AZ-305 Design identity, governance, and monitoring solutions Practice Test 10 — 15 Questions

Question 1

Your organization is implementing a hybrid identity solution with Microsoft Entra ID. Users in an on-premises Active Directory domain need to access cloud applications. You need to ensure that password changes on-premises are synchronized to Entra ID within 30 seconds. Which configuration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Cloud Sync. Microsoft Entra Cloud Sync (Option C) is the correct choice because it is designed for near-real-time synchronization of identity changes, including password writes, with a target latency of under 30 seconds. It uses the lightweight Microsoft Entra Connect provisioning agent and the SCIM (System for Cross-domain Identity Management) protocol to sync changes from on-premises Active Directory to Entra ID, meeting the strict 30-second requirement for password change propagation.

Answer

Pass-through Authentication (PTA)

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Connect Sync with password hash synchronization

Question 2

Refer to the exhibit. You are reviewing an ARM template for deploying a storage account. The template is missing the storage account name parameter definition. What will happen when you attempt to deploy this template?

Accepted Answer

The deployment will fail with a validation error because the parameter is not defined.. In Azure Resource Manager (ARM) templates, all parameters must be explicitly defined in the `parameters` section of the template. If a parameter is referenced (e.g., in the `resources` section) but not defined, the deployment fails with a validation error before any resource provisioning begins. This is because ARM validates the template structure and parameter definitions during the pre-deployment validation phase, and an undefined parameter is considered a syntax error.

Answer

The deployment will prompt the user to provide the missing parameter.

Answer

The deployment will succeed using a default name based on the resource group.

Answer

The deployment will create a storage account with a random name.

Question 3

Your company is designing a governance strategy for Azure. You need to ensure that all resource groups in a subscription are created with a specific naming convention and mandatory tags. Which THREE services or features should you use together? (Choose three.)

Accepted Answer

Azure Blueprints. Azure Blueprints is correct because it enables the orchestrated deployment of Azure Policy, RBAC, and resource templates as a single composable artifact. By defining a blueprint that includes a policy for naming conventions and mandatory tags, you can enforce these requirements consistently across all resource groups within a subscription or management group hierarchy.

Answer

Azure RBAC

Answer

Resource Locks

Question 4

Your company uses Microsoft Entra ID. You need to implement a privileged identity management (PIM) strategy to secure administrative roles. Which TWO capabilities does PIM provide? (Choose two.)

Accepted Answer

Approval workflows for role activation. Privileged Identity Management (PIM) in Microsoft Entra ID provides time-based and approval-based role activation to secure privileged roles. Approval workflows for role activation (Option A) are a core PIM feature, allowing designated approvers to review and approve activation requests before a user gains elevated permissions. This ensures that privileged access is granted only after explicit authorization, reducing the risk of unauthorized use.

Answer

Conditional Access policies for role activation

Answer

Management of external identities

Answer

Automated user provisioning to applications

Question 5

Your organization uses Azure Monitor Logs to analyze application performance. You need to create a custom log query that calculates the 95th percentile of response times for a web app over the last 24 hours. Which THREE KQL functions should you use? (Choose three.)

Accepted Answer

percentile. The `percentile` function in KQL calculates percentile values, such as the 95th percentile, which is essential for analyzing response time distributions. The `summarize` function groups and aggregates data, allowing you to apply `percentile` across the dataset. The `where` function filters the log data to include only records from the last 24 hours, ensuring the query operates on the correct time range.

Answer

project

Answer

sort

Question 6

Your company has multiple Azure subscriptions and needs a single pane of glass to monitor the health and performance of all resources across subscriptions. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct choice because it provides a unified, single-pane-of-glass experience for collecting, analyzing, and acting on telemetry from all Azure resources across multiple subscriptions. It aggregates metrics, logs, and alerts from various sources, enabling cross-subscription monitoring of health and performance without requiring separate tools.

Answer

Microsoft Sentinel

Answer

Azure Service Health

Answer

Azure Advisor

Question 7

Your company is migrating on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises passwords and that password changes are synchronized immediately. The solution must minimize latency and avoid storing password hashes in the cloud. What should you implement?

Accepted Answer

Implement password hash synchronization with password writeback. Password hash synchronization with writeback ensures that password changes are synchronized immediately with low latency. While it stores password hashes in Azure AD, this is done using a secure salted hash that is not reversible, and the hash synchronization provides near-instant synchronization. Pass-through Authentication does not store password hashes in the cloud but requires additional infrastructure and does not provide immediate password change synchronization from on-premises to cloud without additional components. Cloud-only accounts would require new passwords, and AD FS would rely on federation without immediate synchronization. Therefore, password hash synchronization with writeback is the best fit for the stated requirements.

Answer

Implement Microsoft Entra Pass-through Authentication

Answer

Create cloud-only user accounts in Microsoft Entra ID

Answer

Federate with Active Directory Federation Services (AD FS)

Question 8

You are reviewing a Conditional Access policy for a Microsoft Entra ID tenant. The exhibit shows the policy configuration. Users report that they are prompted for MFA every hour even when using approved Microsoft applications. The security team wants to reduce MFA prompts but maintain security. What should you modify?

Accepted Answer

Increase the signInFrequency value to 24 hours. The sign-in frequency control in Conditional Access determines how often a user must re-authenticate. Increasing the value from 1 hour to 24 hours directly reduces the frequency of MFA prompts while still requiring re-authentication daily, balancing security and user experience. This change applies to approved Microsoft applications as configured in the policy.

