy changes, configure diagnostic settings for Microsoft Entra ID to stream audit logs to Azure Monitor Log Analytics. This combination directly addresses both requirements: enforcing MFA for administrators and auditing changes to the Conditional Access policy itself.

Answer

Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.

Answer

Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.

Answer

Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.

Question 3

A large enterprise has multiple Azure subscriptions and on-premises servers. They need to collect performance metrics (CPU, memory) from all servers, create custom dashboards to visualize health across workloads, and set up alerts for critical thresholds. They also need to retain log data for one year. Which combination of Azure services should they use?

Accepted Answer

A. Azure Monitor is the central service for collecting performance metrics (CPU, memory) from both Azure VMs and on-premises servers via the Log Analytics agent or Azure Monitor Agent. Log Analytics workspace stores the data, enabling custom dashboards with Azure Workbooks and alerts with Azure Monitor Alerts. The 1-year retention is achieved by configuring the workspace's data retention settings (up to 730 days by default, extendable to 2 years).

Answer

B

Answer

C

Answer

D

Question 4

A company uses Microsoft Entra ID Privileged Identity Management (PIM) to control access to administrator roles. They want to implement a monitoring solution that sends an email to the security team whenever a user activates the Global Administrator role outside of standard business hours (9 AM–5 PM). They also need to track all activation history for quarterly audits. Which solution should they implement?

Accepted Answer

Configure PIM to send notifications for role activations and stream PIM audit logs to Azure Log Analytics, then create an alert rule for activations outside business hours. PIM can be configured to send email notifications for role activations, but to meet the specific requirement of emailing only for activations outside business hours, you should stream PIM audit logs to Azure Log Analytics and create an alert rule that triggers on Global Administrator activations outside 9 AM–5 PM. This alert rule can send an email to the security team. Log Analytics can be configured to retain logs for up to two years, providing the audit trail needed for quarterly audits.

Answer

Use Microsoft Entra ID Identity Protection to detect risky activations and trigger a Logic App

Answer

Enable Microsoft Entra ID diagnostic settings to send logs to Event Hubs and process with Azure Stream Analytics

Answer

Use Azure Sentinel with a built-in connector for PIM and create a scheduled analytics rule

Question 5

A company uses Microsoft Entra ID and wants to automate the process of granting access to internal applications and Microsoft 365 groups. Employees request access through a portal, and managers must approve the requests. The access should be automatically removed after a defined period, and managers must perform quarterly access reviews to confirm continued need. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management is the correct feature because it provides automated access request workflows, time-bound access assignments (via access packages), and periodic access reviews. This directly matches the requirements for a portal-based request process with manager approval, automatic expiration, and quarterly reviews.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Self-Service Group Management

Question 6

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via an API. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Identity Protection. Microsoft Entra ID Identity Protection is the correct feature because it provides automated detection of identity-based risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. It generates risk event reports and exposes risk data through the Microsoft Graph API, enabling integration with SIEM systems for centralized monitoring and response.

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Connect Health

Answer

Microsoft Entra ID Audit Logs

Question 7

A company uses Microsoft Entra ID. They want to allow users to sign in to partner applications using their Microsoft Entra ID credentials. The partner applications support SAML 2.0 and OpenID Connect. They also need to customize the appearance of the sign-in pages. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra ID Enterprise Application with SAML-based SSO. Microsoft Entra ID Enterprise Application with SAML-based SSO is the correct feature because it allows you to register partner applications that support SAML 2.0 or OpenID Connect, enabling federated single sign-on using existing Microsoft Entra ID credentials. Additionally, you can customize the branding (logo, sign-in page text, etc.) for each enterprise application, meeting the requirement to customize the appearance of sign-in pages.

Answer

Microsoft Entra ID B2C

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID Conditional Access

Question 8

An enterprise wants just-in-time elevation for Azure administrators and periodic validation that privileged users still require access. Which two Microsoft Entra features should you recommend? (Choose 2.)

Accepted Answer

Microsoft Entra Privileged Identity Management.. Microsoft Entra access reviews satisfies the stem's second requirement: periodic validation that privileged users still need their access. Reviewers (or the users themselves) are prompted on a recurring schedule to attest to continued need, and access is automatically revoked if not approved. While access reviews does not provide the just-in-time elevation itself (that is PIM's role), it is the correct complementary feature for periodic recertification of standing or PIM-eligible privileged roles, which is why it is selected alongside Microsoft Entra PIM as the second correct answer.

Answer

Microsoft Entra Domain Services.

Answer

Azure Policy guest configuration.

Question 9

Drag and drop the steps to configure Azure Load Balancer for high availability of web servers into the correct order.

Accepted Answer

Step 1: Create backend pool, Step 2: Create health probe, Step 3: Create rule, Step 4: Associate public IP, Step 5: Test. The correct sequence for configuring an Azure Load Balancer for high availability of web servers is to first create the backend pool, then the health probe, then the load balancing rule, then associate a public IP address, and finally test the configuration. This order ensures all dependencies are met: the health probe monitors the backend pool, the rule uses both, and the public IP provides external access. Common mistakes include swapping steps or creating the rule before its dependencies.

