AZ-305 Design identity, governance, and monitoring solutions Practice Test 10 — 15 Questions

Question 1

You are designing a governance strategy for Azure resources. Your organization has multiple departments, each with its own set of Azure subscriptions. You need to enforce consistent policies across all subscriptions, such as allowed resource locations and required tags, while allowing departments to manage their own resources within those constraints. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy. Azure Policy is the correct service because it enforces organizational standards and compliance rules across all Azure resources, such as allowed locations and required tags, at scale. It applies policies to management groups, subscriptions, or resource groups, ensuring consistent governance while allowing departments to manage their own resources within those constraints. Unlike Azure Blueprints, which deploys a full environment template, Azure Policy focuses solely on rule enforcement and remediation.

Answer

Azure Blueprints

Answer

Azure Management Groups

Answer

Azure Role-Based Access Control (RBAC)

Question 2

Which TWO are benefits of using Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Automate the deprovisioning of user accounts when an employee leaves the organization. Option A is correct because Microsoft Entra ID Governance includes lifecycle workflows that automate the joiner-mover-leaver process, including automatically disabling or deleting user accounts and revoking access when an employee leaves the organization. Option B is correct because entitlement management is a core capability of Entra ID Governance, providing access packages, catalogs, and approval-based access request workflows so users can request and be granted time-bound access. Option C is not correct because just-in-time privileged access to Azure resources is delivered by Microsoft Entra Privileged Identity Management (PIM), which is a separate product from Entra ID Governance. Option D is not correct because single sign-on to SaaS applications is a core Microsoft Entra ID feature (via SAML/OIDC enterprise applications), not a specific benefit of Entra ID Governance. Option E is not correct because VPN connectivity for remote users is provided by Azure VPN Gateway or similar networking services, not by Entra ID Governance.

Answer

Enable just-in-time privileged access to Azure resources

Answer

Provide single sign-on to all SaaS applications

Answer

Provide VPN connectivity for remote users

Question 3

Which THREE should you consider when designing a monitoring solution for a critical application that requires high availability and low latency? (Choose three.)

Accepted Answer

Data volume and associated costs. Monitoring data volume directly impacts cost, especially in Azure Monitor where data ingestion and retention are billed per GB. For a critical application with high availability and low latency, you must balance the granularity of monitoring data against budget constraints to avoid unexpected costs that could compromise operational sustainability.

Answer

Dashboard visual appeal and color scheme

Answer

Custom metric creation for all application counters

Question 4

Refer to the exhibit. You deploy this Azure Network Watcher connection monitor to test TCP connectivity on port 443 between two VMs. The test consistently shows 'Unreachable' status. Both VMs are running and have correct NSG rules allowing inbound port 443 from the source VM's IP. What is the most likely cause?

Accepted Answer

The source VM does not have the Network Watcher Agent installed.. Azure Network Watcher connection monitor relies on the Network Watcher Agent extension installed on both source and destination VMs to collect and report connectivity data. Without the agent on the source VM, the test cannot initiate the TCP probes, resulting in a persistent 'Unreachable' status regardless of NSG rules or VM health.

Answer

The destination VM's NSG is blocking the traffic despite the rule.

Answer

The destination VM's private IP address is incorrect.

Answer

A firewall on the destination VM is blocking TCP port 443.

Question 5

Your company plans to use Microsoft Sentinel as a SIEM solution. You need to ensure that security events from all Azure subscriptions are collected in a single workspace. What should you configure?

Accepted Answer

Enable Microsoft Sentinel on a single Log Analytics workspace and configure diagnostic settings for all subscriptions to send logs to that workspace. Microsoft Sentinel requires a single Log Analytics workspace to act as the SIEM repository. By enabling Sentinel on that workspace and configuring diagnostic settings on all Azure subscriptions to stream their security logs (e.g., Activity logs, NSG flow logs, Windows Event logs) to that same workspace, you centralize all security events in one location. This ensures unified detection, investigation, and response across the entire enterprise without needing multiple Sentinel instances.

Answer

Create a Log Analytics workspace per subscription and use cross-workspace queries

Answer

Use Azure Policy to enforce Log Analytics workspace configuration across subscriptions

Answer

Deploy Microsoft Sentinel in each subscription and connect them via Azure Lighthouse

Question 6

A company uses Microsoft Entra ID for identity management. They want to ensure that users accessing sensitive data from unmanaged devices are prompted for multifactor authentication (MFA) and must accept a terms-of-use. Which policy should be configured?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow granular control over access based on conditions such as device state (managed vs. unmanaged). By configuring a policy that targets unmanaged devices, you can enforce MFA and require acceptance of a terms-of-use before granting access to sensitive data. This directly meets the requirement without needing separate policies for MFA and terms-of-use.

Answer

Terms-of-use policy

Answer

Identity Protection policy

Answer

Privileged Identity Management (PIM) policy

Question 7

Your organization is designing a monitoring solution for a critical application running on Azure VMs. You need to collect performance metrics and logs from the VMs and send them to a centralized Log Analytics workspace. You also need to visualize the data in near real-time. Which combination of services should you use?

Accepted Answer

Azure Monitor Agent and Azure Workbooks. Azure Monitor Agent is the current recommended agent for collecting performance metrics and logs from Azure VMs and sending them to a Log Analytics workspace. Azure Workbooks provide interactive, near real-time visualizations by querying the workspace data. This combination meets the requirements for centralized collection and visualization without unnecessary overhead.

Answer

Azure Diagnostics extension and VM Insights

Answer

Azure Monitor Agent and Azure Sentinel

Answer

Log Analytics Agent and Azure Dashboards

Question 8

A multinational company uses Microsoft Entra ID with a custom domain. They need to implement a governance strategy for Microsoft 365 groups, ensuring that group expiration policies are enforced and that group owners receive renewal notifications. What should you configure?