Answer

Enable 'persistentBrowser' session control

Answer

Change cloudAppSecurityType to 'blockDownloads'

Answer

Remove the 'approvedApplication' grant control

Question 9

Your organization uses Microsoft Azure and has a subscription with multiple resource groups. You need to ensure that only users in the Finance department can access storage accounts in the 'Finance' resource group. The solution must use role-based access control (RBAC). What should you assign?

Accepted Answer

Assign the Storage Blob Data Reader role to the Finance users at the Finance resource group scope. Assigning the Storage Blob Data Reader role at the Finance resource group scope grants Finance users read access to blob data within all storage accounts in that resource group, using RBAC. This meets the requirement of restricting access to only the Finance department while leveraging Azure RBAC's built-in data plane role for storage.

Answer

Assign the Contributor role to the Finance users at the management group scope

Answer

Assign the Reader role to the Finance users at the subscription scope

Answer

Assign the Storage Account Contributor role to the Finance users at each storage account scope

Question 10

Your company uses Microsoft Sentinel for security monitoring. You need to design a solution that automatically responds to incidents involving high-severity alerts. The response should include creating an incident in Microsoft Teams and sending an email to the security team. What should you use?

Accepted Answer

Microsoft Sentinel automation rules and playbooks. Microsoft Sentinel automation rules and playbooks (built on Azure Logic Apps) are specifically designed to orchestrate automated responses to security incidents. When a high-severity alert triggers an incident, an automation rule can invoke a playbook that creates a Microsoft Teams message and sends an email via connectors like Office 365 Outlook, meeting the exact requirements.

Answer

Azure Policy with remediation tasks

Answer

Azure Monitor alert rules with action groups

Answer

Microsoft Defender for Cloud security alerts

Question 11

You are reviewing a custom RBAC role in Azure. The exhibit shows the role definition. A user with this role reports they cannot read diagnostic settings for a storage account in the Production resource group. What is the most likely cause?

Accepted Answer

The role does not include 'Microsoft.Storage/storageAccounts/read'. The user cannot read diagnostic settings because the custom role lacks the 'Microsoft.Storage/storageAccounts/read' permission. This permission is required to read the storage account resource itself, which is a prerequisite for accessing its diagnostic settings. Without it, the role cannot perform any read operations on the storage account, including reading diagnostic logs or metrics configuration.

Answer

Custom roles cannot be assigned to users

Answer

The role lacks the 'Microsoft.Storage/storageAccounts/listKeys/action' permission

Answer

The role is assigned at the wrong scope

Question 12

Your organization plans to use Azure Policy to enforce tagging on all resources. The tags must include 'CostCenter' and 'Environment'. Resources that do not have these tags should be automatically remediated. What should you use?

Accepted Answer

A policy with 'deployIfNotExists' effect and a remediation task. The 'deployIfNotExists' effect is correct because it allows Azure Policy to evaluate resources for missing tags and then deploy a remediation task that automatically adds the required tags. This effect is specifically designed for scenarios where non-compliance can be corrected by deploying or modifying resources, such as adding tags via a policy definition that triggers a remediation task.

Answer

A policy with 'append' effect

Answer

A policy with 'audit' effect

Answer

A policy with 'deny' effect

Question 13

Your company uses Microsoft Intune for device management. You need to ensure that only devices that are compliant with security policies can access corporate resources. The solution must also support legacy authentication protocols. What should you implement?

Accepted Answer

Conditional Access policies with 'Require device to be marked as compliant'. The requirement is to enforce compliance-based access control for devices managed by Microsoft Intune, while also supporting legacy authentication protocols. Conditional Access policies with 'Require device to be marked as compliant' evaluate the device's compliance status reported by Intune and can block or allow access based on that status. This works with legacy authentication protocols (e.g., POP3, IMAP, SMTP) when combined with a compliance policy that does not require modern authentication, though legacy protocols are inherently less secure and should be used cautiously.

Answer

Microsoft Defender for Endpoint

Answer

Device-based Conditional Access with 'Require hybrid Azure AD joined device'

Answer

Microsoft Entra application proxy

Question 14

You are troubleshooting access for a user named John Doe. The exhibit shows the output of Get-AzRoleAssignment. John reports he cannot create virtual machines in the Prod resource group. Other users with the same role can create VMs. What is the most likely cause?

Accepted Answer

John has a deny assignment that prevents VM creation. Azure RBAC supports deny assignments that explicitly block specific actions even if the user has an allow assignment like Contributor. Since other users with the same role can create VMs, John's role assignment is not the issue; a deny assignment at a higher scope (e.g., management group or subscription) or directly on the resource group is overriding the allow, preventing VM creation. This is a common troubleshooting scenario where a deny assignment is the root cause.

Answer

John does not have multi-factor authentication enabled

Answer

John is not assigned the Contributor role

Answer

The role assignment is at the wrong scope

Question 15

Your organization uses Microsoft Purview for data governance. You need to classify sensitive data in Azure SQL Database and automatically apply sensitivity labels. What should you configure?

Accepted Answer

Microsoft Purview Data Map with scanning and labeling. Microsoft Purview Data Map with scanning and labeling is the correct solution because it integrates with Azure SQL Database to automatically scan for sensitive data types (e.g., credit card numbers, social security numbers) and apply sensitivity labels defined in Microsoft Purview Information Protection. This native integration uses the Purview scanning infrastructure to classify data at rest and propagate labels directly to the SQL database, meeting the requirement for automated classification and labeling.

Answer

Azure Information Protection scanner

Answer

Microsoft Sentinel with a workbook

Answer

Azure Policy with built-in SQL classification policy