Answer

Step 1: Create health probe, Step 2: Create backend pool, Step 3: Create rule, Step 4: Associate public IP, Step 5: Test

Answer

Step 1: Create rule, Step 2: Create backend pool, Step 3: Create health probe, Step 4: Associate public IP, Step 5: Test

Answer

Step 1: Associate public IP, Step 2: Create backend pool, Step 3: Create health probe, Step 4: Create rule, Step 5: Test

Question 10

You are designing a monitoring solution for a global e-commerce application hosted on Azure. The application experiences intermittent performance degradation that is difficult to reproduce. You need to ensure that you can capture detailed diagnostic data when the degradation occurs, without permanently storing large amounts of data. Which Azure feature should you use?

Accepted Answer

Implement an Azure Monitor Data Collection Rule with a schedule-based filter to capture detailed logs during degradation.. Azure Monitor Data Collection Rules (DCRs) allow you to define a schedule-based filter that triggers detailed log collection only during specific conditions, such as when performance degradation is detected. This enables capturing granular diagnostic data exactly when needed without permanently storing large volumes of telemetry, aligning with the requirement to avoid persistent high storage costs.

Answer

Use Application Insights continuous export to send all telemetry to a storage account.

Answer

Configure a Log Analytics workspace to collect all performance counters and IIS logs.

Answer

Enable Azure Metrics for the application to monitor performance in real-time.

Question 11

You are designing an identity governance solution for a multinational company. The company uses Microsoft Entra ID and has a requirement to automatically remove user access to critical SaaS applications when the user leaves the organization or changes roles. You need to ensure that the access removal is audited and can be reversed within 30 days if needed. What should you implement?

Accepted Answer

Microsoft Entra Access Reviews with automatic removal and a grace period. Microsoft Entra Access Reviews allow you to automatically remove user access to SaaS applications when a user leaves or changes roles, with a configurable grace period (up to 30 days) for reversal. This meets the audit and reversal requirements because Access Reviews provide a full audit trail of decisions and can automatically revoke access, while the grace period allows administrators to restore access within the specified timeframe.

Answer

Conditional Access policies to block access for inactive users

Answer

Azure Automation runbooks to delete user accounts upon termination

Answer

Microsoft Entra Privileged Identity Management (PIM) to require approval for access assignments

Question 12

Refer to the exhibit. You create this Azure Policy definition in a management group that contains all subscriptions. After assigning the policy, you notice that no audit events are generated when a new custom RBAC role is created. What is the most likely reason?

Accepted Answer

The 'Audit' effect with the specified details does not trigger an audit event when a custom role is created because the policy is not evaluating the correct condition.. The Azure Policy definition shown in the exhibit uses the 'AuditIfNotExists' effect, which requires a condition that evaluates whether a specific resource (e.g., a diagnostic setting) exists. However, the creation of a custom RBAC role is a resource type ('Microsoft.Authorization/roleDefinitions') that is not covered by the 'AuditIfNotExists' effect in the way the policy is written. The policy is likely missing the correct condition or resource type filter, so no audit event is generated when a custom role is created.

Answer

The policy should be assigned at the subscription level to audit custom role creation.

Answer

The policy definition is a custom policy, and custom policies cannot audit RBAC role definitions.

Answer

The policy mode is set to 'All', which does not include RBAC role definitions.

Question 13

Your organization has a hybrid identity infrastructure with Microsoft Entra ID and on-premises Active Directory. You plan to implement Microsoft Entra ID Protection to detect and respond to identity risks. You need to ensure that risky sign-ins from anonymous IP addresses are automatically blocked, while still allowing legitimate users to self-remediate. What should you configure?

Accepted Answer

Configure a Conditional Access policy to block sign-ins from anonymous IP addresses and enable user risk policy for self-remediation. It combines a Conditional Access policy to block sign-ins from anonymous IP addresses with a user risk policy that allows legitimate users to self-remediate by performing a password change. This ensures that high-risk sign-ins are automatically blocked while users can still recover their accounts without administrative intervention.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to block access for high risk

Answer

Use the Identity Protection dashboard to manually review and block risky sign-ins

Answer

Configure a user risk policy to require password change for high risk users

Question 14

Which TWO are valid methods to authenticate to Azure from a PowerShell script that runs unattended? (Choose two.)