Accepted Answer

Microsoft Entra ID – Group settings (Expiration policy). Microsoft Entra ID's Group settings include an expiration policy specifically designed to enforce lifecycle management for Microsoft 365 groups. This policy allows administrators to set a group expiration period (e.g., 180, 365 days) and automatically sends renewal notification emails to group owners before expiration, enabling them to renew the group if needed. This directly meets the requirement for enforcing group expiration and renewal notifications.

Answer

Microsoft Purview compliance portal – Data Lifecycle Management

Answer

Microsoft Intune – Device compliance policies

Answer

Microsoft Sentinel – Analytics rules

Question 9

You are designing a monitoring solution for a hybrid environment with on-premises servers and Azure VMs. You need to collect security events and performance data centrally, and create custom alerts. The solution must use the same agent for both environments. Which agent should you deploy?

Accepted Answer

Azure Monitor Agent. Azure Monitor Agent (AMA) is the correct choice because it is the next-generation agent that replaces the legacy Log Analytics agent (MMA) and supports both Windows and Linux machines in hybrid and Azure environments. It collects security events and performance data into a single Log Analytics workspace and enables custom alert rules via data collection rules (DCRs), all with a single agent deployment.

Answer

Log Analytics agent (MMA)

Answer

Microsoft Dependency Agent

Answer

Azure Diagnostics extension

Question 10

Your organization uses Microsoft Entra ID with P2 licensing. You need to implement a strategy to automatically detect and remediate risky sign-ins without requiring user interaction for low-risk events. What should you configure?

Accepted Answer

Identity Protection sign-in risk policy set to allow access and log for low risk, and require MFA for medium and above. The Identity Protection sign-in risk policy allows you to automatically respond to sign-in risk levels. By configuring it to 'allow access' and 'log' for low risk, you meet the requirement of no user interaction for low-risk events, while requiring MFA for medium and above ensures remediation for higher-risk sign-ins without manual intervention.

Answer

Conditional Access policy with session control requiring MFA for all sign-ins

Answer

Identity Protection user risk policy set to block high risk

Answer

Identity Protection sign-in risk policy set to allow access with MFA for medium and above

Question 11

Your company is deploying a new application on Azure Kubernetes Service (AKS). You need to monitor the health and performance of the cluster, including container logs, metrics, and request rates. Which Azure service should you enable?

Accepted Answer

Azure Monitor Container Insights. Azure Monitor Container Insights is the correct service because it is specifically designed to monitor the health and performance of Azure Kubernetes Service (AKS) clusters. It collects container logs, metrics (such as CPU/memory usage), and request rates from the cluster via a containerized Log Analytics agent, providing visibility into the performance of workloads running on AKS.

Answer

Azure Service Health

Answer

Azure Monitor for VMs

Answer

Azure Application Insights

Question 12

A company uses Microsoft Entra ID to manage identities for employees and partners. They need to allow partners to self-service reset their passwords using a mobile app notification. Which feature should you enable?

Accepted Answer

Microsoft Entra ID Self-Service Password Reset (SSPR). Microsoft Entra ID Self-Service Password Reset (SSPR) is the correct feature because it allows users, including partners configured as external users in the tenant, to reset their own passwords without administrator intervention. SSPR supports multiple authentication methods, including mobile app notification via the Microsoft Authenticator app, which satisfies the requirement for a mobile app notification-based reset. This feature is specifically designed for password reset scenarios and can be scoped to include guest users when properly configured.

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Intune

Answer

Microsoft Entra ID Privileged Identity Management

Question 13

Which TWO actions should you take to design a monitoring solution for a multi-tier application running on Azure VMs? (Select TWO.)

Accepted Answer

Configure Azure Monitor Agent to collect metrics and logs from each tier. Azure Monitor Agent is the modern, unified agent that collects metrics and logs from Azure VMs and sends them to Azure Monitor, Log Analytics workspaces, and other destinations. For a multi-tier application, collecting data from each tier is essential for end-to-end monitoring. Option D is correct because Application Insights provides application performance monitoring (APM) by instrumenting the application code itself, capturing telemetry like request rates, dependency calls, and exceptions, which is critical for understanding the behavior of a multi-tier application.

Answer

Deploy VM Insights on each VM

Answer

Create a Log Analytics workspace and connect all VMs

Answer

Enable Azure Monitor for VMs on all VMs

Question 14

Which THREE capabilities are provided by Microsoft Entra ID Identity Governance? (Select THREE.)

Accepted Answer

Entitlement management. Microsoft Entra ID Identity Governance is a suite of capabilities designed to help organizations manage and govern access to resources. Entitlement management (A) enables the creation of access packages to automate access requests, approvals, and assignments. Access reviews (B) allow periodic recertification of group memberships and application access to ensure only the right users have access. Privileged Identity Management (C) provides just-in-time privileged access and role activation workflows for Microsoft Entra ID roles and Azure resources, directly supporting governance of elevated access.

Answer

Conditional Access

Answer

Identity Protection

Question 15

Which TWO are valid methods to authenticate users in a Microsoft Entra ID hybrid identity solution? (Select TWO.)

Accepted Answer

Password hash synchronization. Password hash synchronization (B), Federation with Active Directory Federation Services (ADFS) (C), and Pass-through Authentication (D) are all valid authentication methods in a Microsoft Entra ID hybrid identity solution. Cloud-only authentication (A) is not hybrid, and Seamless Single Sign-On (E) is a supplementary feature rather than a standalone authentication method.

Answer

Cloud-only authentication

Answer

Seamless Single Sign-On