AZ-305 Design identity, governance, and monitoring solutions Practice Test 1 — 15 Questions

Question 1

A large enterprise wants to enforce zero-trust conditional access policies that use real-time user risk, sign-in risk, and device compliance. Which combination of Microsoft Entra ID features should they use?

Accepted Answer

Microsoft Entra ID Identity Protection and Conditional Access. Microsoft Entra ID Identity Protection provides real-time risk detection for users and sign-ins, while Conditional Access policies can enforce access controls based on those risk signals and device compliance. Together, they enable zero-trust conditional access by blocking or requiring MFA when user or sign-in risk is high, and ensuring only compliant devices can access resources.

Answer

Microsoft Entra ID Privileged Identity Management and Access Reviews

Answer

Microsoft Entra ID B2B and External Identities

Answer

Microsoft Entra ID Domain Services and Managed Identities

Question 2

A company needs to monitor sign-in logs from multiple Microsoft Entra ID tenants and analyze user sign-in patterns across those tenants. Which Azure solution should they use?

Accepted Answer

Azure Sentinel with Microsoft Entra ID connectors. Azure Sentinel (now Microsoft Sentinel) is the correct choice because it provides a cloud-native SIEM that can ingest sign-in logs from multiple Microsoft Entra ID tenants via its built-in Microsoft Entra ID connectors. This enables cross-tenant analysis of user sign-in patterns, which is not possible with single-tenant monitoring tools. Sentinel's analytics rules and workbooks allow security teams to detect anomalies and investigate sign-in behaviors across all connected tenants.

Answer

Azure Log Analytics workspace with Microsoft Entra ID diagnostic settings

Answer

Microsoft Entra ID Reports and Monitoring

Answer

Azure Monitor Workbooks

Question 3

A multinational company uses Microsoft Entra ID for identity. They need to grant external partners access to specific SharePoint Online sites. The access must be time-limited and require approval from a resource owner. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management.. Microsoft Entra ID Entitlement Management (A) is the correct feature because it enables organizations to manage external partner access to resources like SharePoint Online sites through access packages. These access packages can enforce time-limited access and require approval from designated resource owners, directly meeting the scenario's requirements.

Answer

Microsoft Entra ID B2C.

Answer

Microsoft Entra ID Conditional Access.

Answer

Microsoft Entra ID Identity Protection.

Question 4

A company has multiple Azure subscriptions and wants to enforce that all administrators must use multi-factor authentication (MFA) when accessing the Azure portal. They also want to monitor and report on any policy changes that affect this enforcement. Which combination of Azure services should they use?

Accepted Answer

Microsoft Entra ID Conditional Access policy to require MFA for Azure management and Azure Monitor with Log Analytics for monitoring.. Option B is correct because Microsoft Entra ID Conditional Access policies can enforce MFA specifically for Azure management (including the Azure portal), and Azure Monitor with Log Analytics provides the monitoring and reporting of policy changes via the Azure Activity Log. This combination directly addresses both requirements: enforcing MFA for administrators and auditing changes to the Conditional Access policy itself.

Answer

Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.

Answer

Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.

Answer

Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.

Question 5

A company uses Microsoft Entra ID for identity management. They need to automate the process of granting access to resources for employees and external partners, and require periodic access reviews to ensure compliance. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Entitlement Management. Microsoft Entra ID Entitlement Management is the correct feature because it enables automation of access request workflows for employees and external partners, including time-limited access packages and periodic access reviews to enforce compliance. This directly matches the requirement for granting access and ensuring ongoing governance through reviews.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Identity Protection

Question 6

A company has Microsoft Entra ID Premium P2 licenses and wants to ensure that privileged roles (e.g., Global Administrator) are only activated when needed and with approval. They also need to regularly review who has access to these roles. Which combination of features should they use?

Accepted Answer

Privileged Identity Management (PIM) and Microsoft Entra ID Access Reviews. Privileged Identity Management (PIM) provides just-in-time (JIT) activation of privileged roles with approval workflows, meeting the requirement for activation only when needed and with approval. Microsoft Entra ID Access Reviews then enable recurring certification of role assignments, ensuring that access is regularly reviewed and stale or inappropriate assignments are removed. Together, they form the correct combination for managing and governing privileged roles.

Answer

Identity Protection and Conditional Access

Answer

Entitlement Management and Conditional Access

Answer

Microsoft Entra ID Access Reviews and Identity Protection

Question 7

A company wants to collect metrics and logs from all Azure resources in their subscription, including custom metrics from their applications, and create dashboards and alerts. Which Azure service should they use as the primary monitoring platform?

Accepted Answer

Azure Monitor. Azure Monitor is the correct primary monitoring platform because it serves as the single, unified ingestion and analysis service for all metrics and logs across Azure resources, including custom metrics from applications via the Application Insights SDK or the custom metrics API. It provides a consolidated workspace for creating dashboards, setting alerts, and querying data, making it the foundational service for observability in Azure.

Answer

Azure Log Analytics

Answer

Azure Application Insights

Answer

Azure Service Health

Question 8

A large enterprise has multiple Azure subscriptions and on-premises servers. They need to collect performance metrics (CPU, memory) from all servers, create custom dashboards to visualize health across workloads, and set up alerts for critical thresholds. They also need to retain log data for one year. Which combination of Azure services should they use?