Accepted Answer

Service principal with a certificate. Options A and B are correct because unattended PowerShell scripts need non-interactive authentication, and a service principal is an Microsoft Entra ID identity designed for that purpose. A service principal with a certificate (A) authenticates via certificate-based client credential flow, which is more secure and does not require a user present. A service principal with a client secret (B) authenticates via the OAuth 2.0 client credentials grant using an application ID and secret, which is also fully non-interactive and suitable for automation. Options C and D are not valid for unattended scripts because user accounts with MFA require interactive prompts or MFA challenges that cannot be completed silently. Option E is not correct in this context because managed identity is only available to Azure-hosted resources (such as VMs, App Service, or Azure Functions) and is not a general method for a PowerShell script running outside an Azure resource with an assigned identity.

Answer

User account with multi-factor authentication

Answer

User account with password and MFA

Answer

Managed identity for Azure resources

Question 15

Your company uses Azure Policy to enforce tagging standards. You need to ensure that any new resource group automatically inherits the 'CostCenter' tag from its subscription. Which Azure Policy effect should you use?

Accepted Answer

modify. The 'modify' effect is correct because it enables Azure Policy to add, update, or remove tags on resources and resource groups during creation or update. When combined with a 'deployIfNotExists' policy that targets resource groups, the 'modify' effect can automatically apply the 'CostCenter' tag from the subscription to any new resource group at creation time, ensuring inheritance without manual intervention.

Answer

deny

Answer

audit

Answer

append

Question 16

Your company has multiple Azure subscriptions managed by a management group. You need to enforce that all resources are deployed in the West US region only. Additionally, you must allow a specific resource group in the production subscription to be deployed in East US. What should you configure?

Accepted Answer

Assign a policy at the management group level that denies all locations except West US, and create a policy exemption for the specific resource group.. Assigning a policy at the management group level that denies all locations except West US (C) enforces the restriction across all subscriptions. Creating a policy exemption for the specific resource group allows that resource group to deploy in East US, overriding the inherited policy. This is the correct way to handle exceptions in Azure Policy.

Answer

Assign a policy at the management group level that denies all locations except West US, and assign a separate policy at the subscription level that allows East US.

Answer

Assign a policy at each subscription level allowing only West US, and grant the resource group owner role to bypass.

Answer

Use Azure Blueprints to assign a policy at the management group and then edit the blueprint for the exception.

Question 17

Refer to the exhibit. You have an Azure Policy definition as shown. The policy is assigned at the subscription scope. What is the result when a user tries to create a VM with SKU Standard_D8s_v3?

Accepted Answer

The VM creation is denied.. The Azure Policy definition shown uses a 'Deny' effect for VM SKUs that do not match the allowed list. Since Standard_D8s_v3 is not in the allowed list (which includes Standard_D2s_v3, Standard_D4s_v3, and Standard_D8s_v3), the policy denies the VM creation. The 'Deny' effect prevents the resource from being created and logs a denial event in the activity log.

Answer

The VM is created successfully.

Answer

The VM is created but flagged as non-compliant.

Answer

The VM SKU is automatically changed to Standard_D4s_v3.

Question 18

Refer to the exhibit. You run the KQL query in Azure Monitor Log Analytics. Which user accounts should you investigate first?

Accepted Answer

Users with more than 5 medium-risk sign-ins in the last day.. The KQL query filters for sign-ins where RiskLevelDuringSignIn equals 'medium' and then summarizes by UserPrincipalName, counting occurrences. Users with more than 5 medium-risk sign-ins in the last day indicate a pattern of suspicious activity that warrants immediate investigation, as medium-risk sign-ins often correspond to atypical travel, anonymous IPs, or unfamiliar properties, but the query specifically targets the count threshold as the trigger for escalation.

Answer

Users with the highest number of sign-in attempts.

Answer

Users who had sign-ins from anonymous IP addresses.

Answer

Users who have unfamiliar features in their sign-ins.

Question 19

Refer to the exhibit. You are analyzing a deployment of a Custom Script Extension on an Azure VM. The extension fails to run. What is the most likely cause?

Accepted Answer

The 'protectedSettings' property is misconfigured.. The Custom Script Extension on Azure VMs requires the `commandToExecute` parameter to be placed in the `protectedSettings` property when the script URL or command contains sensitive information (e.g., storage account keys). If `commandToExecute` is incorrectly placed in the `publicSettings` property instead, or if the `protectedSettings` JSON structure is malformed (e.g., missing the required `commandToExecute` key or using an incorrect casing), the extension will fail to run because it cannot parse the execution command. This is a common misconfiguration that causes the extension to report a failure status without executing the script.

Answer

The VM agent is not installed.

Answer

The VM has no outbound internet connectivity.

Answer

The extension type is incorrect.

Question 20

You have an Azure subscription that contains a virtual network named VNet1. You need to monitor all network security group (NSG) flow logs. Which three components must you enable? (Select THREE.)

Accepted Answer

Azure Network Watcher. Network security group flow logs must be explicitly enabled on the NSG to capture IP traffic data. Without enabling this feature, no flow log data is generated regardless of other components. The question asks which components must be enabled, and enabling NSG flow logs is the direct action that starts logging.

Answer

Log Analytics workspace

Answer

Traffic Analytics