Accepted Answer

A. Azure Monitor is the central service for collecting performance metrics (CPU, memory) from both Azure VMs and on-premises servers via the Log Analytics agent or Azure Monitor Agent. Log Analytics workspace stores the data, enabling custom dashboards with Azure Workbooks and alerts with Azure Monitor Alerts. The 1-year retention is achieved by configuring the workspace's data retention settings (up to 730 days by default, extendable to 2 years).

Answer

B

Answer

C

Answer

D

Question 9

A company uses Microsoft Entra ID B2B to collaborate with external vendors. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from compliant devices (e.g., managed by Intune). They also want to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

Accepted Answer

B. Option B is correct because it combines Conditional Access policies with session controls to enforce MFA, device compliance (via Intune), and a 1-hour session timeout. Conditional Access policies evaluate sign-in risk and require MFA and compliant devices, while the session control 'Sign-in frequency' can be set to 1 hour to enforce reauthentication. This meets all three requirements without relying on deprecated or separate features.

Answer

A

Answer

C

Answer

D

Question 10

A company requires all users to use multi-factor authentication (MFA) when accessing cloud applications. However, they want to exempt users from MFA when they connect from the company's headquarters, which has a trusted IP range. They want to enforce this policy centrally. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct feature because it allows administrators to create policies that enforce MFA based on conditions such as user location, device state, and application sensitivity. By configuring a Conditional Access policy with a 'trusted location' condition (defined via named locations with specific IP ranges), the company can require MFA for all cloud app access except when users connect from the headquarters' trusted IP range. This provides centralized, granular control over authentication requirements without needing to modify individual user settings.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Self-Service Password Reset

Question 11

A company wants to configure policies that detect risky sign-ins (e.g., from anonymous IPs or unfamiliar locations) and automatically require multi-factor authentication (MFA) when such risk is detected. Which Microsoft Entra ID feature should they use to create these policies?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct feature because it allows administrators to create policies that evaluate sign-in risk signals (such as anonymous IP addresses or unfamiliar locations) and enforce access controls like requiring multi-factor authentication (MFA). Conditional Access policies can integrate with Identity Protection risk detections, but the policy itself is defined and managed within the Conditional Access blade, making it the direct tool for this requirement.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Audit Logs

Question 12

A company uses Microsoft Entra ID and wants to automate the lifecycle management of user accounts in their SaaS applications, such as Salesforce and ServiceNow. The solution should automatically create, update, and deactivate accounts when users join, move, or leave the organization. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID Provisioning. Microsoft Entra ID Provisioning (specifically, HR-driven provisioning) automates the creation, update, and deactivation of user accounts in SaaS applications like Salesforce and ServiceNow based on changes in the organization's HR system or directory. It uses SCIM (System for Cross-domain Identity Management) protocol to synchronize identity lifecycle events, ensuring accounts are automatically created when users join, updated when they move, and deactivated when they leave.

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID Entitlement Management

Question 13

A company uses Microsoft Entra ID and wants to allow users to sign in using their existing personal Microsoft accounts, Google, and Facebook identities. They also need custom sign-up and sign-in flows with collection of specific user attributes. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra ID B2C. Microsoft Entra ID B2C (Business-to-Consumer) is the correct choice because it is specifically designed to support external identity providers like personal Microsoft accounts, Google, and Facebook, and it provides a customizable policy framework (user flows) for sign-up and sign-in that can collect custom user attributes. Unlike B2B, which focuses on business partner collaboration, B2C allows you to define attribute collection during registration via built-in or custom policies.

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Conditional Access

Question 14

A company uses Microsoft Entra ID and wants to enforce that all users must use multi-factor authentication (MFA) when accessing sensitive applications. However, they want to exclude users when connecting from the corporate office IP range and only allow access from devices that are compliant with Intune policies. Which Microsoft Entra ID feature should they use to create this policy?

Accepted Answer

Microsoft Entra ID Conditional Access. C is correct because Microsoft Entra ID Conditional Access is the feature specifically designed to enforce granular access policies based on conditions such as user, location, device compliance, and application sensitivity. By configuring a Conditional Access policy, you can require MFA for sensitive applications, exclude the corporate office IP range, and restrict access to Intune-compliant devices, all within a single policy.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Identity Governance

Question 15

A multinational company uses Microsoft Entra ID. The company has regional IT teams that need to manage users and groups within their respective regions. Each region has a distinct set of users in specific organizational units. The company wants to assign the User Administrator role to regional IT staff, but limit their scope to only the users in their region. Which Microsoft Entra ID feature should they use?

Accepted Answer

Administrative Units. Administrative Units in Microsoft Entra ID allow you to delegate administrative roles, such as User Administrator, to a specific subset of users and groups defined by organizational boundaries (e.g., region). By creating an Administrative Unit for each region and adding the regional users and groups to it, you can assign the User Administrator role scoped to that unit, ensuring regional IT staff can only manage their own region's identities.

Answer

Dynamic Groups

Answer

Microsoft Entra ID B2B

Answer

Microsoft Entra ID Identity Protection